Trojan.agent infected

mfraser213 · April 3, 2012

Hello, I'm trying to help my daughter rid her pc of Trojan.agent found during quick scan. It's back after every reboot. DDS log attached.

really appreciate any help.

thank you!

.

DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORK

Internet Explorer: 8.0.7600.16385

Run by Jess at 21:03:02 on 2012-04-02

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2811.2286 [GMT -7:00]

.

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\Explorer.EXE

C:\Windows\system32\ctfmon.exe

-netsvcs

C:\Windows\system32\conhost.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\SysWOW64\NOTEPAD.EXE

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit=userinit.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SNAPFI~1.LNK - C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

TCP: DhcpNameServer = 192.168.2.1

TCP: Interfaces\{1BCD5175-C649-43A0-88FE-3E952650EA8E} : DhcpNameServer = 40.6.1.100

TCP: Interfaces\{CEE0490B-7D85-43E0-8B53-4BAC0AA2DE5B} : DhcpNameServer = 192.168.2.1

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

BHO-X64: Symantec NCO BHO - No File

BHO-X64: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL

BHO-X64: Symantec Intrusion Prevention - No File

BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

BHO-X64: Search Helper - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

TB-X64: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll

mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Jess\AppData\Roaming\Mozilla\Firefox\Profiles\hjz2097l.default\

FF - prefs.js: network.proxy.type - 0

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll

.

============= SERVICES / DRIVERS ===============

.

R0 amd_sata;amd_sata;C:\Windows\system32\DRIVERS\amd_sata.sys --> C:\Windows\system32\DRIVERS\amd_sata.sys [?]

R0 amd_xata;amd_xata;C:\Windows\system32\DRIVERS\amd_xata.sys --> C:\Windows\system32\DRIVERS\amd_xata.sys [?]

R0 SymDS;Symantec Data Store;C:\Windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS --> C:\Windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [?]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS --> C:\Windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]

S1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys [2011-3-24 945200]

S1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys [2011-3-24 463408]

S1 SymIRON;Symantec Iron Driver;C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS --> C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [?]

S1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\system32\Drivers\NISx64\1206000.01D\SYMNETS.SYS --> C:\Windows\system32\Drivers\NISx64\1206000.01D\SYMNETS.SYS [?]

S2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]

S2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2010-12-9 354304]

S2 AMD Reservation Manager;AMD Reservation Manager;C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-6-17 194496]

S2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2010-2-28 821664]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-27 136176]

S2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-7-21 103992]

S2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-8-5 291896]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-11-3 92216]

S2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-9 26680]

S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-4-2 652360]

S2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe [2012-3-27 130008]

S2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-9-11 399344]

S2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-2 483688]

S3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]

S3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]

S3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]

S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-27 136176]

S3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\system32\DRIVERS\RtsPStor.sys --> C:\Windows\system32\DRIVERS\RtsPStor.sys [?]

S3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys --> C:\Windows\system32\DRIVERS\Sftfslh.sys [?]

S3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys --> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?]

S3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys --> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?]

S3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys --> C:\Windows\system32\DRIVERS\Sftvollh.sys [?]

S3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-2 209768]

S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]

S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]

S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2012-04-03 03:29:16 20480 ----a-w- C:\Windows\svchost.exe

2012-04-03 03:09:19 -------- d-----w- C:\Users\Jess\AppData\Roaming\Tific

2012-04-03 03:09:17 -------- d-----w- C:\Users\Jess\AppData\Local\Symantec

2012-04-03 03:01:05 -------- d-----w- C:\Users\Jess\AppData\Roaming\Malwarebytes

2012-04-03 03:00:53 -------- d-----w- C:\ProgramData\Malwarebytes

2012-04-03 03:00:52 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-04-03 03:00:52 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-03-28 05:25:19 -------- d-----w- C:\ProgramData\VirtualizedApplications

2012-03-28 04:20:48 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe

2012-03-28 04:20:48 76288 ----a-w- C:\Windows\System32\rdpwsx.dll

2012-03-28 04:20:48 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll

2012-03-28 04:20:44 1031680 ----a-w- C:\Windows\System32\rdpcore.dll

2012-03-28 04:20:43 826368 ----a-w- C:\Windows\SysWow64\rdpcore.dll

2012-03-28 04:20:42 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys

2012-03-28 04:20:42 204800 ----a-w- C:\Windows\System32\drivers\rdpwd.sys

2012-03-28 04:09:19 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{746473E9-4C56-4325-B669-0116D2154E82}\offreg.dll

2012-03-28 03:57:39 -------- d-----w- C:\Users\Jess\AppData\Local\Google

2012-03-28 03:54:30 -------- d-----w- C:\ProgramData\AVAST Software

2012-03-28 03:54:30 -------- d-----w- C:\Program Files\AVAST Software

2012-03-28 02:50:39 -------- d-----w- C:\Users\Jess\AppData\Local\SoftGrid Client

2012-03-28 02:50:38 -------- d-----w- C:\Users\Jess\AppData\Roaming\SoftGrid Client

2012-03-28 02:49:48 8669240 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{746473E9-4C56-4325-B669-0116D2154E82}\mpengine.dll

2012-03-28 02:49:47 279656 ------w- C:\Windows\System32\MpSigStub.exe

2012-03-28 02:48:57 -------- d-----w- C:\Program Files (x86)\Microsoft Application Virtualization Client

2012-03-28 02:48:39 -------- d-----w- C:\Users\Jess\AppData\Roaming\TP

2012-03-28 02:44:27 162664 ----a-w- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10140.bin

2012-03-28 02:25:53 -------- d-----w- C:\Users\Jess\AppData\Local\Diagnostics

2012-03-28 02:24:32 -------- d-----w- C:\Users\Jess\AppData\Local\AMD

2012-03-28 02:24:19 -------- d-----w- C:\Users\Jess\AppData\Local\ATI

2012-03-28 02:24:11 -------- d-----w- C:\Users\Jess\AppData\Roaming\PictureMover

2012-03-28 02:23:19 -------- d-----w- C:\Users\Jess\AppData\Roaming\hpqLog

2012-03-28 02:23:03 -------- d-----w- C:\Users\Jess\AppData\Roaming\Synaptics

2012-03-28 02:22:01 -------- d-----w- C:\Users\Jess\AppData\Local\RemEngine

2012-03-28 00:37:54 912504 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\symefa64.sys

2012-03-28 00:37:54 744568 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\srtsp64.sys

2012-03-28 00:37:54 450680 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\symds64.sys

2012-03-28 00:37:54 40568 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\srtspx64.sys

2012-03-28 00:37:54 382584 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\symnets.sys

2012-03-28 00:37:54 171128 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\ironx64.sys

2012-03-28 00:37:47 -------- d-----w- C:\Windows\System32\drivers\NISx64\1206000.01D

2012-03-27 16:38:05 -------- d-----w- C:\Users\Jess\AppData\Local\VirtualStore

2012-03-27 15:30:30 -------- d-----w- C:\Users\Jess\AppData\Local\Hewlett-Packard

2012-03-27 15:30:06 -------- d-----w- C:\Users\Jess\AppData\Local\Hewlett-Packard_Company

.

==================== Find3M ====================

.

2012-03-28 00:37:56 174200 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

.

============= FINISH: 21:03:20.75 ===============

Maniac · April 3, 2012

Hello mfraser213 and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

What about Attach.txt?

mfraser213 · April 3, 2012

thank you....here is attach.txt.

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 3/27/2012 8:26:33 AM

System Uptime: 4/2/2012 8:57:21 PM (1 hours ago)

.

Motherboard: Hewlett-Packard | | 165C

Processor: AMD Athlon II P360 Dual-Core Processor | Socket S1G4 | 2294/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 284 GiB total, 256.09 GiB free.

D: is FIXED (NTFS) - 14 GiB total, 1.738 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: Security Processor Loader Driver

Device ID: ROOT\LEGACY_SPLDR\0000

Manufacturer:

Name: Security Processor Loader Driver

PNP Device ID: ROOT\LEGACY_SPLDR\0000

Service: spldr

.

==== System Restore Points ===================

.

RP1: 3/27/2012 8:29:23 AM - First_User_Boot

RP2: 3/27/2012 7:49:07 PM - Windows Update

RP3: 3/27/2012 8:53:18 PM - avast! Free Antivirus Setup

RP4: 3/27/2012 9:20:55 PM - Windows Update

.

==== Installed Programs ======================

.

ActiveCheck component for HP Active Support Library

Adobe Flash Player 10 ActiveX

Adobe Reader 9.3.3 MUI

Adobe Shockwave Player 11.5

Agatha Christie - Peril at End House

Bejeweled 2 Deluxe

Bing Bar

Bing Bar Platform

Bing Rewards Client Installer

Blackhawk Striker 2

Blasterball 3

Blio

Bounce Symphony

Build-a-lot 2

Cake Mania

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-core-static

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

Chuzzle Deluxe

CyberLink DVD Suite

CyberLink YouCam

D3DX10

Diner Dash 2 Restaurant Rescue

Dora's World Adventure

Energy Star Digital Logo

Escape Rosecliff Island

ESU for Microsoft Windows 7

Farm Frenzy

FATE

Final Drive Nitro

Google Chrome

Google Update Helper

Heroes of Hellas 2 - Olympia

HP CloudDrive

HP Customer Experience Enhancements

HP Documentation

HP Game Console

HP Games

HP MovieStore

HP On Screen Display

HP Power Manager

HP Quick Launch

HP Setup

HP Setup Manager

HP Software Framework

HP Support Assistant

HPAsset component for HP Active Support Library

IDT Audio

Java Auto Updater

Java 6 Update 22

Jewel Quest Solitaire 2

Junk Mail filter update

LabelPrint

Malwarebytes Anti-Malware version 1.60.1.1000

Mesh Runtime

Microsoft Default Manager

Microsoft Office 2010

Microsoft Office Click-to-Run 2010

Microsoft Office Starter 2010 - English

Microsoft Search Enhancement Pack

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft WSE 3.0 Runtime

Mozilla Firefox 11.0 (x86 en-US)

MSVCRT

MSVCRT_amd64

Mystery P.I. - The London Caper

Norton Internet Security

Penguins!

PictureMover

Plants vs. Zombies

PlayReady PC Runtime x86

Poker Superstars III

Polar Bowler

Polar Golfer

Power2Go

Realtek Ethernet Controller Driver

Realtek PCIE Card Reader

Recovery Manager

RoxioNow Player

Virtual Families

Virtual Villagers 4 - The Tree of Life

Wheel of Fortune 2

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Zuma Deluxe

.

==== Event Viewer Messages From Past Week ========

.

4/2/2012 8:58:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

4/2/2012 8:58:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

4/2/2012 8:58:20 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

4/2/2012 8:58:14 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\bcmihvsrv64.dll Error Code: 21

4/2/2012 8:58:13 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

4/2/2012 8:58:01 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: BHDrvx64 discache IDSVia64 spldr SRTSPX SymIRON SymNetS Wanarpv6

4/2/2012 8:57:57 PM, Error: Service Control Manager [7001] - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: The dependency service or group failed to start.

4/2/2012 8:36:56 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

4/2/2012 8:29:12 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.

4/2/2012 8:28:36 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: aswSnx aswSP aswTdi BHDrvx64 discache IDSVia64 spldr SRTSPX SymIRON SymNetS Wanarpv6

4/2/2012 7:56:57 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Norton Internet Security service to connect.

4/2/2012 7:56:57 PM, Error: Service Control Manager [7000] - The Norton Internet Security service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

4/2/2012 7:37:08 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002d7572a, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 040212-41309-01.

4/2/2012 6:47:46 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the HP Health Check Service service to connect.

4/2/2012 6:47:46 PM, Error: Service Control Manager [7000] - The HP Health Check Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

4/2/2012 6:47:07 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

4/2/2012 6:26:50 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

4/2/2012 6:24:25 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x0000000000000008, 0x0000000000000002, 0x0000000000000001, 0xfffff80002a867b4). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 040212-33431-01.

4/2/2012 6:19:21 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002d7272a, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 040212-79092-01.

3/28/2012 5:27:58 PM, Error: Microsoft-Windows-DistributedCOM [10009] - DCOM was unable to communicate with the computer WIN-5CNFBUL2H47 using any of the configured protocols.

3/28/2012 5:18:30 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the NIS service.

.

==== End Of File ===========================

Maniac · April 3, 2012

Thanks!

Step 1

You have some leftovers from Avast Anti-Virus, so let's take care for them. Follow the instructions here:

http://www.avast.com/uninstall-utility

Step 2

Download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
Click the Start Scan button.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results and offer three (3) options.
Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

Step 3

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

In your next reply, post the following log files:

TDSSKiller log
Malwarebytes' Anti-Malware
a new fresh DDS log file

mfraser213 · April 3, 2012

ok here we go: Malwarebytes found instead of 2 after TDSKiller. then i rebooted. it's not finding any now. Scans attached. maybe I'm fixed??

TDSKiller:

09:54:58.0214 2472 TDSS rootkit removing tool 2.7.25.0 Apr 3 2012 13:42:32

09:54:58.0744 2472 ============================================================

09:54:58.0744 2472 Current date / time: 2012/04/03 09:54:58.0744

09:54:58.0744 2472 SystemInfo:

09:54:58.0744 2472

09:54:58.0744 2472 OS Version: 6.1.7600 ServicePack: 0.0

09:54:58.0744 2472 Product type: Workstation

09:54:58.0744 2472 ComputerName: JESS-HP

09:54:58.0744 2472 UserName: Jess

09:54:58.0744 2472 Windows directory: C:\Windows

09:54:58.0744 2472 System windows directory: C:\Windows

09:54:58.0744 2472 Running under WOW64

09:54:58.0744 2472 Processor architecture: Intel x64

09:54:58.0744 2472 Number of processors: 2

09:54:58.0744 2472 Page size: 0x1000

09:54:58.0744 2472 Boot type: Safe boot with network

09:54:58.0744 2472 ============================================================

09:55:00.0351 2472 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

09:55:00.0351 2472 \Device\Harddisk0\DR0:

09:55:00.0351 2472 MBR used

09:55:00.0351 2472 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800

09:55:00.0351 2472 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x237B8000

09:55:00.0351 2472 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x2381C000, BlocksNum 0x1BDE800

09:55:00.0351 2472 \Device\Harddisk0\DR0\Partition3: MBR, Type 0xC, StartLBA 0x253FA800, BlocksNum 0x33AB0

09:55:00.0445 2472 Initialize success

09:55:00.0445 2472 ============================================================

09:55:34.0593 2684 ============================================================

09:55:34.0593 2684 Scan started

09:55:34.0593 2684 Mode: Manual; SigCheck; TDLFS;

09:55:34.0593 2684 ============================================================

09:55:37.0853 2684 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys

09:55:38.0041 2684 1394ohci - ok

09:55:38.0446 2684 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys

09:55:38.0524 2684 ACPI - ok

09:55:38.0883 2684 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys

09:55:39.0117 2684 AcpiPmi - ok

09:55:39.0585 2684 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

09:55:39.0601 2684 adp94xx - ok

09:55:39.0991 2684 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

09:55:40.0006 2684 adpahci - ok

09:55:40.0381 2684 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

09:55:40.0396 2684 adpu320 - ok

09:55:40.0677 2684 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll

09:55:40.0864 2684 AeLookupSvc - ok

09:55:41.0254 2684 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys

09:55:41.0317 2684 AFD - ok

09:55:41.0722 2684 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys

09:55:41.0738 2684 agp440 - ok

09:55:41.0987 2684 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe

09:55:42.0034 2684 ALG - ok

09:55:42.0580 2684 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys

09:55:42.0596 2684 aliide - ok

09:55:42.0923 2684 AMD External Events Utility (c6eea8769226dacb1585fe23beb4af23) C:\Windows\system32\atiesrxx.exe

09:55:43.0001 2684 AMD External Events Utility - ok

09:55:43.0064 2684 AMD FUEL Service - ok

09:55:43.0157 2684 AMD Reservation Manager (dd27f6c3de9bfe50635c721e09edc5dd) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe

09:55:43.0173 2684 AMD Reservation Manager - ok

09:55:43.0501 2684 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys

09:55:43.0516 2684 amdide - ok

09:55:43.0891 2684 amdiox64 (6a2eeb0c4133b20773bb3dd0b7b377b4) C:\Windows\system32\DRIVERS\amdiox64.sys

09:55:43.0969 2684 amdiox64 - ok

09:55:44.0343 2684 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

09:55:44.0374 2684 AmdK8 - ok

09:55:45.0014 2684 amdkmdag (98e20c5a39fea1920031d3850004b334) C:\Windows\system32\DRIVERS\atikmdag.sys

09:55:45.0248 2684 amdkmdag - ok

09:55:45.0638 2684 amdkmdap (8624dc7b8d22daf28f5438735095f6c4) C:\Windows\system32\DRIVERS\atikmpag.sys

09:55:45.0653 2684 amdkmdap - ok

09:55:46.0043 2684 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

09:55:46.0090 2684 AmdPPM - ok

09:55:46.0433 2684 amdsata (ab3166c09438a161fbde13099a72e0af) C:\Windows\system32\DRIVERS\amdsata.sys

09:55:46.0433 2684 amdsata - ok

09:55:46.0808 2684 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

09:55:46.0808 2684 amdsbs - ok

09:55:47.0135 2684 amdxata (5118dcd2065d8c8d752ad5ec0b2d6aa6) C:\Windows\system32\DRIVERS\amdxata.sys

09:55:47.0167 2684 amdxata - ok

09:55:47.0557 2684 amd_sata (08e8a4172c57abd7693a6915cf1e7a99) C:\Windows\system32\DRIVERS\amd_sata.sys

09:55:47.0557 2684 amd_sata - ok

09:55:48.0025 2684 amd_xata (9866af4e4ad7f16e810b6c0b8473f9cd) C:\Windows\system32\DRIVERS\amd_xata.sys

09:55:48.0025 2684 amd_xata - ok

09:55:48.0352 2684 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys

09:55:48.0446 2684 AppID - ok

09:55:48.0711 2684 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll

09:55:48.0758 2684 AppIDSvc - ok

09:55:49.0039 2684 Appinfo (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll

09:55:49.0085 2684 Appinfo - ok

09:55:49.0413 2684 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

09:55:49.0429 2684 arc - ok

09:55:49.0787 2684 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

09:55:49.0787 2684 arcsas - ok

09:55:50.0162 2684 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

09:55:50.0224 2684 AsyncMac - ok

09:55:50.0567 2684 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys

09:55:50.0583 2684 atapi - ok

09:55:50.0989 2684 AtiHdmiService (2d648572ba9a610952fcafba1e119c2d) C:\Windows\system32\drivers\AtiHdmi.sys

09:55:51.0004 2684 AtiHdmiService - ok

09:55:51.0332 2684 AtiPcie (e82e61f46d1336447f4deff8c074f13e) C:\Windows\system32\DRIVERS\AtiPcie64.sys

09:55:51.0332 2684 AtiPcie - ok

09:55:51.0581 2684 AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll

09:55:51.0659 2684 AudioEndpointBuilder - ok

09:55:51.0675 2684 AudioSrv (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll

09:55:51.0722 2684 AudioSrv - ok

09:55:51.0987 2684 AxInstSV (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll

09:55:52.0018 2684 AxInstSV - ok

09:55:52.0361 2684 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

09:55:52.0408 2684 b06bdrv - ok

09:55:52.0767 2684 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

09:55:52.0798 2684 b57nd60a - ok

09:55:53.0219 2684 BCM43XX (0e7a9264576b40638a3fbc804de1ff76) C:\Windows\system32\DRIVERS\bcmwl664.sys

09:55:53.0266 2684 BCM43XX - ok

09:55:53.0531 2684 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll

09:55:53.0578 2684 BDESVC - ok

09:55:53.0937 2684 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

09:55:53.0984 2684 Beep - ok

09:55:54.0249 2684 BFE (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll

09:55:54.0311 2684 BFE - ok

09:55:54.0421 2684 BHDrvx64 (95da658498248d5832aa240850706150) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx64.sys

09:55:54.0436 2684 BHDrvx64 - ok

09:55:54.0701 2684 BITS (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\System32\qmgr.dll

09:55:54.0857 2684 BITS - ok

09:55:55.0201 2684 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

09:55:55.0247 2684 blbdrive - ok

09:55:55.0669 2684 bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys

09:55:55.0762 2684 bowser - ok

09:55:56.0215 2684 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

09:55:56.0324 2684 BrFiltLo - ok

09:55:57.0026 2684 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

09:55:57.0182 2684 BrFiltUp - ok

09:55:57.0509 2684 Browser (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll

09:55:57.0572 2684 Browser - ok

09:55:57.0993 2684 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

09:55:58.0040 2684 Brserid - ok

09:55:58.0570 2684 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

09:55:58.0601 2684 BrSerWdm - ok

09:55:59.0179 2684 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

09:55:59.0241 2684 BrUsbMdm - ok

09:55:59.0834 2684 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

09:55:59.0849 2684 BrUsbSer - ok

09:56:00.0395 2684 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

09:56:00.0411 2684 BTHMODEM - ok

09:56:00.0941 2684 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll

09:56:01.0113 2684 bthserv - ok

09:56:01.0675 2684 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

09:56:01.0753 2684 cdfs - ok

09:56:02.0345 2684 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys

09:56:02.0377 2684 cdrom - ok

09:56:02.0798 2684 CertPropSvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll

09:56:02.0923 2684 CertPropSvc - ok

09:56:03.0359 2684 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

09:56:03.0453 2684 circlass - ok

09:56:03.0796 2684 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

09:56:03.0812 2684 CLFS - ok

09:56:03.0983 2684 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

09:56:03.0999 2684 clr_optimization_v2.0.50727_32 - ok

09:56:04.0171 2684 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

09:56:04.0202 2684 clr_optimization_v2.0.50727_64 - ok

09:56:04.0561 2684 clwvd (50f92c943f18b070f166d019dfab3d9a) C:\Windows\system32\DRIVERS\clwvd.sys

09:56:04.0561 2684 clwvd - ok

09:56:04.0935 2684 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

09:56:04.0951 2684 CmBatt - ok

09:56:05.0325 2684 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys

09:56:05.0341 2684 cmdide - ok

09:56:05.0731 2684 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys

09:56:05.0777 2684 CNG - ok

09:56:06.0121 2684 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

09:56:06.0121 2684 Compbatt - ok

09:56:06.0511 2684 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys

09:56:06.0542 2684 CompositeBus - ok

09:56:06.0807 2684 COMSysApp - ok

09:56:07.0197 2684 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

09:56:07.0197 2684 crcdisk - ok

09:56:07.0587 2684 CryptSvc (8c57411b66282c01533cb776f98ad384) C:\Windows\system32\cryptsvc.dll

09:56:07.0634 2684 CryptSvc - ok

09:56:07.0743 2684 cvhsvc (61a86809b62769643892bc0812b204aa) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

09:56:07.0759 2684 cvhsvc - ok

09:56:08.0133 2684 DcomLaunch (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll

09:56:08.0180 2684 DcomLaunch - ok

09:56:08.0492 2684 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll

09:56:08.0570 2684 defragsvc - ok

09:56:09.0194 2684 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys

09:56:09.0256 2684 DfsC - ok

09:56:09.0631 2684 Dhcp (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll

09:56:09.0724 2684 Dhcp - ok

09:56:10.0457 2684 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

09:56:10.0707 2684 discache - ok

09:56:11.0191 2684 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

09:56:11.0191 2684 Disk - ok

09:56:11.0815 2684 Dnscache (676108c4e3aa6f6b34633748bd0bebd9) C:\Windows\System32\dnsrslvr.dll

09:56:11.0877 2684 Dnscache - ok

09:56:12.0158 2684 dot3svc (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll

09:56:12.0205 2684 dot3svc - ok

09:56:12.0454 2684 DPS (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll

09:56:12.0517 2684 DPS - ok

09:56:12.0829 2684 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

09:56:12.0860 2684 drmkaud - ok

09:56:13.0827 2684 DXGKrnl (ebce0b0924835f635f620d19f0529dce) C:\Windows\System32\drivers\dxgkrnl.sys

09:56:13.0858 2684 DXGKrnl - ok

09:56:14.0139 2684 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll

09:56:14.0186 2684 EapHost - ok

09:56:14.0591 2684 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

09:56:14.0716 2684 ebdrv - ok

09:56:14.0966 2684 EFS (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\System32\lsass.exe

09:56:14.0981 2684 EFS - ok

09:56:15.0153 2684 ehRecvr (47c071994c3f649f23d9cd075ac9304a) C:\Windows\ehome\ehRecvr.exe

09:56:15.0247 2684 ehRecvr - ok

09:56:15.0371 2684 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe

09:56:15.0403 2684 ehSched - ok

09:56:15.0949 2684 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

09:56:16.0011 2684 elxstor - ok

09:56:16.0495 2684 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys

09:56:16.0541 2684 ErrDev - ok

09:56:17.0290 2684 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll

09:56:17.0384 2684 EventSystem - ok

09:56:17.0852 2684 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

09:56:17.0914 2684 exfat - ok

09:56:18.0242 2684 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

09:56:18.0304 2684 fastfat - ok

09:56:18.0554 2684 Fax (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe

09:56:18.0616 2684 Fax - ok

09:56:18.0959 2684 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

09:56:18.0975 2684 fdc - ok

09:56:19.0209 2684 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll

09:56:19.0256 2684 fdPHost - ok

09:56:19.0521 2684 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll

09:56:19.0552 2684 FDResPub - ok

09:56:19.0927 2684 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

09:56:19.0927 2684 FileInfo - ok

09:56:20.0285 2684 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

09:56:20.0332 2684 Filetrace - ok

09:56:20.0738 2684 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

09:56:20.0753 2684 flpydisk - ok

09:56:21.0596 2684 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys

09:56:21.0611 2684 FltMgr - ok

09:56:21.0908 2684 FontCache (8ac4cb4ea61e41009fae9ae7b2b5da3a) C:\Windows\system32\FntCache.dll

09:56:22.0001 2684 FontCache - ok

09:56:22.0111 2684 FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

09:56:22.0111 2684 FontCache3.0.0.0 - ok

09:56:22.0485 2684 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

09:56:22.0501 2684 FsDepends - ok

09:56:22.0969 2684 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

09:56:22.0984 2684 Fs_Rec - ok

09:56:23.0499 2684 fvevol (b8b2a6e1558f8f5de5ce431c5b2c7b09) C:\Windows\system32\DRIVERS\fvevol.sys

09:56:23.0530 2684 fvevol - ok

09:56:23.0905 2684 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

09:56:23.0936 2684 gagp30kx - ok

09:56:24.0045 2684 GameConsoleService (d154305de6090e6e84e525f84bb08a06) C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe

09:56:24.0045 2684 GameConsoleService - ok

09:56:24.0295 2684 gpsvc (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll

09:56:24.0373 2684 gpsvc - ok

09:56:24.0482 2684 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

09:56:24.0482 2684 gupdate - ok

09:56:24.0498 2684 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

09:56:24.0513 2684 gupdatem - ok

09:56:24.0872 2684 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

09:56:24.0919 2684 hcw85cir - ok

09:56:25.0246 2684 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys

09:56:25.0278 2684 HdAudAddService - ok

09:56:25.0636 2684 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys

09:56:25.0714 2684 HDAudBus - ok

09:56:26.0073 2684 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

09:56:26.0120 2684 HidBatt - ok

09:56:26.0510 2684 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

09:56:26.0557 2684 HidBth - ok

09:56:26.0947 2684 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

09:56:26.0978 2684 HidIr - ok

09:56:27.0259 2684 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll

09:56:27.0321 2684 hidserv - ok

09:56:27.0664 2684 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys

09:56:27.0696 2684 HidUsb - ok

09:56:27.0961 2684 hkmsvc (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll

09:56:28.0023 2684 hkmsvc - ok

09:56:28.0273 2684 HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll

09:56:28.0320 2684 HomeGroupListener - ok

09:56:28.0569 2684 HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll

09:56:28.0585 2684 HomeGroupProvider - ok

09:56:28.0710 2684 HP Health Check Service (7a24ad37416b91e4b5e5b46bd25c075f) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe

09:56:28.0725 2684 HP Health Check Service - ok

09:56:28.0866 2684 HP Wireless Assistant Service (c930128c8f8ff03d8f8c42b570920d56) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe

09:56:28.0928 2684 HP Wireless Assistant Service - ok

09:56:29.0022 2684 HPClientSvc (3dc11a802353401332d49c3cbfbbe5fc) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

09:56:29.0037 2684 HPClientSvc - ok

09:56:29.0209 2684 HPDrvMntSvc.exe (2a047e7e0f1018e3134a4065636f2025) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

09:56:29.0209 2684 HPDrvMntSvc.exe - ok

09:56:29.0349 2684 hpqwmiex (59cb6a1ca093edc2881598a45518857d) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

09:56:29.0365 2684 hpqwmiex - ok

09:56:29.0724 2684 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys

09:56:29.0739 2684 HpSAMD - ok

09:56:29.0973 2684 HPWMISVC (f630dd7564ebb7248a13b1cc774d9ea6) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

09:56:29.0973 2684 HPWMISVC - ok

09:56:30.0316 2684 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys

09:56:30.0394 2684 HTTP - ok

09:56:30.0722 2684 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys

09:56:30.0738 2684 hwpolicy - ok

09:56:31.0112 2684 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys

09:56:31.0128 2684 i8042prt - ok

09:56:31.0658 2684 iaStorV (513dc087cfed7d2bb82f005385d3531f) C:\Windows\system32\DRIVERS\iaStorV.sys

09:56:31.0674 2684 iaStorV - ok

09:56:31.0830 2684 idsvc (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

09:56:31.0861 2684 idsvc - ok

09:56:32.0017 2684 IDSVia64 (c3292140bf458b46cf8abbfd7e177bbe) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVia64.sys

09:56:32.0032 2684 IDSVia64 - ok

09:56:32.0563 2684 igfx (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys

09:56:32.0750 2684 igfx - ok

09:56:33.0109 2684 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

09:56:33.0109 2684 iirsp - ok

09:56:33.0390 2684 IKEEXT (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll

09:56:33.0468 2684 IKEEXT - ok

09:56:33.0842 2684 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys

09:56:33.0858 2684 intelide - ok

09:56:34.0263 2684 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

09:56:34.0294 2684 intelppm - ok

09:56:34.0575 2684 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll

09:56:34.0622 2684 IPBusEnum - ok

09:56:35.0355 2684 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys

09:56:35.0402 2684 IpFilterDriver - ok

09:56:35.0698 2684 iphlpsvc (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll

09:56:35.0761 2684 iphlpsvc - ok

09:56:36.0073 2684 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys

09:56:36.0073 2684 IPMIDRV - ok

09:56:36.0494 2684 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

09:56:36.0541 2684 IPNAT - ok

09:56:36.0884 2684 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

09:56:36.0900 2684 IRENUM - ok

09:56:37.0258 2684 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys

09:56:37.0258 2684 isapnp - ok

09:56:37.0617 2684 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys

09:56:37.0633 2684 iScsiPrt - ok

09:56:38.0070 2684 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

09:56:38.0070 2684 kbdclass - ok

09:56:38.0444 2684 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys

09:56:38.0475 2684 kbdhid - ok

09:56:38.0725 2684 KeyIso (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe

09:56:38.0740 2684 KeyIso - ok

09:56:39.0115 2684 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys

09:56:39.0130 2684 KSecDD - ok

09:56:39.0505 2684 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys

09:56:39.0520 2684 KSecPkg - ok

09:56:39.0942 2684 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

09:56:40.0004 2684 ksthunk - ok

09:56:40.0441 2684 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll

09:56:40.0534 2684 KtmRm - ok

09:56:40.0831 2684 LanmanServer (81f1d04d4d0e433099365127375fd501) C:\Windows\system32\srvsvc.dll

09:56:40.0878 2684 LanmanServer - ok

09:56:41.0143 2684 LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll

09:56:41.0205 2684 LanmanWorkstation - ok

09:56:41.0580 2684 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

09:56:41.0626 2684 lltdio - ok

09:56:41.0892 2684 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll

09:56:41.0938 2684 lltdsvc - ok

09:56:42.0344 2684 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll

09:56:42.0375 2684 lmhosts - ok

09:56:42.0984 2684 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

09:56:42.0999 2684 LSI_FC - ok

09:56:43.0389 2684 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

09:56:43.0405 2684 LSI_SAS - ok

09:56:43.0748 2684 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

09:56:43.0764 2684 LSI_SAS2 - ok

09:56:44.0356 2684 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

09:56:44.0372 2684 LSI_SCSI - ok

09:56:44.0809 2684 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

09:56:44.0856 2684 luafv - ok

09:56:45.0277 2684 MBAMProtector (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys

09:56:45.0277 2684 MBAMProtector - ok

09:56:45.0370 2684 MBAMService (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

09:56:45.0402 2684 MBAMService - ok

09:56:45.0636 2684 Mcx2Svc (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll

09:56:45.0667 2684 Mcx2Svc - ok

09:56:46.0010 2684 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

09:56:46.0026 2684 megasas - ok

09:56:46.0416 2684 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

09:56:46.0447 2684 MegaSR - ok

09:56:46.0712 2684 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

09:56:46.0759 2684 MMCSS - ok

09:56:47.0071 2684 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

09:56:47.0118 2684 Modem - ok

09:56:47.0445 2684 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

09:56:47.0461 2684 monitor - ok

09:56:47.0788 2684 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

09:56:47.0804 2684 mouclass - ok

09:56:48.0163 2684 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

09:56:48.0194 2684 mouhid - ok

09:56:48.0584 2684 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys

09:56:48.0584 2684 mountmgr - ok

09:56:48.0927 2684 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys

09:56:48.0943 2684 mpio - ok

09:56:49.0255 2684 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

09:56:49.0317 2684 mpsdrv - ok

09:56:49.0582 2684 MpsSvc (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll

09:56:49.0723 2684 MpsSvc - ok

09:56:50.0222 2684 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys

09:56:50.0331 2684 MRxDAV - ok

09:56:50.0784 2684 mrxsmb (767a4c3bcf9410c286ced15a2db17108) C:\Windows\system32\DRIVERS\mrxsmb.sys

09:56:50.0846 2684 mrxsmb - ok

09:56:51.0298 2684 mrxsmb10 (920ee0ff995fcfdeb08c41605a959e1c) C:\Windows\system32\DRIVERS\mrxsmb10.sys

09:56:51.0361 2684 mrxsmb10 - ok

09:56:51.0860 2684 mrxsmb20 (740d7ea9d72c981510a5292cf6adc941) C:\Windows\system32\DRIVERS\mrxsmb20.sys

09:56:51.0876 2684 mrxsmb20 - ok

09:56:52.0266 2684 msahci (2ba4ff3d5eb68587dd662a896f649c7d) C:\Windows\system32\DRIVERS\msahci.sys

09:56:52.0266 2684 msahci - ok

09:56:53.0077 2684 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys

09:56:53.0077 2684 msdsm - ok

09:56:53.0560 2684 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe

09:56:53.0576 2684 MSDTC - ok

09:56:54.0309 2684 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

09:56:54.0372 2684 Msfs - ok

09:56:54.0840 2684 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

09:56:55.0058 2684 mshidkmdf - ok

09:56:55.0713 2684 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys

09:56:55.0713 2684 msisadrv - ok

09:56:56.0103 2684 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll

09:56:56.0197 2684 MSiSCSI - ok

09:56:56.0712 2684 msiserver - ok

09:56:57.0710 2684 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

09:56:57.0772 2684 MSKSSRV - ok

09:56:58.0287 2684 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

09:56:58.0334 2684 MSPCLOCK - ok

09:56:58.0864 2684 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

09:56:58.0927 2684 MSPQM - ok

09:56:59.0426 2684 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys

09:56:59.0426 2684 MsRPC - ok

09:56:59.0910 2684 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys

09:56:59.0972 2684 mssmbios - ok

09:57:00.0362 2684 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

09:57:00.0424 2684 MSTEE - ok

09:57:01.0033 2684 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

09:57:01.0282 2684 MTConfig - ok

09:57:01.0797 2684 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

09:57:01.0828 2684 Mup - ok

09:57:02.0187 2684 napagent (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll

09:57:02.0234 2684 napagent - ok

09:57:02.0624 2684 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

09:57:02.0671 2684 NativeWifiP - ok

09:57:02.0780 2684 NAVENG (a507b7d1c5f957a1aab98794eb377654) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\ENG64.SYS

09:57:02.0796 2684 NAVENG - ok

09:57:02.0936 2684 NAVEX15 (0d7d6c0fd46f12780c3bab6af891ede3) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\EX64.SYS

09:57:02.0998 2684 NAVEX15 - ok

09:57:03.0342 2684 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys

09:57:03.0373 2684 NDIS - ok

09:57:03.0825 2684 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

09:57:03.0872 2684 NdisCap - ok

09:57:04.0293 2684 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

09:57:04.0340 2684 NdisTapi - ok

09:57:04.0870 2684 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys

09:57:05.0104 2684 Ndisuio - ok

09:57:05.0479 2684 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys

09:57:05.0557 2684 NdisWan - ok

09:57:05.0884 2684 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys

09:57:05.0916 2684 NDProxy - ok

09:57:06.0321 2684 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

09:57:06.0368 2684 NetBIOS - ok

09:57:06.0774 2684 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys

09:57:06.0836 2684 NetBT - ok

09:57:07.0226 2684 Netlogon (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe

09:57:07.0226 2684 Netlogon - ok

09:57:07.0522 2684 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll

09:57:07.0678 2684 Netman - ok

09:57:07.0959 2684 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll

09:57:08.0053 2684 netprofm - ok

09:57:08.0240 2684 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

09:57:08.0256 2684 NetTcpPortSharing - ok

09:57:09.0488 2684 netw5v64 (64428dfdaf6e88366cb51f45a79c5f69) C:\Windows\system32\DRIVERS\netw5v64.sys

09:57:09.0675 2684 netw5v64 - ok

09:57:10.0081 2684 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

09:57:10.0112 2684 nfrd960 - ok

09:57:10.0377 2684 NIS (e78a365cc3e0fbfc018a33dce01909f8) C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

09:57:10.0627 2684 NIS - ok

09:57:10.0923 2684 NlaSvc (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll

09:57:11.0001 2684 NlaSvc - ok

09:57:11.0485 2684 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

09:57:11.0516 2684 Npfs - ok

09:57:11.0766 2684 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll

09:57:11.0812 2684 nsi - ok

09:57:12.0327 2684 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

09:57:12.0499 2684 nsiproxy - ok

09:57:12.0920 2684 Ntfs (1ad8fef2d6ac7116b68b887a9782fd33) C:\Windows\system32\drivers\Ntfs.sys

09:57:13.0014 2684 Ntfs - ok

09:57:13.0372 2684 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

09:57:13.0404 2684 Null - ok

09:57:13.0809 2684 nvraid (deab10231cbdb0881fc25428ebe11506) C:\Windows\system32\DRIVERS\nvraid.sys

09:57:13.0809 2684 nvraid - ok

09:57:14.0262 2684 nvstor (0af7b8136794e23e87be138992880e64) C:\Windows\system32\DRIVERS\nvstor.sys

09:57:14.0277 2684 nvstor - ok

09:57:14.0620 2684 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys

09:57:14.0636 2684 nv_agp - ok

09:57:14.0979 2684 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys

09:57:14.0995 2684 ohci1394 - ok

09:57:15.0104 2684 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

09:57:15.0104 2684 ose - ok

09:57:15.0291 2684 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

09:57:15.0447 2684 osppsvc - ok

09:57:15.0744 2684 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

09:57:15.0790 2684 p2pimsvc - ok

09:57:16.0056 2684 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll

09:57:16.0102 2684 p2psvc - ok

09:57:16.0446 2684 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

09:57:16.0446 2684 Parport - ok

09:57:17.0070 2684 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys

09:57:17.0070 2684 partmgr - ok

09:57:17.0335 2684 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll

09:57:17.0366 2684 PcaSvc - ok

09:57:17.0850 2684 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys

09:57:17.0850 2684 pci - ok

09:57:18.0208 2684 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys

09:57:18.0224 2684 pciide - ok

09:57:18.0692 2684 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

09:57:18.0692 2684 pcmcia - ok

09:57:19.0066 2684 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

09:57:19.0066 2684 pcw - ok

09:57:20.0002 2684 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

09:57:20.0049 2684 PEAUTH - ok

09:57:20.0283 2684 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe

09:57:20.0439 2684 PerfHost - ok

09:57:20.0720 2684 pla (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll

09:57:20.0814 2684 pla - ok

09:57:21.0063 2684 PlugPlay (23157d583244400e1d7fbaee2e4b31b7) C:\Windows\system32\umpnpmgr.dll

09:57:21.0126 2684 PlugPlay - ok

09:57:21.0484 2684 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll

09:57:21.0625 2684 PNRPAutoReg - ok

09:57:21.0890 2684 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

09:57:21.0906 2684 PNRPsvc - ok

09:57:22.0202 2684 PolicyAgent (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll

09:57:22.0296 2684 PolicyAgent - ok

09:57:22.0561 2684 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll

09:57:22.0639 2684 Power - ok

09:57:23.0154 2684 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys

09:57:23.0232 2684 PptpMiniport - ok

09:57:23.0762 2684 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

09:57:23.0840 2684 Processor - ok

09:57:24.0183 2684 ProfSvc (f381975e1f4346de875cb07339ce8d3a) C:\Windows\system32\profsvc.dll

09:57:24.0230 2684 ProfSvc - ok

09:57:24.0573 2684 ProtectedStorage (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe

09:57:24.0589 2684 ProtectedStorage - ok

09:57:25.0088 2684 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys

09:57:25.0135 2684 Psched - ok

09:57:25.0634 2684 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

09:57:25.0696 2684 ql2300 - ok

09:57:26.0102 2684 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

09:57:26.0118 2684 ql40xx - ok

09:57:26.0570 2684 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll

09:57:26.0586 2684 QWAVE - ok

09:57:26.0913 2684 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

09:57:26.0944 2684 QWAVEdrv - ok

09:57:27.0288 2684 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

09:57:27.0350 2684 RasAcd - ok

09:57:27.0724 2684 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

09:57:27.0756 2684 RasAgileVpn - ok

09:57:28.0099 2684 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll

09:57:28.0130 2684 RasAuto - ok

09:57:28.0676 2684 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys

09:57:28.0723 2684 Rasl2tp - ok

09:57:29.0004 2684 RasMan (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll

09:57:29.0082 2684 RasMan - ok

09:57:29.0440 2684 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

09:57:29.0472 2684 RasPppoe - ok

09:57:29.0815 2684 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

09:57:29.0862 2684 RasSstp - ok

09:57:30.0267 2684 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys

09:57:30.0345 2684 rdbss - ok

09:57:30.0751 2684 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

09:57:30.0782 2684 rdpbus - ok

09:57:31.0141 2684 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

09:57:31.0203 2684 RDPCDD - ok

09:57:31.0546 2684 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

09:57:31.0593 2684 RDPENCDD - ok

09:57:31.0936 2684 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

09:57:31.0983 2684 RDPREFMP - ok

09:57:32.0358 2684 RDPWD (074ac702d8b8b660b0e1371555995386) C:\Windows\system32\drivers\RDPWD.sys

09:57:32.0420 2684 RDPWD - ok

09:57:32.0748 2684 rdyboost (e5dc9ba9e439d6dbdd79f8caacb5bf01) C:\Windows\system32\drivers\rdyboost.sys

09:57:32.0779 2684 rdyboost - ok

09:57:32.0997 2684 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll

09:57:33.0028 2684 RemoteAccess - ok

09:57:33.0418 2684 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll

09:57:33.0481 2684 RemoteRegistry - ok

09:57:33.0621 2684 RoxioNow Service (c1568e17039b2ec2b73a4f880ddd51e5) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe

09:57:33.0637 2684 RoxioNow Service - ok

09:57:33.0996 2684 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll

09:57:34.0042 2684 RpcEptMapper - ok

09:57:34.0292 2684 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe

09:57:34.0308 2684 RpcLocator - ok

09:57:34.0729 2684 RpcSs (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll

09:57:34.0776 2684 RpcSs - ok

09:57:35.0119 2684 RSPCIESTOR (ca327a84085f68200452e6761f943298) C:\Windows\system32\DRIVERS\RtsPStor.sys

09:57:35.0134 2684 RSPCIESTOR - ok

09:57:35.0649 2684 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

09:57:35.0712 2684 rspndr - ok

09:57:36.0086 2684 RTL8167 (b15c021c2c9bb217a799d9532e8f04d4) C:\Windows\system32\DRIVERS\Rt64win7.sys

09:57:36.0086 2684 RTL8167 - ok

09:57:36.0336 2684 SamSs (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe

09:57:36.0336 2684 SamSs - ok

09:57:36.0694 2684 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys

09:57:36.0694 2684 sbp2port - ok

09:57:36.0944 2684 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll

09:57:36.0991 2684 SCardSvr - ok

09:57:37.0412 2684 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys

09:57:37.0459 2684 scfilter - ok

09:57:37.0740 2684 Schedule (ec56b171f85c7e855e7b0588ac503eea) C:\Windows\system32\schedsvc.dll

09:57:37.0802 2684 Schedule - ok

09:57:38.0052 2684 SCPolicySvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll

09:57:38.0114 2684 SCPolicySvc - ok

09:57:38.0504 2684 sdbus (54e47ad086782d3ae9417c155cdceb9b) C:\Windows\system32\DRIVERS\sdbus.sys

09:57:38.0535 2684 sdbus - ok

09:57:38.0769 2684 SDRSVC (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll

09:57:38.0832 2684 SDRSVC - ok

09:57:38.0941 2684 SeaPort (331e7bde228914574fc9ae6cd520dafa) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

09:57:38.0956 2684 SeaPort - ok

09:57:39.0284 2684 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

09:57:39.0362 2684 secdrv - ok

09:57:39.0643 2684 seclogon (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll

09:57:39.0690 2684 seclogon - ok

09:57:39.0939 2684 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll

09:57:39.0970 2684 SENS - ok

09:57:40.0220 2684 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll

09:57:40.0298 2684 SensrSvc - ok

09:57:40.0704 2684 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

09:57:40.0704 2684 Serenum - ok

09:57:41.0062 2684 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

09:57:41.0078 2684 Serial - ok

09:57:41.0437 2684 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

09:57:41.0468 2684 sermouse - ok

09:57:41.0983 2684 SessionEnv (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll

09:57:42.0108 2684 SessionEnv - ok

09:57:42.0420 2684 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys

09:57:42.0466 2684 sffdisk - ok

09:57:42.0856 2684 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys

09:57:42.0872 2684 sffp_mmc - ok

09:57:43.0278 2684 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys

09:57:43.0309 2684 sffp_sd - ok

09:57:43.0699 2684 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

09:57:43.0699 2684 sfloppy - ok

09:57:44.0120 2684 Sftfs (d5183ed285d2795491dc15bddcbee5ad) C:\Windows\system32\DRIVERS\Sftfslh.sys

09:57:44.0136 2684 Sftfs - ok

09:57:44.0229 2684 sftlist (bfdb58616ff5ea540a5f58301d50641e) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

09:57:44.0245 2684 sftlist - ok

09:57:44.0604 2684 Sftplay (00f118b68c50d2206dd51634f9142b83) C:\Windows\system32\DRIVERS\Sftplaylh.sys

09:57:44.0619 2684 Sftplay - ok

09:57:44.0978 2684 Sftredir (76a827df5640bfe16a0cdbb4108adeca) C:\Windows\system32\DRIVERS\Sftredirlh.sys

09:57:44.0994 2684 Sftredir - ok

09:57:45.0368 2684 Sftvol (1b4c9701645086bab8cafffce30ed284) C:\Windows\system32\DRIVERS\Sftvollh.sys

09:57:45.0368 2684 Sftvol - ok

09:57:45.0477 2684 sftvsa (b94c3c4dca2093243c76ca218ede2a97) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

09:57:45.0508 2684 sftvsa - ok

09:57:45.0774 2684 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll

09:57:45.0820 2684 SharedAccess - ok

09:57:46.0086 2684 ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll

09:57:46.0164 2684 ShellHWDetection - ok

09:57:46.0554 2684 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

09:57:46.0569 2684 SiSRaid2 - ok

09:57:47.0037 2684 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

09:57:47.0068 2684 SiSRaid4 - ok

09:57:47.0427 2684 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

09:57:47.0552 2684 Smb - ok

09:57:48.0254 2684 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe

09:57:48.0332 2684 SNMPTRAP - ok

09:57:48.0675 2684 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

09:57:48.0706 2684 spldr - ok

09:57:48.0956 2684 Spooler (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\Windows\System32\spoolsv.exe

09:57:49.0034 2684 Spooler - ok

09:57:49.0502 2684 sppsvc (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe

09:57:49.0658 2684 sppsvc - ok

09:57:49.0986 2684 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll

09:57:50.0017 2684 sppuinotify - ok

09:57:50.0407 2684 SRTSP (90ef30c3867bcde4579c01a6d6e75a7a) C:\Windows\System32\Drivers\NISx64\1206000.01D\SRTSP64.SYS

09:57:50.0422 2684 SRTSP - ok

09:57:50.0828 2684 SRTSPX (c513e8a5e7978da49077f5484344ee1b) C:\Windows\system32\drivers\NISx64\1206000.01D\SRTSPX64.SYS

09:57:50.0844 2684 SRTSPX - ok

09:57:51.0374 2684 srv (de6f5658da951c4bc8e498570b5b0d5f) C:\Windows\system32\DRIVERS\srv.sys

09:57:51.0421 2684 srv - ok

09:57:52.0123 2684 srv2 (4d33d59c0b930c523d29f9bd40cda9d2) C:\Windows\system32\DRIVERS\srv2.sys

09:57:52.0170 2684 srv2 - ok

09:57:52.0731 2684 SrvHsfHDA (0c4540311e11664b245a263e1154cef8) C:\Windows\system32\DRIVERS\VSTAZL6.SYS

09:57:52.0762 2684 SrvHsfHDA - ok

09:57:53.0246 2684 SrvHsfV92 (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS

09:57:53.0308 2684 SrvHsfV92 - ok

09:57:53.0776 2684 SrvHsfWinac (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS

09:57:53.0792 2684 SrvHsfWinac - ok

09:57:54.0322 2684 srvnet (5a663fd67049267bc5c3f3279e631ffb) C:\Windows\system32\DRIVERS\srvnet.sys

09:57:54.0354 2684 srvnet - ok

09:57:54.0666 2684 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll

09:57:54.0744 2684 SSDPSRV - ok

09:57:55.0040 2684 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll

09:57:55.0071 2684 SstpSvc - ok

09:57:55.0274 2684 STacSV (7c49a5e1943afda4672d80726af3bae4) C:\Program Files\IDT\WDM\STacSV64.exe

09:57:55.0430 2684 STacSV - ok

09:57:55.0804 2684 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

09:57:55.0804 2684 stexstor - ok

09:57:56.0319 2684 STHDA (0aad250a31a7ee96e0945ab9e1f3baa7) C:\Windows\system32\DRIVERS\stwrt64.sys

09:57:56.0335 2684 STHDA - ok

09:57:56.0834 2684 stisvc (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll

09:57:56.0881 2684 stisvc - ok

09:57:57.0240 2684 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys

09:57:57.0255 2684 swenum - ok

09:57:57.0957 2684 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll

09:57:58.0004 2684 swprv - ok

09:57:58.0394 2684 SymDS (6160145c7a87fc7672e8e3b886888176) C:\Windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS

09:57:58.0410 2684 SymDS - ok

09:57:58.0815 2684 SymEFA (96aeed40d4d3521568b42027687e69e0) C:\Windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS

09:57:58.0846 2684 SymEFA - ok

09:57:59.0236 2684 SymEvent (21a1c2d694c3cf962d31f5e873ab3d6f) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS

09:57:59.0268 2684 SymEvent - ok

09:57:59.0673 2684 SymIRON (bd0d711d8cbfcaa19ca123306eaf53a5) C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS

09:57:59.0689 2684 SymIRON - ok

09:58:00.0172 2684 SymNetS (81d134628a98a22b6e054e971af525dc) C:\Windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS

09:58:00.0219 2684 SymNetS - ok

09:58:00.0874 2684 SynTP (33e6a285daa5134d8ea2247914c86c09) C:\Windows\system32\DRIVERS\SynTP.sys

09:58:00.0906 2684 SynTP - ok

09:58:01.0249 2684 SysMain (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll

09:58:01.0374 2684 SysMain - ok

09:58:01.0608 2684 TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll

09:58:01.0639 2684 TabletInputService - ok

09:58:01.0951 2684 TapiSrv (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll

09:58:02.0029 2684 TapiSrv - ok

09:58:02.0341 2684 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll

09:58:02.0419 2684 TBS - ok

09:58:03.0230 2684 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys

09:58:03.0292 2684 Tcpip - ok

09:58:03.0838 2684 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys

09:58:03.0870 2684 TCPIP6 - ok

09:58:04.0369 2684 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys

09:58:04.0400 2684 tcpipreg - ok

09:58:04.0868 2684 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

09:58:04.0899 2684 TDPIPE - ok

09:58:05.0258 2684 TDTCP (7518f7bcfd4b308abc9192bacaf6c970) C:\Windows\system32\drivers\tdtcp.sys

09:58:05.0289 2684 TDTCP - ok

09:58:05.0601 2684 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys

09:58:05.0664 2684 tdx - ok

09:58:06.0069 2684 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys

09:58:06.0069 2684 TermDD - ok

09:58:06.0412 2684 TermService (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll

09:58:06.0459 2684 TermService - ok

09:58:06.0724 2684 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll

09:58:06.0756 2684 Themes - ok

09:58:07.0005 2684 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

09:58:07.0036 2684 THREADORDER - ok

09:58:07.0317 2684 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll

09:58:07.0411 2684 TrkWks - ok

09:58:07.0520 2684 TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe

09:58:07.0536 2684 TrustedInstaller - ok

09:58:07.0801 2684 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys

09:58:07.0848 2684 tssecsrv - ok

09:58:08.0347 2684 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys

09:58:08.0409 2684 tunnel - ok

09:58:08.0862 2684 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

09:58:08.0862 2684 uagp35 - ok

09:58:09.0220 2684 udfs (0e5e962b5649d544be54e8c90761ea2b) C:\Windows\system32\DRIVERS\udfs.sys

09:58:09.0298 2684 udfs - ok

09:58:09.0735 2684 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe

09:58:09.0751 2684 UI0Detect - ok

09:58:10.0110 2684 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys

09:58:10.0110 2684 uliagpkx - ok

09:58:10.0484 2684 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys

09:58:10.0515 2684 umbus - ok

09:58:11.0046 2684 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

09:58:11.0061 2684 UmPass - ok

09:58:11.0498 2684 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll

09:58:11.0545 2684 upnphost - ok

09:58:11.0919 2684 usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys

09:58:11.0966 2684 usbccgp - ok

09:58:12.0465 2684 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys

09:58:12.0481 2684 usbcir - ok

09:58:12.0949 2684 usbehci (cb490987a7f6928a04bb838e3bd8a936) C:\Windows\system32\DRIVERS\usbehci.sys

09:58:13.0027 2684 usbehci - ok

09:58:13.0370 2684 usbfilter (dc2b306861f42eeeb92ef525f4119f08) C:\Windows\system32\DRIVERS\usbfilter.sys

09:58:13.0386 2684 usbfilter - ok

09:58:13.0744 2684 usbhub (18124ef0a881a00ee222d02a3ee30270) C:\Windows\system32\DRIVERS\usbhub.sys

09:58:13.0807 2684 usbhub - ok

09:58:14.0134 2684 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys

09:58:14.0134 2684 usbohci - ok

09:58:14.0524 2684 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

09:58:14.0556 2684 usbprint - ok

09:58:15.0055 2684 USBSTOR (a60e7e0fa88ff067d049d525547cd5e9) C:\Windows\system32\DRIVERS\USBSTOR.SYS

09:58:15.0070 2684 USBSTOR - ok

09:58:15.0679 2684 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys

09:58:15.0679 2684 usbuhci - ok

09:58:16.0069 2684 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\system32\Drivers\usbvideo.sys

09:58:16.0100 2684 usbvideo - ok

09:58:16.0334 2684 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll

09:58:16.0381 2684 UxSms - ok

09:58:17.0270 2684 VaultSvc (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe

09:58:17.0286 2684 VaultSvc - ok

09:58:17.0691 2684 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys

09:58:17.0722 2684 vdrvroot - ok

09:58:18.0019 2684 vds (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe

09:58:18.0035 2684 vds - ok

09:58:18.0581 2684 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

09:58:18.0674 2684 vga - ok

09:58:19.0049 2684 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

09:58:19.0142 2684 VgaSave - ok

09:58:19.0610 2684 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys

09:58:19.0610 2684 vhdmp - ok

09:58:20.0047 2684 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys

09:58:20.0063 2684 viaide - ok

09:58:20.0624 2684 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys

09:58:20.0624 2684 volmgr - ok

09:58:21.0295 2684 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys

09:58:21.0311 2684 volmgrx - ok

09:58:21.0857 2684 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys

09:58:21.0872 2684 volsnap - ok

09:58:22.0325 2684 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

09:58:22.0325 2684 vsmraid - ok

09:58:22.0683 2684 VSS (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe

09:58:22.0761 2684 VSS - ok

09:58:23.0307 2684 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

09:58:23.0323 2684 vwifibus - ok

09:58:23.0744 2684 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

09:58:23.0807 2684 vwififlt - ok

09:58:24.0119 2684 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll

09:58:24.0165 2684 W32Time - ok

09:58:24.0696 2684 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

09:58:24.0727 2684 WacomPen - ok

09:58:25.0211 2684 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

09:58:25.0273 2684 WANARP - ok

09:58:25.0694 2684 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

09:58:25.0725 2684 Wanarpv6 - ok

09:58:26.0037 2684 wbengine (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe

09:58:26.0115 2684 wbengine - ok

09:58:26.0396 2684 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll

09:58:26.0412 2684 WbioSrvc - ok

09:58:26.0677 2684 wcncsvc (8321c2ca3b62b61b293cda3451984468) C:\Windows\System32\wcncsvc.dll

09:58:26.0708 2684 wcncsvc - ok

09:58:26.0973 2684 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll

09:58:26.0989 2684 WcsPlugInService - ok

09:58:27.0348 2684 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

09:58:27.0348 2684 Wd - ok

09:58:28.0237 2684 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

09:58:28.0268 2684 Wdf01000 - ok

09:58:28.0643 2684 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

09:58:28.0674 2684 WdiServiceHost - ok

09:58:28.0721 2684 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

09:58:28.0736 2684 WdiSystemHost - ok

09:58:28.0970 2684 WebClient (8a438cbb8c032a0c798b0c642ffbe572) C:\Windows\System32\webclnt.dll

09:58:29.0017 2684 WebClient - ok

09:58:29.0298 2684 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll

09:58:29.0360 2684 Wecsvc - ok

09:58:29.0610 2684 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll

09:58:29.0641 2684 wercplsupport - ok

09:58:29.0922 2684 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll

09:58:29.0969 2684 WerSvc - ok

09:58:30.0327 2684 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

09:58:30.0390 2684 WfpLwf - ok

09:58:30.0749 2684 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

09:58:30.0780 2684 WIMMount - ok

09:58:30.0858 2684 WinDefend - ok

09:58:30.0858 2684 WinHttpAutoProxySvc - ok

09:58:31.0263 2684 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll

09:58:31.0326 2684 Winmgmt - ok

09:58:31.0622 2684 WinRM (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll

09:58:31.0747 2684 WinRM - ok

09:58:32.0028 2684 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll

09:58:32.0090 2684 Wlansvc - ok

09:58:32.0215 2684 wlcrasvc (06c8fa1cf39de6a735b54d906ba791c6) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe

09:58:32.0215 2684 wlcrasvc - ok

09:58:32.0324 2684 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

09:58:32.0402 2684 wlidsvc - ok

09:58:32.0777 2684 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys

09:58:32.0777 2684 WmiAcpi - ok

09:58:33.0728 2684 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe

09:58:33.0744 2684 wmiApSrv - ok

09:58:33.0791 2684 WMPNetworkSvc - ok

09:58:34.0009 2684 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll

09:58:34.0025 2684 WPCSvc - ok

09:58:34.0243 2684 WPDBusEnum (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll

09:58:34.0290 2684 WPDBusEnum - ok

09:58:34.0617 2684 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

09:58:34.0664 2684 ws2ifsl - ok

09:58:34.0898 2684 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll

09:58:34.0929 2684 wscsvc - ok

09:58:35.0148 2684 WSearch - ok

09:58:35.0444 2684 wuauserv (38340204a2d0228f1e87740fc5e554a7) C:\Windows\system32\wuaueng.dll

09:58:35.0553 2684 wuauserv - ok

09:58:35.0912 2684 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys

09:58:35.0959 2684 WudfPf - ok

09:58:36.0193 2684 wudfsvc (b551d6637aa0e132c18ac6e504f7b79b) C:\Windows\System32\WUDFSvc.dll

09:58:36.0240 2684 wudfsvc - ok

09:58:36.0630 2684 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll

09:58:36.0692 2684 WwanSvc - ok

09:58:37.0098 2684 yukonw7 (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys

09:58:37.0113 2684 yukonw7 - ok

09:58:37.0160 2684 MBR (0x1B8) (c0dcf0ac171db02db8b0014c5d767cf1) \Device\Harddisk0\DR0

09:58:37.0191 2684 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected

09:58:37.0191 2684 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)

09:58:37.0238 2684 \Device\Harddisk0\DR0 ( TDSS File System ) - warning

09:58:37.0238 2684 \Device\Harddisk0\DR0 - detected TDSS File System (1)

09:58:37.0285 2684 Boot (0x1200) (876cc1f8a07fc0d4b9cb82c6ec45f2b5) \Device\Harddisk0\DR0\Partition0

09:58:37.0285 2684 \Device\Harddisk0\DR0\Partition0 - ok

09:58:37.0285 2684 Boot (0x1200) (11f04bfaeb091397a76bbb147d7f55c3) \Device\Harddisk0\DR0\Partition1

09:58:37.0285 2684 \Device\Harddisk0\DR0\Partition1 - ok

09:58:37.0332 2684 Boot (0x1200) (e70448d587646c060dd151f4fe87c6a7) \Device\Harddisk0\DR0\Partition2

09:58:37.0332 2684 \Device\Harddisk0\DR0\Partition2 - ok

09:58:37.0363 2684 Boot (0x1200) (ffc993f4bb10471cc5852ea387a6b414) \Device\Harddisk0\DR0\Partition3

09:58:37.0363 2684 \Device\Harddisk0\DR0\Partition3 - ok

09:58:37.0363 2684 ============================================================

09:58:37.0363 2684 Scan finished

09:58:37.0363 2684 ============================================================

09:58:37.0394 2676 Detected object count: 2

09:58:37.0394 2676 Actual detected object count: 2

10:00:41.0756 2676 \Device\Harddisk0\DR0\# - copied to quarantine

10:00:41.0756 2676 \Device\Harddisk0\DR0 - copied to quarantine

10:00:41.0818 2676 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine

10:00:41.0818 2676 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine

10:00:41.0818 2676 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine

10:00:41.0834 2676 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine

10:00:41.0849 2676 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine

10:00:41.0849 2676 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine

10:00:41.0880 2676 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine

10:00:41.0880 2676 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine

10:00:41.0896 2676 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine

10:00:41.0896 2676 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine

10:00:41.0896 2676 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine

10:00:41.0896 2676 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine

10:00:41.0896 2676 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot

10:00:41.0896 2676 \Device\Harddisk0\DR0 - ok

10:00:43.0113 2676 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure

10:00:43.0113 2676 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user

10:00:43.0113 2676 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

10:01:01.0162 2468 Deinitialize success

---------------MalwareBytes (1st)

Malwarebytes Anti-Malware (Trial) 1.60.1.1000

www.malwarebytes.org

Database version: v2012.04.03.09

Windows 7 x64 NTFS (Safe Mode/Networking)

Internet Explorer 8.0.7600.16385

Jess :: JESS-HP [administrator]

Protection: Disabled

4/3/2012 10:06:01 AM

mbam-log-2012-04-03 (10-06-01).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 189941

Time elapsed: 2 minute(s), 18 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

(end)

----------------------DDS

.

DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORK

Internet Explorer: 8.0.7600.16385

Run by Jess at 10:18:21 on 2012-04-03

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2811.2329 [GMT -7:00]

.

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\Explorer.EXE

C:\Windows\system32\ctfmon.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted