Cannot find the source of the malware

texaswilly · February 4, 2012

I am having a lot of popups about two IP address that the svchost.exe is trying to connect to. I have run the sanner in full mode at it indicates that the system is clean. Here are the requested dds and attach files. HELP!!

Attach.txt

DDS.txt

Larusso · February 5, 2012

Hy

my name is Daniel and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Please download Gmer from here and save it to your Desktop.

Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.

Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
[*] Then click the Scan button & wait for it to finish.
[*] Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
[*]Save it where you can easily find it, such as your desktop

**Caution**

Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

Please post in your next reply

ark.txt

texaswilly · February 6, 2012

Daniel,

Thank you for the reply; I am in the process of running the indicated tool, it will take all night but I will send the results tomorrow morning CST. Just wanted to let you know that between my first posting and this one, I read in the forum that some people had run Karspersky TDDSkiller and I did that. It found one critical threat that I allowed to be removed. Just wanted you to know that there will be a difference between the condition of the PC during first posting and now.

Larusso · February 6, 2012

Hy there,

Please note this from my first answer

Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.

If you have troubles with Gmer, simply let me know.

Please also post me the logfile from TDSSKiller, saved in C:\TDSSKiller.<version_date_time>log.txt

texaswilly · February 6, 2012

I understand, that is why i wanted you to know. I have not run any other removal tool since that one and before your first communication. I will be posting the results hopefully today since the gmer program ran overnight and it was still going when I left home for work.

Larusso · February 6, 2012

Please stop Gmer if possible. It is not normal that it runs soo long

texaswilly · February 7, 2012

Here are the results (finally!)

GMER 1.0.15.15641 - http://www.gmer.net

Rootkit scan 2012-02-07 06:43:11

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HD103UJ rev.1AA01113

Running: ndcvirhm.exe; Driver: C:\Users\Willy\AppData\Local\Temp\kxliraob.sys

---- System - GMER 1.0.15 ----

INT 0x51 ? 87310E58

INT 0x61 ? 867C8BF8

INT 0x71 ? 87310E58

INT 0x92 ? 87310E58

INT 0xA2 ? 87310E58

INT 0xB2 ? 87310E58

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 867CE1F8

Device \Driver\usbohci \Device\USBFDO-9 873B31F8

Device \Driver\netbt \Device\NetBT_Tcpip_{980025DD-A381-4517-8823-EF080FA4120A} 880351F8

Device \Driver\usbehci \Device\USBFDO-10 873961F8

Device \Driver\volmgr \Device\VolMgrControl 867CA1F8

Device \Driver\usbuhci \Device\USBPDO-0 873951F8

Device \Driver\usbuhci \Device\USBPDO-1 873951F8

Device \Driver\usbuhci \Device\USBPDO-2 873951F8

Device \Driver\usbehci \Device\USBPDO-3 873961F8

Device \Driver\netbt \Device\NetBT_Tcpip_{887CFC8D-C164-45AE-B383-319BF35F3F3E} 880351F8

Device \Driver\usbuhci \Device\USBPDO-4 873951F8

Device \Driver\usbuhci \Device\USBPDO-5 873951F8

Device \Driver\USBSTOR \Device\00000070 8803D1F8

Device \Driver\usbuhci \Device\USBPDO-6 873951F8

Device \Driver\volmgr \Device\HarddiskVolume1 867CA1F8

Device \Driver\USBSTOR \Device\00000071 8803D1F8

Device \Driver\usbehci \Device\USBPDO-7 873961F8

Device \Driver\USBSTOR \Device\00000072 8803D1F8

Device \Driver\volmgr \Device\HarddiskVolume2 867CA1F8

Device \Driver\cdrom \Device\CdRom0 8743A500

Device \Driver\usbohci \Device\USBPDO-8 873B31F8

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 867CC1F8

Device \Driver\atapi \Device\Ide\IdePort0 867CC1F8

Device \Driver\atapi \Device\Ide\IdePort1 867CC1F8

Device \Driver\atapi \Device\Ide\IdePort2 867CC1F8

Device \Driver\atapi \Device\Ide\IdePort3 867CC1F8

Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1 867CC1F8

Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-6 867CC1F8

Device \Driver\USBSTOR \Device\00000073 8803D1F8

Device \Driver\volmgr \Device\HarddiskVolume3 867CA1F8

Device \Driver\cdrom \Device\CdRom1 8743A500

Device \Driver\usbohci \Device\USBPDO-9 873B31F8

Device \Driver\volmgr \Device\HarddiskVolume4 867CA1F8

Device \Driver\cdrom \Device\CdRom2 8743A500

Device \Driver\volmgr \Device\HarddiskVolume5 867CA1F8

Device \Driver\USBSTOR \Device\00000081 8803D1F8

Device \Driver\usbehci \Device\USBPDO-10 873961F8

Device \Driver\volmgr \Device\HarddiskVolume6 867CA1F8

Device \Driver\USBSTOR \Device\00000083 8803D1F8

Device \Driver\volmgr \Device\HarddiskVolume7 867CA1F8

Device \Driver\netbt \Device\NetBt_Wins_Export 880351F8

Device \Driver\USBSTOR \Device\00000084 8803D1F8

Device \Driver\Smb \Device\NetbiosSmb 8808E1F8

Device \Driver\USBSTOR \Device\00000085 8803D1F8

Device \Driver\iScsiPrt \Device\RaidPort0 878111F8

Device \Driver\usbuhci \Device\USBFDO-0 873951F8

Device \Driver\usbuhci \Device\USBFDO-1 873951F8

Device \Driver\USBSTOR \Device\0000006e 8803D1F8

Device \Driver\usbuhci \Device\USBFDO-2 873951F8

Device \Driver\usbehci \Device\USBFDO-3 873961F8

Device \Driver\usbuhci \Device\USBFDO-4 873951F8

Device \Driver\usbuhci \Device\USBFDO-5 873951F8

Device \Driver\USBSTOR \Device\0000007f 8803D1F8

Device \Driver\usbuhci \Device\USBFDO-6 873951F8

Device \Driver\USBSTOR \Device\0000008c 8803D1F8

Device \Driver\usbehci \Device\USBFDO-7 873961F8

Device \Driver\usbohci \Device\USBFDO-8 873B31F8

Device \FileSystem\cdfs \Cdfs 872F81F8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792

---- EOF - GMER 1.0.15 ----

Larusso · February 7, 2012

Could you please also post the TDSSKiller logfile. I need to see what it found

texaswilly · February 7, 2012

Daniel,

Here is a copy of log from TDSSKiller. However, unfortunately, I cannot tell you for sure if this is the one from the first run that found the malware or a second one. I am just not sure if I ran it more than once. Sorry.

17:25:32.0940 7200 TDSS rootkit removing tool 2.7.9.0 Feb 1 2012 09:28:49

17:25:37.0683 7200 ============================================================

17:25:37.0684 7200 Current date / time: 2012/02/07 17:25:37.0683

17:25:37.0684 7200 SystemInfo:

17:25:37.0684 7200

17:25:37.0684 7200 OS Version: 6.0.6002 ServicePack: 2.0

17:25:37.0684 7200 Product type: Workstation

17:25:37.0684 7200 ComputerName: HOMEOFFICE-PC

17:25:37.0684 7200 UserName: Willy

17:25:37.0684 7200 Windows directory: C:\Windows

17:25:37.0684 7200 System windows directory: C:\Windows

17:25:37.0684 7200 Processor architecture: Intel x86

17:25:37.0684 7200 Number of processors: 4

17:25:37.0684 7200 Page size: 0x1000

17:25:37.0684 7200 Boot type: Normal boot

17:25:37.0684 7200 ============================================================

17:25:39.0449 7200 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

17:25:39.0966 7200 Drive \Device\Harddisk5\DR5 - Size: 0x15D50D00000 (1397.26 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

17:25:39.0970 7200 Drive \Device\Harddisk6\DR6 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

17:25:39.0971 7200 \Device\Harddisk0\DR0:

17:25:39.0971 7200 MBR used

17:25:39.0971 7200 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800

17:25:39.0971 7200 \Device\Harddisk5\DR5:

17:25:39.0971 7200 MBR used

17:25:39.0971 7200 \Device\Harddisk5\DR5\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xAEA86000

17:25:39.0971 7200 \Device\Harddisk6\DR6:

17:25:39.0972 7200 MBR used

17:25:39.0972 7200 \Device\Harddisk6\DR6\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x575452C2

17:25:40.0434 7200 Initialize success

17:25:40.0435 7200 ============================================================

Larusso · February 8, 2012

Could you please post the other Logfiles from TDSSK ?

texaswilly · February 8, 2012

Here is the first one, I finally figured out it was on the c:\ directory:

10:48:44.0644 2268 TDSS rootkit removing tool 2.7.9.0 Feb 1 2012 09:28:49

10:48:45.0035 2268 ============================================================

10:48:45.0035 2268 Current date / time: 2012/02/04 10:48:45.0035

10:48:45.0035 2268 SystemInfo:

10:48:45.0035 2268

10:48:45.0035 2268 OS Version: 6.0.6002 ServicePack: 2.0

10:48:45.0035 2268 Product type: Workstation

10:48:45.0035 2268 ComputerName: HOMEOFFICE-PC

10:48:45.0035 2268 UserName: Willy

10:48:45.0035 2268 Windows directory: C:\Windows

10:48:45.0035 2268 System windows directory: C:\Windows

10:48:45.0035 2268 Processor architecture: Intel x86

10:48:45.0035 2268 Number of processors: 4

10:48:45.0035 2268 Page size: 0x1000

10:48:45.0035 2268 Boot type: Normal boot

10:48:45.0035 2268 ============================================================

10:48:46.0425 2268 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

10:48:56.0809 2268 Drive \Device\Harddisk5\DR5 - Size: 0x15D50D00000 (1397.26 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

10:49:06.0013 2268 Drive \Device\Harddisk6\DR6 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

10:49:06.0014 2268 \Device\Harddisk0\DR0:

10:49:06.0014 2268 MBR used

10:49:06.0014 2268 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800

10:49:06.0014 2268 \Device\Harddisk5\DR5:

10:49:06.0014 2268 MBR used

10:49:06.0014 2268 \Device\Harddisk5\DR5\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xAEA86000

10:49:06.0014 2268 \Device\Harddisk6\DR6:

10:49:06.0015 2268 MBR used

10:49:06.0015 2268 \Device\Harddisk6\DR6\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x575452C2

10:49:06.0516 2268 Initialize success

10:49:06.0516 2268 ============================================================

10:49:27.0739 6200 ============================================================

10:49:27.0739 6200 Scan started

10:49:27.0739 6200 Mode: Manual; SigCheck; TDLFS;

10:49:27.0739 6200 ============================================================

10:49:28.0612 6200 61883 (585e64bb6dfbc0a2f1f0b554ded012df) C:\Windows\system32\DRIVERS\61883.sys

10:49:28.0796 6200 61883 - ok

10:49:28.0835 6200 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

10:49:28.0866 6200 ACPI - ok

10:49:28.0920 6200 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

10:49:28.0949 6200 adp94xx - ok

10:49:28.0983 6200 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

10:49:29.0051 6200 adpahci - ok

10:49:29.0088 6200 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

10:49:29.0117 6200 adpu160m - ok

10:49:29.0153 6200 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

10:49:29.0185 6200 adpu320 - ok

10:49:29.0217 6200 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\Windows\system32\drivers\Afc.sys

10:49:29.0286 6200 Afc - ok

10:49:29.0350 6200 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

10:49:29.0414 6200 AFD - ok

10:49:29.0478 6200 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys

10:49:29.0506 6200 agp440 - ok

10:49:29.0540 6200 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

10:49:29.0566 6200 aic78xx - ok

10:49:29.0608 6200 aliide (3a99cb23a2d326fd532618705d6e3048) C:\Windows\system32\drivers\aliide.sys

10:49:29.0623 6200 aliide - ok

10:49:29.0653 6200 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

10:49:29.0682 6200 amdagp - ok

10:49:29.0713 6200 amdide (4333c133dbd71c7d7fe4fb1b83f9ee3e) C:\Windows\system32\drivers\amdide.sys

10:49:29.0729 6200 amdide - ok

10:49:29.0762 6200 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

10:49:29.0911 6200 AmdK7 - ok

10:49:29.0943 6200 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys

10:49:30.0016 6200 AmdK8 - ok

10:49:30.0076 6200 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

10:49:30.0103 6200 arc - ok

10:49:30.0138 6200 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

10:49:30.0164 6200 arcsas - ok

10:49:30.0217 6200 ASPI32 (b979979ab8027f7f53fb16ec4229b7db) C:\Windows\system32\drivers\ASPI32.sys

10:49:30.0284 6200 ASPI32 ( UnsignedFile.Multi.Generic ) - warning

10:49:30.0284 6200 ASPI32 - detected UnsignedFile.Multi.Generic (1)

10:49:30.0326 6200 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

10:49:30.0392 6200 AsyncMac - ok

10:49:30.0440 6200 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

10:49:30.0458 6200 atapi - ok

10:49:30.0519 6200 atikmdag (e615e3c567fbd10121723eff09d26b00) C:\Windows\system32\DRIVERS\atikmdag.sys

10:49:30.0641 6200 atikmdag - ok

10:49:30.0685 6200 Avc (f4b56425a00beb32f5fa6603ff7b0ea2) C:\Windows\system32\DRIVERS\avc.sys

10:49:30.0754 6200 Avc - ok

10:49:30.0787 6200 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

10:49:30.0841 6200 Beep - ok

10:49:30.0864 6200 blbdrive - ok

10:49:30.0919 6200 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

10:49:31.0002 6200 bowser - ok

10:49:31.0026 6200 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

10:49:31.0075 6200 BrFiltLo - ok

10:49:31.0108 6200 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

10:49:31.0178 6200 BrFiltUp - ok

10:49:31.0208 6200 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

10:49:31.0269 6200 Brserid - ok

10:49:31.0300 6200 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

10:49:31.0380 6200 BrSerWdm - ok

10:49:31.0412 6200 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

10:49:31.0468 6200 BrUsbMdm - ok

10:49:31.0507 6200 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

10:49:31.0568 6200 BrUsbSer - ok

10:49:31.0606 6200 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

10:49:31.0689 6200 BTHMODEM - ok

10:49:31.0746 6200 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

10:49:31.0847 6200 cdfs - ok

10:49:31.0899 6200 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

10:49:31.0941 6200 cdrom - ok

10:49:31.0978 6200 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

10:49:32.0031 6200 circlass - ok

10:49:32.0083 6200 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

10:49:32.0115 6200 CLFS - ok

10:49:32.0211 6200 cmdide (dfb94a6fc3a26972b0461ab5f1d8272b) C:\Windows\system32\drivers\cmdide.sys

10:49:32.0228 6200 cmdide - ok

10:49:32.0277 6200 Compbatt (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys

10:49:32.0295 6200 Compbatt - ok

10:49:32.0318 6200 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

10:49:32.0336 6200 crcdisk - ok

10:49:32.0398 6200 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

10:49:32.0452 6200 Crusoe - ok

10:49:32.0493 6200 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys

10:49:32.0548 6200 CVirtA - ok

10:49:32.0645 6200 CVPNDRVA (18994842386fd3039279d7865740abbd) C:\Windows\system32\Drivers\CVPNDRVA.sys

10:49:32.0701 6200 CVPNDRVA ( UnsignedFile.Multi.Generic ) - warning

10:49:32.0701 6200 CVPNDRVA - detected UnsignedFile.Multi.Generic (1)

10:49:32.0846 6200 dbhjcjpf - ok

10:49:32.0925 6200 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

10:49:33.0013 6200 DfsC - ok

10:49:33.0047 6200 DgiVecp (770471de2550820feeb7e5d24bf2e273) C:\Windows\system32\Drivers\DgiVecp.sys

10:49:33.0117 6200 DgiVecp ( UnsignedFile.Multi.Generic ) - warning

10:49:33.0117 6200 DgiVecp - detected UnsignedFile.Multi.Generic (1)

10:49:33.0157 6200 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

10:49:33.0188 6200 disk - ok

10:49:33.0237 6200 DNE (b5aa5aa5ac327bd7c1aec0c58f0c1144) C:\Windows\system32\DRIVERS\dne2000.sys

10:49:33.0268 6200 DNE - ok

10:49:33.0290 6200 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

10:49:33.0340 6200 drmkaud - ok

10:49:33.0410 6200 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

10:49:33.0475 6200 DXGKrnl - ok

10:49:33.0553 6200 e1express (04944f4fc4f0477185f5d26ae0ddb90e) C:\Windows\system32\DRIVERS\e1e6032.sys

10:49:33.0607 6200 e1express - ok

10:49:33.0649 6200 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

10:49:33.0744 6200 E1G60 - ok

10:49:33.0788 6200 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

10:49:33.0820 6200 Ecache - ok

10:49:33.0845 6200 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

10:49:33.0871 6200 elxstor - ok

10:49:33.0907 6200 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

10:49:33.0952 6200 exfat - ok

10:49:33.0994 6200 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

10:49:34.0057 6200 fastfat - ok

10:49:34.0099 6200 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

10:49:34.0188 6200 fdc - ok

10:49:34.0216 6200 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

10:49:34.0246 6200 FileInfo - ok

10:49:34.0273 6200 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

10:49:34.0326 6200 Filetrace - ok

10:49:34.0361 6200 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

10:49:34.0409 6200 flpydisk - ok

10:49:34.0437 6200 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

10:49:34.0467 6200 FltMgr - ok

10:49:34.0531 6200 FlyUsb (85e5ad3a9d56fd6f92db5fc9ca62e2e4) C:\Windows\system32\DRIVERS\FlyUsb.sys

10:49:34.0599 6200 FlyUsb - ok

10:49:34.0660 6200 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys

10:49:34.0684 6200 fssfltr - ok

10:49:34.0732 6200 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

10:49:34.0797 6200 Fs_Rec - ok

10:49:34.0835 6200 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

10:49:34.0863 6200 gagp30kx - ok

10:49:34.0892 6200 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

10:49:34.0914 6200 GEARAspiWDM - ok

10:49:34.0991 6200 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys

10:49:35.0077 6200 HdAudAddService - ok

10:49:35.0133 6200 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

10:49:35.0207 6200 HDAudBus - ok

10:49:35.0252 6200 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

10:49:35.0304 6200 HidBth - ok

10:49:35.0334 6200 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

10:49:35.0476 6200 HidIr - ok

10:49:35.0512 6200 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

10:49:35.0539 6200 HidUsb - ok

10:49:35.0574 6200 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

10:49:35.0595 6200 HpCISSs - ok

10:49:35.0638 6200 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

10:49:35.0718 6200 HTTP - ok

10:49:35.0771 6200 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

10:49:35.0790 6200 i2omp - ok

10:49:35.0850 6200 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

10:49:35.0887 6200 i8042prt - ok

10:49:35.0919 6200 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

10:49:35.0948 6200 iaStorV - ok

10:49:35.0974 6200 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

10:49:35.0997 6200 iirsp - ok

10:49:36.0042 6200 intelide (1c60617d54bc9f035671a44b75d9f7cc) C:\Windows\system32\drivers\intelide.sys

10:49:36.0059 6200 intelide - ok

10:49:36.0084 6200 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

10:49:36.0171 6200 intelppm - ok

10:49:36.0200 6200 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

10:49:36.0242 6200 IpFilterDriver - ok

10:49:36.0251 6200 IpInIp - ok

10:49:36.0273 6200 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

10:49:36.0359 6200 IPMIDRV - ok

10:49:36.0413 6200 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

10:49:36.0448 6200 IPNAT - ok

10:49:36.0510 6200 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

10:49:36.0572 6200 IRENUM - ok

10:49:36.0596 6200 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

10:49:36.0622 6200 isapnp - ok

10:49:36.0664 6200 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

10:49:36.0689 6200 iScsiPrt - ok

10:49:36.0713 6200 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

10:49:36.0734 6200 iteatapi - ok

10:49:36.0757 6200 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

10:49:36.0780 6200 iteraid - ok

10:49:36.0812 6200 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

10:49:36.0836 6200 kbdclass - ok

10:49:36.0847 6200 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

10:49:36.0911 6200 kbdhid - ok

10:49:36.0990 6200 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

10:49:37.0064 6200 KSecDD - ok

10:49:37.0125 6200 LHidFilt (8b30311241f97b35167afe68d79e8530) C:\Windows\system32\DRIVERS\LHidFilt.Sys

10:49:37.0148 6200 LHidFilt - ok

10:49:37.0204 6200 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

10:49:37.0248 6200 lltdio - ok

10:49:37.0285 6200 LMouFilt (48d7422a6c4eec886b56ac534cfa3acf) C:\Windows\system32\DRIVERS\LMouFilt.Sys

10:49:37.0292 6200 LMouFilt - ok

10:49:37.0315 6200 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

10:49:37.0342 6200 LSI_FC - ok

10:49:37.0376 6200 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

10:49:37.0404 6200 LSI_SAS - ok

10:49:37.0439 6200 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

10:49:37.0466 6200 LSI_SCSI - ok

10:49:37.0501 6200 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

10:49:37.0573 6200 luafv - ok

10:49:37.0639 6200 LVPr2Mon (8be71d7edb8c7494913722059f760dd0) C:\Windows\system32\Drivers\LVPr2Mon.sys

10:49:37.0661 6200 LVPr2Mon - ok

10:49:37.0715 6200 LVRS (7521c0c58ee91be90b6cc33e792d10c7) C:\Windows\system32\DRIVERS\lvrs.sys

10:49:37.0754 6200 LVRS - ok

10:49:37.0802 6200 LVUSBSta (5f987fc1aad215ec2c60cf07719b1cce) C:\Windows\system32\drivers\LVUSBSta.sys

10:49:37.0824 6200 LVUSBSta - ok

10:49:37.0938 6200 LVUVC (37e57c48af530df01cdd4e8a2ad77b51) C:\Windows\system32\DRIVERS\lvuvc.sys

10:49:38.0124 6200 LVUVC - ok

10:49:38.0157 6200 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys

10:49:38.0183 6200 MBAMProtector - ok

10:49:38.0211 6200 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

10:49:38.0231 6200 megasas - ok

10:49:38.0265 6200 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

10:49:38.0324 6200 Modem - ok

10:49:38.0395 6200 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

10:49:38.0470 6200 monitor - ok

10:49:38.0510 6200 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

10:49:38.0532 6200 mouclass - ok

10:49:38.0548 6200 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

10:49:38.0626 6200 mouhid - ok

10:49:38.0662 6200 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

10:49:38.0691 6200 MountMgr - ok

10:49:38.0737 6200 MpFilter (356842aac621ab40f18992c01a590f71) C:\Windows\system32\DRIVERS\MpFilter.sys

10:49:38.0757 6200 MpFilter - ok

10:49:38.0792 6200 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

10:49:38.0822 6200 mpio - ok

10:49:38.0850 6200 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

10:49:38.0895 6200 mpsdrv - ok

10:49:38.0974 6200 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

10:49:38.0994 6200 Mraid35x - ok

10:49:39.0050 6200 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

10:49:39.0094 6200 MRxDAV - ok

10:49:39.0151 6200 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

10:49:39.0281 6200 mrxsmb - ok

10:49:39.0347 6200 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys

10:49:39.0377 6200 mrxsmb10 - ok

10:49:39.0393 6200 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

10:49:39.0465 6200 mrxsmb20 - ok

10:49:39.0533 6200 msahci (f0ec3a4e0693a34b148723b4da31668c) C:\Windows\system32\drivers\msahci.sys

10:49:39.0550 6200 msahci - ok

10:49:39.0588 6200 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

10:49:39.0622 6200 msdsm - ok

10:49:39.0707 6200 MSDV (343291a4dfd7c923c3f71f550830ec1c) C:\Windows\system32\DRIVERS\msdv.sys

10:49:39.0767 6200 MSDV - ok

10:49:39.0791 6200 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

10:49:39.0870 6200 Msfs - ok

10:49:39.0894 6200 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

10:49:39.0912 6200 msisadrv - ok

10:49:39.0937 6200 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

10:49:40.0011 6200 MSKSSRV - ok

10:49:40.0058 6200 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

10:49:40.0086 6200 MSPCLOCK - ok

10:49:40.0101 6200 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

10:49:40.0130 6200 MSPQM - ok

10:49:40.0181 6200 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

10:49:40.0230 6200 MsRPC - ok

10:49:40.0244 6200 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

10:49:40.0269 6200 mssmbios - ok

10:49:40.0302 6200 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

10:49:40.0367 6200 MSTEE - ok

10:49:40.0388 6200 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

10:49:40.0418 6200 Mup - ok

10:49:40.0463 6200 N5SG (77dad453144952e7cec56ac6e2061fd7) C:\Windows\system32\DRIVERS\N5SG.sys

10:49:40.0507 6200 N5SG ( UnsignedFile.Multi.Generic ) - warning

10:49:40.0507 6200 N5SG - detected UnsignedFile.Multi.Generic (1)

10:49:40.0563 6200 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

10:49:40.0613 6200 NativeWifiP - ok

10:49:40.0670 6200 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

10:49:40.0709 6200 NDIS - ok

10:49:40.0726 6200 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

10:49:40.0758 6200 NdisTapi - ok

10:49:40.0782 6200 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

10:49:40.0847 6200 Ndisuio - ok

10:49:40.0882 6200 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

10:49:40.0930 6200 NdisWan - ok

10:49:40.0988 6200 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

10:49:41.0047 6200 NDProxy - ok

10:49:41.0074 6200 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

10:49:41.0136 6200 NetBIOS - ok

10:49:41.0165 6200 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

10:49:41.0243 6200 netbt - ok

10:49:41.0321 6200 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

10:49:41.0345 6200 nfrd960 - ok

10:49:41.0361 6200 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

10:49:41.0397 6200 Npfs - ok

10:49:41.0406 6200 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

10:49:41.0455 6200 nsiproxy - ok

10:49:41.0515 6200 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

10:49:41.0642 6200 Ntfs - ok

10:49:41.0669 6200 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

10:49:41.0737 6200 ntrigdigi - ok

10:49:41.0768 6200 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

10:49:41.0790 6200 Null - ok

10:49:41.0855 6200 nvraid (6f785db62a6d8f3fafd3e5695277e849) C:\Windows\system32\drivers\nvraid.sys

10:49:41.0911 6200 nvraid - ok

10:49:41.0942 6200 nvstor (4a5fcab82d9bf6af8a023a66802fe9e9) C:\Windows\system32\drivers\nvstor.sys

10:49:42.0009 6200 nvstor - ok

10:49:42.0033 6200 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

10:49:42.0056 6200 nv_agp - ok

10:49:42.0072 6200 NwlnkFlt - ok

10:49:42.0082 6200 NwlnkFwd - ok

10:49:42.0129 6200 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

10:49:42.0190 6200 ohci1394 - ok

10:49:42.0200 6200 OMCI - ok

10:49:42.0274 6200 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

10:49:42.0353 6200 Parport - ok

10:49:42.0361 6200 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

10:49:42.0392 6200 partmgr - ok

10:49:42.0413 6200 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

10:49:42.0458 6200 Parvdm - ok

10:49:42.0499 6200 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

10:49:42.0524 6200 pci - ok

10:49:42.0538 6200 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys

10:49:42.0557 6200 pciide - ok

10:49:42.0590 6200 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

10:49:42.0614 6200 pcmcia - ok

10:49:42.0680 6200 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\Windows\system32\Drivers\pcouffin.sys

10:49:42.0724 6200 pcouffin - ok

10:49:42.0787 6200 PdiPorts (18ed1d71fef6f71d38c24263500bbd01) C:\Windows\system32\Drivers\PdiPorts.sys

10:49:42.0806 6200 PdiPorts - ok

10:49:42.0835 6200 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

10:49:42.0949 6200 PEAUTH - ok

10:49:43.0059 6200 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

10:49:43.0129 6200 PptpMiniport - ok

10:49:43.0154 6200 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

10:49:43.0207 6200 Processor - ok

10:49:43.0265 6200 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

10:49:43.0342 6200 PSched - ok

10:49:43.0372 6200 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\Windows\system32\Drivers\PxHelp20.sys

10:49:43.0398 6200 PxHelp20 - ok

10:49:43.0438 6200 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

10:49:43.0497 6200 ql2300 - ok

10:49:43.0535 6200 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

10:49:43.0574 6200 ql40xx - ok

10:49:43.0607 6200 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

10:49:43.0681 6200 QWAVEdrv - ok

10:49:43.0706 6200 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

10:49:43.0759 6200 RasAcd - ok

10:49:43.0785 6200 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

10:49:43.0833 6200 Rasl2tp - ok

10:49:43.0874 6200 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

10:49:43.0930 6200 RasPppoe - ok

10:49:43.0963 6200 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

10:49:44.0053 6200 RasSstp - ok

10:49:44.0101 6200 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

10:49:44.0149 6200 rdbss - ok

10:49:44.0168 6200 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

10:49:44.0197 6200 RDPCDD - ok

10:49:44.0221 6200 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

10:49:44.0321 6200 rdpdr - ok

10:49:44.0347 6200 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

10:49:44.0376 6200 RDPENCDD - ok

10:49:44.0399 6200 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

10:49:44.0451 6200 RDPWD - ok

10:49:44.0516 6200 RimUsb (616eac1b0e48b236a5a9b8ae07fdb81c) C:\Windows\system32\Drivers\RimUsb.sys

10:49:44.0563 6200 RimUsb - ok

10:49:44.0619 6200 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys

10:49:44.0684 6200 RimVSerPort - ok

10:49:44.0724 6200 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys

10:49:44.0789 6200 ROOTMODEM - ok

10:49:44.0827 6200 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

10:49:44.0871 6200 rspndr - ok

10:49:44.0895 6200 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

10:49:44.0930 6200 sbp2port - ok

10:49:44.0960 6200 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

10:49:45.0033 6200 secdrv - ok

10:49:45.0088 6200 Sentinel (a2cc81c30bef6ac9f27055490eef6de3) C:\Windows\System32\Drivers\SENTINEL.SYS

10:49:45.0212 6200 Sentinel - ok

10:49:45.0257 6200 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

10:49:45.0323 6200 Serenum - ok

10:49:45.0355 6200 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

10:49:45.0420 6200 Serial - ok

10:49:45.0472 6200 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

10:49:45.0504 6200 sermouse - ok

10:49:45.0526 6200 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys

10:49:45.0587 6200 sffdisk - ok

10:49:45.0615 6200 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

10:49:45.0692 6200 sffp_mmc - ok

10:49:45.0714 6200 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys

10:49:45.0790 6200 sffp_sd - ok

10:49:45.0811 6200 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

10:49:45.0858 6200 sfloppy - ok

10:49:45.0917 6200 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys

10:49:45.0945 6200 sisagp - ok

10:49:45.0975 6200 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

10:49:45.0996 6200 SiSRaid2 - ok

10:49:46.0029 6200 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

10:49:46.0057 6200 SiSRaid4 - ok

10:49:46.0107 6200 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

10:49:46.0152 6200 Smb - ok

10:49:46.0190 6200 SNTNLUSB (ce724fc3ef8468bbab146ca1793c66dc) C:\Windows\system32\DRIVERS\SNTNLUSB.SYS

10:49:46.0213 6200 SNTNLUSB - ok

10:49:46.0243 6200 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

10:49:46.0263 6200 spldr - ok

10:49:46.0322 6200 sptd (d15da1ba189770d93eea2d7e18f95af9) C:\Windows\system32\Drivers\sptd.sys

10:49:46.0322 6200 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9

10:49:46.0325 6200 sptd ( LockedFile.Multi.Generic ) - warning

10:49:46.0325 6200 sptd - detected LockedFile.Multi.Generic (1)

10:49:46.0384 6200 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

10:49:46.0470 6200 srv - ok

10:49:46.0535 6200 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

10:49:46.0586 6200 srv2 - ok

10:49:46.0605 6200 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

10:49:46.0668 6200 srvnet - ok

10:49:46.0703 6200 SSPORT (ef3458337d7341a05169cefc73709264) C:\Windows\system32\Drivers\SSPORT.sys

10:49:46.0715 6200 SSPORT ( UnsignedFile.Multi.Generic ) - warning

10:49:46.0715 6200 SSPORT - detected UnsignedFile.Multi.Generic (1)

10:49:46.0741 6200 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

10:49:46.0758 6200 swenum - ok

10:49:46.0787 6200 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

10:49:46.0810 6200 Symc8xx - ok

10:49:46.0841 6200 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

10:49:46.0861 6200 Sym_hi - ok

10:49:46.0892 6200 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

10:49:46.0913 6200 Sym_u3 - ok

10:49:46.0968 6200 Tcpip (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys

10:49:47.0018 6200 Tcpip - ok

10:49:47.0090 6200 Tcpip6 (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys

10:49:47.0187 6200 Tcpip6 - ok

10:49:47.0254 6200 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

10:49:47.0331 6200 tcpipreg - ok

10:49:47.0393 6200 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

10:49:47.0444 6200 TDPIPE - ok

10:49:47.0466 6200 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

10:49:47.0501 6200 TDTCP - ok

10:49:47.0541 6200 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

10:49:47.0586 6200 tdx - ok

10:49:47.0607 6200 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

10:49:47.0638 6200 TermDD - ok

10:49:47.0683 6200 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

10:49:47.0717 6200 tssecsrv - ok

10:49:47.0751 6200 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

10:49:47.0812 6200 tunmp - ok

10:49:47.0850 6200 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

10:49:47.0892 6200 tunnel - ok

10:49:47.0928 6200 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys

10:49:47.0957 6200 uagp35 - ok

10:49:47.0984 6200 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

10:49:48.0016 6200 udfs - ok

10:49:48.0051 6200 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

10:49:48.0081 6200 uliagpkx - ok

10:49:48.0107 6200 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

10:49:48.0160 6200 uliahci - ok

10:49:48.0198 6200 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

10:49:48.0218 6200 UlSata - ok

10:49:48.0250 6200 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

10:49:48.0276 6200 ulsata2 - ok

10:49:48.0297 6200 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

10:49:48.0354 6200 umbus - ok

10:49:48.0413 6200 USB28xxBGA (48bfa9c9145b7527aa8849c974756461) C:\Windows\system32\DRIVERS\emBDA.sys

10:49:48.0542 6200 USB28xxBGA - ok

10:49:48.0609 6200 USB28xxOEM (9053737716744587b748cf7aaa424758) C:\Windows\system32\DRIVERS\emOEM.sys

10:49:48.0666 6200 USB28xxOEM - ok

10:49:48.0726 6200 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\Windows\system32\Drivers\usbaapl.sys

10:49:48.0835 6200 USBAAPL - ok

10:49:48.0881 6200 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys

10:49:48.0945 6200 usbaudio - ok

10:49:48.0982 6200 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

10:49:49.0058 6200 usbccgp - ok

10:49:49.0079 6200 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

10:49:49.0151 6200 usbcir - ok

10:49:49.0180 6200 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

10:49:49.0212 6200 usbehci - ok

10:49:49.0237 6200 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

10:49:49.0274 6200 usbhub - ok

10:49:49.0293 6200 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys

10:49:49.0322 6200 usbohci - ok

10:49:49.0341 6200 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

10:49:49.0407 6200 usbprint - ok

10:49:49.0446 6200 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys

10:49:49.0480 6200 usbscan - ok

10:49:49.0503 6200 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

10:49:49.0545 6200 USBSTOR - ok

10:49:49.0563 6200 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

10:49:49.0593 6200 usbuhci - ok

10:49:49.0618 6200 usbvideo (0a6b81f01bc86399482e27e6fda7b33b) C:\Windows\system32\Drivers\usbvideo.sys

10:49:49.0700 6200 usbvideo - ok

10:49:49.0743 6200 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

10:49:49.0825 6200 vga - ok

10:49:49.0867 6200 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

10:49:49.0902 6200 VgaSave - ok

10:49:49.0960 6200 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

10:49:49.0988 6200 viaagp - ok

10:49:50.0024 6200 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

10:49:50.0078 6200 ViaC7 - ok

10:49:50.0116 6200 viaide (58c8d5ac5c3eef40e7e704a5ced7987d) C:\Windows\system32\drivers\viaide.sys

10:49:50.0133 6200 viaide - ok

10:49:50.0166 6200 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

10:49:50.0194 6200 volmgr - ok

10:49:50.0246 6200 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

10:49:50.0278 6200 volmgrx - ok

10:49:50.0288 6200 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

10:49:50.0315 6200 volsnap - ok

10:49:50.0339 6200 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

10:49:50.0375 6200 vsmraid - ok

10:49:50.0410 6200 VSTHWBS2 (c466021d31ff6c0a6069d12299d80c0b) C:\Windows\system32\DRIVERS\VSTBS23.SYS

10:49:50.0470 6200 VSTHWBS2 - ok

10:49:50.0512 6200 VST_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS

10:49:50.0570 6200 VST_DPV - ok

10:49:50.0594 6200 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

10:49:50.0642 6200 WacomPen - ok

10:49:50.0679 6200 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

10:49:50.0746 6200 Wanarp - ok

10:49:50.0749 6200 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

10:49:50.0792 6200 Wanarpv6 - ok

10:49:50.0815 6200 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

10:49:50.0834 6200 Wd - ok

10:49:50.0888 6200 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys

10:49:50.0945 6200 Wdf01000 - ok

10:49:51.0017 6200 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS

10:49:51.0106 6200 winachsf - ok

10:49:51.0185 6200 WinUsb (676f4b665bdd8053eaa53ac1695b8074) C:\Windows\system32\DRIVERS\WinUSB.SYS

10:49:51.0239 6200 WinUsb - ok

10:49:51.0309 6200 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys

10:49:51.0355 6200 WmiAcpi - ok

10:49:51.0438 6200 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

10:49:51.0505 6200 WpdUsb - ok

10:49:51.0572 6200 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

10:49:51.0639 6200 ws2ifsl - ok

10:49:51.0686 6200 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

10:49:51.0736 6200 WUDFRd - ok

10:49:51.0774 6200 MBR (0x1B8) (4bf077b4df3f4f5483a79d4ce511c7f3) \Device\Harddisk0\DR0

10:49:51.0896 6200 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected

10:49:51.0896 6200 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)

10:49:52.0194 6200 \Device\Harddisk0\DR0 ( TDSS File System ) - warning

10:49:52.0194 6200 \Device\Harddisk0\DR0 - detected TDSS File System (1)

10:49:52.0197 6200 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk5\DR5

10:49:52.0677 6200 \Device\Harddisk5\DR5 - ok

10:49:52.0702 6200 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk6\DR6

10:49:52.0819 6200 \Device\Harddisk6\DR6 - ok

10:49:52.0864 6200 Boot (0x1200) (72c9b9c4bb3bbf1d1f668a4fea4533af) \Device\Harddisk0\DR0\Partition0

10:49:52.0957 6200 \Device\Harddisk0\DR0\Partition0 - ok

10:49:52.0960 6200 Boot (0x1200) (1b3678f513eb38e152e46d7d2f1d7091) \Device\Harddisk5\DR5\Partition0

10:49:52.0961 6200 \Device\Harddisk5\DR5\Partition0 - ok

10:49:52.0964 6200 Boot (0x1200) (19270f5db212c5652859b65ba4ab0cb3) \Device\Harddisk6\DR6\Partition0

10:49:52.0965 6200 \Device\Harddisk6\DR6\Partition0 - ok

10:49:52.0965 6200 ============================================================

10:49:52.0965 6200 Scan finished

10:49:52.0965 6200 ============================================================

10:49:52.0973 7928 Detected object count: 8

10:49:52.0973 7928 Actual detected object count: 8

10:50:38.0204 7928 ASPI32 ( UnsignedFile.Multi.Generic ) - skipped by user

10:50:38.0204 7928 ASPI32 ( UnsignedFile.Multi.Generic ) - User select action: Skip

10:50:38.0205 7928 CVPNDRVA ( UnsignedFile.Multi.Generic ) - skipped by user

10:50:38.0205 7928 CVPNDRVA ( UnsignedFile.Multi.Generic ) - User select action: Skip

10:50:38.0206 7928 DgiVecp ( UnsignedFile.Multi.Generic ) - skipped by user

10:50:38.0206 7928 DgiVecp ( UnsignedFile.Multi.Generic ) - User select action: Skip

10:50:38.0207 7928 N5SG ( UnsignedFile.Multi.Generic ) - skipped by user

10:50:38.0207 7928 N5SG ( UnsignedFile.Multi.Generic ) - User select action: Skip

10:50:38.0208 7928 sptd ( LockedFile.Multi.Generic ) - skipped by user

10:50:38.0208 7928 sptd ( LockedFile.Multi.Generic ) - User select action: Skip

10:50:38.0209 7928 SSPORT ( UnsignedFile.Multi.Generic ) - skipped by user

10:50:38.0209 7928 SSPORT ( UnsignedFile.Multi.Generic ) - User select action: Skip

10:50:38.0244 7928 \Device\Harddisk0\DR0\# - copied to quarantine

10:50:38.0250 7928 \Device\Harddisk0\DR0 - copied to quarantine

10:50:38.0877 7928 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine

10:50:38.0879 7928 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine

10:50:38.0888 7928 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine

10:50:38.0971 7928 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine

10:50:38.0982 7928 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine

10:50:39.0262 7928 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine

10:50:39.0316 7928 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine

10:50:40.0730 7928 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot

10:50:40.0731 7928 \Device\Harddisk0\DR0 - ok

10:50:40.0731 7928 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure

10:50:40.0732 7928 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user

10:50:40.0732 7928 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

10:50:44.0928 7232 Deinitialize success

texaswilly · February 8, 2012

Here is the log from the second run:

11:01:54.0386 1576 TDSS rootkit removing tool 2.7.9.0 Feb 1 2012 09:28:49

11:01:54.0927 1576 ============================================================

11:01:54.0928 1576 Current date / time: 2012/02/04 11:01:54.0927

11:01:54.0928 1576 SystemInfo:

11:01:54.0928 1576

11:01:54.0928 1576 OS Version: 6.0.6002 ServicePack: 2.0

11:01:54.0928 1576 Product type: Workstation

11:01:54.0928 1576 ComputerName: HOMEOFFICE-PC

11:01:54.0928 1576 UserName: Willy

11:01:54.0928 1576 Windows directory: C:\Windows

11:01:54.0928 1576 System windows directory: C:\Windows

11:01:54.0928 1576 Processor architecture: Intel x86

11:01:54.0928 1576 Number of processors: 4

11:01:54.0928 1576 Page size: 0x1000

11:01:54.0928 1576 Boot type: Normal boot

11:01:54.0928 1576 ============================================================

11:01:57.0505 1576 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

11:01:57.0569 1576 Drive \Device\Harddisk5\DR5 - Size: 0x15D50D00000 (1397.26 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

11:01:57.0612 1576 Drive \Device\Harddisk6\DR6 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

11:01:57.0613 1576 \Device\Harddisk0\DR0:

11:01:57.0619 1576 MBR used

11:01:57.0619 1576 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800

11:01:57.0619 1576 \Device\Harddisk5\DR5:

11:01:57.0619 1576 MBR used

11:01:57.0619 1576 \Device\Harddisk5\DR5\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xAEA86000

11:01:57.0619 1576 \Device\Harddisk6\DR6:

11:01:57.0620 1576 MBR used

11:01:57.0620 1576 \Device\Harddisk6\DR6\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x575452C2

11:01:58.0125 1576 Initialize success

11:01:58.0125 1576 ============================================================

11:02:06.0120 4824 ============================================================

11:02:06.0120 4824 Scan started

11:02:06.0120 4824 Mode: Manual; SigCheck; TDLFS;

11:02:06.0120 4824 ============================================================

11:02:07.0665 4824 61883 (585e64bb6dfbc0a2f1f0b554ded012df) C:\Windows\system32\DRIVERS\61883.sys

11:02:07.0848 4824 61883 - ok

11:02:07.0929 4824 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

11:02:07.0958 4824 ACPI - ok

11:02:08.0014 4824 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

11:02:08.0081 4824 adp94xx - ok

11:02:08.0111 4824 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

11:02:08.0260 4824 adpahci - ok

11:02:08.0298 4824 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

11:02:08.0365 4824 adpu160m - ok

11:02:08.0421 4824 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

11:02:08.0500 4824 adpu320 - ok

11:02:08.0536 4824 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\Windows\system32\drivers\Afc.sys

11:02:08.0616 4824 Afc - ok

11:02:08.0692 4824 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

11:02:08.0798 4824 AFD - ok

11:02:08.0855 4824 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys

11:02:08.0913 4824 agp440 - ok

11:02:09.0115 4824 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

11:02:09.0207 4824 aic78xx - ok

11:02:09.0242 4824 aliide (3a99cb23a2d326fd532618705d6e3048) C:\Windows\system32\drivers\aliide.sys

11:02:09.0264 4824 aliide - ok

11:02:09.0304 4824 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

11:02:09.0350 4824 amdagp - ok

11:02:09.0388 4824 amdide (4333c133dbd71c7d7fe4fb1b83f9ee3e) C:\Windows\system32\drivers\amdide.sys

11:02:09.0412 4824 amdide - ok

11:02:09.0445 4824 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

11:02:09.0526 4824 AmdK7 - ok

11:02:09.0568 4824 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys

11:02:09.0649 4824 AmdK8 - ok

11:02:09.0709 4824 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

11:02:09.0755 4824 arc - ok

11:02:09.0788 4824 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

11:02:09.0825 4824 arcsas - ok

11:02:09.0892 4824 ASPI32 (b979979ab8027f7f53fb16ec4229b7db) C:\Windows\system32\drivers\ASPI32.sys

11:02:09.0949 4824 ASPI32 ( UnsignedFile.Multi.Generic ) - warning

11:02:09.0949 4824 ASPI32 - detected UnsignedFile.Multi.Generic (1)

11:02:09.0993 4824 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

11:02:10.0049 4824 AsyncMac - ok

11:02:10.0099 4824 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

11:02:10.0117 4824 atapi - ok

11:02:10.0211 4824 atikmdag (e615e3c567fbd10121723eff09d26b00) C:\Windows\system32\DRIVERS\atikmdag.sys

11:02:10.0358 4824 atikmdag - ok

11:02:10.0443 4824 Avc (f4b56425a00beb32f5fa6603ff7b0ea2) C:\Windows\system32\DRIVERS\avc.sys

11:02:10.0505 4824 Avc - ok

11:02:10.0536 4824 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

11:02:10.0591 4824 Beep - ok

11:02:10.0604 4824 blbdrive - ok

11:02:10.0669 4824 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

11:02:10.0731 4824 bowser - ok

11:02:10.0751 4824 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

11:02:10.0832 4824 BrFiltLo - ok

11:02:10.0865 4824 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

11:02:10.0919 4824 BrFiltUp - ok

11:02:10.0983 4824 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

11:02:11.0072 4824 Brserid - ok

11:02:11.0150 4824 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

11:02:11.0308 4824 BrSerWdm - ok

11:02:11.0352 4824 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

11:02:11.0425 4824 BrUsbMdm - ok

11:02:11.0456 4824 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

11:02:11.0541 4824 BrUsbSer - ok

11:02:11.0580 4824 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

11:02:11.0672 4824 BTHMODEM - ok

11:02:11.0731 4824 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

11:02:11.0837 4824 cdfs - ok

11:02:11.0889 4824 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

11:02:11.0977 4824 cdrom - ok

11:02:12.0018 4824 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

11:02:12.0093 4824 circlass - ok

11:02:12.0164 4824 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

11:02:12.0215 4824 CLFS - ok

11:02:12.0284 4824 cmdide (dfb94a6fc3a26972b0461ab5f1d8272b) C:\Windows\system32\drivers\cmdide.sys

11:02:12.0310 4824 cmdide - ok

11:02:12.0350 4824 Compbatt (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys

11:02:12.0413 4824 Compbatt - ok

11:02:12.0474 4824 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

11:02:12.0500 4824 crcdisk - ok

11:02:12.0529 4824 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

11:02:12.0767 4824 Crusoe - ok

11:02:12.0815 4824 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys

11:02:12.0970 4824 CVirtA - ok

11:02:13.0083 4824 CVPNDRVA (18994842386fd3039279d7865740abbd) C:\Windows\system32\Drivers\CVPNDRVA.sys

11:02:13.0147 4824 CVPNDRVA ( UnsignedFile.Multi.Generic ) - warning

11:02:13.0147 4824 CVPNDRVA - detected UnsignedFile.Multi.Generic (1)

11:02:13.0178 4824 dbhjcjpf - ok

11:02:13.0230 4824 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

11:02:13.0407 4824 DfsC - ok

11:02:13.0676 4824 DgiVecp (770471de2550820feeb7e5d24bf2e273) C:\Windows\system32\Drivers\DgiVecp.sys

11:02:13.0816 4824 DgiVecp ( UnsignedFile.Multi.Generic ) - warning

11:02:13.0816 4824 DgiVecp - detected UnsignedFile.Multi.Generic (1)

11:02:13.0868 4824 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

11:02:13.0913 4824 disk - ok

11:02:13.0940 4824 DNE (b5aa5aa5ac327bd7c1aec0c58f0c1144) C:\Windows\system32\DRIVERS\dne2000.sys

11:02:13.0958 4824 DNE - ok

11:02:13.0985 4824 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

11:02:14.0036 4824 drmkaud - ok

11:02:14.0139 4824 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

11:02:14.0176 4824 DXGKrnl - ok

11:02:14.0374 4824 e1express (04944f4fc4f0477185f5d26ae0ddb90e) C:\Windows\system32\DRIVERS\e1e6032.sys

11:02:14.0481 4824 e1express - ok

11:02:14.0510 4824 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

11:02:14.0630 4824 E1G60 - ok

11:02:14.0674 4824 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

11:02:14.0725 4824 Ecache - ok

11:02:14.0780 4824 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

11:02:14.0968 4824 elxstor - ok

11:02:15.0042 4824 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

11:02:15.0180 4824 exfat - ok

11:02:15.0211 4824 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

11:02:15.0302 4824 fastfat - ok

11:02:15.0366 4824 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

11:02:15.0464 4824 fdc - ok

11:02:15.0557 4824 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

11:02:15.0609 4824 FileInfo - ok

11:02:15.0756 4824 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

11:02:15.0828 4824 Filetrace - ok

11:02:15.0852 4824 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

11:02:15.0912 4824 flpydisk - ok

11:02:16.0014 4824 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

11:02:16.0088 4824 FltMgr - ok

11:02:16.0147 4824 FlyUsb (85e5ad3a9d56fd6f92db5fc9ca62e2e4) C:\Windows\system32\DRIVERS\FlyUsb.sys

11:02:16.0271 4824 FlyUsb - ok

11:02:16.0333 4824 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys

11:02:16.0367 4824 fssfltr - ok

11:02:16.0405 4824 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

11:02:16.0442 4824 Fs_Rec - ok

11:02:16.0541 4824 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

11:02:16.0591 4824 gagp30kx - ok

11:02:16.0623 4824 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

11:02:16.0665 4824 GEARAspiWDM - ok

11:02:16.0764 4824 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys

11:02:16.0858 4824 HdAudAddService - ok

11:02:17.0031 4824 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

11:02:17.0114 4824 HDAudBus - ok

11:02:17.0282 4824 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

11:02:17.0346 4824 HidBth - ok

11:02:17.0438 4824 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

11:02:17.0553 4824 HidIr - ok

11:02:17.0622 4824 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

11:02:17.0658 4824 HidUsb - ok

11:02:17.0820 4824 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

11:02:17.0853 4824 HpCISSs - ok

11:02:17.0993 4824 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

11:02:18.0171 4824 HTTP - ok

11:02:18.0191 4824 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

11:02:18.0242 4824 i2omp - ok

11:02:18.0294 4824 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

11:02:18.0350 4824 i8042prt - ok

11:02:18.0380 4824 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

11:02:18.0430 4824 iaStorV - ok

11:02:18.0451 4824 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

11:02:18.0488 4824 iirsp - ok

11:02:18.0536 4824 intelide (1c60617d54bc9f035671a44b75d9f7cc) C:\Windows\system32\drivers\intelide.sys

11:02:18.0560 4824 intelide - ok

11:02:18.0587 4824 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

11:02:18.0643 4824 intelppm - ok

11:02:18.0703 4824 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

11:02:18.0778 4824 IpFilterDriver - ok

11:02:18.0797 4824 IpInIp - ok

11:02:18.0859 4824 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

11:02:18.0963 4824 IPMIDRV - ok

11:02:18.0999 4824 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

11:02:19.0156 4824 IPNAT - ok

11:02:19.0369 4824 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

11:02:19.0473 4824 IRENUM - ok

11:02:19.0622 4824 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

11:02:19.0756 4824 isapnp - ok

11:02:19.0805 4824 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

11:02:19.0829 4824 iScsiPrt - ok

11:02:19.0854 4824 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

11:02:19.0876 4824 iteatapi - ok

11:02:19.0915 4824 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

11:02:19.0949 4824 iteraid - ok

11:02:19.0986 4824 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

11:02:20.0024 4824 kbdclass - ok

11:02:20.0063 4824 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

11:02:20.0152 4824 kbdhid - ok

11:02:20.0231 4824 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

11:02:20.0304 4824 KSecDD - ok

11:02:20.0365 4824 LHidFilt (8b30311241f97b35167afe68d79e8530) C:\Windows\system32\DRIVERS\LHidFilt.Sys

11:02:20.0405 4824 LHidFilt - ok

11:02:20.0519 4824 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

11:02:20.0580 4824 lltdio - ok

11:02:20.0617 4824 LMouFilt (48d7422a6c4eec886b56ac534cfa3acf) C:\Windows\system32\DRIVERS\LMouFilt.Sys

11:02:20.0654 4824 LMouFilt - ok

11:02:20.0688 4824 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

11:02:20.0715 4824 LSI_FC - ok

11:02:20.0741 4824 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

11:02:20.0786 4824 LSI_SAS - ok

11:02:20.0837 4824 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

11:02:20.0893 4824 LSI_SCSI - ok

11:02:20.0966 4824 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

11:02:21.0063 4824 luafv - ok

11:02:21.0129 4824 LVPr2Mon (8be71d7edb8c7494913722059f760dd0) C:\Windows\system32\Drivers\LVPr2Mon.sys

11:02:21.0165 4824 LVPr2Mon - ok

11:02:21.0221 4824 LVRS (7521c0c58ee91be90b6cc33e792d10c7) C:\Windows\system32\DRIVERS\lvrs.sys

11:02:21.0292 4824 LVRS - ok

11:02:21.0399 4824 LVUSBSta (5f987fc1aad215ec2c60cf07719b1cce) C:\Windows\system32\drivers\LVUSBSta.sys

11:02:21.0473 4824 LVUSBSta - ok

11:02:21.0644 4824 LVUVC (37e57c48af530df01cdd4e8a2ad77b51) C:\Windows\system32\DRIVERS\lvuvc.sys

11:02:21.0886 4824 LVUVC - ok

11:02:21.0920 4824 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys

11:02:21.0940 4824 MBAMProtector - ok

11:02:21.0983 4824 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

11:02:22.0047 4824 megasas - ok

11:02:22.0085 4824 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

11:02:22.0130 4824 Modem - ok

11:02:22.0216 4824 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

11:02:22.0273 4824 monitor - ok

11:02:22.0298 4824 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

11:02:22.0335 4824 mouclass - ok

11:02:22.0510 4824 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

11:02:22.0611 4824 mouhid - ok

11:02:22.0690 4824 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

11:02:22.0801 4824 MountMgr - ok

11:02:22.0881 4824 MpFilter (356842aac621ab40f18992c01a590f71) C:\Windows\system32\DRIVERS\MpFilter.sys

11:02:22.0913 4824 MpFilter - ok

11:02:22.0945 4824 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

11:02:22.0997 4824 mpio - ok

11:02:23.0185 4824 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

11:02:23.0255 4824 mpsdrv - ok

11:02:23.0301 4824 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

11:02:23.0454 4824 Mraid35x - ok

11:02:23.0526 4824 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

11:02:23.0561 4824 MRxDAV - ok

11:02:23.0619 4824 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

11:02:23.0714 4824 mrxsmb - ok

11:02:23.0799 4824 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys

11:02:23.0852 4824 mrxsmb10 - ok

11:02:23.0870 4824 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

11:02:23.0965 4824 mrxsmb20 - ok

11:02:24.0042 4824 msahci (f0ec3a4e0693a34b148723b4da31668c) C:\Windows\system32\drivers\msahci.sys

11:02:24.0168 4824 msahci - ok

11:02:24.0213 4824 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

11:02:24.0408 4824 msdsm - ok

11:02:24.0482 4824 MSDV (343291a4dfd7c923c3f71f550830ec1c) C:\Windows\system32\DRIVERS\msdv.sys

11:02:24.0624 4824 MSDV - ok

11:02:24.0897 4824 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

11:02:24.0997 4824 Msfs - ok

11:02:25.0150 4824 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

11:02:25.0175 4824 msisadrv - ok

11:02:25.0268 4824 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

11:02:25.0390 4824 MSKSSRV - ok

11:02:25.0446 4824 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

11:02:25.0475 4824 MSPCLOCK - ok

11:02:25.0548 4824 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

11:02:25.0668 4824 MSPQM - ok

11:02:25.0743 4824 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

11:02:25.0831 4824 MsRPC - ok

11:02:25.0980 4824 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

11:02:26.0004 4824 mssmbios - ok

11:02:26.0047 4824 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

11:02:26.0165 4824 MSTEE - ok

11:02:26.0172 4824 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

11:02:26.0221 4824 Mup - ok

11:02:26.0324 4824 N5SG (77dad453144952e7cec56ac6e2061fd7) C:\Windows\system32\DRIVERS\N5SG.sys

11:02:26.0385 4824 N5SG ( UnsignedFile.Multi.Generic ) - warning

11:02:26.0385 4824 N5SG - detected UnsignedFile.Multi.Generic (1)

11:02:26.0582 4824 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

11:02:26.0731 4824 NativeWifiP - ok

11:02:26.0855 4824 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

11:02:26.0966 4824 NDIS - ok

11:02:26.0986 4824 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

11:02:27.0071 4824 NdisTapi - ok

11:02:27.0132 4824 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

11:02:27.0197 4824 Ndisuio - ok

11:02:27.0224 4824 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

11:02:27.0273 4824 NdisWan - ok

11:02:27.0322 4824 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

11:02:27.0405 4824 NDProxy - ok

11:02:27.0433 4824 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

11:02:27.0502 4824 NetBIOS - ok

11:02:27.0532 4824 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

11:02:27.0651 4824 netbt - ok

11:02:27.0779 4824 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

11:02:27.0834 4824 nfrd960 - ok

11:02:27.0843 4824 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

11:02:27.0917 4824 Npfs - ok

11:02:27.0948 4824 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

11:02:28.0038 4824 nsiproxy - ok

11:02:28.0156 4824 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

11:02:28.0399 4824 Ntfs - ok

11:02:28.0442 4824 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

11:02:28.0526 4824 ntrigdigi - ok

11:02:28.0538 4824 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

11:02:28.0568 4824 Null - ok

11:02:28.0612 4824 nvraid (6f785db62a6d8f3fafd3e5695277e849) C:\Windows\system32\drivers\nvraid.sys

11:02:28.0700 4824 nvraid - ok

11:02:28.0732 4824 nvstor (4a5fcab82d9bf6af8a023a66802fe9e9) C:\Windows\system32\drivers\nvstor.sys

11:02:28.0897 4824 nvstor - ok

11:02:28.0923 4824 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

11:02:28.0996 4824 nv_agp - ok

11:02:29.0015 4824 NwlnkFlt - ok

11:02:29.0024 4824 NwlnkFwd - ok

11:02:29.0076 4824 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

11:02:29.0155 4824 ohci1394 - ok

11:02:29.0169 4824 OMCI - ok

11:02:29.0238 4824 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

11:02:29.0367 4824 Parport - ok

11:02:29.0417 4824 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

11:02:29.0468 4824 partmgr - ok

11:02:29.0485 4824 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

11:02:29.0539 4824 Parvdm - ok

11:02:29.0587 4824 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

11:02:29.0599 4824 pci - ok

11:02:29.0635 4824 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys

11:02:29.0661 4824 pciide - ok

11:02:29.0687 4824 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

11:02:29.0724 4824 pcmcia - ok

11:02:29.0793 4824 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\Windows\system32\Drivers\pcouffin.sys

11:02:29.0911 4824 pcouffin - ok

11:02:29.0974 4824 PdiPorts (18ed1d71fef6f71d38c24263500bbd01) C:\Windows\system32\Drivers\PdiPorts.sys

11:02:30.0004 4824 PdiPorts - ok

11:02:30.0048 4824 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

11:02:30.0170 4824 PEAUTH - ok

11:02:30.0297 4824 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

11:02:30.0383 4824 PptpMiniport - ok

11:02:30.0416 4824 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

11:02:30.0488 4824 Processor - ok

11:02:30.0544 4824 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

11:02:30.0631 4824 PSched - ok

11:02:30.0659 4824 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\Windows\system32\Drivers\PxHelp20.sys

11:02:30.0705 4824 PxHelp20 - ok

11:02:30.0775 4824 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

11:02:30.0848 4824 ql2300 - ok

11:02:30.0905 4824 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

11:02:31.0093 4824 ql40xx - ok

11:02:31.0126 4824 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

11:02:31.0227 4824 QWAVEdrv - ok

11:02:31.0350 4824 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

11:02:31.0424 4824 RasAcd - ok

11:02:31.0453 4824 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

11:02:31.0554 4824 Rasl2tp - ok

11:02:31.0618 4824 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

11:02:31.0674 4824 RasPppoe - ok

11:02:31.0700 4824 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

11:02:31.0790 4824 RasSstp - ok

11:02:31.0944 4824 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

11:02:32.0036 4824 rdbss - ok

11:02:32.0077 4824 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

11:02:32.0121 4824 RDPCDD - ok

11:02:32.0355 4824 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

11:02:32.0448 4824 rdpdr - ok

11:02:32.0521 4824 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

11:02:32.0553 4824 RDPENCDD - ok

11:02:32.0590 4824 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

11:02:32.0695 4824 RDPWD - ok

11:02:32.0848 4824 RimUsb (616eac1b0e48b236a5a9b8ae07fdb81c) C:\Windows\system32\Drivers\RimUsb.sys

11:02:32.0960 4824 RimUsb - ok

11:02:33.0139 4824 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys

11:02:33.0264 4824 RimVSerPort - ok

11:02:33.0322 4824 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys

11:02:33.0353 4824 ROOTMODEM - ok

11:02:33.0499 4824 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

11:02:33.0609 4824 rspndr - ok

11:02:33.0659 4824 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

11:02:33.0744 4824 sbp2port - ok

11:02:33.0765 4824 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

11:02:33.0845 4824 secdrv - ok

11:02:33.0910 4824 Sentinel (a2cc81c30bef6ac9f27055490eef6de3) C:\Windows\System32\Drivers\SENTINEL.SYS

11:02:34.0164 4824 Sentinel - ok

11:02:34.0236 4824 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

11:02:34.0327 4824 Serenum - ok

11:02:34.0599 4824 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

11:02:34.0700 4824 Serial - ok

11:02:34.0956 4824 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

11:02:35.0042 4824 sermouse - ok

11:02:35.0260 4824 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys

11:02:35.0417 4824 sffdisk - ok

11:02:35.0730 4824 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

11:02:35.0831 4824 sffp_mmc - ok

11:02:35.0912 4824 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys

11:02:35.0996 4824 sffp_sd - ok

11:02:36.0291 4824 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

11:02:36.0357 4824 sfloppy - ok

11:02:36.0414 4824 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys

11:02:36.0460 4824 sisagp - ok

11:02:36.0513 4824 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

11:02:36.0547 4824 SiSRaid2 - ok

11:02:36.0584 4824 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

11:02:36.0632 4824 SiSRaid4 - ok

11:02:36.0761 4824 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

11:02:36.0853 4824 Smb - ok

11:02:37.0043 4824 SNTNLUSB (ce724fc3ef8468bbab146ca1793c66dc) C:\Windows\system32\DRIVERS\SNTNLUSB.SYS

11:02:37.0083 4824 SNTNLUSB - ok

11:02:37.0113 4824 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

11:02:37.0142 4824 spldr - ok

11:02:37.0233 4824 sptd (d15da1ba189770d93eea2d7e18f95af9) C:\Windows\system32\Drivers\sptd.sys

11:02:37.0233 4824 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9

11:02:37.0235 4824 sptd ( LockedFile.Multi.Generic ) - warning

11:02:37.0235 4824 sptd - detected LockedFile.Multi.Generic (1)

11:02:37.0387 4824 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

11:02:37.0486 4824 srv - ok

11:02:37.0554 4824 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

11:02:37.0597 4824 srv2 - ok

11:02:37.0624 4824 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

11:02:37.0711 4824 srvnet - ok

11:02:37.0780 4824 SSPORT (ef3458337d7341a05169cefc73709264) C:\Windows\system32\Drivers\SSPORT.sys

11:02:37.0877 4824 SSPORT ( UnsignedFile.Multi.Generic ) - warning

11:02:37.0877 4824 SSPORT - detected UnsignedFile.Multi.Generic (1)

11:02:37.0975 4824 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

11:02:37.0999 4824 swenum - ok

11:02:38.0121 4824 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

11:02:38.0163 4824 Symc8xx - ok

11:02:38.0200 4824 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

11:02:38.0245 4824 Sym_hi - ok

11:02:38.0333 4824 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

11:02:38.0367 4824 Sym_u3 - ok

11:02:38.0551 4824 Tcpip (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys

11:02:38.0651 4824 Tcpip - ok

11:02:38.0686 4824 Tcpip6 (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys

11:02:38.0728 4824 Tcpip6 - ok

11:02:38.0762 4824 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

11:02:38.0839 4824 tcpipreg - ok

11:02:38.0885 4824 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

11:02:38.0968 4824 TDPIPE - ok

11:02:39.0107 4824 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

11:02:39.0156 4824 TDTCP - ok

11:02:39.0215 4824 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

11:02:39.0308 4824 tdx - ok

11:02:39.0375 4824 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

11:02:39.0426 4824 TermDD - ok

11:02:39.0473 4824 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

11:02:39.0519 4824 tssecsrv - ok

11:02:39.0550 4824 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

11:02:39.0651 4824 tunmp - ok

11:02:39.0706 4824 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

11:02:39.0766 4824 tunnel - ok

11:02:39.0843 4824 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys

11:02:39.0903 4824 uagp35 - ok

11:02:39.0948 4824 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

11:02:39.0991 4824 udfs - ok

11:02:40.0015 4824 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

11:02:40.0067 4824 uliagpkx - ok

11:02:40.0171 4824 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

11:02:40.0286 4824 uliahci - ok

11:02:40.0311 4824 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

11:02:40.0348 4824 UlSata - ok

11:02:40.0371 4824 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

11:02:40.0408 4824 ulsata2 - ok

11:02:40.0436 4824 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

11:02:40.0509 4824 umbus - ok

11:02:40.0617 4824 USB28xxBGA (48bfa9c9145b7527aa8849c974756461) C:\Windows\system32\DRIVERS\emBDA.sys

11:02:40.0877 4824 USB28xxBGA - ok

11:02:40.0921 4824 USB28xxOEM (9053737716744587b748cf7aaa424758) C:\Windows\system32\DRIVERS\emOEM.sys

11:02:40.0978 4824 USB28xxOEM - ok

11:02:41.0047 4824 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\Windows\system32\Drivers\usbaapl.sys

11:02:41.0140 4824 USBAAPL - ok

11:02:41.0186 4824 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys

11:02:41.0273 4824 usbaudio - ok

11:02:41.0369 4824 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

11:02:41.0453 4824 usbccgp - ok

11:02:41.0488 4824 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

11:02:41.0587 4824 usbcir - ok

11:02:41.0608 4824 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

11:02:41.0663 4824 usbehci - ok

11:02:41.0699 4824 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

11:02:41.0763 4824 usbhub - ok

11:02:41.0788 4824 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys

11:02:41.0837 4824 usbohci - ok

11:02:41.0861 4824 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

11:02:41.0943 4824 usbprint - ok

11:02:41.0974 4824 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys

11:02:42.0025 4824 usbscan - ok

11:02:42.0033 4824 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

11:02:42.0099 4824 USBSTOR - ok

11:02:42.0133 4824 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

11:02:42.0171 4824 usbuhci - ok

11:02:42.0210 4824 usbvideo (0a6b81f01bc86399482e27e6fda7b33b) C:\Windows\system32\Drivers\usbvideo.sys

11:02:42.0305 4824 usbvideo - ok

11:02:42.0487 4824 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

11:02:42.0549 4824 vga - ok

11:02:42.0685 4824 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

11:02:42.0735 4824 VgaSave - ok

11:02:42.0770 4824 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

11:02:42.0817 4824 viaagp - ok

11:02:42.0834 4824 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

11:02:42.0925 4824 ViaC7 - ok

11:02:42.0967 4824 viaide (58c8d5ac5c3eef40e7e704a5ced7987d) C:\Windows\system32\drivers\viaide.sys

11:02:43.0010 4824 viaide - ok

11:02:43.0068 4824 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

11:02:43.0115 4824 volmgr - ok

11:02:43.0268 4824 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

11:02:43.0313 4824 volmgrx - ok

11:02:43.0352 4824 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

11:02:43.0399 4824 volsnap - ok

11:02:43.0440 4824 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

11:02:43.0502 4824 vsmraid - ok

11:02:43.0543 4824 VSTHWBS2 (c466021d31ff6c0a6069d12299d80c0b) C:\Windows\system32\DRIVERS\VSTBS23.SYS

11:02:43.0629 4824 VSTHWBS2 - ok

11:02:43.0670 4824 VST_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS

11:02:43.0758 4824 VST_DPV - ok

11:02:43.0819 4824 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

11:02:43.0878 4824 WacomPen - ok

11:02:43.0920 4824 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

11:02:44.0003 4824 Wanarp - ok

11:02:44.0007 4824 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

11:02:44.0048 4824 Wanarpv6 - ok

11:02:44.0073 4824 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

11:02:44.0101 4824 Wd - ok

11:02:44.0146 4824 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys

11:02:44.0236 4824 Wdf01000 - ok

11:02:44.0291 4824 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS

11:02:44.0388 4824 winachsf - ok

11:02:44.0459 4824 WinUsb (676f4b665bdd8053eaa53ac1695b8074) C:\Windows\system32\DRIVERS\WinUSB.SYS

11:02:44.0521 4824 WinUsb - ok

11:02:44.0559 4824 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys

11:02:44.0613 4824 WmiAcpi - ok

11:02:44.0746 4824 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

11:02:44.0810 4824 WpdUsb - ok

11:02:44.0880 4824 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

11:02:44.0937 4824 ws2ifsl - ok

11:02:44.0985 4824 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

11:02:45.0065 4824 WUDFRd - ok

11:02:45.0095 4824 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0

11:02:45.0235 4824 \Device\Harddisk0\DR0 ( TDSS File System ) - warning

11:02:45.0235 4824 \Device\Harddisk0\DR0 - detected TDSS File System (1)

11:02:45.0239 4824 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk5\DR5

11:02:45.0708 4824 \Device\Harddisk5\DR5 - ok

11:02:45.0728 4824 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk6\DR6

11:02:45.0845 4824 \Device\Harddisk6\DR6 - ok

11:02:45.0855 4824 Boot (0x1200) (72c9b9c4bb3bbf1d1f668a4fea4533af) \Device\Harddisk0\DR0\Partition0

11:02:45.0856 4824 \Device\Harddisk0\DR0\Partition0 - ok

11:02:45.0859 4824 Boot (0x1200) (1b3678f513eb38e152e46d7d2f1d7091) \Device\Harddisk5\DR5\Partition0

11:02:45.0860 4824 \Device\Harddisk5\DR5\Partition0 - ok

11:02:45.0863 4824 Boot (0x1200) (19270f5db212c5652859b65ba4ab0cb3) \Device\Harddisk6\DR6\Partition0

11:02:45.0864 4824 \Device\Harddisk6\DR6\Partition0 - ok

11:02:45.0864 4824 ============================================================

11:02:45.0864 4824 Scan finished

11:02:45.0864 4824 ============================================================

11:02:45.0872 5640 Detected object count: 7

11:02:45.0872 5640 Actual detected object count: 7

11:03:33.0049 5640 ASPI32 ( UnsignedFile.Multi.Generic ) - skipped by user

11:03:33.0049 5640 ASPI32 ( UnsignedFile.Multi.Generic ) - User select action: Skip

11:03:33.0050 5640 CVPNDRVA ( UnsignedFile.Multi.Generic ) - skipped by user

11:03:33.0050 5640 CVPNDRVA ( UnsignedFile.Multi.Generic ) - User select action: Skip

11:03:33.0051 5640 DgiVecp ( UnsignedFile.Multi.Generic ) - skipped by user

11:03:33.0051 5640 DgiVecp ( UnsignedFile.Multi.Generic ) - User select action: Skip

11:03:33.0052 5640 N5SG ( UnsignedFile.Multi.Generic ) - skipped by user

11:03:33.0052 5640 N5SG ( UnsignedFile.Multi.Generic ) - User select action: Skip

11:03:33.0053 5640 sptd ( LockedFile.Multi.Generic ) - skipped by user

11:03:33.0053 5640 sptd ( LockedFile.Multi.Generic ) - User select action: Skip

11:03:33.0054 5640 SSPORT ( UnsignedFile.Multi.Generic ) - skipped by user

11:03:33.0054 5640 SSPORT ( UnsignedFile.Multi.Generic ) - User select action: Skip

11:03:33.0055 5640 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user

11:03:33.0055 5640 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

11:03:48.0518 4108 Deinitialize success

Larusso · February 8, 2012

Thanks

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Execute TDSSKiller.exe and press Start Scan.

Select Cure on this entry.
11:03:33.0055 5640 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user

Note: If Cure is not an option, Skip instead, do not choose Delete unless instructed
Click Continue then click Reboot now.

Once complete, a log will be produced at the root drive which is typically C:\

For example, C:\TDSSKiller.2.4.0.0_24.07.2010_13.10.52_log.txt.

Please post the contents of that log in your next reply.

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to this topic How to disable your security applications

====================================================

Double click on combofix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

*Note - if after running ComboFix you see a message similar to 'registry key marked for deletion..' rebooting the machine will resolve that.

Please post in your next reply

TDSSKiller Log

Combofix.txt

texaswilly · February 8, 2012

On TDSSKiller I was not given the option of cure, just Skip, Quarentine or Delete. Here are the logs:

08:38:35.0684 4856 TDSS rootkit removing tool 2.7.10.0 Feb 7 2012 15:14:46

08:38:36.0049 4856 ============================================================

08:38:36.0049 4856 Current date / time: 2012/02/08 08:38:36.0049

08:38:36.0049 4856 SystemInfo:

08:38:36.0049 4856

08:38:36.0049 4856 OS Version: 6.0.6002 ServicePack: 2.0

08:38:36.0049 4856 Product type: Workstation

08:38:36.0049 4856 ComputerName: HOMEOFFICE-PC

08:38:36.0049 4856 UserName: Willy

08:38:36.0049 4856 Windows directory: C:\Windows

08:38:36.0049 4856 System windows directory: C:\Windows

08:38:36.0049 4856 Processor architecture: Intel x86

08:38:36.0049 4856 Number of processors: 4

08:38:36.0049 4856 Page size: 0x1000

08:38:36.0049 4856 Boot type: Normal boot

08:38:36.0050 4856 ============================================================

08:38:38.0644 4856 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

08:38:38.0700 4856 Drive \Device\Harddisk5\DR5 - Size: 0x15D50D00000 (1397.26 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

08:38:38.0745 4856 Drive \Device\Harddisk6\DR6 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

08:38:38.0746 4856 \Device\Harddisk0\DR0:

08:38:38.0746 4856 MBR used

08:38:38.0746 4856 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800

08:38:38.0746 4856 \Device\Harddisk5\DR5:

08:38:38.0746 4856 MBR used

08:38:38.0746 4856 \Device\Harddisk5\DR5\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xAEA86000

08:38:38.0746 4856 \Device\Harddisk6\DR6:

08:38:38.0747 4856 MBR used

08:38:38.0747 4856 \Device\Harddisk6\DR6\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x575452C2

08:38:39.0285 4856 Initialize success

08:38:39.0285 4856 ============================================================

08:38:46.0662 4208 ============================================================

08:38:46.0663 4208 Scan started

08:38:46.0663 4208 Mode: Manual; SigCheck; TDLFS;

08:38:46.0663 4208 ============================================================

08:38:48.0269 4208 61883 (585e64bb6dfbc0a2f1f0b554ded012df) C:\Windows\system32\DRIVERS\61883.sys

08:38:48.0591 4208 61883 - ok

08:38:48.0772 4208 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

08:38:48.0801 4208 ACPI - ok

08:38:48.0894 4208 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

08:38:49.0015 4208 adp94xx - ok

08:38:49.0058 4208 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

08:38:49.0182 4208 adpahci - ok

08:38:49.0211 4208 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

08:38:49.0260 4208 adpu160m - ok

08:38:49.0339 4208 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

08:38:49.0393 4208 adpu320 - ok

08:38:49.0442 4208 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\Windows\system32\drivers\Afc.sys

08:38:49.0490 4208 Afc - ok

08:38:49.0569 4208 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

08:38:49.0664 4208 AFD - ok

08:38:49.0689 4208 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys

08:38:49.0737 4208 agp440 - ok

08:38:49.0772 4208 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

08:38:49.0814 4208 aic78xx - ok

08:38:49.0850 4208 aliide (3a99cb23a2d326fd532618705d6e3048) C:\Windows\system32\drivers\aliide.sys

08:38:49.0871 4208 aliide - ok

08:38:49.0911 4208 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

08:38:49.0957 4208 amdagp - ok

08:38:49.0992 4208 amdide (4333c133dbd71c7d7fe4fb1b83f9ee3e) C:\Windows\system32\drivers\amdide.sys

08:38:50.0023 4208 amdide - ok

08:38:50.0055 4208 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

08:38:50.0236 4208 AmdK7 - ok

08:38:50.0295 4208 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys

08:38:50.0399 4208 AmdK8 - ok

08:38:50.0464 4208 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

08:38:50.0506 4208 arc - ok

08:38:50.0536 4208 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

08:38:50.0585 4208 arcsas - ok

08:38:50.0657 4208 ASPI32 (b979979ab8027f7f53fb16ec4229b7db) C:\Windows\system32\drivers\ASPI32.sys

08:38:50.0731 4208 ASPI32 ( UnsignedFile.Multi.Generic ) - warning

08:38:50.0731 4208 ASPI32 - detected UnsignedFile.Multi.Generic (1)

08:38:50.0764 4208 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

08:38:50.0823 4208 AsyncMac - ok

08:38:50.0881 4208 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

08:38:50.0902 4208 atapi - ok

08:38:51.0069 4208 atikmdag (e615e3c567fbd10121723eff09d26b00) C:\Windows\system32\DRIVERS\atikmdag.sys

08:38:51.0230 4208 atikmdag - ok

08:38:51.0264 4208 Avc (f4b56425a00beb32f5fa6603ff7b0ea2) C:\Windows\system32\DRIVERS\avc.sys

08:38:51.0360 4208 Avc - ok

08:38:51.0410 4208 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

08:38:51.0480 4208 Beep - ok

08:38:51.0490 4208 blbdrive - ok

08:38:51.0576 4208 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

08:38:51.0699 4208 bowser - ok

08:38:51.0739 4208 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

08:38:51.0928 4208 BrFiltLo - ok

08:38:51.0947 4208 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

08:38:51.0981 4208 BrFiltUp - ok

08:38:52.0057 4208 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

08:38:52.0227 4208 Brserid - ok

08:38:52.0334 4208 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

08:38:52.0434 4208 BrSerWdm - ok

08:38:52.0475 4208 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

08:38:52.0580 4208 BrUsbMdm - ok

08:38:52.0602 4208 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

08:38:52.0688 4208 BrUsbSer - ok

08:38:52.0717 4208 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

08:38:52.0809 4208 BTHMODEM - ok

08:38:52.0862 4208 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

08:38:52.0984 4208 cdfs - ok

08:38:53.0049 4208 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

08:38:53.0148 4208 cdrom - ok

08:38:53.0181 4208 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

08:38:53.0262 4208 circlass - ok

08:38:53.0311 4208 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

08:38:53.0342 4208 CLFS - ok

08:38:53.0404 4208 cmdide (dfb94a6fc3a26972b0461ab5f1d8272b) C:\Windows\system32\drivers\cmdide.sys

08:38:53.0448 4208 cmdide - ok

08:38:53.0519 4208 Compbatt (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys

08:38:53.0560 4208 Compbatt - ok

08:38:53.0604 4208 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

08:38:53.0621 4208 crcdisk - ok

08:38:53.0639 4208 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

08:38:53.0725 4208 Crusoe - ok

08:38:54.0009 4208 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys

08:38:54.0119 4208 CVirtA - ok

08:38:54.0396 4208 CVPNDRVA (18994842386fd3039279d7865740abbd) C:\Windows\system32\Drivers\CVPNDRVA.sys

08:38:54.0468 4208 CVPNDRVA ( UnsignedFile.Multi.Generic ) - warning

08:38:54.0468 4208 CVPNDRVA - detected UnsignedFile.Multi.Generic (1)

08:38:54.0491 4208 dbhjcjpf - ok

08:38:54.0574 4208 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

08:38:54.0682 4208 DfsC - ok

08:38:54.0873 4208 DgiVecp (770471de2550820feeb7e5d24bf2e273) C:\Windows\system32\Drivers\DgiVecp.sys

08:38:54.0957 4208 DgiVecp ( UnsignedFile.Multi.Generic ) - warning

08:38:54.0957 4208 DgiVecp - detected UnsignedFile.Multi.Generic (1)

08:38:55.0025 4208 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

08:38:55.0055 4208 disk - ok

08:38:55.0126 4208 DNE (b5aa5aa5ac327bd7c1aec0c58f0c1144) C:\Windows\system32\DRIVERS\dne2000.sys

08:38:55.0143 4208 DNE - ok

08:38:55.0224 4208 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

08:38:55.0324 4208 drmkaud - ok

08:38:55.0431 4208 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

08:38:55.0584 4208 DXGKrnl - ok

08:38:55.0660 4208 e1express (04944f4fc4f0477185f5d26ae0ddb90e) C:\Windows\system32\DRIVERS\e1e6032.sys

08:38:55.0757 4208 e1express - ok

08:38:55.0867 4208 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

08:38:56.0033 4208 E1G60 - ok

08:38:56.0141 4208 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

08:38:56.0174 4208 Ecache - ok

08:38:56.0218 4208 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

08:38:56.0269 4208 elxstor - ok

08:38:56.0346 4208 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

08:38:56.0441 4208 exfat - ok

08:38:56.0458 4208 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

08:38:56.0538 4208 fastfat - ok

08:38:56.0599 4208 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

08:38:56.0688 4208 fdc - ok

08:38:56.0715 4208 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

08:38:56.0724 4208 FileInfo - ok

08:38:56.0794 4208 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

08:38:56.0900 4208 Filetrace - ok

08:38:56.0947 4208 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

08:38:57.0019 4208 flpydisk - ok

08:38:57.0125 4208 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

08:38:57.0151 4208 FltMgr - ok

08:38:57.0190 4208 FlyUsb (85e5ad3a9d56fd6f92db5fc9ca62e2e4) C:\Windows\system32\DRIVERS\FlyUsb.sys

08:38:57.0287 4208 FlyUsb - ok

08:38:57.0362 4208 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys

08:38:57.0448 4208 fssfltr - ok

08:38:57.0486 4208 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

08:38:57.0521 4208 Fs_Rec - ok

08:38:57.0540 4208 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

08:38:57.0589 4208 gagp30kx - ok

08:38:57.0621 4208 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

08:38:57.0658 4208 GEARAspiWDM - ok

08:38:57.0729 4208 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys

08:38:57.0864 4208 HdAudAddService - ok

08:38:58.0037 4208 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

08:38:58.0127 4208 HDAudBus - ok

08:38:58.0170 4208 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

08:38:58.0220 4208 HidBth - ok

08:38:58.0237 4208 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

08:38:58.0344 4208 HidIr - ok

08:38:58.0366 4208 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

08:38:58.0442 4208 HidUsb - ok

08:38:58.0457 4208 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

08:38:58.0489 4208 HpCISSs - ok

08:38:58.0617 4208 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

08:38:58.0729 4208 HTTP - ok

08:38:58.0781 4208 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

08:38:58.0811 4208 i2omp - ok

08:38:58.0842 4208 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

08:38:58.0900 4208 i8042prt - ok

08:38:59.0000 4208 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

08:38:59.0063 4208 iaStorV - ok

08:38:59.0079 4208 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

08:38:59.0109 4208 iirsp - ok

08:38:59.0203 4208 intelide (1c60617d54bc9f035671a44b75d9f7cc) C:\Windows\system32\drivers\intelide.sys

08:38:59.0236 4208 intelide - ok

08:38:59.0344 4208 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

08:38:59.0414 4208 intelppm - ok

08:38:59.0466 4208 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

08:38:59.0529 4208 IpFilterDriver - ok

08:38:59.0548 4208 IpInIp - ok

08:38:59.0606 4208 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

08:38:59.0720 4208 IPMIDRV - ok

08:38:59.0781 4208 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

08:38:59.0826 4208 IPNAT - ok

08:38:59.0880 4208 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

08:38:59.0947 4208 IRENUM - ok

08:38:59.0984 4208 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

08:39:00.0024 4208 isapnp - ok

08:39:00.0206 4208 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

08:39:00.0229 4208 iScsiPrt - ok

08:39:00.0345 4208 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

08:39:00.0379 4208 iteatapi - ok

08:39:00.0442 4208 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

08:39:00.0481 4208 iteraid - ok

08:39:00.0518 4208 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

08:39:00.0555 4208 kbdclass - ok

08:39:00.0622 4208 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

08:39:00.0694 4208 kbdhid - ok

08:39:00.0790 4208 KSecDD (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys

08:39:00.0820 4208 KSecDD - ok

08:39:00.0882 4208 LHidFilt (8b30311241f97b35167afe68d79e8530) C:\Windows\system32\DRIVERS\LHidFilt.Sys

08:39:00.0924 4208 LHidFilt - ok

08:39:00.0968 4208 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

08:39:01.0028 4208 lltdio - ok

08:39:01.0059 4208 LMouFilt (48d7422a6c4eec886b56ac534cfa3acf) C:\Windows\system32\DRIVERS\LMouFilt.Sys

08:39:01.0095 4208 LMouFilt - ok

08:39:01.0124 4208 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

08:39:01.0168 4208 LSI_FC - ok

08:39:01.0262 4208 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

08:39:01.0311 4208 LSI_SAS - ok

08:39:01.0341 4208 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

08:39:01.0397 4208 LSI_SCSI - ok

08:39:01.0433 4208 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

08:39:01.0529 4208 luafv - ok

08:39:01.0557 4208 LVPr2Mon (8be71d7edb8c7494913722059f760dd0) C:\Windows\system32\Drivers\LVPr2Mon.sys

08:39:01.0592 4208 LVPr2Mon - ok

08:39:01.0657 4208 LVRS (7521c0c58ee91be90b6cc33e792d10c7) C:\Windows\system32\DRIVERS\lvrs.sys

08:39:01.0720 4208 LVRS - ok

08:39:01.0775 4208 LVUSBSta (5f987fc1aad215ec2c60cf07719b1cce) C:\Windows\system32\drivers\LVUSBSta.sys

08:39:01.0842 4208 LVUSBSta - ok

08:39:01.0961 4208 LVUVC (37e57c48af530df01cdd4e8a2ad77b51) C:\Windows\system32\DRIVERS\lvuvc.sys

08:39:02.0145 4208 LVUVC - ok

08:39:02.0209 4208 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys

08:39:02.0230 4208 MBAMProtector - ok

08:39:02.0337 4208 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

08:39:02.0368 4208 megasas - ok

08:39:02.0398 4208 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

08:39:02.0479 4208 Modem - ok

08:39:02.0704 4208 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

08:39:02.0757 4208 monitor - ok

08:39:02.0873 4208 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

08:39:02.0902 4208 mouclass - ok

08:39:02.0936 4208 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

08:39:03.0002 4208 mouhid - ok

08:39:03.0083 4208 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

08:39:03.0110 4208 MountMgr - ok

08:39:03.0174 4208 MpFilter (356842aac621ab40f18992c01a590f71) C:\Windows\system32\DRIVERS\MpFilter.sys

08:39:03.0204 4208 MpFilter - ok

08:39:03.0281 4208 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

08:39:03.0339 4208 mpio - ok

08:39:03.0370 4208 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

08:39:03.0432 4208 mpsdrv - ok

08:39:03.0466 4208 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

08:39:03.0494 4208 Mraid35x - ok

08:39:03.0562 4208 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

08:39:03.0712 4208 MRxDAV - ok

08:39:03.0776 4208 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

08:39:03.0900 4208 mrxsmb - ok

08:39:03.0959 4208 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys

08:39:04.0030 4208 mrxsmb10 - ok

08:39:04.0051 4208 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

08:39:04.0142 4208 mrxsmb20 - ok

08:39:04.0186 4208 msahci (f0ec3a4e0693a34b148723b4da31668c) C:\Windows\system32\drivers\msahci.sys

08:39:04.0204 4208 msahci - ok

08:39:04.0232 4208 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

08:39:04.0289 4208 msdsm - ok

08:39:04.0332 4208 MSDV (343291a4dfd7c923c3f71f550830ec1c) C:\Windows\system32\DRIVERS\msdv.sys

08:39:04.0418 4208 MSDV - ok

08:39:04.0445 4208 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

08:39:04.0519 4208 Msfs - ok

08:39:04.0539 4208 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

08:39:04.0547 4208 msisadrv - ok

08:39:04.0566 4208 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

08:39:04.0695 4208 MSKSSRV - ok

08:39:04.0718 4208 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

08:39:04.0745 4208 MSPCLOCK - ok

08:39:04.0765 4208 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

08:39:04.0793 4208 MSPQM - ok

08:39:04.0851 4208 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

08:39:04.0902 4208 MsRPC - ok

08:39:04.0938 4208 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

08:39:04.0961 4208 mssmbios - ok

08:39:04.0979 4208 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

08:39:05.0038 4208 MSTEE - ok

08:39:05.0046 4208 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

08:39:05.0074 4208 Mup - ok

08:39:05.0116 4208 N5SG (77dad453144952e7cec56ac6e2061fd7) C:\Windows\system32\DRIVERS\N5SG.sys

08:39:05.0160 4208 N5SG ( UnsignedFile.Multi.Generic ) - warning

08:39:05.0160 4208 N5SG - detected UnsignedFile.Multi.Generic (1)

08:39:05.0236 4208 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

08:39:05.0299 4208 NativeWifiP - ok

08:39:05.0373 4208 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

08:39:05.0408 4208 NDIS - ok

08:39:05.0471 4208 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

08:39:05.0515 4208 NdisTapi - ok

08:39:05.0541 4208 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

08:39:05.0614 4208 Ndisuio - ok

08:39:05.0644 4208 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

08:39:05.0725 4208 NdisWan - ok

08:39:05.0769 4208 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

08:39:05.0855 4208 NDProxy - ok

08:39:05.0877 4208 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

08:39:05.0978 4208 NetBIOS - ok

08:39:06.0016 4208 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

08:39:06.0095 4208 netbt - ok

08:39:06.0133 4208 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

08:39:06.0172 4208 nfrd960 - ok

08:39:06.0181 4208 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

08:39:06.0231 4208 Npfs - ok

08:39:06.0240 4208 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

08:39:06.0282 4208 nsiproxy - ok

08:39:06.0360 4208 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

08:39:06.0566 4208 Ntfs - ok

08:39:06.0606 4208 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

08:39:06.0684 4208 ntrigdigi - ok

08:39:06.0717 4208 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

08:39:06.0746 4208 Null - ok

08:39:06.0782 4208 nvraid (6f785db62a6d8f3fafd3e5695277e849) C:\Windows\system32\drivers\nvraid.sys

08:39:06.0862 4208 nvraid - ok

08:39:06.0886 4208 nvstor (4a5fcab82d9bf6af8a023a66802fe9e9) C:\Windows\system32\drivers\nvstor.sys

08:39:06.0969 4208 nvstor - ok

08:39:06.0996 4208 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

08:39:07.0030 4208 nv_agp - ok

08:39:07.0036 4208 NwlnkFlt - ok

08:39:07.0045 4208 NwlnkFwd - ok

08:39:07.0089 4208 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

08:39:07.0177 4208 ohci1394 - ok

08:39:07.0186 4208 OMCI - ok

08:39:07.0255 4208 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

08:39:07.0362 4208 Parport - ok

08:39:07.0405 4208 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

08:39:07.0435 4208 partmgr - ok

08:39:07.0464 4208 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

08:39:07.0518 4208 Parvdm - ok

08:39:07.0575 4208 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

08:39:07.0598 4208 pci - ok

08:39:07.0623 4208 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys

08:39:07.0640 4208 pciide - ok

08:39:07.0681 4208 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

08:39:07.0716 4208 pcmcia - ok

08:39:07.0775 4208 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\Windows\system32\Drivers\pcouffin.sys

08:39:07.0829 4208 pcouffin - ok

08:39:07.0954 4208 PdiPorts (18ed1d71fef6f71d38c24263500bbd01) C:\Windows\system32\Drivers\PdiPorts.sys

08:39:07.0984 4208 PdiPorts - ok

08:39:08.0020 4208 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

08:39:08.0147 4208 PEAUTH - ok

08:39:08.0201 4208 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

08:39:08.0302 4208 PptpMiniport - ok

08:39:08.0347 4208 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

08:39:08.0423 4208 Processor - ok

08:39:08.0465 4208 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

08:39:08.0566 4208 PSched - ok

08:39:08.0589 4208 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\Windows\system32\Drivers\PxHelp20.sys

08:39:08.0615 4208 PxHelp20 - ok

08:39:08.0657 4208 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

08:39:08.0742 4208 ql2300 - ok

08:39:08.0786 4208 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

08:39:08.0855 4208 ql40xx - ok

08:39:08.0901 4208 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

08:39:08.0988 4208 QWAVEdrv - ok

08:39:09.0048 4208 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

08:39:09.0089 4208 RasAcd - ok

08:39:09.0099 4208 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

08:39:09.0185 4208 Rasl2tp - ok

08:39:09.0242 4208 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

08:39:09.0292 4208 RasPppoe - ok

08:39:09.0300 4208 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

08:39:09.0403 4208 RasSstp - ok

08:39:09.0451 4208 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

08:39:09.0523 4208 rdbss - ok

08:39:09.0531 4208 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

08:39:09.0558 4208 RDPCDD - ok

08:39:09.0585 4208 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

08:39:09.0673 4208 rdpdr - ok

08:39:09.0691 4208 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

08:39:09.0719 4208 RDPENCDD - ok

08:39:09.0757 4208 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

08:39:09.0860 4208 RDPWD - ok

08:39:09.0925 4208 RimUsb (616eac1b0e48b236a5a9b8ae07fdb81c) C:\Windows\system32\Drivers\RimUsb.sys

08:39:10.0007 4208 RimUsb - ok

08:39:10.0051 4208 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys

08:39:10.0123 4208 RimVSerPort - ok

08:39:10.0174 4208 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys

08:39:10.0202 4208 ROOTMODEM - ok

08:39:10.0241 4208 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

08:39:10.0309 4208 rspndr - ok

08:39:10.0342 4208 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

08:39:10.0399 4208 sbp2port - ok

08:39:10.0430 4208 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

08:39:10.0498 4208 secdrv - ok

08:39:10.0546 4208 Sentinel (a2cc81c30bef6ac9f27055490eef6de3) C:\Windows\System32\Drivers\SENTINEL.SYS

08:39:10.0783 4208 Sentinel - ok

08:39:10.0914 4208 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

08:39:11.0003 4208 Serenum - ok

08:39:11.0027 4208 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

08:39:11.0095 4208 Serial - ok

08:39:11.0133 4208 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

08:39:11.0214 4208 sermouse - ok

08:39:11.0255 4208 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys

08:39:11.0315 4208 sffdisk - ok

08:39:11.0352 4208 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

08:39:11.0432 4208 sffp_mmc - ok

08:39:11.0489 4208 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys

08:39:11.0570 4208 sffp_sd - ok

08:39:11.0601 4208 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

08:39:11.0669 4208 sfloppy - ok

08:39:11.0700 4208 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys

08:39:11.0727 4208 sisagp - ok

08:39:11.0751 4208 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

08:39:11.0781 4208 SiSRaid2 - ok

08:39:11.0798 4208 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

08:39:11.0843 4208 SiSRaid4 - ok

08:39:11.0888 4208 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

08:39:11.0959 4208 Smb - ok

08:39:12.0007 4208 SNTNLUSB (ce724fc3ef8468bbab146ca1793c66dc) C:\Windows\system32\DRIVERS\SNTNLUSB.SYS

08:39:12.0045 4208 SNTNLUSB - ok

08:39:12.0074 4208 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

08:39:12.0091 4208 spldr - ok

08:39:12.0194 4208 sptd (d15da1ba189770d93eea2d7e18f95af9) C:\Windows\System32\Drivers\sptd.sys

08:39:13.0876 4208 sptd - ok

08:39:13.0915 4208 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

08:39:14.0007 4208 srv - ok

08:39:14.0049 4208 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

08:39:14.0124 4208 srv2 - ok

08:39:14.0169 4208 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

08:39:14.0222 4208 srvnet - ok

08:39:14.0259 4208 SSPORT (ef3458337d7341a05169cefc73709264) C:\Windows\system32\Drivers\SSPORT.sys

08:39:14.0281 4208 SSPORT ( UnsignedFile.Multi.Generic ) - warning

08:39:14.0281 4208 SSPORT - detected UnsignedFile.Multi.Generic (1)

08:39:14.0330 4208 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

08:39:14.0347 4208 swenum - ok

08:39:14.0373 4208 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

08:39:14.0404 4208 Symc8xx - ok

08:39:14.0419 4208 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

08:39:14.0449 4208 Sym_hi - ok

08:39:14.0475 4208 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

08:39:14.0507 4208 Sym_u3 - ok

08:39:14.0566 4208 Tcpip (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys

08:39:14.0664 4208 Tcpip - ok

08:39:14.0718 4208 Tcpip6 (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys

08:39:14.0760 4208 Tcpip6 - ok

08:39:14.0793 4208 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

08:39:14.0827 4208 tcpipreg - ok

08:39:14.0887 4208 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

08:39:14.0956 4208 TDPIPE - ok

08:39:14.0979 4208 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

08:39:15.0027 4208 TDTCP - ok

08:39:15.0072 4208 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

08:39:15.0162 4208 tdx - ok

08:39:15.0179 4208 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

08:39:15.0230 4208 TermDD - ok

08:39:15.0264 4208 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

08:39:15.0308 4208 tssecsrv - ok

08:39:15.0340 4208 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

08:39:15.0420 4208 tunmp - ok

08:39:15.0463 4208 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

08:39:15.0521 4208 tunnel - ok

08:39:15.0557 4208 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys

08:39:15.0603 4208 uagp35 - ok

08:39:15.0630 4208 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

08:39:15.0670 4208 udfs - ok

08:39:15.0703 4208 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

08:39:15.0756 4208 uliagpkx - ok

08:39:15.0793 4208 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

08:39:15.0884 4208 uliahci - ok

08:39:15.0914 4208 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

08:39:15.0943 4208 UlSata - ok

08:39:15.0966 4208 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

08:39:15.0998 4208 ulsata2 - ok

08:39:16.0035 4208 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

08:39:16.0141 4208 umbus - ok

08:39:16.0224 4208 USB28xxBGA (48bfa9c9145b7527aa8849c974756461) C:\Windows\system32\DRIVERS\emBDA.sys

08:39:16.0362 4208 USB28xxBGA - ok

08:39:16.0430 4208 USB28xxOEM (9053737716744587b748cf7aaa424758) C:\Windows\system32\DRIVERS\emOEM.sys

08:39:16.0485 4208 USB28xxOEM - ok

08:39:16.0552 4208 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\Windows\system32\Drivers\usbaapl.sys

08:39:16.0678 4208 USBAAPL - ok

08:39:16.0718 4208 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys

08:39:16.0822 4208 usbaudio - ok

08:39:16.0855 4208 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

08:39:16.0974 4208 usbccgp - ok

08:39:17.0022 4208 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

08:39:17.0125 4208 usbcir - ok

08:39:17.0183 4208 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

08:39:17.0261 4208 usbehci - ok

08:39:17.0323 4208 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

08:39:17.0370 4208 usbhub - ok

08:39:17.0404 4208 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys

08:39:17.0447 4208 usbohci - ok

08:39:17.0474 4208 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

08:39:17.0537 4208 usbprint - ok

08:39:17.0564 4208 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys

08:39:17.0648 4208 usbscan - ok

08:39:17.0671 4208 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

08:39:17.0783 4208 USBSTOR - ok

08:39:17.0816 4208 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

08:39:17.0854 4208 usbuhci - ok

08:39:17.0880 4208 usbvideo (0a6b81f01bc86399482e27e6fda7b33b) C:\Windows\system32\Drivers\usbvideo.sys

08:39:17.0960 4208 usbvideo - ok

08:39:17.0988 4208 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

08:39:18.0047 4208 vga - ok

08:39:18.0067 4208 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

08:39:18.0122 4208 VgaSave - ok

08:39:18.0160 4208 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

08:39:18.0204 4208 viaagp - ok

08:39:18.0237 4208 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

08:39:18.0373 4208 ViaC7 - ok

08:39:18.0465 4208 viaide (58c8d5ac5c3eef40e7e704a5ced7987d) C:\Windows\system32\drivers\viaide.sys

08:39:18.0488 4208 viaide - ok

08:39:19.0463 4208 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

08:39:19.0493 4208 volmgr - ok

08:39:19.0560 4208 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

08:39:19.0587 4208 volmgrx - ok

08:39:19.0648 4208 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

08:39:19.0674 4208 volsnap - ok

08:39:19.0711 4208 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

08:39:19.0778 4208 vsmraid - ok

08:39:19.0819 4208 VSTHWBS2 (c466021d31ff6c0a6069d12299d80c0b) C:\Windows\system32\DRIVERS\VSTBS23.SYS

08:39:19.0906 4208 VSTHWBS2 - ok

08:39:19.0970 4208 VST_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS

08:39:20.0068 4208 VST_DPV - ok

08:39:20.0104 4208 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

08:39:20.0165 4208 WacomPen - ok

08:39:20.0216 4208 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

08:39:20.0315 4208 Wanarp - ok

08:39:20.0328 4208 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

08:39:20.0369 4208 Wanarpv6 - ok

08:39:20.0401 4208 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

08:39:20.0428 4208 Wd - ok

08:39:20.0525 4208 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys

08:39:20.0587 4208 Wdf01000 - ok

08:39:20.0661 4208 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS

08:39:20.0774 4208 winachsf - ok

08:39:20.0905 4208 WinUsb (676f4b665bdd8053eaa53ac1695b8074) C:\Windows\system32\DRIVERS\WinUSB.SYS

08:39:20.0983 4208 WinUsb - ok

08:39:21.0037 4208 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys

08:39:21.0090 4208 WmiAcpi - ok

08:39:21.0224 4208 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

08:39:21.0288 4208 WpdUsb - ok

08:39:21.0346 4208 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

08:39:21.0424 4208 ws2ifsl - ok

08:39:21.0481 4208 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

08:39:21.0558 4208 WUDFRd - ok

08:39:21.0591 4208 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0

08:39:21.0847 4208 \Device\Harddisk0\DR0 ( TDSS File System ) - warning

08:39:21.0847 4208 \Device\Harddisk0\DR0 - detected TDSS File System (1)

08:39:21.0851 4208 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk5\DR5

08:39:22.0324 4208 \Device\Harddisk5\DR5 - ok

08:39:22.0340 4208 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk6\DR6

08:39:22.0457 4208 \Device\Harddisk6\DR6 - ok

08:39:22.0485 4208 Boot (0x1200) (72c9b9c4bb3bbf1d1f668a4fea4533af) \Device\Harddisk0\DR0\Partition0

08:39:22.0486 4208 \Device\Harddisk0\DR0\Partition0 - ok

08:39:22.0488 4208 Boot (0x1200) (1b3678f513eb38e152e46d7d2f1d7091) \Device\Harddisk5\DR5\Partition0

08:39:22.0490 4208 \Device\Harddisk5\DR5\Partition0 - ok

08:39:22.0494 4208 Boot (0x1200) (19270f5db212c5652859b65ba4ab0cb3) \Device\Harddisk6\DR6\Partition0

08:39:22.0495 4208 \Device\Harddisk6\DR6\Partition0 - ok

08:39:22.0495 4208 ============================================================

08:39:22.0495 4208 Scan finished

08:39:22.0495 4208 ============================================================

08:39:22.0504 4352 Detected object count: 6

08:39:22.0504 4352 Actual detected object count: 6

08:39:53.0207 4352 ASPI32 ( UnsignedFile.Multi.Generic ) - skipped by user

08:39:53.0207 4352 ASPI32 ( UnsignedFile.Multi.Generic ) - User select action: Skip

08:39:53.0208 4352 CVPNDRVA ( UnsignedFile.Multi.Generic ) - skipped by user

08:39:53.0208 4352 CVPNDRVA ( UnsignedFile.Multi.Generic ) - User select action: Skip

08:39:53.0209 4352 DgiVecp ( UnsignedFile.Multi.Generic ) - skipped by user

08:39:53.0209 4352 DgiVecp ( UnsignedFile.Multi.Generic ) - User select action: Skip

08:39:53.0210 4352 N5SG ( UnsignedFile.Multi.Generic ) - skipped by user

08:39:53.0210 4352 N5SG ( UnsignedFile.Multi.Generic ) - User select action: Skip

08:39:53.0211 4352 SSPORT ( UnsignedFile.Multi.Generic ) - skipped by user

08:39:53.0211 4352 SSPORT ( UnsignedFile.Multi.Generic ) - User select action: Skip

08:39:53.0212 4352 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user

08:39:53.0212 4352 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

08:40:06.0768 4056 Deinitialize success

ComboFix 12-02-08.01 - Willy 02/08/2012 8:55.1.4 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3325.2066 [GMT -6:00]

Running from: c:\users\Willy\Desktop\ComboFix.exe

AV: Microsoft Forefront Client Security *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Forefront Client Security *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk

c:\programdata\SPL286D.tmp

c:\programdata\SPL5696.tmp

c:\programdata\SPL6141.tmp

c:\programdata\SPL8625.tmp

c:\programdata\SPLD5D4.tmp

c:\users\Willy\AppData\Roaming\inst.exe

c:\users\Willy\AppData\Roaming\Microsoft\Windows\Recent\ironcad.url

c:\users\Willy\g2mdlhlpx.exe

c:\windows\system32\regobj.dll

c:\windows\system32\setup.ini

c:\windows\system32\vs2005-kb908002-enu-x86.exe

c:\windows\system32\WindowsInstaller-KB893803-v2-x86.exe

M:\autorun.inf

.

((((((((((((((((((((((((( Files Created from 2012-01-08 to 2012-02-08 )))))))))))))))))))))))))))))))

.

2012-02-08 14:22 . 2012-01-06 04:19 6557240 ----a-w- c:\programdata\Microsoft\Microsoft Forefront\Client Security\Client\Antimalware\Definition Updates\{DF622446-0653-46DB-BF0D-CBB7518FA040}\mpengine.dll

2012-02-06 18:26 . 2012-02-06 18:27 -------- d-----w- c:\users\Darla.HomeOffice-PC\AppData\Roaming\my_app_files

2012-02-06 18:25 . 2012-02-06 18:25 -------- d-----w- c:\users\Darla.HomeOffice-PC\AppData\Roaming\BirthdayAdventure

2012-02-06 04:34 . 2012-02-06 04:34 -------- d-----w- c:\windows\CheckSur

2012-02-05 04:29 . 2011-11-16 16:23 377344 ----a-w- c:\windows\system32\winhttp.dll

2012-02-05 04:29 . 2011-11-16 16:23 72704 ----a-w- c:\windows\system32\secur32.dll

2012-02-05 04:29 . 2011-11-16 16:23 278528 ----a-w- c:\windows\system32\schannel.dll

2012-02-05 04:29 . 2011-11-17 06:48 440192 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2012-02-05 04:29 . 2011-11-16 16:21 1259008 ----a-w- c:\windows\system32\lsasrv.dll

2012-02-05 04:29 . 2011-11-16 14:12 9728 ----a-w- c:\windows\system32\lsass.exe

2012-02-05 04:17 . 2012-02-05 04:17 -------- d-----w- c:\programdata\NortonInstaller

2012-02-05 04:17 . 2012-02-05 04:17 -------- d-----w- c:\program files\NortonInstaller

2012-02-05 03:30 . 2012-02-05 03:31 -------- d-----w- c:\users\Willy\AppData\Roaming\my_app_files

2012-02-05 03:30 . 2012-02-05 03:30 -------- d-----w- c:\users\Willy\AppData\Roaming\BirthdayAdventure

2012-02-05 03:23 . 2012-02-05 03:26 -------- d-----w- c:\program files\Dora's Big Birthday Adventure

2012-02-04 16:50 . 2012-02-04 16:50 -------- d-----w- C:\TDSSKiller_Quarantine

2012-02-04 03:20 . 2012-02-04 03:20 -------- d-----w- c:\users\Darla.HomeOffice-PC\AppData\Roaming\Malwarebytes

2012-02-03 22:59 . 2012-02-03 22:59 -------- d-----w- c:\users\Willy\AppData\Roaming\Malwarebytes

2012-02-03 22:58 . 2012-02-03 22:58 -------- d-----w- c:\programdata\Malwarebytes

2012-02-03 22:58 . 2012-02-04 04:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-02-03 22:58 . 2011-12-10 21:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-02-03 02:57 . 2012-02-03 02:57 -------- d-----w- c:\windows\Microsoft Antimalware

2012-02-03 02:57 . 2012-02-03 02:57 -------- d-----w- c:\windows\Windows Defender Offline

2012-01-29 04:04 . 2012-01-29 04:04 -------- d-----w- c:\windows\Sun

2012-01-22 18:25 . 2012-01-22 18:25 -------- d-----w- c:\program files\iPod

2012-01-16 04:24 . 2012-01-16 04:24 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll

2012-01-16 04:24 . 2012-01-16 04:24 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll

2012-01-16 04:24 . 2012-01-16 04:24 43992 ----a-w- c:\program files\Mozilla Firefox\mozutils.dll

2012-01-16 04:24 . 2012-01-16 04:24 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll

2012-01-11 14:04 . 2011-10-14 16:03 189952 ----a-w- c:\windows\system32\winmm.dll

2012-01-11 14:04 . 2011-10-14 16:00 23552 ----a-w- c:\windows\system32\mciseq.dll

2012-01-11 14:04 . 2011-11-18 20:23 1205064 ----a-w- c:\windows\system32\ntdll.dll

2012-01-11 14:04 . 2011-11-18 17:47 66560 ----a-w- c:\windows\system32\packager.dll

2012-01-11 14:04 . 2011-11-25 15:59 376320 ----a-w- c:\windows\system32\winsrv.dll

2012-01-11 14:04 . 2011-12-01 15:21 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2012-01-11 14:04 . 2011-10-25 15:58 1314816 ----a-w- c:\windows\system32\quartz.dll

2012-01-11 14:04 . 2011-10-25 15:58 497152 ----a-w- c:\windows\system32\qdvd.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-31 12:44 . 2009-10-02 06:46 237072 ------w- c:\windows\system32\MpSigStub.exe

2012-01-06 04:19 . 2009-08-24 22:26 6557240 ----a-w- c:\programdata\Microsoft\Microsoft Forefront\Client Security\Client\Antimalware\Definition Updates\Backup\mpengine.dll

2011-11-23 13:37 . 2011-12-15 00:44 2043904 ----a-w- c:\windows\system32\win32k.sys

2011-11-18 03:31 . 2011-05-15 13:42 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-11 05:45 . 2011-11-11 05:45 53248 ----a-r- c:\users\Willy\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

2012-01-16 04:24 . 2011-03-25 07:54 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{f897eb0e-a3a4-46c3-80eb-2729699d8892}"= "c:\program files\SmileBox_EN\prxtbSmil.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{f897eb0e-a3a4-46c3-80eb-2729699d8892}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2010-05-26 20:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f897eb0e-a3a4-46c3-80eb-2729699d8892}]

2011-05-09 09:49 176936 ----a-w- c:\program files\SmileBox_EN\prxtbSmil.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

"{f897eb0e-a3a4-46c3-80eb-2729699d8892}"= "c:\program files\SmileBox_EN\prxtbSmil.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CLASSES_ROOT\clsid\{f897eb0e-a3a4-46c3-80eb-2729699d8892}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

"{F897EB0E-A3A4-46C3-80EB-2729699D8892}"= "c:\program files\SmileBox_EN\prxtbSmil.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CLASSES_ROOT\clsid\{f897eb0e-a3a4-46c3-80eb-2729699d8892}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\Willy\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\Willy\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\Willy\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-01-19 2736128]

"Logitech Vid"="c:\program files\Logitech\Vid HD\Vid.exe" [2011-06-02 6123032]

"Eye-Fi"="c:\program files\Eye-Fi\Helper\EyeFiHelper.exe" [2011-12-22 3961464]

"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"WifiMediaSync"="c:\program files\CCApps\Wifi Media Backup\Wifi Media Backup.exe" [2009-12-15 243200]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

"Xvid"="c:\program files\XviD\CheckUpdate.exe" [2011-01-17 8192]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]

"StxTrayMenu"="c:\program files\Seagate\SystemTray\FreeAgentLauncher.exe" [2007-01-18 79416]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]

"Microsoft Forefront Client Security Antimalware Service"="c:\program files\Microsoft Forefront\Client Security\Client\Antimalware\MSASCui.exe" [2011-02-02 1033600]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]

"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]

"Corel File Shell Monitor"="c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2007-10-31 16200]

"UVS12 Preload"="c:\program files\Corel\Corel VideoStudio 12\uvPL.exe" [2008-06-09 397456]

"Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2011-06-06 251744]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-18 180269]

"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]

"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-03 847872]

"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2012-01-03 36760]

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-01-03 815512]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]

"ArcSoft MediaImpression Monitor"="c:\program files\Kodak\MediaImpression\ArcMonitor.exe" [2010-11-12 73728]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]

.

c:\users\Darla.HomeOffice-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\users\Willy\AppData\Local\Temp\ONENOTEM.EXE [N/A]

.

c:\users\Willy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Willy\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-9-1 24183152]

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

VPN Client.lnk - c:\windows\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico [2011-5-2 6144]

Windchill ProductPoint Client Manager.lnk - c:\windows\Installer\{129024FF-A6C9-4696-91BC-570C6C05193A}\_F5BCEE176F60B4DABC6DF8.exe [2011-4-30 1406]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FCSAM]

@="Service"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]

backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk]

backup=c:\windows\pss\VPN Client.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]

2012-01-03 13:10 815512 ----a-w- c:\program files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]

2012-01-03 13:10 36760 ----a-w- c:\program files\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

2007-09-11 05:43 67488 ----a-w- c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-01-30 15:45 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2011-03-21 18:56 1230704 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT HPW]

2008-07-14 18:42 81920 ----a-w- c:\program files\Common Files\Portrait Displays\Shared\DT_Startup.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]

2008-01-19 07:33 125952 ----a-w- c:\windows\ehome\ehtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2010-06-16 02:07 136176 ----atw- c:\users\Willy\AppData\Local\Google\Update\GoogleUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iXL_MiddleWare]

2010-04-28 08:36 52280 ----a-w- c:\program files\Fisher-Price\iXL\iXL.Middleware.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PivotSoftware]

2007-02-09 17:17 694008 ----a-w- c:\program files\Portrait Displays\Pivot Software\wpCtrl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2009-05-18 12:42 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

.

S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2011-01-19 21:06 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

.

2012-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-12 15:01]

.

2012-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-12 15:01]

.

2012-02-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1986106255-517538349-219921657-1000Core.job

- c:\users\Willy\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-26 02:07]

.

2012-02-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1986106255-517538349-219921657-1000UA.job

- c:\users\Willy\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-26 02:07]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://home.mywebsearch.com/index.jhtml?ptnrS=ZKfox000&ptb=pCCxBptJsv9yBYOF_WrRcA

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

Trusted Zone: intuit.com\ttlc

TCP: DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1

FF - ProfilePath - c:\users\Willy\AppData\Roaming\Mozilla\Firefox\Profiles\dk6nrk6u.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:home

FF - user.js: yahoo.homepage.dontask - true

.

- - - - ORPHANS REMOVED - - - -

.

SafeBoot-SolutoService

AddRemove-_{91CABF8F-A81C-4CB0-A1B0-D55B25F1B150} - c:\program files\Corel\Corel Painter X\MSILauncher {91CABF8F-A81C-4CB0-A1B0-D55B25F1B150}

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-02-08 09:07

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Completion time: 2012-02-08 09:11:50

ComboFix-quarantined-files.txt 2012-02-08 15:11

.

Pre-Run: 680,351,715,328 bytes free

Post-Run: 680,265,707,520 bytes free

.

- - End Of File - - 7E74F40922E374C6727B48CC9B46FA3C

Larusso · February 8, 2012

Hy there, re run TDSSKiller and choose delete.

Open notepad and copy/paste the text in the Code-box below into it:


Folder::
c:\program files\Ask.com
DDS::
uStart Page = hxxp://home.mywebsearch.com/index.jhtml?ptnrS=ZKfox000&ptb=pCCxBptJsv9yBYOF_WrRcA

Save this as CFScript.txt, in the same location as ComboFix.exe.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Refering to the picture above, drag CFScript into ComboFix.exe.

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Please post in your next reply

TDSSKiller Log

Combofix.txt

Let me know how your system behaves now

texaswilly · February 9, 2012

It seems to be running normal after the last steps. The logs are below this paragraph as requested. I have a question, I noticed that you went after the "Ask" toolbar and directory, is Ask.com a bad website or was it just a conincidence that the files there had to be removed?

18:34:41.0369 4704 TDSS rootkit removing tool 2.7.10.0 Feb 7 2012 15:14:46

18:34:41.0739 4704 ============================================================

18:34:41.0739 4704 Current date / time: 2012/02/08 18:34:41.0739

18:34:41.0739 4704 SystemInfo:

18:34:41.0739 4704

18:34:41.0739 4704 OS Version: 6.0.6002 ServicePack: 2.0

18:34:41.0739 4704 Product type: Workstation

18:34:41.0740 4704 ComputerName: HOMEOFFICE-PC

18:34:41.0740 4704 UserName: Willy

18:34:41.0740 4704 Windows directory: C:\Windows

18:34:41.0740 4704 System windows directory: C:\Windows

18:34:41.0740 4704 Processor architecture: Intel x86

18:34:41.0740 4704 Number of processors: 4

18:34:41.0740 4704 Page size: 0x1000

18:34:41.0740 4704 Boot type: Normal boot

18:34:41.0740 4704 ============================================================

18:34:42.0687 4704 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

18:34:42.0725 4704 Drive \Device\Harddisk5\DR5 - Size: 0x15D50D00000 (1397.26 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

18:34:52.0767 4704 Drive \Device\Harddisk6\DR6 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

18:35:01.0941 4704 \Device\Harddisk0\DR0:

18:35:01.0941 4704 MBR used

18:35:01.0941 4704 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800

18:35:01.0941 4704 \Device\Harddisk5\DR5:

18:35:01.0941 4704 MBR used

18:35:01.0942 4704 \Device\Harddisk5\DR5\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xAEA86000

18:35:01.0942 4704 \Device\Harddisk6\DR6:

18:35:01.0942 4704 MBR used

18:35:01.0942 4704 \Device\Harddisk6\DR6\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x575452C2

18:35:02.0409 4704 Initialize success

18:35:02.0409 4704 ============================================================

18:35:10.0931 6136 ============================================================

18:35:10.0932 6136 Scan started

18:35:10.0932 6136 Mode: Manual; SigCheck; TDLFS;

18:35:10.0932 6136 ============================================================

18:35:12.0221 6136 61883 (585e64bb6dfbc0a2f1f0b554ded012df) C:\Windows\system32\DRIVERS\61883.sys

18:35:12.0434 6136 61883 - ok

18:35:12.0507 6136 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

18:35:12.0521 6136 ACPI - ok

18:35:12.0557 6136 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

18:35:12.0572 6136 adp94xx - ok

18:35:12.0603 6136 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

18:35:12.0614 6136 adpahci - ok

18:35:12.0633 6136 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

18:35:12.0641 6136 adpu160m - ok

18:35:12.0661 6136 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

18:35:12.0671 6136 adpu320 - ok

18:35:12.0699 6136 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\Windows\system32\drivers\Afc.sys

18:35:12.0751 6136 Afc - ok

18:35:12.0823 6136 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

18:35:12.0870 6136 AFD - ok

18:35:12.0896 6136 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys

18:35:12.0903 6136 agp440 - ok

18:35:12.0920 6136 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

18:35:12.0929 6136 aic78xx - ok

18:35:12.0965 6136 aliide (3a99cb23a2d326fd532618705d6e3048) C:\Windows\system32\drivers\aliide.sys

18:35:12.0973 6136 aliide - ok

18:35:12.0993 6136 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

18:35:13.0001 6136 amdagp - ok

18:35:13.0016 6136 amdide (4333c133dbd71c7d7fe4fb1b83f9ee3e) C:\Windows\system32\drivers\amdide.sys

18:35:13.0023 6136 amdide - ok

18:35:13.0037 6136 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

18:35:13.0186 6136 AmdK7 - ok

18:35:13.0228 6136 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys

18:35:13.0280 6136 AmdK8 - ok

18:35:13.0338 6136 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

18:35:13.0347 6136 arc - ok

18:35:13.0370 6136 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

18:35:13.0378 6136 arcsas - ok

18:35:13.0516 6136 ASPI32 (b979979ab8027f7f53fb16ec4229b7db) C:\Windows\system32\drivers\ASPI32.sys

18:35:13.0536 6136 ASPI32 ( UnsignedFile.Multi.Generic ) - warning

18:35:13.0536 6136 ASPI32 - detected UnsignedFile.Multi.Generic (1)

18:35:13.0564 6136 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

18:35:13.0584 6136 AsyncMac - ok

18:35:13.0623 6136 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

18:35:13.0632 6136 atapi - ok

18:35:13.0694 6136 atikmdag (e615e3c567fbd10121723eff09d26b00) C:\Windows\system32\DRIVERS\atikmdag.sys

18:35:13.0869 6136 atikmdag - ok

18:35:13.0890 6136 Avc (f4b56425a00beb32f5fa6603ff7b0ea2) C:\Windows\system32\DRIVERS\avc.sys

18:35:13.0930 6136 Avc - ok

18:35:13.0961 6136 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

18:35:13.0983 6136 Beep - ok

18:35:13.0992 6136 blbdrive - ok

18:35:14.0036 6136 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

18:35:14.0090 6136 bowser - ok

18:35:14.0108 6136 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

18:35:14.0158 6136 BrFiltLo - ok

18:35:14.0191 6136 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

18:35:14.0227 6136 BrFiltUp - ok

18:35:14.0260 6136 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

18:35:14.0297 6136 Brserid - ok

18:35:14.0313 6136 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

18:35:14.0367 6136 BrSerWdm - ok

18:35:14.0396 6136 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

18:35:14.0451 6136 BrUsbMdm - ok

18:35:14.0474 6136 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

18:35:14.0526 6136 BrUsbSer - ok

18:35:14.0555 6136 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

18:35:14.0607 6136 BTHMODEM - ok

18:35:14.0712 6136 catchme - ok

18:35:14.0733 6136 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

18:35:14.0775 6136 cdfs - ok

18:35:14.0837 6136 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

18:35:14.0854 6136 cdrom - ok

18:35:14.0870 6136 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

18:35:14.0906 6136 circlass - ok

18:35:14.0951 6136 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

18:35:14.0964 6136 CLFS - ok

18:35:15.0026 6136 cmdide (dfb94a6fc3a26972b0461ab5f1d8272b) C:\Windows\system32\drivers\cmdide.sys

18:35:15.0034 6136 cmdide - ok

18:35:15.0051 6136 Compbatt (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys

18:35:15.0058 6136 Compbatt - ok

18:35:15.0078 6136 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

18:35:15.0086 6136 crcdisk - ok

18:35:15.0105 6136 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

18:35:15.0164 6136 Crusoe - ok

18:35:15.0201 6136 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys

18:35:15.0235 6136 CVirtA - ok

18:35:15.0314 6136 CVPNDRVA (18994842386fd3039279d7865740abbd) C:\Windows\system32\Drivers\CVPNDRVA.sys

18:35:15.0349 6136 CVPNDRVA ( UnsignedFile.Multi.Generic ) - warning

18:35:15.0349 6136 CVPNDRVA - detected UnsignedFile.Multi.Generic (1)

18:35:15.0356 6136 dbhjcjpf - ok

18:35:15.0434 6136 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

18:35:15.0496 6136 DfsC - ok

18:35:15.0542 6136 DgiVecp (770471de2550820feeb7e5d24bf2e273) C:\Windows\system32\Drivers\DgiVecp.sys

18:35:15.0579 6136 DgiVecp ( UnsignedFile.Multi.Generic ) - warning

18:35:15.0579 6136 DgiVecp - detected UnsignedFile.Multi.Generic (1)

18:35:15.0610 6136 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

18:35:15.0619 6136 disk - ok

18:35:15.0656 6136 DNE (b5aa5aa5ac327bd7c1aec0c58f0c1144) C:\Windows\system32\DRIVERS\dne2000.sys

18:35:15.0664 6136 DNE - ok

18:35:15.0736 6136 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

18:35:15.0786 6136 drmkaud - ok

18:35:15.0860 6136 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

18:35:15.0884 6136 DXGKrnl - ok

18:35:15.0956 6136 e1express (04944f4fc4f0477185f5d26ae0ddb90e) C:\Windows\system32\DRIVERS\e1e6032.sys

18:35:15.0965 6136 e1express - ok

18:35:15.0997 6136 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

18:35:16.0055 6136 E1G60 - ok

18:35:16.0076 6136 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

18:35:16.0086 6136 Ecache - ok

18:35:16.0116 6136 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

18:35:16.0127 6136 elxstor - ok

18:35:16.0186 6136 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

18:35:16.0265 6136 exfat - ok

18:35:16.0289 6136 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

18:35:16.0342 6136 fastfat - ok

18:35:16.0381 6136 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

18:35:16.0436 6136 fdc - ok

18:35:16.0470 6136 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

18:35:16.0479 6136 FileInfo - ok

18:35:16.0501 6136 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

18:35:16.0521 6136 Filetrace - ok

18:35:16.0538 6136 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

18:35:16.0574 6136 flpydisk - ok

18:35:16.0592 6136 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

18:35:16.0603 6136 FltMgr - ok

18:35:16.0649 6136 FlyUsb (85e5ad3a9d56fd6f92db5fc9ca62e2e4) C:\Windows\system32\DRIVERS\FlyUsb.sys

18:35:16.0692 6136 FlyUsb - ok

18:35:16.0754 6136 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys

18:35:16.0762 6136 fssfltr - ok

18:35:16.0804 6136 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

18:35:16.0820 6136 Fs_Rec - ok

18:35:16.0841 6136 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

18:35:16.0849 6136 gagp30kx - ok

18:35:16.0872 6136 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

18:35:16.0878 6136 GEARAspiWDM - ok

18:35:16.0955 6136 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys

18:35:17.0012 6136 HdAudAddService - ok

18:35:17.0055 6136 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

18:35:17.0121 6136 HDAudBus - ok

18:35:17.0147 6136 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

18:35:17.0184 6136 HidBth - ok

18:35:17.0206 6136 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

18:35:17.0277 6136 HidIr - ok

18:35:17.0318 6136 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

18:35:17.0335 6136 HidUsb - ok

18:35:17.0360 6136 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

18:35:17.0368 6136 HpCISSs - ok

18:35:17.0403 6136 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

18:35:17.0492 6136 HTTP - ok

18:35:17.0518 6136 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

18:35:17.0526 6136 i2omp - ok

18:35:17.0554 6136 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

18:35:17.0571 6136 i8042prt - ok

18:35:17.0596 6136 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

18:35:17.0606 6136 iaStorV - ok

18:35:17.0625 6136 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

18:35:17.0633 6136 iirsp - ok

18:35:17.0666 6136 intelide (1c60617d54bc9f035671a44b75d9f7cc) C:\Windows\system32\drivers\intelide.sys

18:35:17.0674 6136 intelide - ok

18:35:17.0700 6136 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

18:35:17.0755 6136 intelppm - ok

18:35:17.0796 6136 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

18:35:17.0848 6136 IpFilterDriver - ok

18:35:17.0860 6136 IpInIp - ok

18:35:17.0895 6136 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

18:35:17.0965 6136 IPMIDRV - ok

18:35:17.0995 6136 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

18:35:18.0017 6136 IPNAT - ok

18:35:18.0044 6136 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

18:35:18.0065 6136 IRENUM - ok

18:35:18.0082 6136 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

18:35:18.0090 6136 isapnp - ok

18:35:18.0122 6136 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

18:35:18.0134 6136 iScsiPrt - ok

18:35:18.0145 6136 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

18:35:18.0153 6136 iteatapi - ok

18:35:18.0192 6136 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

18:35:18.0200 6136 iteraid - ok

18:35:18.0219 6136 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

18:35:18.0228 6136 kbdclass - ok

18:35:18.0264 6136 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

18:35:18.0316 6136 kbdhid - ok

18:35:18.0365 6136 KSecDD (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys

18:35:18.0382 6136 KSecDD - ok

18:35:18.0458 6136 LHidFilt (8b30311241f97b35167afe68d79e8530) C:\Windows\system32\DRIVERS\LHidFilt.Sys

18:35:18.0465 6136 LHidFilt - ok

18:35:18.0511 6136 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

18:35:18.0549 6136 lltdio - ok

18:35:18.0577 6136 LMouFilt (48d7422a6c4eec886b56ac534cfa3acf) C:\Windows\system32\DRIVERS\LMouFilt.Sys

18:35:18.0583 6136 LMouFilt - ok

18:35:18.0600 6136 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

18:35:18.0609 6136 LSI_FC - ok

18:35:18.0623 6136 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

18:35:18.0631 6136 LSI_SAS - ok

18:35:18.0652 6136 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

18:35:18.0661 6136 LSI_SCSI - ok

18:35:18.0686 6136 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

18:35:18.0723 6136 luafv - ok

18:35:18.0751 6136 LVPr2Mon (8be71d7edb8c7494913722059f760dd0) C:\Windows\system32\Drivers\LVPr2Mon.sys

18:35:18.0758 6136 LVPr2Mon - ok

18:35:18.0810 6136 LVRS (7521c0c58ee91be90b6cc33e792d10c7) C:\Windows\system32\DRIVERS\lvrs.sys

18:35:18.0824 6136 LVRS - ok

18:35:18.0878 6136 LVUSBSta (5f987fc1aad215ec2c60cf07719b1cce) C:\Windows\system32\drivers\LVUSBSta.sys

18:35:18.0885 6136 LVUSBSta - ok

18:35:18.0965 6136 LVUVC (37e57c48af530df01cdd4e8a2ad77b51) C:\Windows\system32\DRIVERS\lvuvc.sys

18:35:19.0073 6136 LVUVC - ok

18:35:19.0113 6136 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys

18:35:19.0120 6136 MBAMProtector - ok

18:35:19.0142 6136 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

18:35:19.0150 6136 megasas - ok

18:35:19.0194 6136 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

18:35:19.0236 6136 Modem - ok

18:35:19.0277 6136 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

18:35:19.0321 6136 monitor - ok

18:35:19.0362 6136 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

18:35:19.0371 6136 mouclass - ok

18:35:19.0384 6136 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

18:35:19.0404 6136 mouhid - ok

18:35:19.0431 6136 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

18:35:19.0440 6136 MountMgr - ok

18:35:19.0486 6136 MpFilter (356842aac621ab40f18992c01a590f71) C:\Windows\system32\DRIVERS\MpFilter.sys

18:35:19.0494 6136 MpFilter - ok

18:35:19.0530 6136 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

18:35:19.0540 6136 mpio - ok

18:35:19.0561 6136 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

18:35:19.0578 6136 mpsdrv - ok

18:35:19.0615 6136 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

18:35:19.0623 6136 Mraid35x - ok

18:35:19.0670 6136 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

18:35:19.0715 6136 MRxDAV - ok

18:35:19.0740 6136 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

18:35:19.0802 6136 mrxsmb - ok

18:35:19.0852 6136 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys

18:35:19.0865 6136 mrxsmb10 - ok

18:35:19.0873 6136 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

18:35:19.0918 6136 mrxsmb20 - ok

18:35:19.0987 6136 msahci (f0ec3a4e0693a34b148723b4da31668c) C:\Windows\system32\drivers\msahci.sys

18:35:19.0995 6136 msahci - ok

18:35:20.0017 6136 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

18:35:20.0026 6136 msdsm - ok

18:35:20.0067 6136 MSDV (343291a4dfd7c923c3f71f550830ec1c) C:\Windows\system32\DRIVERS\msdv.sys

18:35:20.0123 6136 MSDV - ok

18:35:20.0163 6136 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

18:35:20.0184 6136 Msfs - ok

18:35:20.0216 6136 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

18:35:20.0224 6136 msisadrv - ok

18:35:20.0243 6136 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

18:35:20.0297 6136 MSKSSRV - ok

18:35:20.0320 6136 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

18:35:20.0341 6136 MSPCLOCK - ok

18:35:20.0359 6136 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

18:35:20.0381 6136 MSPQM - ok

18:35:20.0405 6136 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

18:35:20.0417 6136 MsRPC - ok

18:35:20.0458 6136 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

18:35:20.0466 6136 mssmbios - ok

18:35:20.0482 6136 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

18:35:20.0524 6136 MSTEE - ok

18:35:20.0544 6136 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

18:35:20.0554 6136 Mup - ok

18:35:20.0603 6136 N5SG (77dad453144952e7cec56ac6e2061fd7) C:\Windows\system32\DRIVERS\N5SG.sys

18:35:20.0643 6136 N5SG ( UnsignedFile.Multi.Generic ) - warning

18:35:20.0644 6136 N5SG - detected UnsignedFile.Multi.Generic (1)

18:35:20.0681 6136 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

18:35:20.0721 6136 NativeWifiP - ok

18:35:20.0751 6136 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

18:35:20.0768 6136 NDIS - ok

18:35:20.0776 6136 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

18:35:20.0792 6136 NdisTapi - ok

18:35:20.0812 6136 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

18:35:20.0832 6136 Ndisuio - ok

18:35:20.0873 6136 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

18:35:20.0909 6136 NdisWan - ok

18:35:20.0957 6136 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

18:35:21.0007 6136 NDProxy - ok

18:35:21.0032 6136 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

18:35:21.0075 6136 NetBIOS - ok

18:35:21.0104 6136 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

18:35:21.0159 6136 netbt - ok

18:35:21.0197 6136 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

18:35:21.0205 6136 nfrd960 - ok

18:35:21.0227 6136 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

18:35:21.0245 6136 Npfs - ok

18:35:21.0253 6136 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

18:35:21.0293 6136 nsiproxy - ok

18:35:21.0340 6136 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

18:35:21.0386 6136 Ntfs - ok

18:35:21.0404 6136 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

18:35:21.0474 6136 ntrigdigi - ok

18:35:21.0509 6136 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

18:35:21.0530 6136 Null - ok

18:35:21.0580 6136 nvraid (6f785db62a6d8f3fafd3e5695277e849) C:\Windows\system32\drivers\nvraid.sys

18:35:21.0601 6136 nvraid - ok

18:35:21.0618 6136 nvstor (4a5fcab82d9bf6af8a023a66802fe9e9) C:\Windows\system32\drivers\nvstor.sys

18:35:21.0702 6136 nvstor - ok

18:35:21.0727 6136 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

18:35:21.0737 6136 nv_agp - ok

18:35:21.0744 6136 NwlnkFlt - ok

18:35:21.0753 6136 NwlnkFwd - ok

18:35:21.0804 6136 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

18:35:21.0855 6136 ohci1394 - ok

18:35:21.0875 6136 OMCI - ok

18:35:21.0945 6136 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

18:35:21.0981 6136 Parport - ok

18:35:21.0993 6136 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

18:35:22.0002 6136 partmgr - ok

18:35:22.0013 6136 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

18:35:22.0073 6136 Parvdm - ok

18:35:22.0116 6136 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

18:35:22.0127 6136 pci - ok

18:35:22.0139 6136 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys

18:35:22.0148 6136 pciide - ok

18:35:22.0189 6136 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

18:35:22.0198 6136 pcmcia - ok

18:35:22.0258 6136 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\Windows\system32\Drivers\pcouffin.sys

18:35:22.0276 6136 pcouffin - ok

18:35:22.0354 6136 PdiPorts (18ed1d71fef6f71d38c24263500bbd01) C:\Windows\system32\Drivers\PdiPorts.sys

18:35:22.0360 6136 PdiPorts - ok

18:35:22.0386 6136 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

18:35:22.0470 6136 PEAUTH - ok

18:35:22.0510 6136 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

18:35:22.0556 6136 PptpMiniport - ok

18:35:22.0581 6136 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

18:35:22.0618 6136 Processor - ok

18:35:22.0658 6136 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

18:35:22.0703 6136 PSched - ok

18:35:22.0732 6136 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\Windows\system32\Drivers\PxHelp20.sys

18:35:22.0739 6136 PxHelp20 - ok

18:35:22.0783 6136 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

18:35:22.0842 6136 ql2300 - ok

18:35:22.0912 6136 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

18:35:22.0921 6136 ql40xx - ok

18:35:22.0953 6136 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

18:35:23.0022 6136 QWAVEdrv - ok

18:35:23.0049 6136 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

18:35:23.0070 6136 RasAcd - ok

18:35:23.0083 6136 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

18:35:23.0146 6136 Rasl2tp - ok

18:35:23.0195 6136 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

18:35:23.0211 6136 RasPppoe - ok

18:35:23.0223 6136 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

18:35:23.0257 6136 RasSstp - ok

18:35:23.0295 6136 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

18:35:23.0314 6136 rdbss - ok

18:35:23.0329 6136 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

18:35:23.0350 6136 RDPCDD - ok

18:35:23.0388 6136 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

18:35:23.0449 6136 rdpdr - ok

18:35:23.0472 6136 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

18:35:23.0494 6136 RDPENCDD - ok

18:35:23.0519 6136 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

18:35:23.0538 6136 RDPWD - ok

18:35:23.0720 6136 RimUsb (616eac1b0e48b236a5a9b8ae07fdb81c) C:\Windows\system32\Drivers\RimUsb.sys

18:35:23.0741 6136 RimUsb - ok

18:35:23.0788 6136 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys

18:35:23.0846 6136 RimVSerPort - ok

18:35:23.0885 6136 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys

18:35:23.0906 6136 ROOTMODEM - ok

18:35:23.0936 6136 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

18:35:23.0976 6136 rspndr - ok

18:35:24.0020 6136 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

18:35:24.0029 6136 sbp2port - ok

18:35:24.0067 6136 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

18:35:24.0123 6136 secdrv - ok

18:35:24.0208 6136 Sentinel (a2cc81c30bef6ac9f27055490eef6de3) C:\Windows\System32\Drivers\SENTINEL.SYS

18:35:24.0215 6136 Sentinel - ok

18:35:24.0269 6136 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

18:35:24.0305 6136 Serenum - ok

18:35:24.0325 6136 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

18:35:24.0384 6136 Serial - ok

18:35:24.0422 6136 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

18:35:24.0467 6136 sermouse - ok

18:35:24.0502 6136 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys

18:35:24.0538 6136 sffdisk - ok

18:35:24.0549 6136 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

18:35:24.0619 6136 sffp_mmc - ok

18:35:24.0645 6136 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys

18:35:24.0717 6136 sffp_sd - ok

18:35:24.0741 6136 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

18:35:24.0777 6136 sfloppy - ok

18:35:24.0840 6136 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys

18:35:24.0848 6136 sisagp - ok

18:35:24.0865 6136 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

18:35:24.0873 6136 SiSRaid2 - ok

18:35:24.0897 6136 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

18:35:24.0905 6136 SiSRaid4 - ok

18:35:24.0944 6136 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

18:35:24.0962 6136 Smb - ok

18:35:24.0997 6136 SNTNLUSB (ce724fc3ef8468bbab146ca1793c66dc) C:\Windows\system32\DRIVERS\SNTNLUSB.SYS

18:35:25.0004 6136 SNTNLUSB - ok

18:35:25.0031 6136 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

18:35:25.0039 6136 spldr - ok

18:35:25.0102 6136 sptd (d15da1ba189770d93eea2d7e18f95af9) C:\Windows\System32\Drivers\sptd.sys

18:35:25.0126 6136 sptd - ok

18:35:25.0181 6136 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

18:35:25.0299 6136 srv - ok

18:35:25.0348 6136 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

18:35:25.0384 6136 srv2 - ok

18:35:25.0410 6136 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

18:35:25.0457 6136 srvnet - ok

18:35:25.0532 6136 SSPORT (ef3458337d7341a05169cefc73709264) C:\Windows\system32\Drivers\SSPORT.sys

18:35:25.0536 6136 SSPORT ( UnsignedFile.Multi.Generic ) - warning

18:35:25.0536 6136 SSPORT - detected UnsignedFile.Multi.Generic (1)

18:35:25.0562 6136 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

18:35:25.0570 6136 swenum - ok

18:35:25.0589 6136 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

18:35:25.0597 6136 Symc8xx - ok

18:35:25.0610 6136 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

18:35:25.0618 6136 Sym_hi - ok

18:35:25.0633 6136 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

18:35:25.0641 6136 Sym_u3 - ok

18:35:25.0690 6136 Tcpip (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys

18:35:25.0738 6136 Tcpip - ok

18:35:25.0785 6136 Tcpip6 (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys

18:35:25.0841 6136 Tcpip6 - ok

18:35:25.0909 6136 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

18:35:25.0945 6136 tcpipreg - ok

18:35:25.0995 6136 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

18:35:26.0038 6136 TDPIPE - ok

18:35:26.0062 6136 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

18:35:26.0083 6136 TDTCP - ok

18:35:26.0121 6136 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

18:35:26.0138 6136 tdx - ok

18:35:26.0163 6136 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

18:35:26.0172 6136 TermDD - ok

18:35:26.0206 6136 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

18:35:26.0227 6136 tssecsrv - ok

18:35:26.0249 6136 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

18:35:26.0310 6136 tunmp - ok

18:35:26.0363 6136 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

18:35:26.0392 6136 tunnel - ok

18:35:26.0424 6136 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys

18:35:26.0433 6136 uagp35 - ok

18:35:26.0481 6136 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

18:35:26.0501 6136 udfs - ok

18:35:26.0546 6136 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

18:35:26.0554 6136 uliagpkx - ok

18:35:26.0569 6136 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

18:35:26.0579 6136 uliahci - ok

18:35:26.0599 6136 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

18:35:26.0608 6136 UlSata - ok

18:35:26.0626 6136 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

18:35:26.0635 6136 ulsata2 - ok

18:35:26.0659 6136 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

18:35:26.0703 6136 umbus - ok

18:35:26.0785 6136 USB28xxBGA (48bfa9c9145b7527aa8849c974756461) C:\Windows\system32\DRIVERS\emBDA.sys

18:35:26.0870 6136 USB28xxBGA - ok

18:35:26.0899 6136 USB28xxOEM (9053737716744587b748cf7aaa424758) C:\Windows\system32\DRIVERS\emOEM.sys

18:35:26.0942 6136 USB28xxOEM - ok

18:35:26.0980 6136 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\Windows\system32\Drivers\usbaapl.sys

18:35:27.0027 6136 USBAAPL - ok

18:35:27.0080 6136 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys

18:35:27.0119 6136 usbaudio - ok

18:35:27.0151 6136 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

18:35:27.0167 6136 usbccgp - ok

18:35:27.0226 6136 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

18:35:27.0263 6136 usbcir - ok

18:35:27.0279 6136 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

18:35:27.0317 6136 usbehci - ok

18:35:27.0345 6136 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

18:35:27.0363 6136 usbhub - ok

18:35:27.0376 6136 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys

18:35:27.0415 6136 usbohci - ok

18:35:27.0446 6136 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

18:35:27.0466 6136 usbprint - ok

18:35:27.0494 6136 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys

18:35:27.0511 6136 usbscan - ok

18:35:27.0527 6136 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

18:35:27.0545 6136 USBSTOR - ok

18:35:27.0563 6136 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

18:35:27.0580 6136 usbuhci - ok

18:35:27.0603 6136 usbvideo (0a6b81f01bc86399482e27e6fda7b33b) C:\Windows\system32\Drivers\usbvideo.sys

18:35:27.0674 6136 usbvideo - ok

18:35:27.0703 6136 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

18:35:27.0739 6136 vga - ok

18:35:27.0756 6136 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

18:35:27.0778 6136 VgaSave - ok

18:35:27.0833 6136 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

18:35:27.0841 6136 viaagp - ok

18:35:27.0852 6136 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

18:35:27.0907 6136 ViaC7 - ok

18:35:27.0948 6136 viaide (58c8d5ac5c3eef40e7e704a5ced7987d) C:\Windows\system32\drivers\viaide.sys

18:35:27.0957 6136 viaide - ok

18:35:27.0976 6136 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

18:35:27.0984 6136 volmgr - ok

18:35:28.0039 6136 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

18:35:28.0053 6136 volmgrx - ok

18:35:28.0094 6136 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

18:35:28.0106 6136 volsnap - ok

18:35:28.0140 6136 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

18:35:28.0149 6136 vsmraid - ok

18:35:28.0207 6136 VSTHWBS2 (c466021d31ff6c0a6069d12299d80c0b) C:\Windows\system32\DRIVERS\VSTBS23.SYS

18:35:28.0262 6136 VSTHWBS2 - ok

18:35:28.0300 6136 VST_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS

18:35:28.0359 6136 VST_DPV - ok

18:35:28.0384 6136 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

18:35:28.0420 6136 WacomPen - ok

18:35:28.0447 6136 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

18:35:28.0488 6136 Wanarp - ok

18:35:28.0491 6136 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

18:35:28.0508 6136 Wanarpv6 - ok

18:35:28.0532 6136 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

18:35:28.0559 6136 Wd - ok

18:35:28.0615 6136 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys

18:35:28.0631 6136 Wdf01000 - ok

18:35:28.0676 6136 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS

18:35:28.0730 6136 winachsf - ok

18:35:28.0820 6136 WinUsb (676f4b665bdd8053eaa53ac1695b8074) C:\Windows\system32\DRIVERS\WinUSB.SYS

18:35:28.0836 6136 WinUsb - ok

18:35:28.0886 6136 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys

18:35:28.0922 6136 WmiAcpi - ok

18:35:29.0006 6136 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

18:35:29.0045 6136 WpdUsb - ok

18:35:29.0103 6136 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

18:35:29.0146 6136 ws2ifsl - ok

18:35:29.0189 6136 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

18:35:29.0210 6136 WUDFRd - ok

18:35:29.0257 6136 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0

18:35:29.0346 6136 \Device\Harddisk0\DR0 ( TDSS File System ) - warning

18:35:29.0346 6136 \Device\Harddisk0\DR0 - detected TDSS File System (1)

18:35:29.0350 6136 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk5\DR5

18:35:29.0815 6136 \Device\Harddisk5\DR5 - ok

18:35:29.0841 6136 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk6\DR6

18:35:29.0957 6136 \Device\Harddisk6\DR6 - ok

18:35:29.0960 6136 Boot (0x1200) (72c9b9c4bb3bbf1d1f668a4fea4533af) \Device\Harddisk0\DR0\Partition0

18:35:29.0960 6136 \Device\Harddisk0\DR0\Partition0 - ok

18:35:29.0964 6136 Boot (0x1200) (1b3678f513eb38e152e46d7d2f1d7091) \Device\Harddisk5\DR5\Partition0

18:35:29.0965 6136 \Device\Harddisk5\DR5\Partition0 - ok

18:35:29.0967 6136 Boot (0x1200) (19270f5db212c5652859b65ba4ab0cb3) \Device\Harddisk6\DR6\Partition0

18:35:29.0969 6136 \Device\Harddisk6\DR6\Partition0 - ok

18:35:29.0969 6136 ============================================================

18:35:29.0969 6136 Scan finished

18:35:29.0969 6136 ============================================================

18:35:29.0976 5304 Detected object count: 6

18:35:29.0976 5304 Actual detected object count: 6

18:35:45.0305 5304 ASPI32 ( UnsignedFile.Multi.Generic ) - skipped by user

18:35:45.0305 5304 ASPI32 ( UnsignedFile.Multi.Generic ) - User select action: Skip

18:35:45.0306 5304 CVPNDRVA ( UnsignedFile.Multi.Generic ) - skipped by user

18:35:45.0306 5304 CVPNDRVA ( UnsignedFile.Multi.Generic ) - User select action: Skip

18:35:45.0307 5304 DgiVecp ( UnsignedFile.Multi.Generic ) - skipped by user

18:35:45.0307 5304 DgiVecp ( UnsignedFile.Multi.Generic ) - User select action: Skip

18:35:45.0308 5304 N5SG ( UnsignedFile.Multi.Generic ) - skipped by user

18:35:45.0308 5304 N5SG ( UnsignedFile.Multi.Generic ) - User select action: Skip

18:35:45.0309 5304 SSPORT ( UnsignedFile.Multi.Generic ) - skipped by user

18:35:45.0309 5304 SSPORT ( UnsignedFile.Multi.Generic ) - User select action: Skip

18:35:45.0317 5304 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine

18:35:45.0319 5304 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine

18:35:45.0326 5304 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine

18:35:45.0327 5304 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine

18:35:45.0329 5304 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine

18:35:45.0330 5304 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine

18:35:45.0339 5304 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine

18:35:45.0340 5304 \Device\Harddisk0\DR0\TDLFS - deleted

18:35:45.0340 5304 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Delete

18:35:57.0897 7304 Deinitialize success

ComboFix 12-02-08.01 - Willy 02/08/2012 18:40:38.2.4 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3325.1739 [GMT -6:00]

Running from: c:\users\Willy\Desktop\ComboFix.exe

Command switches used :: c:\users\Willy\Desktop\CFScript.txt

AV: Microsoft Forefront Client Security *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Forefront Client Security *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\Ask.com

c:\program files\Ask.com\cobrand.ico

c:\program files\Ask.com\config.xml

c:\program files\Ask.com\favicon.ico

c:\program files\Ask.com\fv_ebe2.ico

c:\program files\Ask.com\GenericAskToolbar.dll

c:\program files\Ask.com\mupcfg.xml

c:\program files\Ask.com\SaUpdate.exe

c:\program files\Ask.com\UpdateTask.exe

.

((((((((((((((((((((((((( Files Created from 2012-01-09 to 2012-02-09 )))))))))))))))))))))))))))))))

.

2012-02-09 00:53 . 2012-02-09 00:53 -------- d-----w- c:\users\Willy\AppData\Local\temp

2012-02-09 00:53 . 2012-02-09 00:53 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-02-09 00:53 . 2012-02-09 00:53 -------- d-----w- c:\users\Darla\AppData\Local\temp

2012-02-09 00:53 . 2012-02-09 00:53 -------- d-----w- c:\users\Darla.HomeOffice-PC\AppData\Local\temp