Svchost exe trojan

RedGem · March 1, 2012

This started popping up the last few days. I had Malware installed and it kept stopping the SCVHOST.EXE trojan from running but then Malware stopped responding. When the system is restarted and Malware was run it found 2 items and required a system restart to remove but it has not been removed the many times Malware has been run. I have also run McAfee but it doesnt even register a virus or trojan. Thank you for your help in advance.

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Ruby at 8:50:48 on 2012-03-01

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3959.1784 [GMT -5:00]

.

AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\atieclxx.exe

C:\Program Files\Dell\DellDock\DockLogin.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE

C:\Program Files\mcafee\MAT\McPvTray.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\IDT\WDM\AESTSr64.exe

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

C:\Windows\system32\mfevtps.exe

C:\Windows\system32\rundll32.exe

C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\SearchIndexer.exe

-netsvcs

C:\Windows\system32\conhost.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\taskmgr.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe

C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Windows\servicing\TrustedInstaller.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

C:\Users\Ruby\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.mindspring.com/~braininajar/

uSearch Bar = Preserve

uURLSearchHooks: H - No File

mWinlogon: Userinit=userinit.exe,

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120301002221.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~2\mcafee\sitead~1\mcieplg.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~2\mcafee\sitead~1\mcieplg.dll

TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

TB: {7B13EC3E-999A-4B70-B9CB-2617B8323822} - No File

uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

uRun: [Google Update] "C:\Users\Ruby\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [spotify] "C:\Users\Ruby\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [dellsupportcenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

dRun: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

TCP: DhcpNameServer = 207.69.188.186 207.69.188.187

TCP: Interfaces\{E6ABFD4F-1A09-4B31-9E21-7F4A87BABD78} : DhcpNameServer = 207.69.188.186 207.69.188.187

TCP: Interfaces\{E6ABFD4F-1A09-4B31-9E21-7F4A87BABD78}\2375942554035333 : DhcpNameServer = 192.168.1.254

TCP: Interfaces\{E6ABFD4F-1A09-4B31-9E21-7F4A87BABD78}\4497E65687 : DhcpNameServer = 192.168.2.1 68.87.77.134 68.87.72.134

TCP: Interfaces\{E6ABFD4F-1A09-4B31-9E21-7F4A87BABD78}\4637D602E6564777F627B6 : DhcpNameServer = 205.152.37.23 205.152.150.23

TCP: Interfaces\{E6ABFD4F-1A09-4B31-9E21-7F4A87BABD78}\8686F6E6F62737 : DhcpNameServer = 12.127.16.67 12.127.17.71

TCP: Interfaces\{E6ABFD4F-1A09-4B31-9E21-7F4A87BABD78}\C4F62746027556C6C696E67647F6E67237022456566602452716D27657563747 : DhcpNameServer = 207.69.188.186 207.69.188.187

TCP: Interfaces\{E6ABFD4F-1A09-4B31-9E21-7F4A87BABD78}\C696E6B6379737 : DhcpNameServer = 97.64.209.36 97.64.168.13

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\MSC\McSnIePl.dll

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

Handler: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - C:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO-X64: 0x1 - No File

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

BHO-X64: Search Helper - No File

BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120301002221.dll

BHO-X64: scriptproxy - No File

BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\progra~2\mcafee\sitead~1\mcieplg.dll

BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL

BHO-X64: URLRedirectionBHO - No File

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\progra~2\mcafee\sitead~1\mcieplg.dll

TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

TB-X64: {7B13EC3E-999A-4B70-B9CB-2617B8323822} - No File

mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun-x64: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2

mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun-x64: [dellsupportcenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

Hosts: 87.229.126.44 www.google.com

Hosts: 87.229.126.45 www.bing.com

.

============= SERVICES / DRIVERS ===============

.

R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]

R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]

R3 BcmVWL;Broadcom Virtual Wireless;C:\Windows\system32\DRIVERS\bcmvwl64.sys --> C:\Windows\system32\DRIVERS\bcmvwl64.sys [?]

S3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]

.

=============== Created Last 30 ================

.

2012-03-01 05:29:00 71800 ----a-w- C:\Windows\System32\drivers\McPvDrv.sys

2012-03-01 05:22:38 -------- d-----w- C:\Program Files (x86)\McAfee.com

2012-03-01 05:22:20 10248 ----a-w- C:\Windows\System32\drivers\mfeclnk.sys

2012-03-01 05:22:20 -------- d-----w- C:\Program Files (x86)\Common Files\McAfee

2012-03-01 05:22:14 75808 ----a-w- C:\Windows\System32\drivers\mfenlfk.sys

2012-03-01 05:22:14 65264 ----a-w- C:\Windows\System32\drivers\cfwids.sys

2012-03-01 05:22:14 481768 ----a-w- C:\Windows\System32\drivers\mfefirek.sys

2012-03-01 05:22:14 284648 ----a-w- C:\Windows\System32\drivers\mfewfpk.sys

2012-03-01 05:22:14 229528 ----a-w- C:\Windows\System32\drivers\mfeavfk.sys

2012-03-01 05:22:14 100912 ----a-w- C:\Windows\System32\drivers\mferkdet.sys

2012-03-01 05:22:05 -------- d-----w- C:\Program Files\McAfee.com

2012-03-01 05:15:25 69648 ----a-w- C:\ProgramData\fontkrnl.exe

2012-03-01 04:52:54 161168 ----a-w- C:\Windows\System32\mfevtps.exe

2012-02-29 23:39:27 -------- d-sh--w- C:\Windows\SysWow64\%USERPROFILE%

2012-02-29 19:30:27 -------- d-----w- C:\6b8eae85aeac68d7299db7ed

2012-02-29 19:17:14 -------- d-----w- C:\Users\Ruby\AppData\Roaming\ParetoLogic

2012-02-29 19:17:14 -------- d-----w- C:\Users\Ruby\AppData\Roaming\DriverCure

2012-02-29 19:17:03 -------- d-----w- C:\ProgramData\ParetoLogic

2012-02-29 02:54:21 -------- d-----w- C:\Users\Ruby\AppData\Local\McAfee Anti-Theft

2012-02-25 15:26:02 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%

2012-02-25 15:08:31 20480 ----a-w- C:\Windows\svchost.exe

2012-02-15 08:53:56 509952 ----a-w- C:\Windows\System32\ntshrui.dll

2012-02-15 08:53:55 442880 ----a-w- C:\Windows\SysWow64\ntshrui.dll

2012-02-15 08:53:52 515584 ----a-w- C:\Windows\System32\timedate.cpl

2012-02-15 08:53:51 478720 ----a-w- C:\Windows\SysWow64\timedate.cpl

2012-02-15 08:53:48 3145728 ----a-w- C:\Windows\System32\win32k.sys

2012-02-15 08:53:46 498688 ----a-w- C:\Windows\System32\drivers\afd.sys

2012-02-15 08:53:32 634880 ----a-w- C:\Windows\System32\msvcrt.dll

2012-02-15 08:53:31 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll

.

==================== Find3M ====================

.

2012-03-01 11:53:33 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-12-14 07:11:03 2308096 ----a-w- C:\Windows\System32\jscript9.dll

2011-12-14 07:04:30 1390080 ----a-w- C:\Windows\System32\wininet.dll

2011-12-14 07:03:38 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl

2011-12-14 06:57:28 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2011-12-14 03:04:54 1798656 ----a-w- C:\Windows\SysWow64\jscript9.dll

2011-12-14 02:57:18 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll

2011-12-14 02:56:58 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2011-12-14 02:50:04 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2011-12-12 00:07:03 55384 ----a-w- C:\Windows\System32\drivers\SBREDrv.sys

2011-12-10 20:24:08 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys

.

============= FINISH: 8:57:00.34 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 9/6/2010 7:52:09 PM

System Uptime: 3/1/2012 8:37:23 AM (0 hours ago)

.

Motherboard: Dell Inc. | | 03C6YH

Processor: Intel® Core i3 CPU M 350 @ 2.27GHz | CPU 1 | 2261/533mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 283 GiB total, 158.468 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP218: 2/23/2012 4:47:40 AM - Scheduled Checkpoint

RP219: 2/28/2012 6:59:33 AM - Windows Update

RP220: 2/29/2012 2:29:39 PM - Windows Update

RP221: 2/29/2012 4:27:04 PM - Windows Update

.

==== Installed Programs ======================

.

Adobe AIR

Adobe Flash Player 10 Plugin

Adobe Reader 9.1

Advanced Audio FX Engine

Amazon Games & Software Downloader

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center Graphics Previews Vista

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-core-static

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

Cisco EAP-FAST Module

Cisco LEAP Module

Cisco PEAP Module

Consumer In-Home Service Agreement

Cozi

Curse Client

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

Dell Dock

Dell Driver Download Manager

Dell Getting Started Guide

Dell Support Center (Support Software)

Dell Webcam Central

Dragon Age II

Dragon Age: Origins

EA Installer

EA Shared Game Component: Activation

Google Chrome

Google Update Helper

GoToAssist 8.0.0.514

Hero Lab 3.9b

Heroes of Might and Magic® IV

Intel® Control Center

Intel® Management Engine Components

Intel® Rapid Storage Technology

J2SE Runtime Environment 5.0

Java Auto Updater

Java 6 Update 26

Live! Cam Avatar Creator

LoJack Factory Installer

Malwarebytes Anti-Malware version 1.60.1.1000

Mass Effect 2

McAfee Total Protection

Media Player Utilities 4.27

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Home and Student 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Single Image 2010

Microsoft Office Word MUI (English) 2010

Microsoft Search Enhancement Pack

Microsoft Silverlight

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Neverwinter Nights 2

NVIDIA PhysX

Origin

PDFCanvas V1.5

Roxio Burn

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft Office 2010 (KB2553091)

Security Update for Microsoft Office 2010 (KB2553096)

Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition

Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition

Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)

Security Update for Microsoft Visio Viewer 2010 (KB2597170) 32-Bit Edition

Skype™ 5.6

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Excel 2010 (KB2553439) 32-Bit Edition

Update for Microsoft Office 2010 (KB2494150)

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition

Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition

Update for Microsoft Outlook 2010 (KB2553323) 32-Bit Edition

Update for Microsoft Outlook Social Connector (KB2583935)

VC80CRTRedist - 8.0.50727.6195

Ventrilo Client

Windows Live Sync

World of Warcraft

Yahoo! Detect

.

==== Event Viewer Messages From Past Week ========

.

3/1/2012 8:42:43 AM, Error: Service Control Manager [7031] - The McAfee McShield service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

3/1/2012 8:40:52 AM, Error: Service Control Manager [7003] - The McAfee Personal Firewall Service service depends the following service: MpsSvc. This service might not be installed.

3/1/2012 8:38:55 AM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.

3/1/2012 8:38:11 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.

3/1/2012 8:38:08 AM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.

3/1/2012 8:38:07 AM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.

3/1/2012 8:16:42 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service McNaiAnn with arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

3/1/2012 8:13:00 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.

3/1/2012 8:12:52 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

3/1/2012 8:12:52 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

3/1/2012 8:12:51 AM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\bcmihvsrv64.dll Error Code: 21

3/1/2012 8:12:46 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

3/1/2012 8:12:37 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

3/1/2012 8:12:34 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr Wanarpv6

3/1/2012 8:12:31 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

3/1/2012 12:20:00 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800034ac3a6, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 030112-33056-01.

3/1/2012 12:15:26 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {3AD05575-8857-4850-9277-11B85BDB8E09} and APPID {3AD05575-8857-4850-9277-11B85BDB8E09} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

3/1/2012 1:09:18 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000000000dc, 0x0000000000000002, 0x0000000000000001, 0xfffff800034c1ab5). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 030112-16894-01.

2/29/2012 7:58:44 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800034b1f6b, 0x0000000000000000, 0x000000007efa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022912-21512-01.

2/29/2012 7:58:34 AM, Error: Service Control Manager [7001] - The McAfee Anti-Spam Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.

2/29/2012 7:16:08 AM, Error: Service Control Manager [7034] - The McAfee Scanner service terminated unexpectedly. It has done this 2 time(s).

2/29/2012 7:12:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service McNaSvc with arguments "" in order to run the server: {24F616A1-B755-4053-8018-C3425DC8B68A}

2/29/2012 4:20:32 AM, Error: Service Control Manager [7034] - The McAfee McShield service terminated unexpectedly. It has done this 6 time(s).

2/29/2012 4:19:04 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0xfffff8a0400c0024, 0x0000000000000002, 0x0000000000000000, 0xfffff80003481d75). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022912-18844-01.

2/29/2012 4:18:33 AM, Error: Service Control Manager [7031] - The McAfee McShield service terminated unexpectedly. It has done this 5 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

2/29/2012 4:16:15 AM, Error: Service Control Manager [7031] - The McAfee McShield service terminated unexpectedly. It has done this 4 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

2/29/2012 4:14:26 AM, Error: Service Control Manager [7031] - The McAfee McShield service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

2/29/2012 4:11:03 AM, Error: Service Control Manager [7031] - The McAfee McShield service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

2/29/2012 2:37:45 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service McNaiAnn with arguments "" in order to run the server: {395633B1-EED9-4DFC-B67F-9788B51C9F06}

2/29/2012 2:36:44 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache mfehidk mfenlfk NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf

2/29/2012 2:36:44 PM, Error: Service Control Manager [7001] - The McAfee Validation Trust Protection Service service depends on the McAfee Inc. mfehidk service which failed to start because of the following error: A device attached to the system is not functioning.

2/29/2012 2:36:44 PM, Error: Service Control Manager [7001] - The McAfee Proxy Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.

2/29/2012 2:36:44 PM, Error: Service Control Manager [7001] - The McAfee McShield service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.

2/29/2012 2:36:44 PM, Error: Service Control Manager [7001] - The McAfee Firewall Core Service service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.

2/29/2012 2:33:00 PM, Error: Service Control Manager [7034] - The McAfee Scanner service terminated unexpectedly. It has done this 1 time(s).

2/29/2012 2:30:59 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800037cfa9a, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022912-32151-01.

2/29/2012 12:28:59 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000000000dc, 0x0000000000000002, 0x0000000000000001, 0xfffff800034faab5). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022912-31090-01.

2/29/2012 11:44:17 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80003478f6b, 0x0000000000000000, 0x000000007efa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022912-19016-01.

2/29/2012 11:41:47 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000000000dc, 0x0000000000000002, 0x0000000000000001, 0xfffff8000350cab5). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022912-18408-01.

2/29/2012 11:38:17 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.

2/29/2012 10:35:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}

2/29/2012 10:32:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

2/29/2012 10:32:27 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf

2/29/2012 10:32:22 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800034a9f6b, 0x0000000000000000, 0x000000007efa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022912-20482-01.

2/29/2012 10:32:13 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.

2/29/2012 10:32:13 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

2/29/2012 10:32:13 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

2/29/2012 10:32:13 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

2/29/2012 10:32:12 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

2/29/2012 10:32:12 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

2/29/2012 10:32:12 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.

2/29/2012 10:32:12 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.

2/29/2012 10:32:12 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

2/29/2012 10:25:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

2/29/2012 10:25:24 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.

2/29/2012 10:25:24 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

2/28/2012 9:37:50 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x0000000000002e40, 0x0000000000000002, 0x0000000000000000, 0xfffff8000348cd75). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022812-28267-01.

2/28/2012 7:58:05 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800034baf6b, 0x0000000000000000, 0x000000007efa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022812-33072-01.

2/28/2012 5:58:58 PM, Error: Service Control Manager [7023] - The Superfetch service terminated with the following error: The data is invalid.

2/28/2012 4:13:32 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800034c5f6b, 0x0000000000000000, 0x000000007efa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022812-17908-01.

2/28/2012 11:58:55 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff8000345ef6b, 0x0000000000000000, 0x000000007efa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022812-22838-01.

.

==== End Of File ===========================

Larusso · March 2, 2012

Hy

my name is Daniel and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Please read and follow these instructions carefully. We do not want it to fix anything yet (if found), we need to see a report first.

Download TDSSKiller.exe and save it to your desktop

Execute TDSSKiller.exe by doubleclicking on it.
Press Start Scan
If Malicious objects are found, do NOT select Cure. Change the action to Skip, and save the log.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt

Please post the contents of that log in your next reply.

RedGem · March 2, 2012

Downloaded file fine and ran it. Found one object, changed the action to Skip and created the log file as requested.

20:02:49.0535 0400 TDSS rootkit removing tool 2.7.17.0 Feb 29 2012 14:02:24

20:02:49.0909 0400 ============================================================

20:02:49.0909 0400 Current date / time: 2012/03/01 20:02:49.0909

20:02:49.0909 0400 SystemInfo:

20:02:49.0909 0400

20:02:49.0909 0400 OS Version: 6.1.7601 ServicePack: 1.0

20:02:49.0909 0400 Product type: Workstation

20:02:49.0909 0400 ComputerName: REDGEM

20:02:49.0909 0400 UserName: Ruby

20:02:49.0909 0400 Windows directory: C:\Windows

20:02:49.0909 0400 System windows directory: C:\Windows

20:02:49.0909 0400 Running under WOW64

20:02:49.0909 0400 Processor architecture: Intel x64

20:02:49.0909 0400 Number of processors: 4

20:02:49.0909 0400 Page size: 0x1000

20:02:49.0909 0400 Boot type: Safe boot with network

20:02:49.0909 0400 ============================================================

20:02:52.0062 0400 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

20:02:52.0078 0400 \Device\Harddisk0\DR0:

20:02:52.0093 0400 MBR used

20:02:52.0093 0400 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1D4C000

20:02:52.0093 0400 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1D7E800, BlocksNum 0x236AFAB0

20:02:52.0202 0400 Initialize success

20:02:52.0202 0400 ============================================================

20:03:59.0634 2380 ============================================================

20:03:59.0634 2380 Scan started

20:03:59.0634 2380 Mode: Manual;

20:03:59.0634 2380 ============================================================

20:04:02.0414 2380 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys

20:04:02.0437 2380 1394ohci - ok

20:04:02.0871 2380 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

20:04:02.0894 2380 ACPI - ok

20:04:03.0387 2380 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

20:04:03.0388 2380 AcpiPmi - ok

20:04:03.0857 2380 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

20:04:03.0900 2380 adp94xx - ok

20:04:04.0395 2380 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

20:04:04.0425 2380 adpahci - ok

20:04:04.0895 2380 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

20:04:04.0915 2380 adpu320 - ok

20:04:05.0645 2380 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys

20:04:05.0665 2380 AFD - ok

20:04:05.0975 2380 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

20:04:05.0995 2380 agp440 - ok

20:04:06.0335 2380 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

20:04:06.0355 2380 aliide - ok

20:04:06.0655 2380 Alpham1 (b3e801135e0c81733542c14d9aa8120a) C:\Windows\system32\DRIVERS\Alpham164.sys

20:04:06.0665 2380 Alpham1 - ok

20:04:07.0131 2380 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

20:04:07.0193 2380 amdide - ok

20:04:07.0802 2380 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

20:04:07.0817 2380 AmdK8 - ok

20:04:10.0088 2380 amdkmdag (79a11cb10ff02a8425dabbb040249f7d) C:\Windows\system32\DRIVERS\atikmdag.sys

20:04:10.0244 2380 amdkmdag - ok

20:04:10.0665 2380 amdkmdap (6f6d47246fbb0cf65619684a0f89179e) C:\Windows\system32\DRIVERS\atikmpag.sys

20:04:10.0681 2380 amdkmdap - ok

20:04:11.0009 2380 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

20:04:11.0055 2380 AmdPPM - ok

20:04:11.0367 2380 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

20:04:11.0508 2380 amdsata - ok

20:04:12.0210 2380 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

20:04:12.0225 2380 amdsbs - ok

20:04:12.0787 2380 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

20:04:12.0803 2380 amdxata - ok

20:04:13.0364 2380 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

20:04:13.0395 2380 AppID - ok

20:04:13.0895 2380 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

20:04:13.0910 2380 arc - ok

20:04:14.0425 2380 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

20:04:14.0441 2380 arcsas - ok

20:04:14.0893 2380 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

20:04:14.0893 2380 AsyncMac - ok

20:04:15.0408 2380 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

20:04:15.0423 2380 atapi - ok

20:04:16.0016 2380 AtiHdmiService (2d648572ba9a610952fcafba1e119c2d) C:\Windows\system32\drivers\AtiHdmi.sys

20:04:16.0016 2380 AtiHdmiService - ok

20:04:16.0447 2380 atksgt (fc0e8778c000291caf60eb88c011e931) C:\Windows\system32\DRIVERS\atksgt.sys

20:04:16.0477 2380 atksgt - ok

20:04:17.0107 2380 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

20:04:17.0497 2380 b06bdrv - ok

20:04:18.0087 2380 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

20:04:18.0147 2380 b57nd60a - ok

20:04:18.0857 2380 BCM42RLY (ac4e2d84de54cd3a013aeff0cc56095c) C:\Windows\system32\drivers\BCM42RLY.sys

20:04:18.0857 2380 BCM42RLY - ok

20:04:20.0651 2380 BCM43XX (8b5d16d20774fc3727f44e161be2c0ac) C:\Windows\system32\DRIVERS\bcmwl664.sys

20:04:20.0666 2380 BCM43XX - ok

20:04:21.0087 2380 BcmVWL (d224b2e6bb543f1d8f1177d57fec2950) C:\Windows\system32\DRIVERS\bcmvwl64.sys

20:04:21.0087 2380 BcmVWL - ok

20:04:21.0633 2380 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

20:04:21.0649 2380 Beep - ok

20:04:22.0286 2380 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

20:04:22.0316 2380 blbdrive - ok

20:04:22.0976 2380 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

20:04:22.0986 2380 bowser - ok

20:04:23.0876 2380 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

20:04:23.0886 2380 BrFiltLo - ok

20:04:24.0727 2380 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

20:04:24.0743 2380 BrFiltUp - ok

20:04:25.0716 2380 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

20:04:25.0836 2380 Brserid - ok

20:04:26.0746 2380 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

20:04:26.0796 2380 BrSerWdm - ok

20:04:27.0686 2380 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

20:04:27.0696 2380 BrUsbMdm - ok

20:04:28.0326 2380 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

20:04:28.0346 2380 BrUsbSer - ok

20:04:28.0706 2380 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

20:04:28.0726 2380 BTHMODEM - ok

20:04:29.0366 2380 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

20:04:29.0376 2380 cdfs - ok

20:04:29.0786 2380 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys

20:04:29.0796 2380 cdrom - ok

20:04:30.0426 2380 cfwids (ed0263b2eb24f0f4e3898036fa1d28a1) C:\Windows\system32\drivers\cfwids.sys

20:04:30.0446 2380 cfwids - ok

20:04:30.0942 2380 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

20:04:30.0957 2380 circlass - ok

20:04:31.0675 2380 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

20:04:31.0737 2380 CLFS - ok

20:04:33.0017 2380 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

20:04:33.0032 2380 CmBatt - ok

20:04:33.0765 2380 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

20:04:33.0781 2380 cmdide - ok

20:04:34.0327 2380 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys

20:04:34.0374 2380 CNG - ok

20:04:35.0591 2380 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

20:04:35.0684 2380 Compbatt - ok

20:04:36.0464 2380 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys

20:04:36.0480 2380 CompositeBus - ok

20:04:36.0953 2380 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

20:04:36.0963 2380 crcdisk - ok

20:04:37.0773 2380 CtClsFlt (ed5cf92396a62f4c15110dcdb5e854d9) C:\Windows\system32\DRIVERS\CtClsFlt.sys

20:04:37.0793 2380 CtClsFlt - ok

20:04:38.0543 2380 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

20:04:38.0553 2380 DfsC - ok

20:04:39.0023 2380 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

20:04:39.0053 2380 discache - ok

20:04:39.0863 2380 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

20:04:39.0883 2380 Disk - ok

20:04:40.0663 2380 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

20:04:40.0683 2380 drmkaud - ok

20:04:41.0753 2380 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

20:04:41.0803 2380 DXGKrnl - ok

20:04:44.0183 2380 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

20:04:44.0313 2380 ebdrv - ok

20:04:45.0023 2380 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

20:04:45.0043 2380 elxstor - ok

20:04:46.0293 2380 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

20:04:46.0463 2380 ErrDev - ok

20:04:46.0893 2380 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

20:04:46.0913 2380 exfat - ok

20:04:47.0983 2380 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

20:04:48.0013 2380 fastfat - ok

20:04:48.0573 2380 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

20:04:48.0643 2380 fdc - ok

20:04:49.0553 2380 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

20:04:49.0573 2380 FileInfo - ok

20:04:50.0153 2380 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

20:04:50.0153 2380 Filetrace - ok

20:04:50.0733 2380 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

20:04:50.0743 2380 flpydisk - ok

20:04:51.0543 2380 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

20:04:51.0563 2380 FltMgr - ok

20:04:51.0963 2380 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

20:04:51.0983 2380 FsDepends - ok

20:04:52.0203 2380 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

20:04:52.0213 2380 Fs_Rec - ok

20:04:52.0613 2380 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

20:04:52.0633 2380 fvevol - ok

20:04:52.0823 2380 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

20:04:52.0823 2380 gagp30kx - ok

20:04:53.0483 2380 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

20:04:53.0483 2380 hcw85cir - ok

20:04:53.0943 2380 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys

20:04:53.0963 2380 HdAudAddService - ok

20:04:54.0123 2380 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys

20:04:54.0123 2380 HDAudBus - ok

20:04:54.0363 2380 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys

20:04:54.0363 2380 HECIx64 - ok

20:04:54.0633 2380 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

20:04:54.0633 2380 HidBatt - ok

20:04:54.0853 2380 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

20:04:54.0863 2380 HidBth - ok

20:04:54.0973 2380 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

20:04:54.0973 2380 HidIr - ok

20:04:55.0523 2380 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys

20:04:55.0523 2380 HidUsb - ok

20:04:55.0793 2380 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

20:04:55.0793 2380 HpSAMD - ok

20:04:55.0953 2380 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

20:04:55.0963 2380 HTTP - ok

20:04:56.0063 2380 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

20:04:56.0063 2380 hwpolicy - ok

20:04:56.0223 2380 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys

20:04:56.0223 2380 i8042prt - ok

20:04:56.0343 2380 iaStor (2064090c9faad92c090d77e50e735b2e) C:\Windows\system32\DRIVERS\iaStor.sys

20:04:56.0343 2380 iaStor - ok

20:04:56.0573 2380 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

20:04:56.0593 2380 iaStorV - ok

20:04:59.0053 2380 igfx (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys

20:04:59.0203 2380 igfx - ok

20:04:59.0973 2380 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

20:04:59.0983 2380 iirsp - ok

20:05:00.0303 2380 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

20:05:00.0343 2380 intelide - ok

20:05:00.0663 2380 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

20:05:00.0673 2380 intelppm - ok

20:05:01.0003 2380 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

20:05:01.0013 2380 IpFilterDriver - ok

20:05:01.0113 2380 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

20:05:01.0183 2380 IPMIDRV - ok

20:05:01.0683 2380 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

20:05:01.0693 2380 IPNAT - ok

20:05:01.0833 2380 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

20:05:01.0853 2380 IRENUM - ok

20:05:02.0033 2380 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

20:05:02.0043 2380 isapnp - ok

20:05:02.0226 2380 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

20:05:02.0239 2380 iScsiPrt - ok

20:05:02.0442 2380 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

20:05:02.0443 2380 kbdclass - ok

20:05:02.0633 2380 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys

20:05:02.0646 2380 kbdhid - ok

20:05:02.0743 2380 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys

20:05:02.0745 2380 KSecDD - ok

20:05:02.0847 2380 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys

20:05:02.0850 2380 KSecPkg - ok

20:05:02.0992 2380 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

20:05:02.0993 2380 ksthunk - ok

20:05:03.0266 2380 lirsgt (156ab2e56dc3ca0b582e3362e07cded7) C:\Windows\system32\DRIVERS\lirsgt.sys

20:05:03.0267 2380 lirsgt - ok

20:05:03.0386 2380 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

20:05:03.0387 2380 lltdio - ok

20:05:03.0612 2380 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

20:05:03.0614 2380 LSI_FC - ok

20:05:03.0771 2380 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

20:05:03.0773 2380 LSI_SAS - ok

20:05:03.0808 2380 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

20:05:03.0809 2380 LSI_SAS2 - ok

20:05:03.0870 2380 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

20:05:03.0872 2380 LSI_SCSI - ok

20:05:04.0023 2380 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

20:05:04.0025 2380 luafv - ok

20:05:04.0187 2380 MBAMProtector (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys

20:05:04.0188 2380 MBAMProtector - ok

20:05:04.0570 2380 McPvDrv (a0c364079e7ae6c3127bee8e196f00e5) C:\Windows\system32\drivers\McPvDrv.sys

20:05:04.0582 2380 McPvDrv - ok

20:05:04.0935 2380 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

20:05:04.0936 2380 megasas - ok

20:05:05.0012 2380 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

20:05:05.0015 2380 MegaSR - ok

20:05:05.0554 2380 mfeapfk (ef3acfb7e3f82d5f7cde9ef5f0a4e2e2) C:\Windows\system32\drivers\mfeapfk.sys

20:05:05.0557 2380 mfeapfk - ok

20:05:05.0740 2380 mfeavfk (e7a60bdb4365b561d896019b82fb7dd0) C:\Windows\system32\drivers\mfeavfk.sys

20:05:05.0784 2380 mfeavfk - ok

20:05:05.0909 2380 mfefirek (670dffe55e2f9ab99d9169c428bcece9) C:\Windows\system32\drivers\mfefirek.sys

20:05:05.0912 2380 mfefirek - ok

20:05:06.0256 2380 mfehidk (1892616b7f9291fd77c3fa0a5811fe9f) C:\Windows\system32\drivers\mfehidk.sys

20:05:06.0320 2380 mfehidk - ok

20:05:06.0548 2380 mfenlfk (1721261c77f6e7a9e0cb51b7d9f31b60) C:\Windows\system32\DRIVERS\mfenlfk.sys

20:05:06.0549 2380 mfenlfk - ok

20:05:06.0959 2380 mferkdet (65776bd8029e409935b90de30bf99526) C:\Windows\system32\drivers\mferkdet.sys

20:05:06.0973 2380 mferkdet - ok

20:05:07.0911 2380 mfewfpk (4f17d8b85b903d96ef7033bb6ef50516) C:\Windows\system32\drivers\mfewfpk.sys

20:05:07.0928 2380 mfewfpk - ok

20:05:08.0364 2380 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

20:05:08.0401 2380 Modem - ok

20:05:08.0830 2380 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

20:05:08.0831 2380 monitor - ok

20:05:09.0520 2380 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

20:05:09.0520 2380 mouclass - ok

20:05:09.0959 2380 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

20:05:09.0982 2380 mouhid - ok

20:05:10.0205 2380 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

20:05:10.0217 2380 mountmgr - ok

20:05:10.0560 2380 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

20:05:10.0579 2380 mpio - ok

20:05:10.0876 2380 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

20:05:10.0878 2380 mpsdrv - ok

20:05:11.0029 2380 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

20:05:11.0031 2380 MRxDAV - ok

20:05:11.0798 2380 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

20:05:11.0800 2380 mrxsmb - ok

20:05:11.0906 2380 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

20:05:11.0910 2380 mrxsmb10 - ok

20:05:12.0050 2380 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

20:05:12.0051 2380 mrxsmb20 - ok

20:05:12.0161 2380 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

20:05:12.0162 2380 msahci - ok

20:05:12.0268 2380 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

20:05:12.0270 2380 msdsm - ok

20:05:12.0404 2380 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

20:05:12.0405 2380 Msfs - ok

20:05:12.0517 2380 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

20:05:12.0518 2380 mshidkmdf - ok

20:05:12.0677 2380 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

20:05:12.0679 2380 msisadrv - ok

20:05:12.0860 2380 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

20:05:12.0862 2380 MSKSSRV - ok

20:05:13.0025 2380 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

20:05:13.0026 2380 MSPCLOCK - ok

20:05:13.0551 2380 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

20:05:13.0552 2380 MSPQM - ok

20:05:13.0732 2380 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

20:05:13.0749 2380 MsRPC - ok

20:05:14.0027 2380 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys

20:05:14.0028 2380 mssmbios - ok

20:05:14.0174 2380 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

20:05:14.0175 2380 MSTEE - ok

20:05:14.0339 2380 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

20:05:14.0340 2380 MTConfig - ok

20:05:14.0537 2380 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

20:05:14.0539 2380 Mup - ok

20:05:15.0478 2380 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

20:05:15.0502 2380 NativeWifiP - ok

20:05:15.0686 2380 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

20:05:15.0765 2380 NDIS - ok

20:05:15.0911 2380 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

20:05:15.0947 2380 NdisCap - ok

20:05:16.0196 2380 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

20:05:16.0197 2380 NdisTapi - ok

20:05:16.0596 2380 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

20:05:16.0598 2380 Ndisuio - ok

20:05:16.0753 2380 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

20:05:16.0755 2380 NdisWan - ok

20:05:16.0884 2380 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

20:05:16.0885 2380 NDProxy - ok

20:05:17.0326 2380 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

20:05:17.0327 2380 NetBIOS - ok

20:05:17.0429 2380 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

20:05:17.0433 2380 NetBT - ok

20:05:17.0572 2380 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

20:05:17.0573 2380 nfrd960 - ok

20:05:17.0726 2380 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

20:05:17.0735 2380 Npfs - ok

20:05:17.0870 2380 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

20:05:17.0871 2380 nsiproxy - ok

20:05:17.0964 2380 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

20:05:17.0988 2380 Ntfs - ok

20:05:18.0104 2380 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

20:05:18.0105 2380 Null - ok

20:05:18.0185 2380 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

20:05:18.0188 2380 nvraid - ok

20:05:18.0224 2380 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

20:05:18.0226 2380 nvstor - ok

20:05:18.0249 2380 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

20:05:18.0265 2380 nv_agp - ok

20:05:18.0316 2380 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

20:05:18.0318 2380 ohci1394 - ok

20:05:18.0454 2380 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

20:05:18.0456 2380 Parport - ok

20:05:18.0483 2380 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys

20:05:18.0484 2380 partmgr - ok

20:05:18.0527 2380 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

20:05:18.0530 2380 pci - ok

20:05:18.0570 2380 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

20:05:18.0571 2380 pciide - ok

20:05:18.0612 2380 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

20:05:18.0615 2380 pcmcia - ok

20:05:18.0643 2380 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

20:05:18.0645 2380 pcw - ok

20:05:18.0682 2380 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

20:05:18.0690 2380 PEAUTH - ok

20:05:18.0803 2380 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

20:05:18.0818 2380 PptpMiniport - ok

20:05:18.0855 2380 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

20:05:18.0857 2380 Processor - ok

20:05:19.0051 2380 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

20:05:19.0054 2380 Psched - ok

20:05:19.0274 2380 PxHlpa64 (87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys

20:05:19.0290 2380 PxHlpa64 - ok

20:05:19.0466 2380 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

20:05:19.0483 2380 ql2300 - ok

20:05:19.0619 2380 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

20:05:19.0621 2380 ql40xx - ok

20:05:19.0667 2380 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

20:05:19.0668 2380 QWAVEdrv - ok

20:05:19.0687 2380 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

20:05:19.0688 2380 RasAcd - ok

20:05:19.0751 2380 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

20:05:19.0752 2380 RasAgileVpn - ok

20:05:19.0801 2380 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

20:05:19.0802 2380 Rasl2tp - ok

20:05:19.0848 2380 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

20:05:19.0849 2380 RasPppoe - ok

20:05:19.0871 2380 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

20:05:19.0872 2380 RasSstp - ok

20:05:19.0929 2380 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

20:05:19.0933 2380 rdbss - ok

20:05:19.0986 2380 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

20:05:19.0988 2380 rdpbus - ok

20:05:20.0008 2380 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

20:05:20.0009 2380 RDPCDD - ok

20:05:20.0081 2380 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

20:05:20.0082 2380 RDPENCDD - ok

20:05:20.0113 2380 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

20:05:20.0116 2380 RDPREFMP - ok

20:05:20.0148 2380 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys

20:05:20.0151 2380 RDPWD - ok

20:05:20.0200 2380 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

20:05:20.0203 2380 rdyboost - ok

20:05:20.0311 2380 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

20:05:20.0313 2380 rspndr - ok

20:05:20.0371 2380 RSUSBSTOR (30f463768d5143bfd7b2df822b53cf4d) C:\Windows\system32\Drivers\RtsUStor.sys

20:05:20.0374 2380 RSUSBSTOR - ok

20:05:20.0416 2380 RTL8167 (fd978b2bf8a9b2390dcbef435e9c1f9f) C:\Windows\system32\DRIVERS\Rt64win7.sys

20:05:20.0418 2380 RTL8167 - ok

20:05:20.0475 2380 SAlphamHid (e13d43901ec079280a2a9bad9a2ccda7) C:\Windows\system32\DRIVERS\SAlpham64.sys

20:05:20.0477 2380 SAlphamHid - ok

20:05:20.0513 2380 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

20:05:20.0516 2380 sbp2port - ok

20:05:20.0560 2380 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

20:05:20.0561 2380 scfilter - ok

20:05:20.0628 2380 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

20:05:20.0629 2380 secdrv - ok

20:05:20.0689 2380 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

20:05:20.0691 2380 Serenum - ok

20:05:20.0736 2380 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

20:05:20.0738 2380 Serial - ok

20:05:20.0760 2380 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

20:05:20.0762 2380 sermouse - ok

20:05:20.0804 2380 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

20:05:20.0805 2380 sffdisk - ok

20:05:20.0829 2380 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

20:05:20.0830 2380 sffp_mmc - ok

20:05:20.0872 2380 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

20:05:20.0875 2380 sffp_sd - ok

20:05:20.0900 2380 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

20:05:20.0901 2380 sfloppy - ok

20:05:20.0968 2380 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

20:05:20.0969 2380 SiSRaid2 - ok

20:05:20.0994 2380 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

20:05:20.0996 2380 SiSRaid4 - ok

20:05:21.0051 2380 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

20:05:21.0053 2380 Smb - ok

20:05:21.0121 2380 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

20:05:21.0130 2380 spldr - ok

20:05:21.0208 2380 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

20:05:21.0214 2380 srv - ok

20:05:21.0243 2380 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

20:05:21.0248 2380 srv2 - ok

20:05:21.0287 2380 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

20:05:21.0291 2380 srvnet - ok

20:05:21.0354 2380 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

20:05:21.0356 2380 stexstor - ok

20:05:21.0674 2380 STHDA (4304b75094e106fb5423a290c95841e5) C:\Windows\system32\DRIVERS\stwrt64.sys

20:05:21.0680 2380 STHDA - ok

20:05:21.0943 2380 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys

20:05:21.0943 2380 swenum - ok

20:05:22.0126 2380 SynTP (8a3fbcb3d6d4710730d27da4392a4863) C:\Windows\system32\DRIVERS\SynTP.sys

20:05:22.0128 2380 SynTP - ok

20:05:22.0280 2380 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys

20:05:22.0300 2380 Tcpip - ok

20:05:22.0458 2380 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys

20:05:22.0469 2380 TCPIP6 - ok

20:05:22.0586 2380 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

20:05:22.0587 2380 tcpipreg - ok

20:05:22.0607 2380 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

20:05:22.0608 2380 TDPIPE - ok

20:05:22.0628 2380 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys

20:05:22.0629 2380 TDTCP - ok

20:05:22.0692 2380 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

20:05:22.0706 2380 tdx - ok

20:05:22.0767 2380 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys

20:05:22.0768 2380 TermDD - ok

20:05:22.0828 2380 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

20:05:22.0829 2380 tssecsrv - ok

20:05:22.0884 2380 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

20:05:22.0892 2380 TsUsbFlt - ok

20:05:22.0937 2380 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

20:05:22.0939 2380 tunnel - ok

20:05:22.0973 2380 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

20:05:22.0974 2380 uagp35 - ok

20:05:23.0003 2380 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

20:05:23.0007 2380 udfs - ok

20:05:23.0047 2380 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

20:05:23.0048 2380 uliagpkx - ok

20:05:23.0090 2380 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys

20:05:23.0091 2380 umbus - ok

20:05:23.0111 2380 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

20:05:23.0165 2380 UmPass - ok

20:05:23.0335 2380 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys

20:05:23.0337 2380 usbaudio - ok

20:05:23.0365 2380 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

20:05:23.0367 2380 usbccgp - ok

20:05:23.0410 2380 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

20:05:23.0412 2380 usbcir - ok

20:05:23.0437 2380 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys

20:05:23.0439 2380 usbehci - ok

20:05:23.0507 2380 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

20:05:23.0511 2380 usbhub - ok

20:05:23.0535 2380 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys

20:05:23.0536 2380 usbohci - ok

20:05:23.0595 2380 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

20:05:23.0596 2380 usbprint - ok

20:05:23.0636 2380 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

20:05:23.0638 2380 USBSTOR - ok

20:05:23.0671 2380 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys

20:05:23.0672 2380 usbuhci - ok

20:05:23.0730 2380 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys

20:05:23.0733 2380 usbvideo - ok

20:05:23.0790 2380 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

20:05:23.0792 2380 vdrvroot - ok

20:05:23.0899 2380 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

20:05:23.0908 2380 vga - ok

20:05:23.0928 2380 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

20:05:23.0929 2380 VgaSave - ok

20:05:23.0967 2380 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

20:05:23.0970 2380 vhdmp - ok

20:05:24.0005 2380 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

20:05:24.0006 2380 viaide - ok

20:05:24.0029 2380 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

20:05:24.0031 2380 volmgr - ok

20:05:24.0060 2380 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

20:05:24.0069 2380 volmgrx - ok

20:05:24.0095 2380 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

20:05:24.0100 2380 volsnap - ok

20:05:24.0191 2380 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

20:05:24.0193 2380 vsmraid - ok

20:05:24.0231 2380 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

20:05:24.0232 2380 vwifibus - ok

20:05:24.0263 2380 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

20:05:24.0284 2380 vwififlt - ok

20:05:24.0420 2380 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys

20:05:24.0421 2380 vwifimp - ok

20:05:24.0454 2380 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

20:05:24.0455 2380 WacomPen - ok

20:05:24.0511 2380 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

20:05:24.0513 2380 WANARP - ok

20:05:24.0534 2380 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

20:05:24.0535 2380 Wanarpv6 - ok

20:05:24.0598 2380 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

20:05:24.0599 2380 Wd - ok

20:05:24.0633 2380 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

20:05:24.0641 2380 Wdf01000 - ok

20:05:24.0740 2380 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

20:05:24.0741 2380 WfpLwf - ok

20:05:24.0803 2380 WimFltr (b14ef15bd757fa488f9c970eee9c0d35) C:\Windows\system32\DRIVERS\wimfltr.sys

20:05:24.0805 2380 WimFltr - ok

20:05:24.0840 2380 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

20:05:24.0841 2380 WIMMount - ok

20:05:25.0048 2380 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys

20:05:25.0050 2380 WinUsb - ok

20:05:25.0148 2380 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys

20:05:25.0148 2380 WmiAcpi - ok

20:05:25.0514 2380 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

20:05:25.0516 2380 ws2ifsl - ok

20:05:25.0907 2380 WSDPrintDevice (8d918b1db190a4d9b1753a66fa8c96e8) C:\Windows\system32\DRIVERS\WSDPrint.sys

20:05:25.0920 2380 WSDPrintDevice - ok

20:05:26.0133 2380 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

20:05:26.0135 2380 WudfPf - ok

20:05:26.0275 2380 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys

20:05:26.0278 2380 WUDFRd - ok

20:05:26.0430 2380 yukonw7 (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys

20:05:26.0435 2380 yukonw7 - ok

20:05:26.0524 2380 MBR (0x1B8) (c0dcf0ac171db02db8b0014c5d767cf1) \Device\Harddisk0\DR0

20:05:26.0549 2380 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected

20:05:26.0549 2380 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)

20:05:26.0633 2380 Boot (0x1200) (b4a651ea79a9998884da67ecffb5e2e7) \Device\Harddisk0\DR0\Partition0

20:05:26.0634 2380 \Device\Harddisk0\DR0\Partition0 - ok

20:05:26.0646 2380 Boot (0x1200) (42830d70bbef9b5ec0b23baae40fa686) \Device\Harddisk0\DR0\Partition1

20:05:26.0648 2380 \Device\Harddisk0\DR0\Partition1 - ok

20:05:26.0648 2380 ============================================================

20:05:26.0648 2380 Scan finished

20:05:26.0648 2380 ============================================================

20:05:26.0663 2372 Detected object count: 1

20:05:26.0664 2372 Actual detected object count: 1

20:05:48.0961 2372 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - skipped by user

20:05:48.0961 2372 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Skip

Larusso · March 2, 2012

Good work

Execute TDSSKiller.exe and press Start Scan.

Ensure Cure is selected ( it should be by default )
Note: If Cure is not an option, Skip instead, do not choose Delete unless instructed
Click Continue then click Reboot now.

Once complete, a log will be produced at the root drive which is typically C:\

For example, C:\TDSSKiller.2.4.0.0_24.07.2010_13.10.52_log.txt.

Please post the contents of that log in your next reply.

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to this topic How to disable your security applications

====================================================

Double click on combofix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

*Note - if after running ComboFix you see a message similar to 'registry key marked for deletion..' rebooting the machine will resolve that.

Please post in your next reply

TDSSKiller Log

Combofix.txt

RedGem · March 2, 2012

While trying to start the computer in safemode for the first time since last night the Windows Startup Repair feature started to run. I included the information on what actions Startup Repair took. It appears to have restored toe system to 2-28-12. I know I was infected at that point as I had started running scans of Malware and renews my McAfee licences along with cleaning up files that day, and spend the whole next day looking up information on the issue.

I had to redownload TDSSKiller. The computer bluescreened on me two times and McAfee made me restart the system before I was able to run TDSSKiller. Ran TDSSKiller and then downlaoded ComboFix and ran Combofix. I did get the message of Registry key marked for deletion on everything I clicked on so I restarted the computed as suggested.

Startup Repair Info:

Root cause Found:

Book critical file c:\windows\system32\kdcom.dll is corrupt.

Repair action: File repair

Result Failed. Error code = 0x490

Time taken = 5772 ms

Repair action: System Restore

Result: Complete successfully. Error Code = 0x0

Time taken = 640898 ms

09:34:14.0019 1720 TDSS rootkit removing tool 2.7.18.0 Mar 2 2012 09:40:07

09:34:14.0409 1720 ============================================================

09:34:14.0409 1720 Current date / time: 2012/03/02 09:34:14.0409

09:34:14.0409 1720 SystemInfo:

09:34:14.0409 1720

09:34:14.0409 1720 OS Version: 6.1.7601 ServicePack: 1.0

09:34:14.0409 1720 Product type: Workstation

09:34:14.0409 1720 ComputerName: REDGEM

09:34:14.0409 1720 UserName: Ruby

09:34:14.0409 1720 Windows directory: C:\Windows

09:34:14.0409 1720 System windows directory: C:\Windows

09:34:14.0409 1720 Running under WOW64

09:34:14.0409 1720 Processor architecture: Intel x64

09:34:14.0409 1720 Number of processors: 4

09:34:14.0409 1720 Page size: 0x1000

09:34:14.0409 1720 Boot type: Safe boot with network

09:34:14.0409 1720 ============================================================

09:34:14.0784 1720 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

09:34:14.0784 1720 \Device\Harddisk0\DR0:

09:34:14.0784 1720 MBR used

09:34:14.0784 1720 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1D4C000

09:34:14.0784 1720 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1D7E800, BlocksNum 0x236AFAB0

09:34:14.0815 1720 Initialize success

09:34:14.0815 1720 ============================================================

09:35:00.0866 1512 ============================================================

09:35:00.0866 1512 Scan started

09:35:00.0866 1512 Mode: Manual;

09:35:00.0866 1512 ============================================================

09:35:01.0225 1512 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys

09:35:01.0225 1512 1394ohci - ok

09:35:01.0350 1512 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

09:35:01.0350 1512 ACPI - ok

09:35:01.0459 1512 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

09:35:01.0475 1512 AcpiPmi - ok

09:35:01.0631 1512 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

09:35:01.0631 1512 adp94xx - ok

09:35:01.0740 1512 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

09:35:01.0740 1512 adpahci - ok

09:35:01.0865 1512 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

09:35:01.0865 1512 adpu320 - ok

09:35:02.0021 1512 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys

09:35:02.0021 1512 AFD - ok

09:35:02.0130 1512 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

09:35:02.0130 1512 agp440 - ok

09:35:02.0239 1512 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

09:35:02.0239 1512 aliide - ok

09:35:02.0379 1512 Alpham1 (b3e801135e0c81733542c14d9aa8120a) C:\Windows\system32\DRIVERS\Alpham164.sys

09:35:02.0379 1512 Alpham1 - ok

09:35:02.0520 1512 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

09:35:02.0520 1512 amdide - ok

09:35:02.0676 1512 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

09:35:02.0676 1512 AmdK8 - ok

09:35:02.0925 1512 amdkmdag (79a11cb10ff02a8425dabbb040249f7d) C:\Windows\system32\DRIVERS\atikmdag.sys

09:35:03.0066 1512 amdkmdag - ok

09:35:03.0175 1512 amdkmdap (6f6d47246fbb0cf65619684a0f89179e) C:\Windows\system32\DRIVERS\atikmpag.sys

09:35:03.0175 1512 amdkmdap - ok

09:35:03.0315 1512 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

09:35:03.0315 1512 AmdPPM - ok

09:35:03.0440 1512 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

09:35:03.0440 1512 amdsata - ok

09:35:03.0627 1512 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

09:35:03.0643 1512 amdsbs - ok

09:35:03.0752 1512 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

09:35:03.0752 1512 amdxata - ok

09:35:03.0893 1512 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

09:35:03.0908 1512 AppID - ok

09:35:04.0049 1512 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

09:35:04.0049 1512 arc - ok

09:35:04.0064 1512 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

09:35:04.0064 1512 arcsas - ok

09:35:04.0111 1512 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

09:35:04.0111 1512 AsyncMac - ok

09:35:04.0158 1512 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

09:35:04.0158 1512 atapi - ok

09:35:04.0314 1512 AtiHdmiService (2d648572ba9a610952fcafba1e119c2d) C:\Windows\system32\drivers\AtiHdmi.sys

09:35:04.0314 1512 AtiHdmiService - ok

09:35:04.0361 1512 atksgt (fc0e8778c000291caf60eb88c011e931) C:\Windows\system32\DRIVERS\atksgt.sys

09:35:04.0361 1512 atksgt - ok

09:35:04.0517 1512 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

09:35:04.0517 1512 b06bdrv - ok

09:35:04.0657 1512 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

09:35:04.0657 1512 b57nd60a - ok

09:35:04.0797 1512 BCM42RLY (ac4e2d84de54cd3a013aeff0cc56095c) C:\Windows\system32\drivers\BCM42RLY.sys

09:35:04.0797 1512 BCM42RLY - ok

09:35:04.0875 1512 BCM43XX (8b5d16d20774fc3727f44e161be2c0ac) C:\Windows\system32\DRIVERS\bcmwl664.sys

09:35:04.0891 1512 BCM43XX - ok

09:35:05.0031 1512 BcmVWL (d224b2e6bb543f1d8f1177d57fec2950) C:\Windows\system32\DRIVERS\bcmvwl64.sys

09:35:05.0031 1512 BcmVWL - ok

09:35:05.0078 1512 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

09:35:05.0078 1512 Beep - ok

09:35:05.0125 1512 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

09:35:05.0125 1512 blbdrive - ok

09:35:05.0172 1512 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

09:35:05.0172 1512 bowser - ok

09:35:05.0219 1512 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

09:35:05.0219 1512 BrFiltLo - ok

09:35:05.0250 1512 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

09:35:05.0250 1512 BrFiltUp - ok

09:35:05.0265 1512 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

09:35:05.0265 1512 Brserid - ok

09:35:05.0312 1512 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

09:35:05.0312 1512 BrSerWdm - ok

09:35:05.0343 1512 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

09:35:05.0343 1512 BrUsbMdm - ok

09:35:05.0375 1512 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

09:35:05.0375 1512 BrUsbSer - ok

09:35:05.0437 1512 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

09:35:05.0437 1512 BTHMODEM - ok

09:35:05.0499 1512 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

09:35:05.0499 1512 cdfs - ok

09:35:05.0546 1512 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys

09:35:05.0546 1512 cdrom - ok

09:35:05.0609 1512 cfwids (ed0263b2eb24f0f4e3898036fa1d28a1) C:\Windows\system32\drivers\cfwids.sys

09:35:05.0624 1512 cfwids - ok

09:35:05.0687 1512 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

09:35:05.0687 1512 circlass - ok

09:35:05.0765 1512 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

09:35:05.0780 1512 CLFS - ok

09:35:05.0952 1512 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

09:35:05.0952 1512 CmBatt - ok

09:35:05.0983 1512 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

09:35:05.0999 1512 cmdide - ok

09:35:06.0045 1512 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys

09:35:06.0045 1512 CNG - ok

09:35:06.0123 1512 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

09:35:06.0123 1512 Compbatt - ok

09:35:06.0186 1512 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys

09:35:06.0186 1512 CompositeBus - ok

09:35:06.0248 1512 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

09:35:06.0248 1512 crcdisk - ok

09:35:06.0342 1512 CtClsFlt (ed5cf92396a62f4c15110dcdb5e854d9) C:\Windows\system32\DRIVERS\CtClsFlt.sys

09:35:06.0342 1512 CtClsFlt - ok

09:35:06.0435 1512 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

09:35:06.0435 1512 DfsC - ok

09:35:06.0498 1512 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

09:35:06.0498 1512 discache - ok

09:35:06.0576 1512 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

09:35:06.0576 1512 Disk - ok

09:35:06.0654 1512 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

09:35:06.0654 1512 drmkaud - ok

09:35:06.0747 1512 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

09:35:06.0747 1512 DXGKrnl - ok

09:35:06.0857 1512 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

09:35:06.0903 1512 ebdrv - ok

09:35:07.0044 1512 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

09:35:07.0059 1512 elxstor - ok

09:35:07.0091 1512 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

09:35:07.0091 1512 ErrDev - ok

09:35:07.0137 1512 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

09:35:07.0137 1512 exfat - ok

09:35:07.0184 1512 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

09:35:07.0184 1512 fastfat - ok

09:35:07.0247 1512 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

09:35:07.0247 1512 fdc - ok

09:35:07.0278 1512 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

09:35:07.0278 1512 FileInfo - ok

09:35:07.0309 1512 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

09:35:07.0309 1512 Filetrace - ok

09:35:07.0325 1512 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

09:35:07.0325 1512 flpydisk - ok

09:35:07.0387 1512 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

09:35:07.0387 1512 FltMgr - ok

09:35:07.0418 1512 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

09:35:07.0434 1512 FsDepends - ok

09:35:07.0449 1512 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

09:35:07.0449 1512 Fs_Rec - ok

09:35:07.0496 1512 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

09:35:07.0496 1512 fvevol - ok

09:35:07.0543 1512 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

09:35:07.0543 1512 gagp30kx - ok

09:35:07.0637 1512 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

09:35:07.0637 1512 hcw85cir - ok

09:35:07.0683 1512 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys

09:35:07.0683 1512 HdAudAddService - ok

09:35:07.0746 1512 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys

09:35:07.0761 1512 HDAudBus - ok

09:35:07.0824 1512 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys

09:35:07.0824 1512 HECIx64 - ok

09:35:07.0855 1512 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

09:35:07.0855 1512 HidBatt - ok

09:35:07.0902 1512 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

09:35:07.0902 1512 HidBth - ok

09:35:07.0933 1512 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

09:35:07.0933 1512 HidIr - ok

09:35:07.0964 1512 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys

09:35:07.0964 1512 HidUsb - ok

09:35:08.0027 1512 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

09:35:08.0027 1512 HpSAMD - ok

09:35:08.0089 1512 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

09:35:08.0105 1512 HTTP - ok

09:35:08.0136 1512 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

09:35:08.0136 1512 hwpolicy - ok

09:35:08.0198 1512 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys

09:35:08.0198 1512 i8042prt - ok

09:35:08.0214 1512 iaStor (2064090c9faad92c090d77e50e735b2e) C:\Windows\system32\DRIVERS\iaStor.sys

09:35:08.0229 1512 iaStor - ok

09:35:08.0276 1512 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

09:35:08.0276 1512 iaStorV - ok

09:35:08.0448 1512 igfx (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys

09:35:08.0557 1512 igfx - ok

09:35:08.0682 1512 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

09:35:08.0682 1512 iirsp - ok

09:35:08.0713 1512 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

09:35:08.0713 1512 intelide - ok

09:35:08.0807 1512 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

09:35:08.0807 1512 intelppm - ok

09:35:08.0838 1512 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

09:35:08.0838 1512 IpFilterDriver - ok

09:35:08.0869 1512 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

09:35:08.0869 1512 IPMIDRV - ok

09:35:08.0885 1512 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

09:35:08.0885 1512 IPNAT - ok

09:35:08.0931 1512 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

09:35:08.0931 1512 IRENUM - ok

09:35:08.0947 1512 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

09:35:08.0947 1512 isapnp - ok

09:35:08.0994 1512 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

09:35:08.0994 1512 iScsiPrt - ok

09:35:09.0025 1512 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

09:35:09.0025 1512 kbdclass - ok

09:35:09.0072 1512 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys

09:35:09.0072 1512 kbdhid - ok

09:35:09.0134 1512 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys

09:35:09.0134 1512 KSecDD - ok

09:35:09.0165 1512 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys

09:35:09.0165 1512 KSecPkg - ok

09:35:09.0212 1512 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

09:35:09.0212 1512 ksthunk - ok

09:35:09.0259 1512 lirsgt (156ab2e56dc3ca0b582e3362e07cded7) C:\Windows\system32\DRIVERS\lirsgt.sys

09:35:09.0259 1512 lirsgt - ok

09:35:09.0290 1512 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

09:35:09.0290 1512 lltdio - ok

09:35:09.0368 1512 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

09:35:09.0368 1512 LSI_FC - ok

09:35:09.0384 1512 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

09:35:09.0384 1512 LSI_SAS - ok

09:35:09.0399 1512 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

09:35:09.0399 1512 LSI_SAS2 - ok

09:35:09.0431 1512 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

09:35:09.0431 1512 LSI_SCSI - ok

09:35:09.0462 1512 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

09:35:09.0462 1512 luafv - ok

09:35:09.0555 1512 MBAMProtector (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys

09:35:09.0555 1512 MBAMProtector - ok

09:35:09.0680 1512 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

09:35:09.0680 1512 megasas - ok

09:35:09.0696 1512 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

09:35:09.0696 1512 MegaSR - ok

09:35:09.0727 1512 mfeapfk (ef3acfb7e3f82d5f7cde9ef5f0a4e2e2) C:\Windows\system32\drivers\mfeapfk.sys

09:35:09.0727 1512 mfeapfk - ok

09:35:09.0758 1512 mfeavfk (e7a60bdb4365b561d896019b82fb7dd0) C:\Windows\system32\drivers\mfeavfk.sys

09:35:09.0758 1512 mfeavfk - ok

09:35:09.0821 1512 mfefirek (670dffe55e2f9ab99d9169c428bcece9) C:\Windows\system32\drivers\mfefirek.sys

09:35:09.0821 1512 mfefirek - ok

09:35:09.0852 1512 mfehidk (1892616b7f9291fd77c3fa0a5811fe9f) C:\Windows\system32\drivers\mfehidk.sys

09:35:09.0852 1512 mfehidk - ok

09:35:09.0899 1512 mfenlfk (1721261c77f6e7a9e0cb51b7d9f31b60) C:\Windows\system32\DRIVERS\mfenlfk.sys

09:35:09.0899 1512 mfenlfk - ok

09:35:09.0945 1512 mferkdet (65776bd8029e409935b90de30bf99526) C:\Windows\system32\drivers\mferkdet.sys

09:35:09.0945 1512 mferkdet - ok

09:35:09.0977 1512 mfewfpk (4f17d8b85b903d96ef7033bb6ef50516) C:\Windows\system32\drivers\mfewfpk.sys

09:35:09.0992 1512 mfewfpk - ok

09:35:10.0039 1512 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

09:35:10.0039 1512 Modem - ok

09:35:10.0070 1512 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

09:35:10.0070 1512 monitor - ok

09:35:10.0101 1512 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

09:35:10.0101 1512 mouclass - ok

09:35:10.0148 1512 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

09:35:10.0148 1512 mouhid - ok

09:35:10.0164 1512 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

09:35:10.0179 1512 mountmgr - ok

09:35:10.0195 1512 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

09:35:10.0195 1512 mpio - ok

09:35:10.0242 1512 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

09:35:10.0242 1512 mpsdrv - ok

09:35:10.0257 1512 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

09:35:10.0257 1512 MRxDAV - ok

09:35:10.0273 1512 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

09:35:10.0273 1512 mrxsmb - ok

09:35:10.0304 1512 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

09:35:10.0304 1512 mrxsmb10 - ok

09:35:10.0320 1512 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

09:35:10.0335 1512 mrxsmb20 - ok

09:35:10.0367 1512 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

09:35:10.0367 1512 msahci - ok

09:35:10.0382 1512 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

09:35:10.0382 1512 msdsm - ok

09:35:10.0413 1512 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

09:35:10.0413 1512 Msfs - ok

09:35:10.0429 1512 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

09:35:10.0429 1512 mshidkmdf - ok

09:35:10.0445 1512 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

09:35:10.0445 1512 msisadrv - ok

09:35:10.0491 1512 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

09:35:10.0491 1512 MSKSSRV - ok

09:35:10.0523 1512 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

09:35:10.0523 1512 MSPCLOCK - ok

09:35:10.0554 1512 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

09:35:10.0554 1512 MSPQM - ok

09:35:10.0569 1512 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

09:35:10.0585 1512 MsRPC - ok

09:35:10.0616 1512 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys

09:35:10.0616 1512 mssmbios - ok

09:35:10.0679 1512 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

09:35:10.0679 1512 MSTEE - ok

09:35:10.0694 1512 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

09:35:10.0694 1512 MTConfig - ok

09:35:10.0725 1512 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

09:35:10.0725 1512 Mup - ok

09:35:10.0788 1512 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

09:35:10.0788 1512 NativeWifiP - ok

09:35:10.0850 1512 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

09:35:10.0850 1512 NDIS - ok

09:35:10.0897 1512 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

09:35:10.0897 1512 NdisCap - ok

09:35:10.0944 1512 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

09:35:10.0944 1512 NdisTapi - ok

09:35:10.0991 1512 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

09:35:10.0991 1512 Ndisuio - ok

09:35:11.0022 1512 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

09:35:11.0022 1512 NdisWan - ok

09:35:11.0037 1512 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

09:35:11.0037 1512 NDProxy - ok

09:35:11.0053 1512 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

09:35:11.0053 1512 NetBIOS - ok

09:35:11.0084 1512 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

09:35:11.0084 1512 NetBT - ok

09:35:11.0131 1512 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

09:35:11.0131 1512 nfrd960 - ok

09:35:11.0178 1512 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

09:35:11.0178 1512 Npfs - ok

09:35:11.0240 1512 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

09:35:11.0240 1512 nsiproxy - ok

09:35:11.0287 1512 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

09:35:11.0303 1512 Ntfs - ok

09:35:11.0318 1512 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

09:35:11.0318 1512 Null - ok

09:35:11.0365 1512 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

09:35:11.0365 1512 nvraid - ok

09:35:11.0381 1512 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

09:35:11.0381 1512 nvstor - ok

09:35:11.0412 1512 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

09:35:11.0412 1512 nv_agp - ok

09:35:11.0443 1512 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

09:35:11.0443 1512 ohci1394 - ok

09:35:11.0505 1512 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

09:35:11.0505 1512 Parport - ok

09:35:11.0552 1512 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys

09:35:11.0552 1512 partmgr - ok

09:35:11.0568 1512 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

09:35:11.0568 1512 pci - ok

09:35:11.0599 1512 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

09:35:11.0599 1512 pciide - ok

09:35:11.0615 1512 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

09:35:11.0630 1512 pcmcia - ok

09:35:11.0646 1512 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

09:35:11.0646 1512 pcw - ok

09:35:11.0677 1512 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

09:35:11.0693 1512 PEAUTH - ok

09:35:11.0786 1512 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

09:35:11.0786 1512 PptpMiniport - ok

09:35:11.0817 1512 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

09:35:11.0833 1512 Processor - ok

09:35:11.0880 1512 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

09:35:11.0880 1512 Psched - ok

09:35:11.0895 1512 PxHlpa64 (87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys

09:35:11.0895 1512 PxHlpa64 - ok

09:35:11.0942 1512 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

09:35:11.0958 1512 ql2300 - ok

09:35:11.0989 1512 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

09:35:11.0989 1512 ql40xx - ok

09:35:12.0020 1512 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

09:35:12.0020 1512 QWAVEdrv - ok

09:35:12.0051 1512 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

09:35:12.0051 1512 RasAcd - ok

09:35:12.0114 1512 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

09:35:12.0114 1512 RasAgileVpn - ok

09:35:12.0129 1512 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

09:35:12.0129 1512 Rasl2tp - ok

09:35:12.0145 1512 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

09:35:12.0145 1512 RasPppoe - ok

09:35:12.0161 1512 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

09:35:12.0161 1512 RasSstp - ok

09:35:12.0192 1512 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

09:35:12.0192 1512 rdbss - ok

09:35:12.0207 1512 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

09:35:12.0207 1512 rdpbus - ok

09:35:12.0239 1512 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

09:35:12.0239 1512 RDPCDD - ok

09:35:12.0270 1512 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

09:35:12.0270 1512 RDPENCDD - ok

09:35:12.0317 1512 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

09:35:12.0317 1512 RDPREFMP - ok

09:35:12.0348 1512 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys

09:35:12.0348 1512 RDPWD - ok

09:35:12.0379 1512 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

09:35:12.0379 1512 rdyboost - ok

09:35:12.0426 1512 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

09:35:12.0426 1512 rspndr - ok

09:35:12.0457 1512 RSUSBSTOR (30f463768d5143bfd7b2df822b53cf4d) C:\Windows\system32\Drivers\RtsUStor.sys

09:35:12.0473 1512 RSUSBSTOR - ok

09:35:12.0488 1512 RTL8167 (fd978b2bf8a9b2390dcbef435e9c1f9f) C:\Windows\system32\DRIVERS\Rt64win7.sys

09:35:12.0488 1512 RTL8167 - ok

09:35:12.0551 1512 SAlphamHid (e13d43901ec079280a2a9bad9a2ccda7) C:\Windows\system32\DRIVERS\SAlpham64.sys

09:35:12.0551 1512 SAlphamHid - ok

09:35:12.0566 1512 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

09:35:12.0582 1512 sbp2port - ok

09:35:12.0613 1512 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

09:35:12.0613 1512 scfilter - ok

09:35:12.0660 1512 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

09:35:12.0660 1512 secdrv - ok

09:35:12.0707 1512 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

09:35:12.0707 1512 Serenum - ok

09:35:12.0753 1512 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

09:35:12.0753 1512 Serial - ok

09:35:12.0769 1512 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

09:35:12.0785 1512 sermouse - ok

09:35:12.0800 1512 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

09:35:12.0800 1512 sffdisk - ok

09:35:12.0816 1512 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

09:35:12.0816 1512 sffp_mmc - ok

09:35:12.0816 1512 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

09:35:12.0816 1512 sffp_sd - ok

09:35:12.0847 1512 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

09:35:12.0863 1512 sfloppy - ok

09:35:12.0925 1512 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

09:35:12.0925 1512 SiSRaid2 - ok

09:35:12.0925 1512 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

09:35:12.0941 1512 SiSRaid4 - ok

09:35:12.0987 1512 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

09:35:12.0987 1512 Smb - ok

09:35:13.0050 1512 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

09:35:13.0050 1512 spldr - ok

09:35:13.0097 1512 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

09:35:13.0097 1512 srv - ok

09:35:13.0112 1512 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

09:35:13.0112 1512 srv2 - ok

09:35:13.0143 1512 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

09:35:13.0143 1512 srvnet - ok

09:35:13.0175 1512 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

09:35:13.0175 1512 stexstor - ok

09:35:13.0221 1512 STHDA (4304b75094e106fb5423a290c95841e5) C:\Windows\system32\DRIVERS\stwrt64.sys

09:35:13.0237 1512 STHDA - ok

09:35:13.0253 1512 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys

09:35:13.0253 1512 swenum - ok

09:35:13.0284 1512 SynTP (8a3fbcb3d6d4710730d27da4392a4863) C:\Windows\system32\DRIVERS\SynTP.sys

09:35:13.0299 1512 SynTP - ok

09:35:13.0377 1512 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys

09:35:13.0393 1512 Tcpip - ok

09:35:13.0533 1512 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys

09:35:13.0549 1512 TCPIP6 - ok

09:35:13.0580 1512 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

09:35:13.0580 1512 tcpipreg - ok

09:35:13.0611 1512 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

09:35:13.0611 1512 TDPIPE - ok

09:35:13.0627 1512 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys

09:35:13.0627 1512 TDTCP - ok

09:35:13.0658 1512 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

09:35:13.0658 1512 tdx - ok

09:35:13.0674 1512 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys

09:35:13.0674 1512 TermDD - ok

09:35:13.0736 1512 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

09:35:13.0736 1512 tssecsrv - ok

09:35:13.0799 1512 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

09:35:13.0799 1512 TsUsbFlt - ok

09:35:13.0845 1512 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

09:35:13.0845 1512 tunnel - ok

09:35:13.0877 1512 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

09:35:13.0877 1512 uagp35 - ok

09:35:13.0908 1512 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

09:35:13.0923 1512 udfs - ok

09:35:13.0955 1512 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

09:35:13.0955 1512 uliagpkx - ok

09:35:13.0986 1512 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys

09:35:13.0986 1512 umbus - ok

09:35:14.0017 1512 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

09:35:14.0017 1512 UmPass - ok

09:35:14.0111 1512 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys

09:35:14.0111 1512 usbaudio - ok

09:35:14.0126 1512 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

09:35:14.0126 1512 usbccgp - ok

09:35:14.0173 1512 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

09:35:14.0173 1512 usbcir - ok

09:35:14.0189 1512 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys

09:35:14.0189 1512 usbehci - ok

09:35:14.0235 1512 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

09:35:14.0235 1512 usbhub - ok

09:35:14.0251 1512 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys

09:35:14.0251 1512 usbohci - ok

09:35:14.0282 1512 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

09:35:14.0282 1512 usbprint - ok

09:35:14.0298 1512 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

09:35:14.0313 1512 USBSTOR - ok

09:35:14.0329 1512 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys

09:35:14.0329 1512 usbuhci - ok

09:35:14.0376 1512 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys

09:35:14.0376 1512 usbvideo - ok

09:35:14.0438 1512 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

09:35:14.0438 1512 vdrvroot - ok

09:35:14.0485 1512 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

09:35:14.0485 1512 vga - ok

09:35:14.0501 1512 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

09:35:14.0516 1512 VgaSave - ok

09:35:14.0547 1512 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

09:35:14.0547 1512 vhdmp - ok

09:35:14.0579 1512 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

09:35:14.0579 1512 viaide - ok

09:35:14.0610 1512 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

09:35:14.0610 1512 volmgr - ok

09:35:14.0625 1512 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

09:35:14.0625 1512 volmgrx - ok

09:35:14.0672 1512 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

09:35:14.0672 1512 volsnap - ok

09:35:14.0688 1512 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

09:35:14.0703 1512 vsmraid - ok

09:35:14.0735 1512 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

09:35:14.0735 1512 vwifibus - ok

09:35:14.0750 1512 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

09:35:14.0750 1512 vwififlt - ok

09:35:14.0797 1512 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys

09:35:14.0797 1512 vwifimp - ok

09:35:14.0828 1512 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

09:35:14.0828 1512 WacomPen - ok

09:35:14.0875 1512 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

09:35:14.0875 1512 WANARP - ok

09:35:14.0875 1512 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

09:35:14.0875 1512 Wanarpv6 - ok

09:35:14.0922 1512 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

09:35:14.0922 1512 Wd - ok

09:35:14.0953 1512 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

09:35:14.0969 1512 Wdf01000 - ok

09:35:15.0015 1512 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

09:35:15.0015 1512 WfpLwf - ok

09:35:15.0062 1512 WimFltr (b14ef15bd757fa488f9c970eee9c0d35) C:\Windows\system32\DRIVERS\wimfltr.sys

09:35:15.0062 1512 WimFltr - ok

09:35:15.0093 1512 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

09:35:15.0093 1512 WIMMount - ok

09:35:15.0187 1512 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys

09:35:15.0187 1512 WinUsb - ok

09:35:15.0249 1512 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys

09:35:15.0249 1512 WmiAcpi - ok

09:35:15.0312 1512 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

09:35:15.0312 1512 ws2ifsl - ok

09:35:15.0343 1512 WSDPrintDevice (8d918b1db190a4d9b1753a66fa8c96e8) C:\Windows\system32\DRIVERS\WSDPrint.sys

09:35:15.0359 1512 WSDPrintDevice - ok

09:35:15.0374 1512 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

09:35:15.0374 1512 WudfPf - ok

09:35:15.0405 1512 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys

09:35:15.0405 1512 WUDFRd - ok

09:35:15.0437 1512 yukonw7 (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys

09:35:15.0452 1512 yukonw7 - ok

09:35:15.0499 1512 MBR (0x1B8) (c0dcf0ac171db02db8b0014c5d767cf1) \Device\Harddisk0\DR0

09:35:15.0515 1512 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected

09:35:15.0515 1512 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)

09:35:15.0546 1512 Boot (0x1200) (b4a651ea79a9998884da67ecffb5e2e7) \Device\Harddisk0\DR0\Partition0

09:35:15.0546 1512 \Device\Harddisk0\DR0\Partition0 - ok

09:35:15.0561 1512 Boot (0x1200) (42830d70bbef9b5ec0b23baae40fa686) \Device\Harddisk0\DR0\Partition1

09:35:15.0561 1512 \Device\Harddisk0\DR0\Partition1 - ok

09:35:15.0561 1512 ============================================================

09:35:15.0561 1512 Scan finished

09:35:15.0561 1512 ============================================================

09:35:15.0608 1616 Detected object count: 1

09:35:15.0608 1616 Actual detected object count: 1

09:35:40.0069 1616 \Device\Harddisk0\DR0\# - copied to quarantine

09:35:40.0069 1616 \Device\Harddisk0\DR0 - copied to quarantine

09:35:40.0085 1616 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine

09:35:40.0085 1616 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine

09:35:40.0085 1616 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine

09:35:40.0085 1616 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine

09:35:40.0100 1616 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine

09:35:40.0100 1616 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine

09:35:40.0147 1616 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine

09:35:40.0147 1616 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine

09:35:40.0147 1616 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine

09:35:40.0147 1616 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine

09:35:40.0225 1616 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot

09:35:40.0225 1616 \Device\Harddisk0\DR0 - ok

09:35:40.0319 1616 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure

09:35:51.0379 1660 Deinitialize success

ComboFix 12-03-02.01 - Ruby 03/02/2012 9:52.1.4 - x64 NETWORK

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3959.3257 [GMT -5:00]

Running from: c:\users\Ruby\Desktop\ComboFix.exe

AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Ruby\AppData\Local\Microsoft\Windows\Temporary Internet Files\{85343B55-A649-4EA8-ABD2-3BAD863EEC7D}.xps

c:\users\Ruby\AppData\Local\Microsoft\Windows\Temporary Internet Files\{AE55AFD4-E22C-41A3-9396-A1969BA5AA90}.xps

c:\windows\svchost.exe

.

((((((((((((((((((((((((( Files Created from 2012-02-02 to 2012-03-02 )))))))))))))))))))))))))))))))

.

2012-03-02 14:35 . 2012-03-02 14:35 -------- d-----w- C:\TDSSKiller_Quarantine

2012-02-29 23:39 . 2012-02-29 23:39 -------- d-sh--w- c:\windows\SysWow64\%USERPROFILE%

2012-02-29 19:30 . 2012-02-29 19:30 -------- d-----w- C:\6b8eae85aeac68d7299db7ed

2012-02-29 19:17 . 2012-02-29 19:17 -------- d-----w- c:\users\Ruby\AppData\Roaming\ParetoLogic

2012-02-29 19:17 . 2012-02-29 19:17 -------- d-----w- c:\users\Ruby\AppData\Roaming\DriverCure

2012-02-29 19:17 . 2012-02-29 19:29 -------- d-----w- c:\programdata\ParetoLogic

2012-02-29 02:54 . 2012-02-29 02:54 -------- d-----w- c:\users\Ruby\AppData\Local\McAfee Anti-Theft

2012-02-25 15:26 . 2012-02-25 15:26 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%

2012-02-15 08:53 . 2012-01-04 10:44 509952 ----a-w- c:\windows\system32\ntshrui.dll

2012-02-15 08:53 . 2012-01-04 08:58 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll

2012-02-15 08:53 . 2011-12-30 06:26 515584 ----a-w- c:\windows\system32\timedate.cpl

2012-02-15 08:53 . 2011-12-30 05:27 478720 ----a-w- c:\windows\SysWow64\timedate.cpl

2012-02-15 08:53 . 2012-01-14 04:06 3145728 ----a-w- c:\windows\system32\win32k.sys

2012-02-15 08:53 . 2011-12-28 03:59 498688 ----a-w- c:\windows\system32\drivers\afd.sys

2012-02-15 08:53 . 2011-12-16 08:46 634880 ----a-w- c:\windows\system32\msvcrt.dll

2012-02-15 08:53 . 2011-12-16 07:52 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-15 19:42 . 2011-05-17 12:53 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-12-12 00:07 . 2011-12-12 00:07 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-12-10 20:24 . 2011-12-14 05:09 23152 ----a-w- c:\windows\system32\drivers\mbam.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-06-08 284696]

"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-06-02 98304]

"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-11-22 1675160]

"dellsupportcenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

2;2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-27 136176]

R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]

R3 Amazon Download Agent;Amazon Download Agent;c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2009-10-23 401920]

R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x]

R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]

R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-27 136176]

R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

R3 SAlphamHid;SteelHIDSvc;c:\windows\system32\DRIVERS\SAlpham64.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

R4 McOobeSv;McAfee OOBE Service;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-27 249936]

S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-06-08 13336]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]

S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-01-27 249936]

S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-10-18 208536]

S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2011-10-18 161168]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 BcmVWL;Broadcom Virtual Wireless;c:\windows\system32\DRIVERS\bcmvwl64.sys [x]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

*Deregistered* - mfeavfk01

.

Contents of the 'Scheduled Tasks' folder

.

2012-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-27 17:30]

.

2012-02-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-27 17:30]

.

2012-02-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2932831676-3308562004-1232316635-1001Core.job

- c:\users\Ruby\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-08 16:45]

.

2012-03-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2932831676-3308562004-1232316635-1001UA.job

- c:\users\Ruby\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-08 16:45]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2010-01-06 3179288]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-06-18 487424]

"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2010-02-03 5712896]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.mindspring.com/~braininajar/

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-{25515A79-C1C7-4B97-97F8-31A711694487} - (no file)

Wow6432Node-HKCU-Run-Spotify - c:\users\Ruby\AppData\Roaming\Spotify\Spotify.exe

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{7B13EC3E-999A-4B70-B9CB-2617B8323822} - (no file)

ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-Heroes of Might and Magic IV - g:\video games\Heros\Heroes of Might and Magic IV.isu

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files (x86)\Dell Support Center\bin\sprtsvc.exe

.

**************************************************************************

.

Completion time: 2012-03-02 10:14:33 - machine was rebooted

ComboFix-quarantined-files.txt 2012-03-02 15:14

.

Pre-Run: 167,768,920,064 bytes free

Post-Run: 168,920,104,960 bytes free

.

- - End Of File - - 2A4661ADD74BF29885F8580C33BBE1DB

Larusso · March 2, 2012

Hy there.

Are you now able to reboot your OS in Normal Mode ?

RedGem · March 2, 2012

Yes I am able to boot in normal mode.

Larusso · March 3, 2012

Great

Please boot your OS in Normal Mode and run Combofix.exe again.

Make sure all your Anti Virus and Spyware applications are disabled.

Please post the C:\Combofix.txt in your next reply and let me know how your system is behaving now

RedGem · March 4, 2012

Okay Ran combo fix again, turned off Malware and Mcafee, and checked windows defender and it said it was off but I see at the top of the combofix log that it says windows defender is enabled. I double checked and confirmed that windows defender was turned off. It had a big red box around it and was asking if I wanted to turn it on. I am unsure now thou if it was truely off or not. Also I have tried to post the log a few times and it keeps telling me the post is to long so I am breaking the log up and putting it in multiple posts below

ComboFix 12-03-02.01 - Ruby 03/03/2012 20:37:04.2.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3959.2497 [GMT -5:00]

Running from: c:\users\Ruby\Desktop\ComboFix.exe

AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2012-02-04 to 2012-03-04 )))))))))))))))))))))))))))))))

.

2012-03-04 01:49 . 2012-03-04 01:49 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-03-04 01:34 . 2011-04-11 19:29 71800 ----a-w- c:\windows\system32\drivers\McPvDrv.sys

2012-03-04 01:28 . 2012-03-04 01:28 -------- d-----w- c:\program files (x86)\McAfee.com

2012-03-04 01:28 . 2012-03-04 01:28 -------- d-----w- c:\program files (x86)\Common Files\McAfee

2012-03-04 01:28 . 2011-10-15 17:16 10248 ----a-w- c:\windows\system32\drivers\mfeclnk.sys

2012-03-04 01:28 . 2011-10-15 17:16 75808 ----a-w- c:\windows\system32\drivers\mfenlfk.sys

2012-03-04 01:28 . 2011-10-15 17:16 65264 ----a-w- c:\windows\system32\drivers\cfwids.sys

2012-03-04 01:28 . 2011-10-15 17:16 481768 ----a-w- c:\windows\system32\drivers\mfefirek.sys

2012-03-04 01:28 . 2011-10-15 17:16 284648 ----a-w- c:\windows\system32\drivers\mfewfpk.sys

2012-03-04 01:28 . 2011-10-15 17:16 229528 ----a-w- c:\windows\system32\drivers\mfeavfk.sys

2012-03-04 01:28 . 2011-10-15 17:16 100912 ----a-w- c:\windows\system32\drivers\mferkdet.sys

2012-03-04 01:27 . 2012-03-04 01:27 -------- d-----w- c:\program files\McAfee.com

2012-03-04 01:15 . 2011-11-18 21:36 161168 ----a-w- c:\windows\system32\mfevtps.exe

2012-03-04 00:46 . 2012-02-20 06:05 8643640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BC2D034D-5A6A-49C6-AC46-578C11DB3019}\mpengine.dll