ShatteredFoX Posted March 4, 2012 ID:532575 Share Posted March 4, 2012 This malware has been running me up the wall. Malwarebytes keeps blasting off warnings and everytime it removes it, it simply replace itself.There is also a google redirect virus, I'm not sure where it's coming from but it is blocking me from anything google related including captchas.Attach.txtDDS.txt Link to post Share on other sites More sharing options...
ShatteredFoX Posted March 7, 2012 Author ID:533179 Share Posted March 7, 2012 I don't know your policies on bumping your own thread, but I haven't had a reply in over 60+ hours and getting close to page 4. If I was not supposed to bump I apologize..DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_22Run by ShatteredFoX at 8:19:18 on 2012-03-04Microsoft Windows 7 Ultimate 6.1.7601.1.932.81.1033.18.4095.1837 [GMT -5:00].SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\system32\atiesrxx.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\atieclxx.exeC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\spoolsv.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Windows\system32\taskhost.exeC:\Windows\system32\Dwm.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeC:\Windows\Explorer.EXEC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exec:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exeC:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exec:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exeC:\Windows\system32\svchost.exe -k imgsvcC:\Windows\System32\svchost.exe -k secsvcsC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\Windows\system32\SearchIndexer.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Program Files\Zune\ZuneLauncher.exeC:\Program Files\Microsoft IntelliPoint\ipoint.exeC:\Program Files (x86)\Skype\Phone\Skype.exeC:\Program Files (x86)\DAEMON Tools Lite\DTLite.exeC:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exeC:\Program Files (x86)\OpenOffice.org 3\program\soffice.exeC:\Program Files (x86)\lg_fwupdate\fwupdate.exeC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files (x86)\Unlocker\UnlockerAssistant.exeC:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\mswinext.exeC:\ProgramData\confighst.exeC:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin-netsvcsC:\Windows\system32\conhost.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Windows\System32\svchost.exe -k LocalServicePeerNetC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeC:\Windows\SysWOW64\NOTEPAD.EXEC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Windows\SysWOW64\cmd.exeC:\Windows\system32\conhost.exeC:\Windows\SysWOW64\cscript.exeC:\Windows\system32\wbem\wmiprvse.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.google.com/BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dllBHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllBHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dllBHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllBHO: Microsoft Web Test Recorder 10.0 Helper: {dda57003-0068-4ed2-9d32-4d1ec707d94d} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dllTB: @C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dllTB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dlluRun: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exeuRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimizeduRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorunuRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silentuRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"uRun: [confighst] C:\ProgramData\confighst.exeuRun: [cschar] C:\Users\ShatteredFoX\AppData\Roaming\cschar.exemRun: [LGODDFU] "C:\Program Files (x86)\lg_fwupdate\fwupdate.exe" blrunmRun: [updatePSTShortCut] "C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttraymRun: [unlockerAssistant] "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe"mRun: [bing Bar] "C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\mswinext.exe"mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resumemRun: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exemRun: [confighst] C:\ProgramData\confighst.exemRun: [cschar] C:\Users\ShatteredFoX\AppData\Roaming\cschar.exedRun: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exedRun: [confighst] C:\ProgramData\confighst.exedRun: [cschar] C:\Windows\system32\config\systemprofile\AppData\Roaming\cschar.exeStartupFolder: C:\Users\SHATTE~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exeStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exemPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableLUA = 0 (0x0)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)mPolicies-system: PromptOnSecureDesktop = 0 (0x0)IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cabTCP: DhcpNameServer = 75.75.75.75 75.75.76.76TCP: Interfaces\{670B7918-13C2-47C3-B891-39BAAB0048C8} : DhcpNameServer = 75.75.75.75 75.75.76.76Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllBHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO-X64: AcroIEHelperStub - No FileBHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dllBHO-X64: Search Helper - No FileBHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllBHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllBHO-X64: SkypeIEPluginBHO - No FileBHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dllBHO-X64: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dllBHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllBHO-X64: Microsoft Web Test Recorder 10.0 Helper: {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dllTB-X64: @C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dllTB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllmRun-x64: [LGODDFU] "C:\Program Files (x86)\lg_fwupdate\fwupdate.exe" blrunmRun-x64: [updatePSTShortCut] "C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttraymRun-x64: [unlockerAssistant] "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe"mRun-x64: [bing Bar] "C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\mswinext.exe"mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resumemRun-x64: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exemRun-x64: [confighst] C:\ProgramData\confighst.exemRun-x64: [cschar] C:\Users\ShatteredFoX\AppData\Roaming\cschar.exeHosts: 94.63.147.16 www.google.comHosts: 94.63.147.17 www.bing.com.================= FIREFOX ===================.FF - ProfilePath - C:\Users\ShatteredFoX\AppData\Roaming\Mozilla\Firefox\Profiles\992wb1ws.default\FF - prefs.js: browser.search.selectedEngine - YahooFF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dllFF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dllFF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dllFF - plugin: C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dllFF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dllFF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dllFF - plugin: C:\Users\ShatteredFoX\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dllFF - plugin: C:\Users\ShatteredFoX\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll.============= SERVICES / DRIVERS ===============.R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [2012-2-5 8704]R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-2-9 652360]R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-10-5 136176]S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-10-5 136176]S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]S3 netr28ux;RT2870 USB Wireless LAN Card Driver for Vista;C:\Windows\system32\DRIVERS\netr28ux.sys --> C:\Windows\system32\DRIVERS\netr28ux.sys [?]S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]S3 Synth3dVsc;Synth3dVsc;C:\Windows\system32\drivers\synth3dvsc.sys --> C:\Windows\system32\drivers\synth3dvsc.sys [?]S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys --> C:\Windows\system32\drivers\terminpt.sys [?]S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]S3 tsusbhub;tsusbhub;C:\Windows\system32\drivers\tsusbhub.sys --> C:\Windows\system32\drivers\tsusbhub.sys [?]S3 VSPerfDrv100;Performance Tools Driver 10.0;C:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [2010-3-17 68440]S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]S3 WMZuneComm;Zune Windows Mobile Connectivity Service;C:\Program Files\Zune\WMZuneComm.exe [2011-8-5 306400]S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files\Microsoft SQL Server\100\Shared\sqladhlp.exe [2009-7-22 61976]S4 RsFx0103;RsFx0103 Driver;C:\Windows\system32\DRIVERS\RsFx0103.sys --> C:\Windows\system32\DRIVERS\RsFx0103.sys [?]S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-3-30 427880].=============== Created Last 30 ================.2012-03-04 12:47:43 72248 ----a-w- C:\Users\ShatteredFoX\AppData\Roaming\cschar.exe2012-03-04 10:50:27 -------- d-----w- C:\Program Files (x86)\UnHackMe2012-03-04 10:23:46 -------- d-----w- C:\Users\ShatteredFoX\AppData\Roaming\ParetoLogic2012-03-04 10:23:46 -------- d-----w- C:\Users\ShatteredFoX\AppData\Roaming\DriverCure2012-03-04 10:23:20 -------- d-----w- C:\ProgramData\ParetoLogic2012-03-04 10:23:20 -------- d-----w- C:\Program Files (x86)\ParetoLogic2012-03-04 10:23:20 -------- d-----w- C:\Program Files (x86)\Common Files\ParetoLogic2012-03-04 10:12:34 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D8ED4EE0-4715-41F5-A4CB-FE09A414B730}\offreg.dll2012-03-04 08:55:28 -------- d-----w- C:\Users\ShatteredFoX\D2LOD-1.12A-enUS2012-03-04 07:09:47 -------- d-----w- C:\Program Files (x86)\Common Files\Blizzard Entertainment2012-03-02 10:11:52 8643640 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D8ED4EE0-4715-41F5-A4CB-FE09A414B730}\mpengine.dll2012-03-01 16:48:01 72248 ----a-w- C:\ProgramData\confighst.exe2012-03-01 14:29:30 20480 ----a-w- C:\Windows\svchost.exe2012-03-01 12:23:27 -------- d-----w- C:\Program Files\CCleaner2012-03-01 11:17:54 -------- d-----w- C:\Users\ShatteredFoX\AppData\Local\Vidalia2012-03-01 11:11:01 -------- d-sh--w- C:\$RECYCLE.BIN2012-03-01 10:58:12 98816 ----a-w- C:\Windows\sed.exe2012-03-01 10:58:12 518144 ----a-w- C:\Windows\SWREG.exe2012-03-01 10:58:12 256000 ----a-w- C:\Windows\PEV.exe2012-03-01 10:58:12 208896 ----a-w- C:\Windows\MBR.exe2012-02-29 08:09:59 766976 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll2012-02-28 06:59:14 509952 ----a-w- C:\Windows\System32\ntshrui.dll2012-02-28 06:59:14 442880 ----a-w- C:\Windows\SysWow64\ntshrui.dll2012-02-28 06:59:13 515584 ----a-w- C:\Windows\System32\timedate.cpl2012-02-28 06:59:13 478720 ----a-w- C:\Windows\SysWow64\timedate.cpl2012-02-28 06:59:11 3145728 ----a-w- C:\Windows\System32\win32k.sys2012-02-28 06:59:10 498688 ----a-w- C:\Windows\System32\drivers\afd.sys2012-02-28 06:57:51 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll2012-02-28 06:57:51 634880 ----a-w- C:\Windows\System32\msvcrt.dll2012-02-12 16:09:18 -------- d-----w- C:\ProgramData\RegAce2012-02-12 16:09:15 -------- d-----w- C:\Windows\RegAce2012-02-12 16:08:20 -------- d-----w- C:\Program Files (x86)\RegAce System Suite2012-02-12 00:52:05 -------- d-----w- C:\Program Files (x86)\Cockatrice2012-02-10 16:36:59 -------- d-----w- C:\Program Files (x86)\Microsoft2012-02-10 16:36:58 -------- d-----w- C:\Program Files (x86)\MSN Toolbar2012-02-10 16:36:26 -------- d-----w- C:\Program Files (x86)\Bing Bar Installer2012-02-10 16:36:17 -------- d-----w- C:\Program Files (x86)\Unlocker2012-02-10 02:14:07 -------- d-----w- C:\Users\ShatteredFoX\AppData\Roaming\EnMasse2012-02-09 14:03:51 -------- d-----w- C:\ProgramData\TERA2012-02-07 17:28:12 -------- d-----w- C:\Users\ShatteredFoX\AppData\Local\Chromium2012-02-06 01:36:34 -------- d-----w- C:\ProgramData\Hi-Rez Studios2012-02-06 01:36:15 -------- d-----w- C:\Program Files (x86)\Hi-Rez Studios2012-02-04 23:41:45 -------- d-----w- C:\ProgramData\ASign2012-02-04 18:40:24 -------- d-----w- C:\Down2012-02-04 18:40:14 -------- d-----w- C:\Perfect World Entertainment2012-02-04 04:07:59 28168 ----a-w- C:\Windows\System32\X3DAudio1_4.dll.==================== Find3M ====================.2012-02-29 08:09:59 35840 ----a-w- C:\Windows\SysWow64\imgutil.dll2012-01-29 22:02:56 466456 ----a-w- C:\Windows\System32\wrap_oal.dll2012-01-29 22:02:56 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll2012-01-29 22:02:56 122904 ----a-w- C:\Windows\System32\OpenAL32.dll2012-01-29 22:02:56 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll2012-01-29 10:10:42 279656 ------w- C:\Windows\System32\MpSigStub.exe2011-12-10 20:24:08 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys.============= FINISH: 8:19:58.32 =============== Link to post Share on other sites More sharing options...
LDTate Posted March 8, 2012 ID:533534 Share Posted March 8, 2012 We look for post with 0 replies so it wouldn't matter what page your topic is on, but when people reply to their own topic it appears they are being helped already.Logs will be closed if you haven't replied within 3 days Please don't attach the scans / logs for these tools, use "copy/paste".DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.Please run a new MBAM scan being sure to update before scanning.Post the scan resultsAlso please describe how your computer behaves at the moment.Please don't attach the scans / logs, use "copy/paste". Link to post Share on other sites More sharing options...
ShatteredFoX Posted March 12, 2012 Author ID:534150 Share Posted March 12, 2012 I can't use google or any google services it will simply stall, not load(in the case of recaptcha or maps), or redirect me to another website. Google chrome even has a habit of crashing at any moment especially if I do a search via the address bar rather then a search engine.Malwarebytes will also every every couple of minutes to sometimes more frequently will notify me that it blocked something trying to access my internet. The name varies every couple of days and will change depending on what browser I try to use.The MBAM logsMalwarebytes Anti-Malware (Trial) 1.60.1.1000www.malwarebytes.orgDatabase version: v2012.03.12.01Windows 7 Service Pack 1 x64 NTFSInternet Explorer 9.0.8112.16421ShatteredFoX :: FOX [administrator]Protection: Enabled3/11/2012 11:09:01 PMmbam-log-2012-03-11 (23-09-01).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 207979Time elapsed: 5 minute(s), 38 second(s)Memory Processes Detected: 2C:\ProgramData\confighst.exe (Trojan.Downloader) -> 3308 -> Delete on reboot.C:\Windows\svchost.exe (Trojan.Agent) -> 7712 -> Delete on reboot.Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 7HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|confighst (Trojan.Downloader) -> Data: C:\ProgramData\confighst.exe -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|confighst (Trojan.Downloader) -> Data: C:\ProgramData\confighst.exe -> Quarantined and deleted successfully.HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|confighst (Trojan.Downloader) -> Data: C:\ProgramData\confighst.exe -> Quarantined and deleted successfully.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|cschar (Trojan.Downloader) -> Data: C:\Users\ShatteredFoX\AppData\Roaming\cschar.exe -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|cschar (Trojan.Downloader) -> Data: C:\Users\ShatteredFoX\AppData\Roaming\cschar.exe -> Quarantined and deleted successfully.HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|cschar (Trojan.Downloader) -> Data: C:\Windows\system32\config\systemprofile\AppData\Roaming\cschar.exe -> Quarantined and deleted successfully.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|dplaysvr (Trojan.QHost.BG) -> Data: C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe -> Quarantined and deleted successfully.Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 5C:\ProgramData\confighst.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\ShatteredFoX\AppData\Roaming\cschar.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Windows\System32\config\systemprofile\AppData\Roaming\cschar.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\ShatteredFoX\AppData\Local\Temp\isomore.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.(end) Link to post Share on other sites More sharing options...
LDTate Posted March 12, 2012 ID:534202 Share Posted March 12, 2012 Next:Download TDSSKiller from here and save it to your Desktop.Note: if the Cure option is not there, please select 'Skip'. Please read carefully and follow these steps. Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.Click the Start Scan button.If a suspicious object is detected, the default action will be Skip, click on Continue.If malicious objects are found, they will show in the Scan results and offer three (3) options.Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply. Link to post Share on other sites More sharing options...
ShatteredFoX Posted March 13, 2012 Author ID:534408 Share Posted March 13, 2012 22:40:41.0557 5212 TDSS rootkit removing tool 2.7.20.0 Mar 9 2012 17:10:4322:40:41.0832 5212 ============================================================22:40:41.0832 5212 Current date / time: 2012/03/12 22:40:41.083222:40:41.0832 5212 SystemInfo:22:40:41.0832 5212 22:40:41.0832 5212 OS Version: 6.1.7601 ServicePack: 1.022:40:41.0832 5212 Product type: Workstation22:40:41.0832 5212 ComputerName: FOX22:40:41.0832 5212 UserName: ShatteredFoX22:40:41.0833 5212 Windows directory: C:\Windows22:40:41.0833 5212 System windows directory: C:\Windows22:40:41.0833 5212 Running under WOW6422:40:41.0833 5212 Processor architecture: Intel x6422:40:41.0833 5212 Number of processors: 222:40:41.0833 5212 Page size: 0x100022:40:41.0833 5212 Boot type: Normal boot22:40:41.0833 5212 ============================================================22:40:43.0535 5212 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0x7E2CB, SectorsPerTrack: 0xE, TracksPerCylinder: 0x87, Type 'K0', Flags 0x0000004022:40:43.0538 5212 \Device\Harddisk0\DR0:22:40:43.0538 5212 MBR used22:40:43.0538 5212 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x3200022:40:43.0538 5212 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x3A35300022:40:43.0559 5212 Initialize success22:40:43.0559 5212 ============================================================22:41:07.0337 5772 ============================================================22:41:07.0337 5772 Scan started22:41:07.0337 5772 Mode: Manual;22:41:07.0337 5772 ============================================================22:41:07.0908 5772 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys22:41:07.0911 5772 1394ohci - ok22:41:07.0957 5772 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys22:41:07.0961 5772 ACPI - ok22:41:08.0021 5772 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys22:41:08.0022 5772 AcpiPmi - ok22:41:08.0079 5772 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys22:41:08.0085 5772 adp94xx - ok22:41:08.0159 5772 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys22:41:08.0163 5772 adpahci - ok22:41:08.0205 5772 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys22:41:08.0208 5772 adpu320 - ok22:41:08.0295 5772 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys22:41:08.0302 5772 AFD - ok22:41:08.0386 5772 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys22:41:08.0387 5772 agp440 - ok22:41:08.0498 5772 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys22:41:08.0500 5772 aliide - ok22:41:08.0548 5772 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys22:41:08.0549 5772 amdide - ok22:41:08.0604 5772 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys22:41:08.0605 5772 AmdK8 - ok22:41:08.0783 5772 amdkmdag (dcc8177244fe79c61c4e73c65e63922a) C:\Windows\system32\DRIVERS\atikmdag.sys22:41:08.0900 5772 amdkmdag - ok22:41:08.0980 5772 amdkmdap (7fe67d107329dc2cf89136a8e19bceb7) C:\Windows\system32\DRIVERS\atikmpag.sys22:41:08.0983 5772 amdkmdap - ok22:41:09.0010 5772 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys22:41:09.0011 5772 AmdPPM - ok22:41:09.0098 5772 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys22:41:09.0101 5772 amdsata - ok22:41:09.0132 5772 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys22:41:09.0135 5772 amdsbs - ok22:41:09.0222 5772 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys22:41:09.0224 5772 amdxata - ok22:41:09.0311 5772 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys22:41:09.0313 5772 AppID - ok22:41:09.0421 5772 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys22:41:09.0424 5772 arc - ok22:41:09.0440 5772 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys22:41:09.0442 5772 arcsas - ok22:41:09.0538 5772 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys22:41:09.0539 5772 AsyncMac - ok22:41:09.0563 5772 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys22:41:09.0564 5772 atapi - ok22:41:09.0672 5772 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys22:41:09.0677 5772 b06bdrv - ok22:41:09.0704 5772 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys22:41:09.0707 5772 b57nd60a - ok22:41:09.0809 5772 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys22:41:09.0810 5772 Beep - ok22:41:09.0911 5772 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys22:41:09.0913 5772 blbdrive - ok22:41:09.0944 5772 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys22:41:09.0947 5772 bowser - ok22:41:10.0022 5772 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys22:41:10.0023 5772 BrFiltLo - ok22:41:10.0030 5772 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys22:41:10.0031 5772 BrFiltUp - ok22:41:10.0136 5772 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys22:41:10.0139 5772 BridgeMP - ok22:41:10.0171 5772 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys22:41:10.0175 5772 Brserid - ok22:41:10.0183 5772 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys22:41:10.0184 5772 BrSerWdm - ok22:41:10.0271 5772 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys22:41:10.0272 5772 BrUsbMdm - ok22:41:10.0290 5772 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys22:41:10.0292 5772 BrUsbSer - ok22:41:10.0316 5772 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys22:41:10.0318 5772 BTHMODEM - ok22:41:10.0349 5772 catchme - ok22:41:10.0429 5772 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys22:41:10.0431 5772 cdfs - ok22:41:10.0473 5772 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys22:41:10.0477 5772 cdrom - ok22:41:10.0577 5772 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys22:41:10.0579 5772 circlass - ok22:41:10.0610 5772 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys22:41:10.0614 5772 CLFS - ok22:41:10.0790 5772 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys22:41:10.0792 5772 CmBatt - ok22:41:10.0848 5772 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys22:41:10.0850 5772 cmdide - ok22:41:10.0914 5772 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys22:41:10.0932 5772 CNG - ok22:41:10.0994 5772 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys22:41:10.0995 5772 Compbatt - ok22:41:11.0034 5772 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\DRIVERS\CompositeBus.sys22:41:11.0035 5772 CompositeBus - ok22:41:11.0108 5772 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys22:41:11.0110 5772 crcdisk - ok22:41:11.0203 5772 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys22:41:11.0210 5772 CSC - ok22:41:11.0381 5772 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys22:41:11.0383 5772 DfsC - ok22:41:11.0406 5772 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys22:41:11.0407 5772 discache - ok22:41:11.0462 5772 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys22:41:11.0464 5772 Disk - ok22:41:11.0518 5772 dmvsc (5db085a8a6600be6401f2b24eecb5415) C:\Windows\system32\drivers\dmvsc.sys22:41:11.0520 5772 dmvsc - ok22:41:11.0586 5772 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys22:41:11.0587 5772 drmkaud - ok22:41:11.0640 5772 dtsoftbus01 (d3d64cf7b2bceaa34a270f45a3fffb36) C:\Windows\system32\DRIVERS\dtsoftbus01.sys22:41:11.0643 5772 dtsoftbus01 - ok22:41:11.0723 5772 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys22:41:11.0743 5772 DXGKrnl - ok22:41:11.0774 5772 EagleX64 - ok22:41:11.0876 5772 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys22:41:11.0904 5772 ebdrv - ok22:41:11.0977 5772 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys22:41:11.0982 5772 elxstor - ok22:41:12.0023 5772 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys22:41:12.0024 5772 ErrDev - ok22:41:12.0064 5772 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys22:41:12.0066 5772 exfat - ok22:41:12.0108 5772 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys22:41:12.0111 5772 fastfat - ok22:41:12.0147 5772 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys22:41:12.0148 5772 fdc - ok22:41:12.0170 5772 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys22:41:12.0171 5772 FileInfo - ok22:41:12.0212 5772 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys22:41:12.0214 5772 Filetrace - ok22:41:12.0248 5772 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys22:41:12.0249 5772 flpydisk - ok22:41:12.0288 5772 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys22:41:12.0291 5772 FltMgr - ok22:41:12.0337 5772 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys22:41:12.0338 5772 FsDepends - ok22:41:12.0379 5772 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys22:41:12.0380 5772 Fs_Rec - ok22:41:12.0407 5772 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys22:41:12.0410 5772 fvevol - ok22:41:12.0440 5772 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys22:41:12.0441 5772 gagp30kx - ok22:41:12.0515 5772 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys22:41:12.0517 5772 hcw85cir - ok22:41:12.0559 5772 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys22:41:12.0562 5772 HdAudAddService - ok22:41:12.0646 5772 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys22:41:12.0648 5772 HDAudBus - ok22:41:12.0676 5772 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys22:41:12.0677 5772 HidBatt - ok22:41:12.0739 5772 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys22:41:12.0741 5772 HidBth - ok22:41:12.0762 5772 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys22:41:12.0770 5772 HidIr - ok22:41:12.0903 5772 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys22:41:12.0905 5772 HidUsb - ok22:41:12.0995 5772 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys22:41:13.0000 5772 HpSAMD - ok22:41:13.0159 5772 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys22:41:13.0166 5772 HTTP - ok22:41:13.0206 5772 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys22:41:13.0207 5772 hwpolicy - ok22:41:13.0259 5772 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys22:41:13.0260 5772 i8042prt - ok22:41:13.0321 5772 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys22:41:13.0325 5772 iaStorV - ok22:41:13.0373 5772 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys22:41:13.0374 5772 iirsp - ok22:41:13.0418 5772 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys22:41:13.0419 5772 intelide - ok22:41:13.0471 5772 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\drivers\intelppm.sys22:41:13.0472 5772 intelppm - ok22:41:13.0500 5772 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys22:41:13.0501 5772 IpFilterDriver - ok22:41:13.0523 5772 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys22:41:13.0524 5772 IPMIDRV - ok22:41:13.0531 5772 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys22:41:13.0534 5772 IPNAT - ok22:41:13.0579 5772 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys22:41:13.0580 5772 IRENUM - ok22:41:13.0618 5772 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys22:41:13.0619 5772 isapnp - ok22:41:13.0636 5772 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys22:41:13.0638 5772 iScsiPrt - ok22:41:13.0689 5772 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys22:41:13.0690 5772 kbdclass - ok22:41:13.0730 5772 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys22:41:13.0731 5772 kbdhid - ok22:41:13.0759 5772 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys22:41:13.0761 5772 KSecDD - ok22:41:13.0791 5772 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys22:41:13.0792 5772 KSecPkg - ok22:41:13.0865 5772 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys22:41:13.0866 5772 ksthunk - ok22:41:13.0926 5772 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys22:41:13.0927 5772 lltdio - ok22:41:13.0985 5772 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys22:41:13.0987 5772 LSI_FC - ok22:41:14.0029 5772 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys22:41:14.0030 5772 LSI_SAS - ok22:41:14.0073 5772 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys22:41:14.0074 5772 LSI_SAS2 - ok22:41:14.0114 5772 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys22:41:14.0115 5772 LSI_SCSI - ok22:41:14.0164 5772 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys22:41:14.0165 5772 luafv - ok22:41:14.0228 5772 MBAMProtector (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys22:41:14.0229 5772 MBAMProtector - ok22:41:14.0302 5772 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys22:41:14.0303 5772 megasas - ok22:41:14.0345 5772 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys22:41:14.0349 5772 MegaSR - ok22:41:14.0406 5772 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys22:41:14.0407 5772 Modem - ok22:41:14.0452 5772 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys22:41:14.0453 5772 monitor - ok22:41:14.0510 5772 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys22:41:14.0512 5772 mouclass - ok22:41:14.0564 5772 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys22:41:14.0568 5772 mouhid - ok22:41:14.0615 5772 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys22:41:14.0617 5772 mountmgr - ok22:41:14.0661 5772 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys22:41:14.0663 5772 mpio - ok22:41:14.0718 5772 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys22:41:14.0719 5772 mpsdrv - ok22:41:14.0763 5772 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys22:41:14.0765 5772 MRxDAV - ok22:41:14.0811 5772 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys22:41:14.0814 5772 mrxsmb - ok22:41:14.0858 5772 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys22:41:14.0862 5772 mrxsmb10 - ok22:41:14.0917 5772 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys22:41:14.0919 5772 mrxsmb20 - ok22:41:14.0967 5772 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys22:41:14.0968 5772 msahci - ok22:41:15.0010 5772 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys22:41:15.0012 5772 msdsm - ok22:41:15.0072 5772 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys22:41:15.0073 5772 Msfs - ok22:41:15.0108 5772 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys22:41:15.0109 5772 mshidkmdf - ok22:41:15.0131 5772 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys22:41:15.0132 5772 msisadrv - ok22:41:15.0218 5772 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys22:41:15.0219 5772 MSKSSRV - ok22:41:15.0228 5772 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys22:41:15.0228 5772 MSPCLOCK - ok22:41:15.0247 5772 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys22:41:15.0247 5772 MSPQM - ok22:41:15.0272 5772 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys22:41:15.0275 5772 MsRPC - ok22:41:15.0349 5772 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys22:41:15.0350 5772 mssmbios - ok22:41:15.0382 5772 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys22:41:15.0383 5772 MSTEE - ok22:41:15.0449 5772 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys22:41:15.0451 5772 MTConfig - ok22:41:15.0505 5772 MTsensor (03b7145c889603537e9ffeabb1ad1089) C:\Windows\system32\DRIVERS\ASACPI.sys22:41:15.0505 5772 MTsensor - ok22:41:15.0572 5772 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys22:41:15.0574 5772 Mup - ok22:41:15.0671 5772 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys22:41:15.0675 5772 NativeWifiP - ok22:41:15.0710 5772 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys22:41:15.0719 5772 NDIS - ok22:41:15.0792 5772 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys22:41:15.0794 5772 NdisCap - ok22:41:15.0822 5772 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys22:41:15.0824 5772 NdisTapi - ok22:41:15.0926 5772 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys22:41:15.0927 5772 Ndisuio - ok22:41:15.0943 5772 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys22:41:15.0945 5772 NdisWan - ok22:41:15.0960 5772 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys22:41:15.0961 5772 NDProxy - ok22:41:16.0031 5772 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys22:41:16.0032 5772 NetBIOS - ok22:41:16.0051 5772 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys22:41:16.0054 5772 NetBT - ok22:41:16.0163 5772 netr28ux (618c55b392238b9467f9113e13525c49) C:\Windows\system32\DRIVERS\netr28ux.sys22:41:16.0173 5772 netr28ux - ok22:41:16.0207 5772 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys22:41:16.0208 5772 nfrd960 - ok22:41:16.0283 5772 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys22:41:16.0284 5772 Npfs - ok22:41:16.0308 5772 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys22:41:16.0309 5772 nsiproxy - ok22:41:16.0398 5772 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys22:41:16.0416 5772 Ntfs - ok22:41:16.0462 5772 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys22:41:16.0464 5772 Null - ok22:41:16.0535 5772 NVENETFD (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys22:41:16.0545 5772 NVENETFD - ok22:41:16.0619 5772 NVNET (0ad267a4674805b61a5d7b911d2a978a) C:\Windows\system32\DRIVERS\nvmf6264.sys22:41:16.0624 5772 NVNET - ok22:41:16.0675 5772 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys22:41:16.0677 5772 nvraid - ok22:41:16.0723 5772 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys22:41:16.0724 5772 nvstor - ok22:41:16.0769 5772 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys22:41:16.0771 5772 nv_agp - ok22:41:16.0814 5772 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys22:41:16.0815 5772 ohci1394 - ok22:41:16.0914 5772 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys22:41:16.0922 5772 Parport - ok22:41:16.0958 5772 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys22:41:16.0966 5772 partmgr - ok22:41:17.0124 5772 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys22:41:17.0128 5772 pci - ok22:41:17.0160 5772 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys22:41:17.0161 5772 pciide - ok22:41:17.0192 5772 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys22:41:17.0195 5772 pcmcia - ok22:41:17.0230 5772 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys22:41:17.0231 5772 pcw - ok22:41:17.0409 5772 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys22:41:17.0417 5772 PEAUTH - ok22:41:17.0544 5772 Point64 (4f0878fd62d5f7444c5f1c4c66d9d293) C:\Windows\system32\DRIVERS\point64.sys22:41:17.0545 5772 Point64 - ok22:41:17.0592 5772 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys22:41:17.0594 5772 PptpMiniport - ok22:41:17.0660 5772 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys22:41:17.0661 5772 Processor - ok22:41:17.0705 5772 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys22:41:17.0707 5772 Psched - ok22:41:17.0802 5772 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys22:41:17.0821 5772 ql2300 - ok22:41:17.0848 5772 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys22:41:17.0850 5772 ql40xx - ok22:41:17.0956 5772 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys22:41:17.0956 5772 QWAVEdrv - ok22:41:17.0990 5772 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys22:41:17.0991 5772 RasAcd - ok22:41:18.0043 5772 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys22:41:18.0044 5772 RasAgileVpn - ok22:41:18.0077 5772 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys22:41:18.0078 5772 Rasl2tp - ok22:41:18.0133 5772 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys22:41:18.0135 5772 RasPppoe - ok22:41:18.0167 5772 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys22:41:18.0169 5772 RasSstp - ok22:41:18.0205 5772 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys22:41:18.0209 5772 rdbss - ok22:41:18.0258 5772 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys22:41:18.0260 5772 rdpbus - ok22:41:18.0305 5772 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys22:41:18.0306 5772 RDPCDD - ok22:41:18.0360 5772 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys22:41:18.0362 5772 RDPDR - ok22:41:18.0412 5772 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys22:41:18.0413 5772 RDPENCDD - ok22:41:18.0454 5772 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys22:41:18.0455 5772 RDPREFMP - ok22:41:18.0505 5772 RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys22:41:18.0506 5772 RdpVideoMiniport - ok22:41:18.0569 5772 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys22:41:18.0571 5772 RDPWD - ok22:41:18.0612 5772 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys22:41:18.0615 5772 rdyboost - ok22:41:18.0713 5772 RsFx0103 (cd553b8633466a6d1c115812f2619f1f) C:\Windows\system32\DRIVERS\RsFx0103.sys22:41:18.0720 5772 RsFx0103 - ok22:41:18.0805 5772 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys22:41:18.0807 5772 rspndr - ok22:41:18.0834 5772 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys22:41:18.0835 5772 s3cap - ok22:41:18.0932 5772 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys22:41:18.0934 5772 sbp2port - ok22:41:18.0956 5772 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys22:41:18.0957 5772 scfilter - ok22:41:19.0069 5772 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys22:41:19.0070 5772 secdrv - ok22:41:19.0103 5772 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys22:41:19.0104 5772 Serenum - ok22:41:19.0175 5772 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys22:41:19.0177 5772 Serial - ok22:41:19.0197 5772 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys22:41:19.0198 5772 sermouse - ok22:41:19.0224 5772 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys22:41:19.0225 5772 sffdisk - ok22:41:19.0238 5772 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys22:41:19.0239 5772 sffp_mmc - ok22:41:19.0245 5772 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys22:41:19.0246 5772 sffp_sd - ok22:41:19.0258 5772 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys22:41:19.0258 5772 sfloppy - ok22:41:19.0336 5772 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys22:41:19.0337 5772 SiSRaid2 - ok22:41:19.0409 5772 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys22:41:19.0410 5772 SiSRaid4 - ok22:41:19.0531 5772 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys22:41:19.0535 5772 Smb - ok22:41:19.0628 5772 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys22:41:19.0629 5772 spldr - ok22:41:19.0739 5772 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys22:41:19.0745 5772 srv - ok22:41:19.0766 5772 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys22:41:19.0771 5772 srv2 - ok22:41:19.0848 5772 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys22:41:19.0850 5772 srvnet - ok22:41:20.0033 5772 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys22:41:20.0033 5772 stexstor - ok22:41:20.0084 5772 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys22:41:20.0085 5772 storflt - ok22:41:20.0138 5772 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys22:41:20.0140 5772 storvsc - ok22:41:20.0162 5772 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys22:41:20.0163 5772 swenum - ok22:41:20.0246 5772 Synth3dVsc (c3a39c4079305480972d29c44b868c78) C:\Windows\system32\drivers\synth3dvsc.sys22:41:20.0249 5772 Synth3dVsc - ok22:41:20.0308 5772 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys22:41:20.0325 5772 Tcpip - ok22:41:20.0445 5772 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys22:41:20.0458 5772 TCPIP6 - ok22:41:20.0477 5772 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys22:41:20.0478 5772 tcpipreg - ok22:41:20.0538 5772 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys22:41:20.0539 5772 TDPIPE - ok22:41:20.0553 5772 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys22:41:20.0553 5772 TDTCP - ok22:41:20.0586 5772 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys22:41:20.0588 5772 tdx - ok22:41:20.0653 5772 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\DRIVERS\termdd.sys22:41:20.0656 5772 TermDD - ok22:41:20.0689 5772 terminpt (2b5bdff688ec9871d7ec5837833374e9) C:\Windows\system32\drivers\terminpt.sys22:41:20.0690 5772 terminpt - ok22:41:20.0790 5772 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys22:41:20.0792 5772 tssecsrv - ok22:41:20.0818 5772 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys22:41:20.0819 5772 TsUsbFlt - ok22:41:20.0896 5772 TsUsbGD (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys22:41:20.0904 5772 TsUsbGD - ok22:41:20.0927 5772 tsusbhub (e1748d04ae40118b62bc18ac86032192) C:\Windows\system32\drivers\tsusbhub.sys22:41:20.0929 5772 tsusbhub - ok22:41:21.0007 5772 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys22:41:21.0011 5772 tunnel - ok22:41:21.0099 5772 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys22:41:21.0102 5772 uagp35 - ok22:41:21.0127 5772 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys22:41:21.0132 5772 udfs - ok22:41:21.0211 5772 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys22:41:21.0214 5772 uliagpkx - ok22:41:21.0238 5772 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys22:41:21.0239 5772 umbus - ok22:41:21.0309 5772 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys22:41:21.0311 5772 UmPass - ok22:41:21.0349 5772 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys22:41:21.0350 5772 usbccgp - ok22:41:21.0436 5772 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys22:41:21.0438 5772 usbcir - ok22:41:21.0467 5772 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys22:41:21.0468 5772 usbehci - ok22:41:21.0539 5772 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys22:41:21.0547 5772 usbhub - ok22:41:21.0565 5772 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys22:41:21.0566 5772 usbohci - ok22:41:21.0636 5772 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys22:41:21.0638 5772 usbprint - ok22:41:21.0679 5772 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys22:41:21.0680 5772 usbscan - ok22:41:21.0754 5772 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS22:41:21.0755 5772 USBSTOR - ok22:41:21.0770 5772 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys22:41:21.0772 5772 usbuhci - ok22:41:21.0861 5772 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys22:41:21.0863 5772 vdrvroot - ok22:41:21.0898 5772 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys22:41:21.0899 5772 vga - ok22:41:21.0935 5772 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys22:41:21.0937 5772 VgaSave - ok22:41:21.0991 5772 VGPU - ok22:41:22.0027 5772 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys22:41:22.0030 5772 vhdmp - ok22:41:22.0067 5772 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys22:41:22.0068 5772 viaide - ok22:41:22.0114 5772 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys22:41:22.0126 5772 vmbus - ok22:41:22.0151 5772 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys22:41:22.0152 5772 VMBusHID - ok22:41:22.0201 5772 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys22:41:22.0202 5772 volmgr - ok22:41:22.0238 5772 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys22:41:22.0242 5772 volmgrx - ok22:41:22.0296 5772 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys22:41:22.0303 5772 volsnap - ok22:41:22.0349 5772 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys22:41:22.0351 5772 vsmraid - ok22:41:22.0435 5772 VSPerfDrv100 (1928b9ca20f51bfbbad54d2c2c447b13) C:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys22:41:22.0441 5772 VSPerfDrv100 - ok22:41:22.0523 5772 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys22:41:22.0525 5772 vwifibus - ok22:41:22.0551 5772 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys22:41:22.0552 5772 vwififlt - ok22:41:22.0579 5772 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys22:41:22.0579 5772 WacomPen - ok22:41:22.0659 5772 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys22:41:22.0663 5772 WANARP - ok22:41:22.0670 5772 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys22:41:22.0671 5772 Wanarpv6 - ok22:41:22.0708 5772 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys22:41:22.0709 5772 Wd - ok22:41:22.0729 5772 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys22:41:22.0735 5772 Wdf01000 - ok22:41:22.0827 5772 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys22:41:22.0828 5772 WfpLwf - ok22:41:22.0841 5772 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys22:41:22.0843 5772 WIMMount - ok22:41:22.0992 5772 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys22:41:22.0993 5772 WmiAcpi - ok22:41:23.0090 5772 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys22:41:23.0091 5772 ws2ifsl - ok22:41:23.0358 5772 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys22:41:23.0367 5772 WudfPf - ok22:41:23.0737 5772 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys22:41:23.0740 5772 WUDFRd - ok22:41:23.0827 5772 X6va005 - ok22:41:23.0871 5772 MBR (0x1B8) (c0dcf0ac171db02db8b0014c5d767cf1) \Device\Harddisk0\DR022:41:23.0916 5772 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected22:41:23.0916 5772 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)22:41:23.0929 5772 Boot (0x1200) (193dec06f97004a93c9c5c3bdc955b96) \Device\Harddisk0\DR0\Partition022:41:23.0931 5772 \Device\Harddisk0\DR0\Partition0 - ok22:41:23.0983 5772 Boot (0x1200) (4498922d6e484a7ea65d8ac5cb92e9b9) \Device\Harddisk0\DR0\Partition122:41:23.0985 5772 \Device\Harddisk0\DR0\Partition1 - ok22:41:23.0986 5772 ============================================================22:41:23.0986 5772 Scan finished22:41:23.0986 5772 ============================================================22:41:24.0003 0148 Detected object count: 122:41:24.0003 0148 Actual detected object count: 122:42:34.0368 0148 \Device\Harddisk0\DR0\# - copied to quarantine22:42:34.0368 0148 \Device\Harddisk0\DR0 - copied to quarantine22:42:34.0415 0148 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine22:42:34.0417 0148 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine22:42:34.0422 0148 \Device\Harddisk0\DR0\TDLFS\xh.dll - copied to quarantine22:42:34.0435 0148 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine22:42:34.0443 0148 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine22:42:34.0443 0148 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine22:42:34.0444 0148 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine22:42:34.0445 0148 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine22:42:34.0447 0148 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine22:42:34.0450 0148 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine22:42:34.0451 0148 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine22:42:34.0498 0148 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot22:42:34.0537 0148 \Device\Harddisk0\DR0 - ok22:42:34.0564 0148 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure22:42:40.0781 4132 Deinitialize success Link to post Share on other sites More sharing options...
LDTate Posted March 13, 2012 ID:534450 Share Posted March 13, 2012 Please run a new MBAM scan being sure to update before scanning.Post the scan resultsAlso please describe how your computer behaves at the moment.Please don't attach the scans / logs, use "copy/paste". Link to post Share on other sites More sharing options...
ShatteredFoX Posted March 13, 2012 Author ID:534499 Share Posted March 13, 2012 l don't appear to have any issues and I am able to use google with no issues.Malwarebytes Anti-Malware 1.60.1.1000www.malwarebytes.orgDatabase version: v2012.03.12.01Windows 7 Service Pack 1 x64 NTFSInternet Explorer 9.0.8112.16421ShatteredFoX :: FOX [administrator]Protection: Enabled3/13/2012 8:37:48 AMmbam-log-2012-03-13 (08-37-48).txtScan type: Full scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 395082Time elapsed: 49 minute(s), 30 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end) Link to post Share on other sites More sharing options...
LDTate Posted March 13, 2012 ID:534501 Share Posted March 13, 2012 Good job Here's my usual all clean postTo be on the safe side, I would also change all my passwords. This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.Log looks good Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.Without a firewall your computer is succeptible to being hacked and taken over.I am very serious about this and see it happen almost every day with my clients.Simply using a Firewall in its default configuration can lower your risk greatly.Using a secure browser plugin M86 SecureBrowsing makes it safe to search, surf and socialize online. This free browser plug-in displays security icons next to links on search engines and social networking sites like Facebook, Twitter and LinkedIn, so you'll know which pages are safe and which ones to avoid.•Free browser plug-in for Internet Explorer and Firefox•Real-time safety ratings•Ideal for Facebook, Twitter and LinkedIn JAVA Click this link and click on the Free JAVA DownloadVisit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.This will ensure your computer has always the latest security updates available installed on your computer.If there are new updates to install, install them immediately, reboot your computer, and revisit the siteuntil there are no more critical updates.Only run one Anti-Virus and Firewall program.I would suggest you read:PC Safety and Security--What Do I Need?.How to Prevent Malware:The full version of Malwarebytes' Anti-Malware could have helped protect your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & ServersMalware Execution PreventionSave yourself the hassle and get protected. Link to post Share on other sites More sharing options...
LDTate Posted March 18, 2012 ID:535917 Share Posted March 18, 2012 Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you. Link to post Share on other sites More sharing options...
Recommended Posts