Belcoot Posted March 29, 2012 ID:538252 Share Posted March 29, 2012 So, while I was checking my normal websites last night, my computer suddenly resetted on its own. When it came back on and I tried to go online, it crashed completely and gave me the blue screen. I reopened in safe mode and ran Malwarebytes to delete whatever I might caught. It found something, rebooted, and thought it was over. Turns out, though, the trojan I caught will not go away. I tried and I tried to get rid of it with several other anti-spyware programs but none of them work. This trojan is really annoying and I need some help. Here's my logs.Attach.txtDDS.txt Link to post Share on other sites More sharing options...
MrCharlie Posted March 31, 2012 ID:538686 Share Posted March 31, 2012 Please remove any usb or external drives from the computer before you run this scan!Please download and run RogueKiller.For Windows XP, double-click to start.For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.Click Scan to scan the system (don't run any other options)Post back the report.MrC Link to post Share on other sites More sharing options...
Belcoot Posted April 2, 2012 Author ID:539312 Share Posted April 2, 2012 Well, a friend of mine was able to rid of the trojan, but now I got another problem. Each time I use the internet, my internet just slows down completely. My Avast keeps blocking an infection called url:Mal. Should I do another scan and upload the result? Link to post Share on other sites More sharing options...
MrCharlie Posted April 2, 2012 ID:539314 Share Posted April 2, 2012 Yes please do that, MrC Link to post Share on other sites More sharing options...
Belcoot Posted April 2, 2012 Author ID:539324 Share Posted April 2, 2012 Here they areAttach.txtDDS.txt Link to post Share on other sites More sharing options...
MrCharlie Posted April 2, 2012 ID:539332 Share Posted April 2, 2012 Run RogueKiller as outlined in my first post, post back the log, MrC Link to post Share on other sites More sharing options...
Belcoot Posted April 2, 2012 Author ID:539333 Share Posted April 2, 2012 Grr, I'm having trouble running Roguekiller. I ran it three times and it suddenly stops after a few minutes. Link to post Share on other sites More sharing options...
MrCharlie Posted April 2, 2012 ID:539334 Share Posted April 2, 2012 Uncheck the MBR Scan and then try it, MrC Link to post Share on other sites More sharing options...
Belcoot Posted April 2, 2012 Author ID:539335 Share Posted April 2, 2012 Okay, found a way to run it somehow. Here's what came up.¤¤¤ Registry Entries: 3 ¤¤¤[sUSP PATH] HKLM\[...]\Wow6432Node\Run : Anti-phishing Domain Advisor ("C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe") -> FOUND[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND¤¤¤ Particular Files / Folders: ¤¤¤¤¤¤ Driver: [NOT LOADED] ¤¤¤¤¤¤ Infection : ¤¤¤¤¤¤ HOSTS File: ¤¤¤127.0.0.1 www.007guard.com127.0.0.1 007guard.com127.0.0.1 008i.com127.0.0.1 www.008k.com127.0.0.1 008k.com127.0.0.1 www.00hq.com127.0.0.1 00hq.com127.0.0.1 010402.com127.0.0.1 www.032439.com127.0.0.1 032439.com127.0.0.1 www.0scan.com127.0.0.1 0scan.com127.0.0.1 www.1000gratisproben.com127.0.0.1 1000gratisproben.com127.0.0.1 1001namen.com127.0.0.1 www.1001namen.com127.0.0.1 100888290cs.com127.0.0.1 www.100888290cs.com127.0.0.1 www.100sexlinks.com127.0.0.1 100sexlinks.com[...]¤¤¤ MBR Check: ¤¤¤Finished : << RKreport[1].txt >>RKreport[1].txt Link to post Share on other sites More sharing options...
MrCharlie Posted April 2, 2012 ID:539336 Share Posted April 2, 2012 I don't see anything, all I can do is have you run some scans, I have no idea what the other guy did to the computer.If you want.....Please download and run TDSSKiller to your desktop as outlined below:Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.-------------------------Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.------------------------Click the Start Scan button.-----------------------If a suspicious object is detected, the default action will be Skip, click on ContinueIf you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please chooseSkip and click on Continue----------------------If malicious objects are found, they will show in the Scan results and offer three (3) options.Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.--------------------A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply. MrC Link to post Share on other sites More sharing options...
Belcoot Posted April 2, 2012 Author ID:539339 Share Posted April 2, 2012 15:17:43.0691 0984 TDSS rootkit removing tool 2.7.24.0 Apr 2 2012 10:31:4815:17:44.0439 0984 ============================================================15:17:44.0439 0984 Current date / time: 2012/04/02 15:17:44.043915:17:44.0439 0984 SystemInfo:15:17:44.0439 0984 15:17:44.0439 0984 OS Version: 6.1.7600 ServicePack: 0.015:17:44.0439 0984 Product type: Workstation15:17:44.0439 0984 ComputerName: HERNANDEZ-VAIO15:17:44.0439 0984 UserName: Hernandez15:17:44.0439 0984 Windows directory: C:\Windows15:17:44.0439 0984 System windows directory: C:\Windows15:17:44.0439 0984 Running under WOW6415:17:44.0439 0984 Processor architecture: Intel x6415:17:44.0439 0984 Number of processors: 815:17:44.0439 0984 Page size: 0x100015:17:44.0439 0984 Boot type: Safe boot with network15:17:44.0439 0984 ============================================================15:17:45.0150 0984 Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x0000004015:17:45.0155 0984 \Device\Harddisk0\DR0:15:17:45.0155 0984 MBR used15:17:45.0155 0984 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x141D000, BlocksNum 0x3200015:17:45.0155 0984 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x144F000, BlocksNum 0x49408AB015:17:45.0195 0984 Initialize success15:17:45.0195 0984 ============================================================15:18:22.0608 0964 ============================================================15:18:22.0608 0964 Scan started15:18:22.0608 0964 Mode: Manual; SigCheck; TDLFS;15:18:22.0608 0964 ============================================================15:18:25.0259 0964 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\drivers\1394ohci.sys15:18:25.0390 0964 1394ohci - ok15:18:25.0481 0964 ACDaemon (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe15:18:25.0500 0964 ACDaemon - ok15:18:25.0669 0964 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\drivers\ACPI.sys15:18:25.0685 0964 ACPI - ok15:18:25.0800 0964 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\drivers\acpipmi.sys15:18:25.0875 0964 AcpiPmi - ok15:18:25.0983 0964 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys15:18:26.0006 0964 adp94xx - ok15:18:26.0113 0964 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys15:18:26.0128 0964 adpahci - ok15:18:26.0227 0964 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys15:18:26.0240 0964 adpu320 - ok15:18:26.0353 0964 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll15:18:26.0514 0964 AeLookupSvc - ok15:18:26.0618 0964 AFD (db9d6c6b2cd95a9ca414d045b627422e) C:\Windows\system32\drivers\afd.sys15:18:26.0688 0964 AFD - ok15:18:26.0785 0964 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys15:18:26.0795 0964 agp440 - ok15:18:26.0871 0964 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe15:18:26.0919 0964 ALG - ok15:18:27.0030 0964 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys15:18:27.0042 0964 aliide - ok15:18:27.0130 0964 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys15:18:27.0140 0964 amdide - ok15:18:27.0243 0964 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys15:18:27.0279 0964 AmdK8 - ok15:18:27.0378 0964 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys15:18:27.0412 0964 AmdPPM - ok15:18:27.0514 0964 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys15:18:27.0525 0964 amdsata - ok15:18:27.0642 0964 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys15:18:27.0655 0964 amdsbs - ok15:18:27.0763 0964 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys15:18:27.0772 0964 amdxata - ok15:18:27.0882 0964 ApfiltrService (2d45f2dfbc3d8f53df7ebeffa8c9bc38) C:\Windows\system32\DRIVERS\Apfiltr.sys15:18:27.0892 0964 ApfiltrService - ok15:18:27.0988 0964 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys15:18:28.0027 0964 AppID - ok15:18:28.0105 0964 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll15:18:28.0172 0964 AppIDSvc - ok15:18:28.0252 0964 Appinfo (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll15:18:28.0291 0964 Appinfo - ok15:18:28.0401 0964 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys15:18:28.0412 0964 arc - ok15:18:28.0516 0964 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys15:18:28.0527 0964 arcsas - ok15:18:28.0642 0964 ArcSoftKsUFilter (c130bc4a51b1382b2be8e44579ec4c0a) C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys15:18:28.0649 0964 ArcSoftKsUFilter - ok15:18:28.0778 0964 aswFsBlk (b9da213b5271db5fce962d827e6d620d) C:\Windows\system32\drivers\aswFsBlk.sys15:18:28.0786 0964 aswFsBlk - ok15:18:28.0946 0964 aswMonFlt (21c9835d0e5ad2ff0f16134bcb32cc71) C:\Windows\system32\drivers\aswMonFlt.sys15:18:28.0953 0964 aswMonFlt - ok15:18:29.0074 0964 aswRdr (1b96a5867abd4fa6135d8298fcccf9c6) C:\Windows\System32\Drivers\aswrdr2.sys15:18:29.0081 0964 aswRdr - ok15:18:29.0241 0964 aswSnx (6e98bb288696777a3a8a07a52b0eaee9) C:\Windows\system32\drivers\aswSnx.sys15:18:29.0262 0964 aswSnx - ok15:18:29.0376 0964 aswSP (d9fb49f16e4eb02efecae8cbfe4bcb4c) C:\Windows\system32\drivers\aswSP.sys15:18:29.0388 0964 aswSP - ok15:18:29.0475 0964 aswTdi (7352bb9a564b94bbd7c9cbf165f55006) C:\Windows\system32\drivers\aswTdi.sys15:18:29.0482 0964 aswTdi - ok15:18:29.0572 0964 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys15:18:29.0622 0964 AsyncMac - ok15:18:29.0728 0964 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys15:18:29.0737 0964 atapi - ok15:18:29.0857 0964 athr (08baaa2432e81031a6c3b11ad5a67e2b) C:\Windows\system32\DRIVERS\athrx.sys15:18:29.0950 0964 athr - ok15:18:30.0047 0964 AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll15:18:30.0123 0964 AudioEndpointBuilder - ok15:18:30.0180 0964 AudioSrv (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll15:18:30.0223 0964 AudioSrv - ok15:18:30.0356 0964 avast! Antivirus (4041d31508a2a084dfb42c595854090f) C:\Program Files\AVAST Software\Avast\AvastSvc.exe15:18:30.0363 0964 avast! Antivirus - ok15:18:30.0431 0964 AxInstSV (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll15:18:30.0489 0964 AxInstSV - ok15:18:30.0599 0964 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys15:18:30.0635 0964 b06bdrv - ok15:18:30.0772 0964 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys15:18:30.0834 0964 b57nd60a - ok15:18:30.0938 0964 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll15:18:30.0971 0964 BDESVC - ok15:18:31.0084 0964 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys15:18:31.0160 0964 Beep - ok15:18:31.0258 0964 BFE (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll15:18:31.0306 0964 BFE - ok15:18:31.0489 0964 BHDrvx64 (6c64fa457c200874faa87d74152e0d84) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\BASHDefs\20120317.002\BHDrvx64.sys15:18:31.0517 0964 BHDrvx64 - ok15:18:31.0653 0964 BITS (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\System32\qmgr.dll15:18:31.0744 0964 BITS - ok15:18:31.0840 0964 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\drivers\blbdrive.sys15:18:31.0867 0964 blbdrive - ok15:18:31.0963 0964 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys15:18:32.0020 0964 bowser - ok15:18:32.0131 0964 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys15:18:32.0181 0964 BrFiltLo - ok15:18:32.0298 0964 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys15:18:32.0312 0964 BrFiltUp - ok15:18:32.0398 0964 Browser (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll15:18:32.0449 0964 Browser - ok15:18:32.0565 0964 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys15:18:32.0597 0964 Brserid - ok15:18:32.0698 0964 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys15:18:32.0723 0964 BrSerWdm - ok15:18:32.0842 0964 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys15:18:32.0881 0964 BrUsbMdm - ok15:18:32.0987 0964 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys15:18:33.0015 0964 BrUsbSer - ok15:18:33.0134 0964 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys15:18:33.0153 0964 BthEnum - ok15:18:33.0268 0964 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys15:18:33.0298 0964 BTHMODEM - ok15:18:33.0404 0964 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys15:18:33.0428 0964 BthPan - ok15:18:33.0552 0964 BTHPORT (21084ceb85280468c9aca3c805c0f8cf) C:\Windows\System32\Drivers\BTHport.sys15:18:33.0611 0964 BTHPORT - ok15:18:33.0698 0964 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll15:18:33.0753 0964 bthserv - ok15:18:33.0860 0964 BTHUSB (8504842634dd144c075b6b0c982ccec4) C:\Windows\System32\Drivers\BTHUSB.sys15:18:33.0889 0964 BTHUSB - ok15:18:33.0987 0964 btwampfl (59e3510784548c6939c1b3b985c232e3) C:\Windows\system32\drivers\btwampfl.sys15:18:33.0999 0964 btwampfl - ok15:18:34.0083 0964 btwaudio (1872074ed0a3fb22e3f1e3197b984bfa) C:\Windows\system32\drivers\btwaudio.sys15:18:34.0093 0964 btwaudio - ok15:18:34.0198 0964 btwavdt (691cf076c33ab1c3a5b2fd5450300733) C:\Windows\system32\drivers\btwavdt.sys15:18:34.0206 0964 btwavdt - ok15:18:34.0280 0964 btwdins (8ba6e93a182126781952a7895ec1e4b2) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe15:18:34.0303 0964 btwdins - ok15:18:34.0401 0964 btwl2cap (07096d2bc22ccb6cea5a532df0be8a75) C:\Windows\system32\DRIVERS\btwl2cap.sys15:18:34.0407 0964 btwl2cap - ok15:18:34.0495 0964 btwrchid (c9273b20dec8ce38dbce5d29de63c907) C:\Windows\system32\DRIVERS\btwrchid.sys15:18:34.0501 0964 btwrchid - ok15:18:34.0622 0964 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys15:18:34.0703 0964 cdfs - ok15:18:34.0949 0964 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys15:18:34.0987 0964 cdrom - ok15:18:35.0072 0964 CertPropSvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll15:18:35.0141 0964 CertPropSvc - ok15:18:35.0227 0964 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys15:18:35.0268 0964 circlass - ok15:18:35.0353 0964 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys15:18:35.0369 0964 CLFS - ok15:18:35.0490 0964 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe15:18:35.0500 0964 clr_optimization_v2.0.50727_32 - ok15:18:35.0603 0964 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe15:18:35.0616 0964 clr_optimization_v2.0.50727_64 - ok15:18:36.0074 0964 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe15:18:36.0086 0964 clr_optimization_v4.0.30319_32 - ok15:18:37.0615 0964 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe15:18:37.0645 0964 clr_optimization_v4.0.30319_64 - ok15:18:37.0741 0964 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys15:18:37.0757 0964 CmBatt - ok15:18:37.0863 0964 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys15:18:37.0872 0964 cmdide - ok15:18:37.0974 0964 CNG (937beb186a735aca91d717044a49d17e) C:\Windows\system32\Drivers\cng.sys15:18:38.0003 0964 CNG - ok15:18:38.0797 0964 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys15:18:38.0808 0964 Compbatt - ok15:18:39.0043 0964 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\drivers\CompositeBus.sys15:18:39.0073 0964 CompositeBus - ok15:18:39.0127 0964 COMSysApp - ok15:18:39.0166 0964 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys15:18:39.0176 0964 crcdisk - ok15:18:39.0247 0964 CryptSvc (8c57411b66282c01533cb776f98ad384) C:\Windows\system32\cryptsvc.dll15:18:39.0295 0964 CryptSvc - ok15:18:39.0375 0964 DcomLaunch (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll15:18:39.0435 0964 DcomLaunch - ok15:18:39.0518 0964 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll15:18:39.0582 0964 defragsvc - ok15:18:39.0681 0964 DfsC (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys15:18:39.0735 0964 DfsC - ok15:18:39.0829 0964 Dhcp (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll15:18:39.0909 0964 Dhcp - ok15:18:40.0003 0964 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys15:18:40.0065 0964 discache - ok15:18:40.0161 0964 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys15:18:40.0175 0964 Disk - ok15:18:40.0249 0964 Dnscache (85cf424c74a1d5ec33533e1dbff9920a) C:\Windows\System32\dnsrslvr.dll15:18:40.0262 0964 Dnscache - ok15:18:40.0351 0964 dot3svc (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll15:18:40.0412 0964 dot3svc - ok15:18:40.0500 0964 DPS (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll15:18:40.0559 0964 DPS - ok15:18:40.0653 0964 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys15:18:40.0680 0964 drmkaud - ok15:18:40.0808 0964 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys15:18:40.0838 0964 DXGKrnl - ok15:18:40.0918 0964 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll15:18:40.0971 0964 EapHost - ok15:18:41.0121 0964 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys15:18:41.0207 0964 ebdrv - ok15:18:41.0303 0964 eeCtrl (0c3f9eff8ddd9f9eb56d754b4620155f) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys15:18:41.0317 0964 eeCtrl - ok15:18:41.0429 0964 EFS (156f6159457d0aa7e59b62681b56eb90) C:\Windows\System32\lsass.exe15:18:41.0481 0964 EFS - ok15:18:41.0560 0964 ehRecvr (47c071994c3f649f23d9cd075ac9304a) C:\Windows\ehome\ehRecvr.exe15:18:41.0605 0964 ehRecvr - ok15:18:41.0679 0964 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe15:18:41.0695 0964 ehSched - ok15:18:41.0781 0964 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys15:18:41.0804 0964 elxstor - ok15:18:41.0900 0964 EraserUtilRebootDrv (8c0f9b877bc0b7ffd327ef55f9efb642) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys15:18:41.0908 0964 EraserUtilRebootDrv - ok15:18:42.0111 0964 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys15:18:42.0246 0964 ErrDev - ok15:18:42.0351 0964 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll15:18:42.0405 0964 EventSystem - ok15:18:42.0496 0964 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys15:18:42.0548 0964 exfat - ok15:18:42.0667 0964 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys15:18:42.0718 0964 fastfat - ok15:18:42.0846 0964 Fax (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe15:18:42.0890 0964 Fax - ok15:18:43.0033 0964 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys15:18:43.0121 0964 fdc - ok15:18:43.0224 0964 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll15:18:43.0273 0964 fdPHost - ok15:18:43.0419 0964 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll15:18:43.0476 0964 FDResPub - ok15:18:43.0613 0964 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys15:18:43.0627 0964 FileInfo - ok15:18:43.0736 0964 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys15:18:43.0805 0964 Filetrace - ok15:18:43.0936 0964 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys15:18:43.0975 0964 flpydisk - ok15:18:44.0079 0964 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys15:18:44.0094 0964 FltMgr - ok15:18:44.0207 0964 FontCache (bc00505cfda789ed3be95d2ff38c4875) C:\Windows\system32\FntCache.dll15:18:44.0263 0964 FontCache - ok15:18:44.0362 0964 FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe15:18:44.0372 0964 FontCache3.0.0.0 - ok15:18:44.0512 0964 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys15:18:44.0522 0964 FsDepends - ok15:18:45.0079 0964 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys15:18:45.0091 0964 Fs_Rec - ok15:18:45.0212 0964 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys15:18:45.0228 0964 fvevol - ok15:18:45.0334 0964 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys15:18:45.0344 0964 gagp30kx - ok15:18:45.0443 0964 gpsvc (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll15:18:45.0486 0964 gpsvc - ok15:18:45.0586 0964 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe15:18:45.0595 0964 gupdate - ok15:18:45.0670 0964 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe15:18:45.0678 0964 gusvc - ok15:18:45.0791 0964 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys15:18:45.0824 0964 hcw85cir - ok15:18:45.0937 0964 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys15:18:45.0977 0964 HdAudAddService - ok15:18:46.0105 0964 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\drivers\HDAudBus.sys15:18:46.0127 0964 HDAudBus - ok15:18:46.0236 0964 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys15:18:46.0247 0964 HidBatt - ok15:18:46.0360 0964 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys15:18:46.0405 0964 HidBth - ok15:18:46.0529 0964 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys15:18:46.0569 0964 HidIr - ok15:18:46.0670 0964 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll15:18:46.0716 0964 hidserv - ok15:18:46.0855 0964 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys15:18:46.0892 0964 HidUsb - ok15:18:46.0990 0964 hkmsvc (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll15:18:47.0055 0964 hkmsvc - ok15:18:47.0164 0964 HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll15:18:47.0183 0964 HomeGroupListener - ok15:18:47.0272 0964 HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll15:18:47.0304 0964 HomeGroupProvider - ok15:18:47.0423 0964 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\drivers\HpSAMD.sys15:18:47.0434 0964 HpSAMD - ok15:18:47.0557 0964 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys15:18:47.0645 0964 HTTP - ok15:18:47.0764 0964 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys15:18:47.0773 0964 hwpolicy - ok15:18:47.0957 0964 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys15:18:47.0970 0964 i8042prt - ok15:18:48.0238 0964 iaStor (abbf174cb394f5c437410a788b7e404a) C:\Windows\system32\drivers\iaStor.sys15:18:48.0253 0964 iaStor - ok15:18:48.0327 0964 IAStorDataMgrSvc (31a0e93cdf29007d6c6fffb632f375ed) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe15:18:48.0333 0964 IAStorDataMgrSvc - ok15:18:48.0479 0964 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys15:18:48.0497 0964 iaStorV - ok15:18:48.0828 0964 idsvc (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe15:18:48.0852 0964 idsvc - ok15:18:49.0186 0964 IDSVia64 (18c40c3f368323b203ace403cb430db1) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\IPSDefs\20120330.002\IDSvia64.sys15:18:49.0203 0964 IDSVia64 - ok15:18:49.0423 0964 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys15:18:49.0434 0964 iirsp - ok15:18:49.0564 0964 IKEEXT (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll15:18:49.0645 0964 IKEEXT - ok15:18:50.0002 0964 Impcd (4b6363cd4610bb848531bb260b15dfcc) C:\Windows\system32\drivers\Impcd.sys15:18:50.0038 0964 Impcd - ok15:18:50.0193 0964 IntcAzAudAddService (526e482afb586cb1cdd687869decf686) C:\Windows\system32\drivers\RTKVHD64.sys15:18:50.0251 0964 IntcAzAudAddService - ok15:18:50.0345 0964 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys15:18:50.0355 0964 intelide - ok15:18:50.0560 0964 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\drivers\intelppm.sys15:18:50.0578 0964 intelppm - ok15:18:50.0675 0964 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll15:18:50.0735 0964 IPBusEnum - ok15:18:50.0849 0964 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys15:18:50.0914 0964 IpFilterDriver - ok15:18:51.0027 0964 iphlpsvc (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll15:18:51.0103 0964 iphlpsvc - ok15:18:51.0218 0964 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\drivers\IPMIDrv.sys15:18:51.0242 0964 IPMIDRV - ok15:18:51.0330 0964 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys15:18:51.0386 0964 IPNAT - ok15:18:51.0476 0964 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys15:18:51.0492 0964 IRENUM - ok15:18:51.0587 0964 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys15:18:51.0601 0964 isapnp - ok15:18:51.0689 0964 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\drivers\msiscsi.sys15:18:51.0703 0964 iScsiPrt - ok15:18:51.0759 0964 IviRegMgr (213822072085b5bbad9af30ab577d817) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe15:18:51.0771 0964 IviRegMgr - ok15:18:51.0855 0964 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys15:18:51.0865 0964 kbdclass - ok15:18:51.0956 0964 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\drivers\kbdhid.sys15:18:51.0990 0964 kbdhid - ok15:18:52.0074 0964 KeyIso (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe15:18:52.0087 0964 KeyIso - ok15:18:52.0173 0964 KSecDD (16c1b906fc5ead84769f90b736b6bf0e) C:\Windows\system32\Drivers\ksecdd.sys15:18:52.0184 0964 KSecDD - ok15:18:52.0282 0964 KSecPkg (0b711550c56444879d71c7daabda6c83) C:\Windows\system32\Drivers\ksecpkg.sys15:18:52.0296 0964 KSecPkg - ok15:18:52.0390 0964 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys15:18:52.0436 0964 ksthunk - ok15:18:52.0535 0964 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll15:18:52.0602 0964 KtmRm - ok15:18:52.0728 0964 LanmanServer (81f1d04d4d0e433099365127375fd501) C:\Windows\system32\srvsvc.dll15:18:52.0773 0964 LanmanServer - ok15:18:52.0896 0964 LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll15:18:52.0966 0964 LanmanWorkstation - ok15:18:53.0069 0964 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys15:18:53.0107 0964 lltdio - ok15:18:53.0212 0964 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll15:18:53.0254 0964 lltdsvc - ok15:18:53.0333 0964 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll15:18:53.0371 0964 lmhosts - ok15:18:53.0482 0964 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys15:18:53.0494 0964 LSI_FC - ok15:18:53.0586 0964 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys15:18:53.0597 0964 LSI_SAS - ok15:18:53.0687 0964 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys15:18:53.0697 0964 LSI_SAS2 - ok15:18:53.0790 0964 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys15:18:53.0801 0964 LSI_SCSI - ok15:18:53.0892 0964 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys15:18:53.0938 0964 luafv - ok15:18:54.0015 0964 Mcx2Svc (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll15:18:54.0027 0964 Mcx2Svc - ok15:18:54.0126 0964 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys15:18:54.0136 0964 megasas - ok15:18:54.0235 0964 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys15:18:54.0250 0964 MegaSR - ok15:18:54.0333 0964 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll15:18:54.0391 0964 MMCSS - ok15:18:54.0490 0964 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys15:18:54.0548 0964 Modem - ok15:18:54.0668 0964 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys15:18:54.0691 0964 monitor - ok15:18:54.0814 0964 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys15:18:54.0824 0964 mouclass - ok15:18:54.0970 0964 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys15:18:54.0997 0964 mouhid - ok15:18:55.0117 0964 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys15:18:55.0127 0964 mountmgr - ok15:18:55.0244 0964 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\drivers\mpio.sys15:18:55.0256 0964 mpio - ok15:18:55.0367 0964 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys15:18:55.0417 0964 mpsdrv - ok15:18:55.0532 0964 MpsSvc (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll15:18:55.0598 0964 MpsSvc - ok15:18:55.0714 0964 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys15:18:55.0747 0964 MRxDAV - ok15:18:55.0861 0964 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys15:18:55.0900 0964 mrxsmb - ok15:18:56.0045 0964 mrxsmb10 (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys15:18:56.0060 0964 mrxsmb10 - ok15:18:56.0179 0964 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys15:18:56.0209 0964 mrxsmb20 - ok15:18:56.0335 0964 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\drivers\msahci.sys15:18:56.0345 0964 msahci - ok15:18:56.0472 0964 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\drivers\msdsm.sys15:18:56.0488 0964 msdsm - ok15:18:56.0586 0964 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe15:18:56.0619 0964 MSDTC - ok15:18:56.0772 0964 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys15:18:56.0808 0964 Msfs - ok15:18:56.0927 0964 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys15:18:56.0987 0964 mshidkmdf - ok15:18:57.0109 0964 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys15:18:57.0122 0964 msisadrv - ok15:18:57.0218 0964 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll15:18:57.0272 0964 MSiSCSI - ok15:18:57.0496 0964 msiserver - ok15:18:57.0566 0964 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys15:18:57.0626 0964 MSKSSRV - ok15:18:57.0722 0964 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys15:18:57.0783 0964 MSPCLOCK - ok15:18:58.0111 0964 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys15:18:58.0179 0964 MSPQM - ok15:18:58.0300 0964 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys15:18:58.0317 0964 MsRPC - ok15:18:58.0920 0964 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys15:18:58.0931 0964 mssmbios - ok15:18:59.0043 0964 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys15:18:59.0085 0964 MSTEE - ok15:18:59.0199 0964 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys15:18:59.0243 0964 MTConfig - ok15:18:59.0367 0964 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys15:18:59.0377 0964 Mup - ok15:18:59.0470 0964 napagent (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll15:18:59.0516 0964 napagent - ok15:18:59.0641 0964 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys15:18:59.0687 0964 NativeWifiP - ok15:18:59.0831 0964 NAVENG (2dbe90210de76be6e1653bb20ec70ec2) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\VirusDefs\20120402.002\ENG64.SYS15:18:59.0839 0964 NAVENG - ok15:19:00.0012 0964 NAVEX15 (346da70e203b8e2c850277713de8f71b) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\VirusDefs\20120402.002\EX64.SYS15:19:00.0058 0964 NAVEX15 - ok15:19:00.0194 0964 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys15:19:00.0221 0964 NDIS - ok15:19:00.0345 0964 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys15:19:00.0390 0964 NdisCap - ok15:19:00.0545 0964 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys15:19:00.0582 0964 NdisTapi - ok15:19:00.0690 0964 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys15:19:00.0750 0964 Ndisuio - ok15:19:00.0872 0964 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys15:19:00.0911 0964 NdisWan - ok15:19:01.0153 0964 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys15:19:01.0204 0964 NDProxy - ok15:19:01.0321 0964 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys15:19:01.0387 0964 NetBIOS - ok15:19:01.0505 0964 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys15:19:01.0571 0964 NetBT - ok15:19:01.0664 0964 Netlogon (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe15:19:01.0676 0964 Netlogon - ok15:19:01.0806 0964 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll15:19:01.0884 0964 Netman - ok15:19:01.0998 0964 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll15:19:02.0050 0964 netprofm - ok15:19:02.0183 0964 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe15:19:02.0192 0964 NetTcpPortSharing - ok15:19:02.0358 0964 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys15:19:02.0368 0964 nfrd960 - ok15:19:02.0463 0964 NIS (e78a365cc3e0fbfc018a33dce01909f8) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.0.13\ccSvcHst.exe15:19:02.0472 0964 NIS - ok15:19:02.0627 0964 NlaSvc (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll15:19:02.0686 0964 NlaSvc - ok15:19:02.0804 0964 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys15:19:02.0850 0964 Npfs - ok15:19:03.0083 0964 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll15:19:03.0149 0964 nsi - ok15:19:03.0448 0964 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys15:19:03.0498 0964 nsiproxy - ok15:19:03.0692 0964 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys15:19:03.0733 0964 Ntfs - ok15:19:03.0864 0964 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys15:19:03.0914 0964 Null - ok15:19:04.0010 0964 nusb3hub (285acec1b13a15ba520aae06bacb9cff) C:\Windows\system32\DRIVERS\nusb3hub.sys15:19:04.0017 0964 nusb3hub - ok15:19:04.0117 0964 nusb3xhc (f6d625ff7b56bb6ea063f0d3a5bbc996) C:\Windows\system32\drivers\nusb3xhc.sys15:19:04.0125 0964 nusb3xhc - ok15:19:04.0220 0964 NVHDA (a842341ef3c702ef8208e610be0fd1d9) C:\Windows\system32\drivers\nvhda64v.sys15:19:04.0228 0964 NVHDA - ok15:19:04.0969 0964 nvlddmkm (b4402e1d61a3015fc29bef94bb1c81fd) C:\Windows\system32\DRIVERS\nvlddmkm.sys15:19:05.0361 0964 nvlddmkm - ok15:19:05.0703 0964 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys15:19:05.0717 0964 nvraid - ok15:19:05.0831 0964 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys15:19:05.0843 0964 nvstor - ok15:19:06.0099 0964 nvsvc (3446574a40b1f355b9ce636fc49da5f1) C:\Windows\system32\nvvsvc.exe15:19:06.0108 0964 nvsvc - ok15:19:06.0215 0964 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys15:19:06.0226 0964 nv_agp - ok15:19:06.0322 0964 Oasis2Service (07571684567859da796a566cc78ffa74) C:\Program Files (x86)\DDNi\Oasis2Service\Oasis2Service.exe15:19:06.0347 0964 Oasis2Service ( UnsignedFile.Multi.Generic ) - warning15:19:06.0347 0964 Oasis2Service - detected UnsignedFile.Multi.Generic (1)15:19:06.0699 0964 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys15:19:06.0717 0964 ohci1394 - ok15:19:07.0003 0964 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll15:19:07.0027 0964 p2pimsvc - ok15:19:07.0108 0964 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll15:19:07.0126 0964 p2psvc - ok15:19:07.0226 0964 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys15:19:07.0238 0964 Parport - ok15:19:07.0338 0964 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys15:19:07.0349 0964 partmgr - ok15:19:07.0395 0964 Partner Service (9665402b7fa59302d520ad845ddfc026) C:\ProgramData\Partner\Partner.exe15:19:07.0407 0964 Partner Service - ok15:19:07.0489 0964 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll15:19:07.0519 0964 PcaSvc - ok15:19:07.0620 0964 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\drivers\pci.sys15:19:07.0634 0964 pci - ok15:19:07.0809 0964 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys15:19:07.0818 0964 pciide - ok15:19:08.0028 0964 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys15:19:08.0043 0964 pcmcia - ok15:19:08.0139 0964 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys15:19:08.0149 0964 pcw - ok15:19:08.0283 0964 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys15:19:08.0339 0964 PEAUTH - ok15:19:08.0413 0964 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe15:19:08.0440 0964 PerfHost - ok15:19:08.0551 0964 pla (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll15:19:08.0627 0964 pla - ok15:19:08.0894 0964 PlugPlay (98b1721b8718164293b9701b98c52d77) C:\Windows\system32\umpnpmgr.dll15:19:08.0912 0964 PlugPlay - ok15:19:09.0624 0964 PMBDeviceInfoProvider (80e85394d8cd7f84340b1c6f4b9d698f) c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe15:19:09.0647 0964 PMBDeviceInfoProvider - ok15:19:09.0751 0964 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll15:19:09.0764 0964 PNRPAutoReg - ok15:19:10.0359 0964 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll15:19:10.0374 0964 PNRPsvc - ok15:19:10.0472 0964 PolicyAgent (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll15:19:10.0571 0964 PolicyAgent - ok15:19:10.0667 0964 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll15:19:10.0707 0964 Power - ok15:19:10.0812 0964 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys15:19:10.0860 0964 PptpMiniport - ok15:19:10.0987 0964 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys15:19:11.0017 0964 Processor - ok15:19:11.0133 0964 ProfSvc (f381975e1f4346de875cb07339ce8d3a) C:\Windows\system32\profsvc.dll15:19:11.0213 0964 ProfSvc - ok15:19:11.0531 0964 ProtectedStorage (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe15:19:11.0543 0964 ProtectedStorage - ok15:19:11.0669 0964 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys15:19:11.0707 0964 Psched - ok15:19:11.0797 0964 PSI_SVC_2 (a6a7ad767bf5141665f5c675f671b3e1) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe15:19:11.0807 0964 PSI_SVC_2 - ok15:19:12.0008 0964 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys15:19:12.0047 0964 ql2300 - ok15:19:12.0858 0964 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys15:19:12.0874 0964 ql40xx - ok15:19:12.0982 0964 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll15:19:13.0028 0964 QWAVE - ok15:19:13.0136 0964 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys15:19:13.0168 0964 QWAVEdrv - ok15:19:13.0281 0964 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys15:19:13.0324 0964 RasAcd - ok15:19:13.0443 0964 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys15:19:13.0485 0964 RasAgileVpn - ok15:19:13.0610 0964 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll15:19:13.0662 0964 RasAuto - ok15:19:13.0784 0964 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys15:19:13.0859 0964 Rasl2tp - ok15:19:14.0045 0964 RasMan (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll15:19:14.0124 0964 RasMan - ok15:19:14.0221 0964 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys15:19:14.0275 0964 RasPppoe - ok15:19:14.0391 0964 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys15:19:14.0444 0964 RasSstp - ok15:19:14.0632 0964 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys15:19:14.0696 0964 rdbss - ok15:19:14.0910 0964 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\drivers\rdpbus.sys15:19:14.0934 0964 rdpbus - ok15:19:15.0054 0964 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys15:19:15.0104 0964 RDPCDD - ok15:19:15.0210 0964 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys15:19:15.0268 0964 RDPENCDD - ok15:19:15.0377 0964 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys15:19:15.0420 0964 RDPREFMP - ok15:19:15.0537 0964 RDPWD (074ac702d8b8b660b0e1371555995386) C:\Windows\system32\drivers\RDPWD.sys15:19:15.0567 0964 RDPWD - ok15:19:15.0686 0964 rdyboost (e5dc9ba9e439d6dbdd79f8caacb5bf01) C:\Windows\system32\drivers\rdyboost.sys15:19:15.0702 0964 rdyboost - ok15:19:15.0796 0964 regi (4d9afddda0efe97cdbfd3b5fa48b05f6) C:\Windows\system32\drivers\regi.sys15:19:15.0802 0964 regi - ok15:19:15.0897 0964 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll15:19:15.0954 0964 RemoteAccess - ok15:19:16.0027 0964 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll15:19:16.0071 0964 RemoteRegistry - ok15:19:16.0185 0964 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys15:19:16.0221 0964 RFCOMM - ok15:19:16.0328 0964 rimspci (fa6abc06b629da29634d31f1fe0347bd) C:\Windows\system32\drivers\rimssne64.sys15:19:16.0376 0964 rimspci - ok15:19:16.0764 0964 risdsnpe (8f8539a7f5c117d4407b2985995671f2) C:\Windows\system32\drivers\risdsne64.sys15:19:16.0814 0964 risdsnpe - ok15:19:16.0890 0964 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll15:19:16.0954 0964 RpcEptMapper - ok15:19:17.0040 0964 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe15:19:17.0074 0964 RpcLocator - ok15:19:17.0156 0964 RpcSs (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll15:19:17.0205 0964 RpcSs - ok15:19:17.0302 0964 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys15:19:17.0351 0964 rspndr - ok15:19:17.0432 0964 SamSs (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe15:19:17.0443 0964 SamSs - ok15:19:17.0537 0964 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\drivers\sbp2port.sys15:19:17.0550 0964 sbp2port - ok15:19:17.0647 0964 SBSDWSCService (794d4b48dfb6e999537c7c3947863463) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe15:19:17.0679 0964 SBSDWSCService - ok15:19:17.0778 0964 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll15:19:17.0837 0964 SCardSvr - ok15:19:17.0938 0964 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys15:19:18.0002 0964 scfilter - ok15:19:18.0107 0964 Schedule (624d0f5ff99428bb90a5b8a4123e918e) C:\Windows\system32\schedsvc.dll15:19:18.0147 0964 Schedule - ok15:19:18.0220 0964 SCPolicySvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll15:19:18.0258 0964 SCPolicySvc - ok15:19:18.0344 0964 sdbus (2c8d162efaf73abd36d8bcbb6340cae7) C:\Windows\system32\DRIVERS\sdbus.sys15:19:18.0367 0964 sdbus - ok15:19:18.0444 0964 SDRSVC (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll15:19:18.0467 0964 SDRSVC - ok15:19:18.0556 0964 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys15:19:18.0600 0964 secdrv - ok15:19:18.0679 0964 seclogon (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll15:19:18.0734 0964 seclogon - ok15:19:18.0808 0964 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll15:19:18.0871 0964 SENS - ok15:19:18.0958 0964 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll15:19:18.0993 0964 SensrSvc - ok15:19:19.0101 0964 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys15:19:19.0118 0964 Serenum - ok15:19:19.0227 0964 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys15:19:19.0240 0964 Serial - ok15:19:19.0349 0964 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys15:19:19.0382 0964 sermouse - ok15:19:19.0482 0964 SessionEnv (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll15:19:19.0522 0964 SessionEnv - ok15:19:19.0613 0964 SFEP (286d3889e6ab5589646ff8a63cb928ae) C:\Windows\system32\DRIVERS\SFEP.sys15:19:19.0657 0964 SFEP - ok15:19:19.0761 0964 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys15:19:19.0783 0964 sffdisk - ok15:19:19.0883 0964 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys15:19:19.0906 0964 sffp_mmc - ok15:19:20.0006 0964 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\drivers\sffp_sd.sys15:19:20.0039 0964 sffp_sd - ok15:19:20.0140 0964 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys15:19:20.0150 0964 sfloppy - ok15:19:20.0245 0964 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll15:19:20.0306 0964 SharedAccess - ok15:19:20.0416 0964 ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll15:19:20.0447 0964 ShellHWDetection - ok15:19:20.0563 0964 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys15:19:20.0573 0964 SiSRaid2 - ok15:19:20.0698 0964 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys15:19:20.0708 0964 SiSRaid4 - ok15:19:20.0822 0964 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys15:19:20.0874 0964 Smb - ok15:19:20.0978 0964 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe15:19:21.0020 0964 SNMPTRAP - ok15:19:21.0109 0964 SOHCImp (c3e69db0a4e59564230e053232f39ac7) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe15:19:21.0117 0964 SOHCImp - ok15:19:21.0216 0964 SOHDms (65cc4779a29c3e82b987bd4961790dff) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe15:19:21.0228 0964 SOHDms - ok15:19:21.0332 0964 SOHDs (f47d75cee1844eef4a9ea6ee768828fb) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe15:19:21.0339 0964 SOHDs - ok15:19:21.0428 0964 SpfService (5449fc97476f52e027409e703791e6a9) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe15:19:21.0440 0964 SpfService - ok15:19:21.0556 0964 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys15:19:21.0566 0964 spldr - ok15:19:21.0676 0964 Spooler (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\Windows\System32\spoolsv.exe15:19:21.0850 0964 Spooler - ok15:19:22.0026 0964 sppsvc (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe15:19:22.0138 0964 sppsvc - ok15:19:22.0253 0964 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll15:19:22.0305 0964 sppuinotify - ok15:19:22.0460 0964 SRTSP (90ef30c3867bcde4579c01a6d6e75a7a) C:\Windows\System32\Drivers\NISx64\1207000.00D\SRTSP64.SYS15:19:22.0480 0964 SRTSP - ok15:19:22.0638 0964 SRTSPX (c513e8a5e7978da49077f5484344ee1b) C:\Windows\system32\drivers\NISx64\1207000.00D\SRTSPX64.SYS15:19:22.0644 0964 SRTSPX - ok15:19:22.0777 0964 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys15:19:22.0820 0964 srv - ok15:19:22.0971 0964 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys15:19:23.0010 0964 srv2 - ok15:19:23.0137 0964 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys15:19:23.0185 0964 srvnet - ok15:19:23.0306 0964 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll15:19:23.0361 0964 SSDPSRV - ok15:19:23.0472 0964 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll15:19:23.0510 0964 SstpSvc - ok15:19:23.0623 0964 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys15:19:23.0633 0964 stexstor - ok15:19:23.0764 0964 stisvc (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll15:19:23.0817 0964 stisvc - ok15:19:23.0915 0964 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys15:19:23.0924 0964 swenum - ok15:19:24.0032 0964 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll15:19:24.0100 0964 swprv - ok15:19:24.0246 0964 SymDS (6160145c7a87fc7672e8e3b886888176) C:\Windows\system32\drivers\NISx64\1207000.00D\SYMDS64.SYS15:19:24.0260 0964 SymDS - ok15:19:24.0417 0964 SymEFA (96aeed40d4d3521568b42027687e69e0) C:\Windows\system32\drivers\NISx64\1207000.00D\SYMEFA64.SYS15:19:24.0463 0964 SymEFA - ok15:19:24.0924 0964 SymEvent (21a1c2d694c3cf962d31f5e873ab3d6f) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS15:19:24.0933 0964 SymEvent - ok15:19:25.0078 0964 SymIRON (bd0d711d8cbfcaa19ca123306eaf53a5) C:\Windows\system32\drivers\NISx64\1207000.00D\Ironx64.SYS15:19:25.0087 0964 SymIRON - ok15:19:25.0226 0964 SymNetS (a6adb3d83023f8daa0f7b6fda785d83b) C:\Windows\System32\Drivers\NISx64\1207000.00D\SYMNETS.SYS15:19:25.0239 0964 SymNetS - ok15:19:25.0394 0964 SysMain (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll15:19:25.0456 0964 SysMain - ok15:19:25.0561 0964 TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll15:19:25.0606 0964 TabletInputService - ok15:19:25.0729 0964 TapiSrv (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll15:19:25.0804 0964 TapiSrv - ok15:19:25.0914 0964 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll15:19:25.0953 0964 TBS - ok15:19:26.0112 0964 Tcpip (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\drivers\tcpip.sys15:19:26.0157 0964 Tcpip - ok15:19:26.0324 0964 TCPIP6 (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\DRIVERS\tcpip.sys15:19:26.0365 0964 TCPIP6 - ok15:19:26.0472 0964 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys15:19:26.0511 0964 tcpipreg - ok15:19:26.0628 0964 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys15:19:26.0647 0964 TDPIPE - ok15:19:26.0782 0964 TDTCP (7518f7bcfd4b308abc9192bacaf6c970) C:\Windows\system32\drivers\tdtcp.sys15:19:26.0793 0964 TDTCP - ok15:19:26.0908 0964 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys15:19:26.0953 0964 tdx - ok15:19:27.0065 0964 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\drivers\termdd.sys15:19:27.0075 0964 TermDD - ok15:19:27.0178 0964 TermService (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll15:19:27.0245 0964 TermService - ok15:19:27.0363 0964 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll15:19:27.0402 0964 Themes - ok15:19:27.0514 0964 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll15:19:27.0552 0964 THREADORDER - ok15:19:27.0674 0964 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll15:19:27.0716 0964 TrkWks - ok15:19:27.0780 0964 TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe15:19:27.0798 0964 TrustedInstaller - ok15:19:27.0899 0964 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys15:19:27.0954 0964 tssecsrv - ok15:19:28.0235 0964 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys15:19:28.0293 0964 tunnel - ok15:19:28.0404 0964 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys15:19:28.0415 0964 uagp35 - ok15:19:28.0480 0964 uCamMonitor (63f6d08c54d5b3c1b12a6172032055c7) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe15:19:28.0488 0964 uCamMonitor - ok15:19:28.0624 0964 udfs (0e5e962b5649d544be54e8c90761ea2b) C:\Windows\system32\DRIVERS\udfs.sys15:19:28.0662 0964 udfs - ok15:19:28.0765 0964 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe15:19:28.0778 0964 UI0Detect - ok15:19:28.0879 0964 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys15:19:28.0889 0964 uliagpkx - ok15:19:28.0991 0964 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys15:19:29.0010 0964 umbus - ok15:19:29.0135 0964 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys15:19:29.0158 0964 UmPass - ok15:19:29.0263 0964 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll15:19:29.0329 0964 upnphost - ok15:19:29.0450 0964 usbccgp (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys15:19:29.0486 0964 usbccgp - ok15:19:29.0587 0964 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys15:19:29.0608 0964 usbcir - ok15:19:29.0748 0964 usbehci (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\drivers\usbehci.sys15:19:29.0760 0964 usbehci - ok15:19:29.0891 0964 usbhub (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys15:19:29.0934 0964 usbhub - ok15:19:30.0056 0964 usbohci (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\drivers\usbohci.sys15:19:30.0083 0964 usbohci - ok15:19:30.0215 0964 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\drivers\usbprint.sys15:19:30.0235 0964 usbprint - ok15:19:30.0394 0964 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\drivers\USBSTOR.SYS15:19:30.0433 0964 USBSTOR - ok15:19:30.0550 0964 usbuhci (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\drivers\usbuhci.sys15:19:30.0560 0964 usbuhci - ok15:19:30.0710 0964 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\System32\Drivers\usbvideo.sys15:19:30.0734 0964 usbvideo - ok15:19:30.0833 0964 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll15:19:30.0895 0964 UxSms - ok15:19:30.0986 0964 VAIO Event Service (a60605fc66552b421ee1f3d4ebb9a4e0) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe15:19:30.0995 0964 VAIO Event Service - ok15:19:31.0089 0964 VAIO Power Management (d469be2723f79cf4b384680b1fdc577d) C:\Program Files\Sony\VAIO Power Management\SPMService.exe15:19:31.0105 0964 VAIO Power Management - ok15:19:31.0222 0964 VaultSvc (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe15:19:31.0233 0964 VaultSvc - ok15:19:31.0349 0964 VCFw (96efa2698d6b9e2931609a3ea73fc5dc) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe15:19:31.0372 0964 VCFw - ok15:19:31.0459 0964 VcmIAlzMgr (7bebf6a5285ffc03c34a7297a4e177cb) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe15:19:31.0475 0964 VcmIAlzMgr - ok15:19:31.0562 0964 VcmINSMgr (e005b04dfca99f5880c5111933194ca9) C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe15:19:31.0575 0964 VcmINSMgr - ok15:19:31.0646 0964 VcmXmlIfHelper (829a32fd1334f72429ca0515760eb7a7) C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe15:19:31.0654 0964 VcmXmlIfHelper - ok15:19:31.0746 0964 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys15:19:31.0755 0964 vdrvroot - ok15:19:31.0852 0964 vds (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe15:19:31.0879 0964 vds - ok15:19:31.0958 0964 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys15:19:31.0972 0964 vga - ok15:19:32.0058 0964 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys15:19:32.0118 0964 VgaSave - ok15:19:32.0208 0964 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\drivers\vhdmp.sys15:19:32.0221 0964 vhdmp - ok15:19:32.0308 0964 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys15:19:32.0317 0964 viaide - ok15:19:32.0402 0964 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\drivers\volmgr.sys15:19:32.0413 0964 volmgr - ok15:19:32.0545 0964 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys15:19:32.0560 0964 volmgrx - ok15:19:32.0685 0964 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\drivers\volsnap.sys15:19:32.0700 0964 volsnap - ok15:19:32.0943 0964 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys15:19:32.0956 0964 vsmraid - ok15:19:33.0108 0964 VSS (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe15:19:33.0161 0964 VSS - ok15:19:33.0280 0964 VUAgent (e55a44d8f9f713d5f5d5bbaef2ba0a34) C:\Program Files\Sony\VAIO Update 5\VUAgent.exe15:19:33.0308 0964 VUAgent - ok15:19:33.0409 0964 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys15:19:33.0433 0964 vwifibus - ok15:19:33.0532 0964 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys15:19:33.0548 0964 vwififlt - ok15:19:33.0632 0964 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys15:19:33.0648 0964 vwifimp - ok15:19:33.0732 0964 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll15:19:33.0778 0964 W32Time - ok15:19:33.0911 0964 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys15:19:33.0945 0964 WacomPen - ok15:19:34.0048 0964 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys15:19:34.0106 0964 WANARP - ok15:19:34.0110 0964 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys15:19:34.0147 0964 Wanarpv6 - ok15:19:34.0291 0964 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe15:19:34.0326 0964 WatAdminSvc - ok15:19:34.0628 0964 wbengine (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe15:19:34.0662 0964 wbengine - ok15:19:34.0747 0964 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll15:19:34.0766 0964 WbioSrvc - ok15:19:34.0879 0964 wcncsvc (dd1bae8ebfc653824d29ccf8c9054d68) C:\Windows\System32\wcncsvc.dll15:19:34.0912 0964 wcncsvc - ok15:19:34.0989 0964 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll15:19:35.0001 0964 WcsPlugInService - ok15:19:35.0105 0964 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys15:19:35.0114 0964 Wd - ok15:19:35.0203 0964 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys15:19:35.0224 0964 Wdf01000 - ok15:19:35.0305 0964 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll15:19:35.0332 0964 WdiServiceHost - ok15:19:35.0360 0964 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll15:19:35.0378 0964 WdiSystemHost - ok15:19:35.0917 0964 WebClient (733006127f235be7c35354ebee7b9a7b) C:\Windows\System32\webclnt.dll15:19:35.0947 0964 WebClient - ok15:19:36.0160 0964 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll15:19:36.0217 0964 Wecsvc - ok15:19:36.0299 0964 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll15:19:36.0338 0964 wercplsupport - ok15:19:36.0428 0964 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll15:19:36.0467 0964 WerSvc - ok15:19:36.0568 0964 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys15:19:36.0605 0964 WfpLwf - ok15:19:36.0702 0964 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys15:19:36.0711 0964 WIMMount - ok15:19:36.0747 0964 WinDefend - ok15:19:36.0751 0964 WinHttpAutoProxySvc - ok15:19:36.0847 0964 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll15:19:36.0901 0964 Winmgmt - ok15:19:37.0146 0964 WinRM (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll15:19:37.0228 0964 WinRM - ok15:19:37.0322 0964 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll15:19:37.0369 0964 Wlansvc - ok15:19:37.0458 0964 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys15:19:37.0470 0964 WmiAcpi - ok15:19:37.0570 0964 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe15:19:37.0595 0964 wmiApSrv - ok15:19:37.0795 0964 WMPNetworkSvc - ok15:19:37.0862 0964 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll15:19:37.0873 0964 WPCSvc - ok15:19:38.0021 0964 WPDBusEnum (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll15:19:38.0103 0964 WPDBusEnum - ok15:19:38.0181 0964 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys15:19:38.0218 0964 ws2ifsl - ok15:19:38.0306 0964 wscsvc (8f9f3969933c02da96eb0f84576db43e) C:\Windows\System32\wscsvc.dll15:19:38.0318 0964 wscsvc - ok15:19:38.0377 0964 WSearch - ok15:19:38.0462 0964 wuauserv (38340204a2d0228f1e87740fc5e554a7) C:\Windows\system32\wuaueng.dll15:19:38.0559 0964 wuauserv - ok15:19:38.0651 0964 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys15:19:38.0706 0964 WudfPf - ok15:19:38.0842 0964 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys15:19:38.0880 0964 WUDFRd - ok15:19:38.0953 0964 wudfsvc (b551d6637aa0e132c18ac6e504f7b79b) C:\Windows\System32\WUDFSvc.dll15:19:39.0004 0964 wudfsvc - ok15:19:39.0075 0964 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll15:19:39.0104 0964 WwanSvc - ok15:19:39.0213 0964 yukonw7 (5250193ef8e173aa7491250f00eb367f) C:\Windows\system32\DRIVERS\yk62x64.sys15:19:39.0225 0964 yukonw7 - ok15:19:39.0261 0964 MBR (0x1B8) (0f84f2562620c40d8a3e1908c8075675) \Device\Harddisk0\DR015:19:39.0286 0964 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected15:19:39.0286 0964 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)15:19:40.0053 0964 \Device\Harddisk0\DR0 ( TDSS File System ) - warning15:19:40.0053 0964 \Device\Harddisk0\DR0 - detected TDSS File System (1)15:19:40.0084 0964 Boot (0x1200) (1e5b2d3597c22f36553de0839ad50452) \Device\Harddisk0\DR0\Partition015:19:40.0085 0964 \Device\Harddisk0\DR0\Partition0 - ok15:19:40.0100 0964 Boot (0x1200) (682208e969e7c0cfba3cda9b6eded1e2) \Device\Harddisk0\DR0\Partition115:19:40.0101 0964 \Device\Harddisk0\DR0\Partition1 - ok15:19:40.0101 0964 ============================================================15:19:40.0101 0964 Scan finished15:19:40.0101 0964 ============================================================15:19:40.0126 3536 Detected object count: 315:19:40.0126 3536 Actual detected object count: 315:20:16.0487 3536 Oasis2Service ( UnsignedFile.Multi.Generic ) - skipped by user15:20:16.0487 3536 Oasis2Service ( UnsignedFile.Multi.Generic ) - User select action: Skip15:20:16.0625 3536 \Device\Harddisk0\DR0\# - copied to quarantine15:20:16.0625 3536 \Device\Harddisk0\DR0 - copied to quarantine15:20:16.0655 3536 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine15:20:16.0656 3536 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine15:20:16.0660 3536 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine15:20:16.0663 3536 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine15:20:16.0679 3536 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine15:20:16.0685 3536 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine15:20:16.0686 3536 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine15:20:16.0686 3536 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine15:20:16.0688 3536 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine15:20:16.0691 3536 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine15:20:16.0693 3536 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine15:20:16.0709 3536 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine15:20:16.0757 3536 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot15:20:16.0757 3536 \Device\Harddisk0\DR0 - ok15:20:16.0920 3536 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure15:20:16.0921 3536 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user15:20:16.0921 3536 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip Link to post Share on other sites More sharing options...
MrCharlie Posted April 2, 2012 ID:539344 Share Posted April 2, 2012 Well, a friend of mine was able to rid of the trojanI don't think so, you're badly infected!-----------------------Please download and run ComboFix.The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.Please visit this webpage for download links, and instructions for running ComboFixhttp://www.bleepingc...to-use-combofixEnsure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Information on disabling your malware programs can be found Here.Make sure you run ComboFix from your desktop. Please include the C:\ComboFix.txt in your next reply for further review.MrC Link to post Share on other sites More sharing options...
Belcoot Posted April 2, 2012 Author ID:539349 Share Posted April 2, 2012 Done the scan and here's the resultsComboFix 12-04-01.03 - Hernandez 04/02/2012 15:47:25.1.8 - x64Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.6125.3290 [GMT -7:00]Running from: c:\users\Hernandez\Downloads\ComboFix.exeAV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\windows\svchost.exe..((((((((((((((((((((((((( Files Created from 2012-03-02 to 2012-04-02 )))))))))))))))))))))))))))))))..2012-04-02 22:53 . 2012-04-02 22:53 -------- d-----w- c:\users\Default\AppData\Local\temp2012-04-02 22:38 . 2012-04-02 22:38 -------- d-----w- c:\programdata\AIM2012-04-02 22:38 . 2012-04-02 22:38 -------- d-----w- c:\program files (x86)\AIM2012-04-02 22:38 . 2012-04-02 22:38 -------- d-----w- c:\program files (x86)\Common Files\Software Update Utility2012-04-02 22:38 . 2012-04-02 22:38 -------- d-----w- c:\program files (x86)\Common Files\AOL2012-04-02 22:20 . 2012-04-02 22:20 -------- d-----w- C:\TDSSKiller_Quarantine2012-04-02 21:17 . 2012-04-02 21:17 -------- d-----w- C:\57d5afa02ad90c9d5809830cb981e80a2012-04-02 20:33 . 2012-04-02 22:44 -------- d-----w- c:\program files\LeagueOfLegends2012-04-02 20:32 . 2012-04-02 22:32 -------- d-----w- c:\programdata\PMB Files2012-04-02 20:32 . 2012-04-02 20:32 -------- d-----w- c:\program files (x86)\Pando Networks2012-04-02 20:04 . 2012-04-02 20:49 -------- d-----w- c:\program files (x86)\World of Warcraft2012-04-02 20:04 . 2012-04-02 20:05 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment2012-04-02 20:02 . 2012-04-02 20:05 -------- d-----w- c:\programdata\Blizzard Entertainment2012-04-02 19:37 . 2011-04-28 03:58 552448 ----a-w- c:\windows\system32\drivers\bthport.sys2012-04-02 19:37 . 2011-04-28 03:58 80384 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS2012-04-02 19:37 . 2011-03-25 03:23 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys2012-04-02 19:37 . 2011-03-25 03:23 324608 ----a-w- c:\windows\system32\drivers\usbport.sys2012-04-02 19:37 . 2011-03-25 03:22 52224 ----a-w- c:\windows\system32\drivers\usbehci.sys2012-04-01 23:01 . 2012-03-06 23:01 24408 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys2012-04-01 23:01 . 2012-03-06 23:04 337240 ----a-w- c:\windows\system32\drivers\aswSP.sys2012-04-01 23:00 . 2012-03-06 23:02 53080 ----a-w- c:\windows\system32\drivers\aswRdr2.sys2012-04-01 23:00 . 2012-03-06 23:01 59224 ----a-w- c:\windows\system32\drivers\aswTdi.sys2012-04-01 23:00 . 2012-03-06 23:04 819032 ----a-w- c:\windows\system32\drivers\aswSnx.sys2012-04-01 23:00 . 2012-03-06 23:15 258520 ----a-w- c:\windows\system32\aswBoot.exe2012-04-01 23:00 . 2012-03-06 23:01 69976 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys2012-04-01 22:59 . 2012-03-06 23:15 41184 ----a-w- c:\windows\avastSS.scr2012-04-01 22:59 . 2012-03-06 23:15 201352 ----a-w- c:\windows\SysWow64\aswBoot.exe2012-04-01 22:59 . 2012-04-01 22:59 -------- d-----w- c:\programdata\AVAST Software2012-04-01 22:59 . 2012-04-01 22:59 -------- d-----w- c:\program files\AVAST Software2012-04-01 22:47 . 2012-04-01 22:47 -------- dc-h--w- c:\programdata\{F974CC36-BF25-4374-A035-B0A9DA79E735}2012-04-01 22:45 . 2012-04-01 22:45 -------- d-----w- c:\windows\SysWow64\Wat2012-04-01 22:45 . 2012-04-01 22:45 -------- d-----w- c:\windows\system32\Wat2012-04-01 22:22 . 2012-04-01 22:22 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll2012-04-01 22:22 . 2012-04-01 22:22 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll2012-04-01 22:21 . 2012-04-01 22:21 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll2012-04-01 22:21 . 2012-04-01 22:21 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll2012-04-01 22:11 . 2010-09-14 06:45 367104 ----a-w- c:\windows\system32\wcncsvc.dll2012-04-01 22:11 . 2010-09-14 06:07 276992 ----a-w- c:\windows\SysWow64\wcncsvc.dll2012-04-01 21:57 . 2009-11-25 19:47 99176 ----a-w- c:\windows\SysWow64\PresentationHostProxy.dll2012-04-01 21:57 . 2009-11-25 19:47 49472 ----a-w- c:\windows\SysWow64\netfxperf.dll2012-04-01 21:57 . 2009-11-25 19:47 48960 ----a-w- c:\windows\system32\netfxperf.dll2012-04-01 21:57 . 2009-11-25 19:47 297808 ----a-w- c:\windows\SysWow64\mscoree.dll2012-04-01 21:57 . 2009-11-25 19:47 295264 ----a-w- c:\windows\SysWow64\PresentationHost.exe2012-04-01 21:57 . 2009-11-25 19:47 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll2012-04-01 21:57 . 2009-11-25 19:47 109912 ----a-w- c:\windows\system32\PresentationHostProxy.dll2012-04-01 21:57 . 2009-11-25 19:47 444752 ----a-w- c:\windows\system32\mscoree.dll2012-04-01 21:57 . 2009-11-25 19:47 320352 ----a-w- c:\windows\system32\PresentationHost.exe2012-04-01 21:57 . 2009-11-25 19:47 1942856 ----a-w- c:\windows\system32\dfshim.dll2012-04-01 21:45 . 2010-03-04 04:40 184832 ----a-w- c:\windows\system32\drivers\usbvideo.sys2012-04-01 21:45 . 2010-03-04 04:32 243712 ----a-w- c:\windows\system32\drivers\ks.sys2012-04-01 21:41 . 2010-11-02 05:23 1198592 ----a-w- c:\windows\system32\taskschd.dll2012-04-01 21:40 . 2011-03-03 06:17 182272 ----a-w- c:\windows\system32\dnsrslvr.dll2012-04-01 21:39 . 2011-11-05 05:17 2048 ----a-w- c:\windows\system32\tzres.dll2012-04-01 21:39 . 2011-11-05 04:30 2048 ----a-w- c:\windows\SysWow64\tzres.dll2012-04-01 21:38 . 2010-12-18 06:12 3138048 ----a-w- c:\windows\system32\mstscax.dll2012-04-01 21:38 . 2010-12-18 06:08 1097216 ----a-w- c:\windows\system32\mstsc.exe2012-04-01 21:38 . 2010-12-18 05:30 2690560 ----a-w- c:\windows\SysWow64\mstscax.dll2012-04-01 21:38 . 2010-12-18 05:26 1034240 ----a-w- c:\windows\SysWow64\mstsc.exe2012-04-01 20:26 . 2012-04-02 01:22 -------- d-----w- c:\programdata\Spybot - Search & Destroy2012-04-01 20:26 . 2012-04-02 01:03 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy2012-04-01 19:59 . 2012-04-01 20:18 -------- d-----w- C:\Usuario Hermandez2012-04-01 19:49 . 2012-04-01 19:49 -------- d-----w- c:\programdata\blekko toolbars2012-04-01 19:49 . 2012-04-01 19:49 -------- d-----w- c:\program files (x86)\vafoontoolbar2012-04-01 19:49 . 2012-04-02 21:34 -------- d-----w- c:\programdata\Anti-phishing Domain Advisor2012-04-01 19:26 . 2012-04-01 19:26 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared2012-04-01 19:13 . 2012-02-15 06:27 1031680 ----a-w- c:\windows\system32\rdpcore.dll2012-04-01 19:13 . 2012-02-15 05:44 826368 ----a-w- c:\windows\SysWow64\rdpcore.dll2012-04-01 19:13 . 2012-02-15 04:47 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys2012-04-01 19:13 . 2012-02-15 04:46 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys2012-04-01 19:13 . 2012-01-25 06:27 76288 ----a-w- c:\windows\system32\rdpwsx.dll2012-04-01 19:13 . 2012-01-25 06:27 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll2012-04-01 19:13 . 2012-01-25 06:20 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe2012-04-01 17:14 . 2012-04-01 17:14 952 --sha-w- c:\programdata\KGyGaAvL.sys2012-04-01 16:51 . 2012-04-01 19:21 -------- d-----w- c:\program files\Symantec2012-04-01 16:51 . 2012-04-01 19:21 174200 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS2012-04-01 16:51 . 2012-04-01 16:51 -------- d-----w- c:\program files\Common Files\Symantec Shared2012-04-01 16:49 . 2012-04-01 16:49 -------- d-----w- c:\windows\SysWow64\VAIO Startup Setting Tool2012-04-01 16:49 . 2012-04-01 16:49 -------- d-----w- c:\users\Public\Symantec2012-04-01 16:48 . 2012-04-01 17:33 -------- d-----w- c:\users\Hernandez2012-04-01 13:55 . 2012-04-01 13:55 -------- d-----w- c:\program files (x86)\Microsoft Silverlight2012-04-01 13:54 . 2006-11-29 20:06 4398360 ----a-w- c:\windows\system32\d3dx9_32.dll2012-04-01 13:54 . 2006-11-29 20:06 3426072 ----a-w- c:\windows\SysWow64\d3dx9_32.dll2012-04-01 13:53 . 2012-04-01 13:53 -------- d-----w- c:\program files (x86)\Microsoft2012-04-01 13:53 . 2012-04-01 13:53 -------- d-----w- c:\program files (x86)\Windows Live SkyDrive2012-04-01 13:53 . 2012-04-01 13:53 -------- d-----w- c:\windows\PCHEALTH2012-04-01 13:52 . 2012-04-01 13:52 -------- d-----w- c:\program files (x86)\Common Files\Windows Live2012-04-01 13:45 . 2012-04-01 13:46 -------- d-----w- c:\program files\SPHE BD-Live2012-04-01 13:41 . 2012-04-01 13:41 -------- d-----w- C:\VAIO Sample Contents2012-04-01 13:09 . 2012-04-01 13:09 -------- d-----w- c:\program files (x86)\MSXML 4.02012-04-01 13:09 . 2007-07-20 01:14 5073256 ----a-w- c:\windows\system32\d3dx9_35.dll2012-04-01 13:04 . 2005-04-27 23:36 245408 ----a-w- c:\windows\SysWow64\unicows.dll2012-04-01 13:04 . 2003-03-19 05:14 499712 ----a-r- c:\windows\SysWow64\msvcp71.dll2012-04-01 13:04 . 2003-02-21 11:42 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll2012-04-01 13:04 . 1995-07-31 20:44 212480 ----a-w- c:\windows\SysWow64\PCDLIB32.DLL2012-04-01 13:04 . 2012-04-01 13:44 -------- d-----w- c:\program files (x86)\ArcSoft2012-04-01 13:04 . 2012-04-01 13:04 -------- d-----w- c:\program files (x86)\Common Files\ArcSoft2012-04-01 13:04 . 2009-05-26 21:32 19968 ----a-w- c:\windows\system32\drivers\ArcSoftKsUFilter.sys2012-04-01 13:04 . 2008-09-05 00:06 55808 ----a-w- c:\windows\system\ArcSoftKsUFilter.dll2012-04-01 13:04 . 2012-04-01 13:04 -------- d-----w- c:\program files (x86)\Evernote2012-04-01 13:04 . 2012-04-01 13:04 -------- d-----w- c:\programdata\Evernote2012-04-01 13:03 . 2012-04-01 16:50 -------- d-----w- c:\program files\Sony2012-04-01 13:02 . 2007-04-17 18:51 14112 ----a-w- c:\windows\system32\drivers\regi.sys2012-04-01 13:02 . 2012-04-01 13:02 -------- d-----w- c:\program files (x86)\Common Files\InterVideo2012-04-01 13:00 . 2012-04-01 13:00 3584 ----a-w- c:\windows\system32\Spool\prtprocs\x64\en-US\LXKPTPRC.DLL.mui2012-04-01 13:00 . 2012-04-01 13:00 -------- d-----w- C:\Documentation2012-04-01 13:00 . 2012-04-01 13:00 -------- d-----w- C:\_FS_SWRINFO2012-04-01 13:00 . 2008-09-25 01:17 114688 ----a-w- c:\program files (x86)\Windows Sidebar\Gadgets\eBayGadget.Gadget\Bin\eBayGadget.dll2012-04-01 13:00 . 2008-09-25 01:17 114688 ----a-w- c:\program files\Windows Sidebar\Gadgets\eBayGadget.Gadget\Bin\eBayGadget.dll2012-04-01 12:59 . 2012-04-01 12:59 -------- d-----w- c:\users\boinc_master2012-04-01 12:57 . 2012-04-01 16:50 -------- d-----w- c:\program files (x86)\BOINC2012-04-01 12:57 . 2012-04-01 16:50 -------- d-----w- c:\programdata\BOINC2012-04-01 12:57 . 2012-04-01 12:57 -------- d-----w- c:\windows\Downloaded Installations2012-04-01 12:57 . 2012-04-01 13:55 -------- d-----w- c:\program files (x86)\Windows Live2012-04-01 12:49 . 2012-04-01 13:57 -------- d-----w- c:\program files (x86)\Sony2012-04-01 12:48 . 2012-04-01 12:48 -------- d-----w- c:\program files (x86)\Common Files\Skype2012-04-01 12:48 . 2012-04-01 12:48 -------- d-----r- c:\program files (x86)\Skype2012-04-01 12:48 . 2012-04-01 12:48 -------- d-----w- c:\programdata\Skype2012-04-01 12:47 . 2012-04-01 12:47 -------- d---a-w- c:\program files\Shutterfly2012-04-01 12:45 . 2012-04-01 12:45 -------- d-----w- c:\program files\PlayReady2012-04-01 12:44 . 2012-04-01 12:44 -------- d---a-w- C:\Nobu_Icon2012-04-01 12:42 . 2012-04-01 21:22 -------- d-----w- c:\windows\system32\drivers\NISx642012-04-01 12:42 . 2012-04-01 16:51 -------- d-----w- c:\programdata\Norton2012-04-01 12:42 . 2012-04-01 12:42 -------- d-----w- c:\program files (x86)\Norton Internet Security2012-04-01 12:41 . 2012-04-01 12:41 -------- d-----w- c:\program files (x86)\NortonInstaller2012-04-01 12:39 . 2010-04-21 21:20 33000960 ----a-w- c:\programdata\Microsoft\OEMOffice14\OStarter\en-us\click2run64.msi..(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2012-04-01 13:00 . 2012-04-01 13:00 2560 ----a-w- c:\windows\SysWow64\drivers\en-US\qwavedrv.sys.mui2012-04-01 13:00 . 2012-04-01 13:00 25600 ----a-w- c:\windows\SysWow64\drivers\en-US\bfe.dll.mui2012-04-01 13:00 . 2012-04-01 13:00 15360 ----a-w- c:\windows\SysWow64\drivers\en-US\pacer.sys.mui2012-04-01 13:00 . 2012-04-01 13:00 2560 ----a-w- c:\windows\SysWow64\drivers\en-US\scfilter.sys.mui2012-04-01 13:00 . 2012-04-01 13:00 5632 ----a-w- c:\windows\SysWow64\drivers\en-US\ndiscap.sys.mui2012-04-01 13:00 . 2012-04-01 13:00 44032 ----a-w- c:\windows\SysWow64\drivers\en-US\tcpip.sys.mui..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]2012-04-01 12:32 433648 ----a-w- c:\programdata\Partner\Partner.dll.[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{c65d6942-fe75-4ef5-8fe0-20e8a29ecd20}]2012-03-30 20:11 85288 ----a-w- c:\program files (x86)\vafoontoolbar\mystartblekkotemplateX.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]"{c65d6942-fe75-4ef5-8fe0-20e8a29ecd20}"= "c:\program files (x86)\vafoontoolbar\mystartblekkotemplateX.dll" [2012-03-30 85288].[HKEY_CLASSES_ROOT\clsid\{c65d6942-fe75-4ef5-8fe0-20e8a29ecd20}].[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]"Aim"="c:\program files (x86)\AIM\aim.exe" [2012-02-29 4321112].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]"SmartWiHelper"="c:\program files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" [2010-07-15 89080]"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2010-06-01 673136]"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-06-01 600928]"Anti-phishing Domain Advisor"="c:\programdata\Anti-phishing Domain Advisor\visicom_antiphishing.exe" [2012-03-23 217256]"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-6-8 1128224].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]"mixer1"=wdmaud.drv.R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-01 136176]R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [x]R3 Partner Service;Partner Service;c:\programdata\Partner\Partner.exe [2012-04-01 332272]R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-06-21 108400]R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-06-18 423280]R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-06-21 67952]R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2010-06-09 537456]R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-06-09 384880]R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2010-06-09 101232]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1207000.00D\SYMDS64.SYS [x]S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1207000.00D\SYMEFA64.SYS [x]S1 aswSnx;aswSnx; [x]S1 aswSP;aswSP; [x]S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\BASHDefs\20120317.002\BHDrvx64.sys [2012-03-17 1157240]S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\IPSDefs\20120330.002\IDSvia64.sys [2012-03-30 488568]S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1207000.00D\Ironx64.SYS [x]S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1207000.00D\SYMNETS.SYS [x]S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]S2 aswFsBlk;aswFsBlk; [x]S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.7.0.13\ccSvcHst.exe [2011-04-17 130008]S2 Oasis2Service;Oasis2Service;c:\program files (x86)\DDNi\Oasis2Service\Oasis2Service.exe [2012-02-10 53248]S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-06-01 367456]S2 regi;regi;c:\windows\system32\drivers\regi.sys [x]S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [x]S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [x]S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2010-05-25 252416]S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-06-22 575856]S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2010-06-17 851824]S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x]S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-04-01 138360]S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [x]S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x]S3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2010-06-07 304496]S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2010-06-01 1250160]S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]..Contents of the 'Scheduled Tasks' folder.2012-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-01 12:32].2012-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-01 12:32]..--------- x86-64 -----------..[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]2012-04-01 12:32 750064 ----a-w- c:\programdata\Partner\Partner64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]@="{472083B0-C522-11CF-8763-00608CC02F24}"[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]2012-03-06 23:15 135408 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-21 10775584]"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-06-21 2040352].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"LoadAppInit_DLLs"=0x0.------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmuStart Page = hxxp://blekkosearch.mystart.com/vafoontoolbar/?source=4744474a&toolbarid=vafoontoolbar&u=20120401564F404DB7EEC09A0D247CB3&tbp=homepagemStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNTmLocal Page = c:\windows\SysWOW64\blank.htmTCP: DhcpNameServer = 192.168.1.254FF - ProfilePath - c:\users\Hernandez\AppData\Roaming\Mozilla\Firefox\Profiles\9cxgr5ex.default\FF - user.js: network.protocol-handler.warn-external.dnupdate - false.- - - - ORPHANS REMOVED - - - -.HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe...[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.7.0.13\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.7.0.13\diMaster.dll\" /prefetch:1"--.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=2000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=inteldata\"".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.10".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]@Denied: (A 2) (Everyone)@="IFlashBroker4".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).Completion time: 2012-04-02 15:57:37ComboFix-quarantined-files.txt 2012-04-02 22:57.Pre-Run: 543,566,049,280 bytes freePost-Run: 543,294,234,624 bytes free.- - End Of File - - 6C8B340F2AB842638AAD751726E967E9 Link to post Share on other sites More sharing options...
MrCharlie Posted April 2, 2012 ID:539351 Share Posted April 2, 2012 Please Update and run a Quick Scan with MBAM, post the report.Please let me know how it is, MrC Link to post Share on other sites More sharing options...
Belcoot Posted April 2, 2012 Author ID:539355 Share Posted April 2, 2012 No problems found Thank you so much for your help! Here's the results none the lessMalwarebytes Anti-Malware (Trial) 1.60.1.1000www.malwarebytes.orgDatabase version: v2012.04.02.10Windows 7 x64 NTFSInternet Explorer 9.0.8112.16421Hernandez :: HERNANDEZ-VAIO [administrator]Protection: Enabled4/2/2012 4:08:57 PMmbam-log-2012-04-02 (16-08-57).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 212459Time elapsed: 3 minute(s), 26 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end) Link to post Share on other sites More sharing options...
MrCharlie Posted April 2, 2012 ID:539356 Share Posted April 2, 2012 How's it running now?? MrC Link to post Share on other sites More sharing options...
Belcoot Posted April 2, 2012 Author ID:539357 Share Posted April 2, 2012 Very fast. Not getting any kind virus alerts or anything. No resets either. Computer used to heat up when it was infected and now it's not. Link to post Share on other sites More sharing options...
MrCharlie Posted April 3, 2012 ID:539486 Share Posted April 3, 2012 Great! Please Uninstall ComboFix:Press the Windows logo key + R to bring up the "run box"Copy and paste next command in the field:ComboFix /uninstallMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point---------------------------------Please download OTL from one of the links below:http://oldtimer.geekstogo.com/OTL.exehttp://oldtimer.geekstogo.com/OTL.comSave it to your desktop.Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)Any other programs or logs you can manually delete.-------------------------------You have out date Java on the system, older versions are vulnerable to malware.Please go to your control panels add/remove programs and uninstall these:Java™ 6 Update 20Then download and install the latest version Java™ 6 Update 31.http://www.java.com/...load/manual.jsp <---latest versionhttp://www.java.com/...d/installed.jsp <---verify your Java-----------------------------------Any questions...please post back.If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.Take a look at My Preventive Maintenance to avoid being infected again.Good Luck and Thanks for using the forum, MrC Link to post Share on other sites More sharing options...
LDTate Posted April 3, 2012 ID:539602 Share Posted April 3, 2012 Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you. Link to post Share on other sites More sharing options...
Recommended Posts