Jump to content

Infected with svchost.exe know nothing


Recommended Posts

Hy

my name is Daniel and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.

  • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Please read and follow these instructions carefully. We do not want it to fix anything yet (if found), we need to see a report first.

Download TDSSKiller.exe and save it to your desktop

  • Execute TDSSKiller.exe by doubleclicking on it.
  • Press Start Scan
  • If Malicious objects are found, do NOT select Cure. Change the action to Skip, and save the log.
  • Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt

Please post the contents of that log in your next reply.

Link to post
Share on other sites

Thank you so much for your help Larusso. TDS found something, but at the moment, I cannot find how to save the log. The threat it found was: Rootkit.Boot.Pihar.c

Physical drive: \ Device\Harddisk0\DR0

Malware object High Risk

(if I figure out how to save the log, I'll BRB)

Link to post
Share on other sites

09:11:58.0093 0632 TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32

09:11:58.0375 0632 ============================================================

09:11:58.0375 0632 Current date / time: 2012/08/12 09:11:58.0375

09:11:58.0375 0632 SystemInfo:

09:11:58.0375 0632

09:11:58.0375 0632 OS Version: 5.1.2600 ServicePack: 3.0

09:11:58.0375 0632 Product type: Workstation

09:11:58.0375 0632 ComputerName: PATTI-A333147A3

09:11:58.0375 0632 UserName: Patti Chase

09:11:58.0375 0632 Windows directory: C:\WINDOWS

09:11:58.0375 0632 System windows directory: C:\WINDOWS

09:11:58.0375 0632 Processor architecture: Intel x86

09:11:58.0375 0632 Number of processors: 2

09:11:58.0375 0632 Page size: 0x1000

09:11:58.0375 0632 Boot type: Normal boot

09:11:58.0375 0632 ============================================================

09:12:03.0578 0632 Drive \Device\Harddisk0\DR0 - Size: 0xDF8F90000 (55.89 Gb), SectorSize: 0x200, Cylinders: 0x1C80, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

09:12:03.0593 0632 ============================================================

09:12:03.0593 0632 \Device\Harddisk0\DR0:

09:12:03.0593 0632 MBR partitions:

09:12:03.0593 0632 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x6FC3D80

09:12:03.0593 0632 ============================================================

09:12:03.0609 0632 C: <-> \Device\Harddisk0\DR0\Partition0

09:12:03.0609 0632 ============================================================

09:12:03.0609 0632 Initialize success

09:12:03.0609 0632 ============================================================

09:12:05.0718 2568 ============================================================

09:12:05.0718 2568 Scan started

09:12:05.0718 2568 Mode: Manual;

09:12:05.0718 2568 ============================================================

09:12:07.0203 2568 Abiosdsk - ok

09:12:07.0218 2568 abp480n5 - ok

09:12:07.0265 2568 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

09:12:07.0281 2568 ACPI - ok

09:12:07.0296 2568 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys

09:12:07.0312 2568 ACPIEC - ok

09:12:07.0375 2568 AdobeFlashPlayerUpdateSvc (f19c98ad81d2c0e1bbfd8153d2c80ee8) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

09:12:07.0375 2568 AdobeFlashPlayerUpdateSvc - ok

09:12:07.0375 2568 adpu160m - ok

09:12:07.0406 2568 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

09:12:07.0406 2568 aec - ok

09:12:07.0468 2568 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

09:12:07.0468 2568 AFD - ok

09:12:07.0468 2568 Aha154x - ok

09:12:07.0484 2568 aic78u2 - ok

09:12:07.0484 2568 aic78xx - ok

09:12:07.0562 2568 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll

09:12:07.0562 2568 Alerter - ok

09:12:07.0640 2568 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe

09:12:07.0640 2568 ALG - ok

09:12:07.0656 2568 AliIde - ok

09:12:07.0703 2568 AmdK8 (efbb0956baed786e137351b5ca272aef) C:\WINDOWS\system32\DRIVERS\AmdK8.sys

09:12:07.0703 2568 AmdK8 - ok

09:12:07.0718 2568 amsint - ok

09:12:07.0812 2568 APPDRV (ec94e05b76d033b74394e7b2175103cf) C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS

09:12:07.0812 2568 APPDRV - ok

09:12:07.0812 2568 AppMgmt - ok

09:12:07.0828 2568 asc - ok

09:12:07.0828 2568 asc3350p - ok

09:12:07.0843 2568 asc3550 - ok

09:12:07.0953 2568 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

09:12:07.0984 2568 aspnet_state - ok

09:12:08.0015 2568 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

09:12:08.0015 2568 AsyncMac - ok

09:12:08.0046 2568 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

09:12:08.0046 2568 atapi - ok

09:12:08.0046 2568 Atdisk - ok

09:12:08.0140 2568 Ati HotKey Poller (8bb6a2488a93259fddc18d040008c1a4) C:\WINDOWS\system32\Ati2evxx.exe

09:12:08.0140 2568 Ati HotKey Poller - ok

09:12:08.0343 2568 ati2mtag (e78b73eb84c257d0d940e041742d2699) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

09:12:08.0375 2568 ati2mtag - ok

09:12:08.0515 2568 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

09:12:08.0515 2568 Atmarpc - ok

09:12:08.0562 2568 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll

09:12:08.0562 2568 AudioSrv - ok

09:12:08.0625 2568 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

09:12:08.0671 2568 audstub - ok

09:12:09.0093 2568 AVGIDSAgent (ba60fd7a64b9759a14c0fba4a9ed4c7b) C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

09:12:09.0437 2568 AVGIDSAgent - ok

09:12:09.0703 2568 AVGIDSDriver (1074f787080068c71303b61fae7e7ca4) C:\WINDOWS\system32\DRIVERS\avgidsdriverx.sys

09:12:09.0703 2568 AVGIDSDriver - ok

09:12:09.0718 2568 AVGIDSFilter (61a7e0b02f82cff3db2445bbe50b3589) C:\WINDOWS\system32\DRIVERS\avgidsfilterx.sys

09:12:09.0718 2568 AVGIDSFilter - ok

09:12:09.0750 2568 AVGIDSHX (d63d83659eedf60b3a3e620281a888e5) C:\WINDOWS\system32\DRIVERS\avgidshx.sys

09:12:09.0750 2568 AVGIDSHX - ok

09:12:09.0765 2568 AVGIDSShim (baf975b72062f53d327788e99d64197e) C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys

09:12:09.0765 2568 AVGIDSShim - ok

09:12:09.0828 2568 Avgldx86 (dda6a2a18841e4c9172bb85958b8d948) C:\WINDOWS\system32\DRIVERS\avgldx86.sys

09:12:09.0828 2568 Avgldx86 - ok

09:12:09.0828 2568 Avgmfx86 (ccdd61545aaea265977e4b1efdc74e8c) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys

09:12:09.0843 2568 Avgmfx86 - ok

09:12:09.0859 2568 Avgrkx86 (1fd90b28d2c3100bf4500199c8ad6358) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys

09:12:09.0859 2568 Avgrkx86 - ok

09:12:09.0890 2568 Avgtdix (1263f2554ace925c237a40b4c568d815) C:\WINDOWS\system32\DRIVERS\avgtdix.sys

09:12:09.0890 2568 Avgtdix - ok

09:12:10.0093 2568 avgwd (ea1145debcd508fd25bd1e95c4346929) C:\Program Files\AVG\AVG2012\avgwdsvc.exe

09:12:10.0093 2568 avgwd - ok

09:12:10.0187 2568 BCM43XX (b89bcf0a25aeb3b47030ac83287f894a) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys

09:12:10.0203 2568 BCM43XX - ok

09:12:10.0250 2568 bcm4sbxp (cd4646067cc7dcba1907fa0acf7e3966) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys

09:12:10.0250 2568 bcm4sbxp - ok

09:12:10.0359 2568 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

09:12:10.0359 2568 Beep - ok

09:12:10.0437 2568 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll

09:12:10.0468 2568 BITS - ok

09:12:10.0515 2568 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll

09:12:10.0531 2568 Browser - ok

09:12:10.0593 2568 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

09:12:10.0593 2568 cbidf2k - ok

09:12:10.0609 2568 cd20xrnt - ok

09:12:10.0656 2568 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

09:12:10.0656 2568 Cdaudio - ok

09:12:10.0734 2568 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

09:12:10.0734 2568 Cdfs - ok

09:12:10.0750 2568 Cdr4_xp (297acc7d7c66ec86ee0b4eb5af9a8fd3) C:\WINDOWS\system32\drivers\Cdr4_xp.sys

09:12:10.0765 2568 Cdr4_xp - ok

09:12:10.0765 2568 Cdralw2k (5e31abf467a6fd857710c0927c88ee4c) C:\WINDOWS\system32\drivers\Cdralw2k.sys

09:12:10.0765 2568 Cdralw2k - ok

09:12:10.0781 2568 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

09:12:10.0781 2568 Cdrom - ok

09:12:10.0796 2568 cdudf_xp (cfd81f2140193fc7f1812e6d6eaf6795) C:\WINDOWS\system32\drivers\cdudf_xp.sys

09:12:10.0796 2568 cdudf_xp - ok

09:12:10.0843 2568 cercsr6 (84853b3fd012251690570e9e7e43343f) C:\WINDOWS\system32\drivers\cercsr6.sys

09:12:10.0843 2568 cercsr6 - ok

09:12:10.0843 2568 Changer - ok

09:12:10.0875 2568 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe

09:12:10.0875 2568 CiSvc - ok

09:12:10.0906 2568 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe

09:12:10.0906 2568 ClipSrv - ok

09:12:11.0015 2568 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

09:12:11.0062 2568 clr_optimization_v2.0.50727_32 - ok

09:12:11.0093 2568 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys

09:12:11.0093 2568 CmBatt - ok

09:12:11.0093 2568 CmdIde - ok

09:12:11.0109 2568 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys

09:12:11.0109 2568 Compbatt - ok

09:12:11.0125 2568 COMSysApp - ok

09:12:11.0140 2568 Cpqarray - ok

09:12:11.0187 2568 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll

09:12:11.0187 2568 CryptSvc - ok

09:12:11.0203 2568 dac2w2k - ok

09:12:11.0203 2568 dac960nt - ok

09:12:11.0312 2568 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

09:12:11.0312 2568 DcomLaunch - ok

09:12:11.0375 2568 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll

09:12:11.0375 2568 Dhcp - ok

09:12:11.0406 2568 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

09:12:11.0406 2568 Disk - ok

09:12:11.0406 2568 dmadmin - ok

09:12:11.0546 2568 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

09:12:11.0562 2568 dmboot - ok

09:12:11.0578 2568 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

09:12:11.0593 2568 dmio - ok

09:12:11.0625 2568 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

09:12:11.0625 2568 dmload - ok

09:12:11.0671 2568 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll

09:12:11.0671 2568 dmserver - ok

09:12:11.0703 2568 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

09:12:11.0703 2568 DMusic - ok

09:12:11.0765 2568 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll

09:12:11.0765 2568 Dnscache - ok

09:12:11.0812 2568 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll

09:12:11.0812 2568 Dot3svc - ok

09:12:11.0828 2568 dpti2o - ok

09:12:11.0859 2568 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

09:12:11.0875 2568 drmkaud - ok

09:12:11.0968 2568 dvd_2K (677829f7010768eeeed8d0083e510dab) C:\WINDOWS\system32\drivers\dvd_2K.sys

09:12:11.0968 2568 dvd_2K - ok

09:12:12.0000 2568 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll

09:12:12.0000 2568 EapHost - ok

09:12:12.0031 2568 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll

09:12:12.0031 2568 ERSvc - ok

09:12:12.0078 2568 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

09:12:12.0078 2568 Eventlog - ok

09:12:12.0203 2568 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll

09:12:12.0203 2568 EventSystem - ok

09:12:12.0234 2568 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

09:12:12.0234 2568 Fastfat - ok

09:12:12.0265 2568 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

09:12:12.0265 2568 FastUserSwitchingCompatibility - ok

09:12:12.0312 2568 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

09:12:12.0312 2568 Fdc - ok

09:12:12.0328 2568 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

09:12:12.0328 2568 Fips - ok

09:12:12.0343 2568 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

09:12:12.0343 2568 Flpydisk - ok

09:12:12.0468 2568 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

09:12:12.0468 2568 FltMgr - ok

09:12:12.0625 2568 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

09:12:12.0625 2568 FontCache3.0.0.0 - ok

09:12:12.0640 2568 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

09:12:12.0640 2568 Fs_Rec - ok

09:12:12.0671 2568 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

09:12:12.0671 2568 Ftdisk - ok

09:12:12.0796 2568 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

09:12:12.0796 2568 Gpc - ok

09:12:12.0828 2568 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

09:12:12.0828 2568 HDAudBus - ok

09:12:12.0890 2568 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

09:12:12.0890 2568 helpsvc - ok

09:12:12.0890 2568 HidServ - ok

09:12:12.0937 2568 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll

09:12:12.0953 2568 hkmsvc - ok

09:12:12.0953 2568 hpn - ok

09:12:13.0015 2568 HSFHWAZL (290cdbb05903742ea06b7203c5a662f5) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys

09:12:13.0031 2568 HSFHWAZL - ok

09:12:13.0125 2568 HSF_DPV (7ab812355f98858b9ecdd46e6fcc221f) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys

09:12:13.0171 2568 HSF_DPV - ok

09:12:13.0250 2568 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

09:12:13.0265 2568 HTTP - ok

09:12:13.0343 2568 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll

09:12:13.0359 2568 HTTPFilter - ok

09:12:13.0359 2568 i2omgmt - ok

09:12:13.0359 2568 i2omp - ok

09:12:13.0421 2568 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

09:12:13.0421 2568 i8042prt - ok

09:12:13.0640 2568 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

09:12:13.0671 2568 idsvc - ok

09:12:13.0703 2568 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

09:12:13.0703 2568 Imapi - ok

09:12:13.0765 2568 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe

09:12:13.0765 2568 ImapiService - ok

09:12:13.0781 2568 ini910u - ok

09:12:13.0796 2568 IntelIde - ok

09:12:13.0828 2568 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

09:12:13.0828 2568 Ip6Fw - ok

09:12:13.0875 2568 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

09:12:13.0875 2568 IpFilterDriver - ok

09:12:13.0890 2568 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

09:12:13.0890 2568 IpInIp - ok

09:12:13.0953 2568 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

09:12:13.0984 2568 IpNat - ok

09:12:14.0015 2568 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

09:12:14.0015 2568 IPSec - ok

09:12:14.0046 2568 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

09:12:14.0062 2568 IRENUM - ok

09:12:14.0093 2568 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

09:12:14.0093 2568 isapnp - ok

09:12:14.0312 2568 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe

09:12:14.0328 2568 JavaQuickStarterService - ok

09:12:14.0343 2568 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

09:12:14.0343 2568 Kbdclass - ok

09:12:14.0359 2568 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

09:12:14.0375 2568 kmixer - ok

09:12:14.0406 2568 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

09:12:14.0406 2568 KSecDD - ok

09:12:14.0453 2568 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll

09:12:14.0453 2568 lanmanserver - ok

09:12:14.0468 2568 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll

09:12:14.0468 2568 lanmanworkstation - ok

09:12:14.0484 2568 lbrtfdc - ok

09:12:14.0546 2568 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll

09:12:14.0546 2568 LmHosts - ok

09:12:14.0593 2568 MBAMProtector (6dfe7f2e8e8a337263aa5c92a215f161) C:\WINDOWS\system32\drivers\mbam.sys

09:12:14.0593 2568 MBAMProtector - ok

09:12:14.0718 2568 MBAMService (43683e970f008c93c9429ef428147a54) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

09:12:14.0734 2568 MBAMService - ok

09:12:14.0781 2568 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

09:12:14.0781 2568 mdmxsdk - ok

09:12:14.0828 2568 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll

09:12:14.0843 2568 Messenger - ok

09:12:15.0015 2568 mmc_2K (9b90303a9c9405a6ce1466ff4aa20fdd) C:\WINDOWS\system32\drivers\mmc_2K.sys

09:12:15.0015 2568 mmc_2K - ok

09:12:15.0062 2568 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

09:12:15.0062 2568 mnmdd - ok

09:12:15.0125 2568 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe

09:12:15.0125 2568 mnmsrvc - ok

09:12:15.0171 2568 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

09:12:15.0171 2568 Modem - ok

09:12:15.0187 2568 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

09:12:15.0187 2568 Mouclass - ok

09:12:15.0312 2568 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

09:12:15.0312 2568 MountMgr - ok

09:12:15.0312 2568 mraid35x - ok

09:12:15.0328 2568 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

09:12:15.0328 2568 MRxDAV - ok

09:12:15.0406 2568 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

09:12:15.0421 2568 MRxSmb - ok

09:12:15.0468 2568 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe

09:12:15.0468 2568 MSDTC - ok

09:12:15.0484 2568 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

09:12:15.0484 2568 Msfs - ok

09:12:15.0484 2568 MSIServer - ok

09:12:15.0531 2568 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

09:12:15.0531 2568 MSKSSRV - ok

09:12:15.0546 2568 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

09:12:15.0546 2568 MSPCLOCK - ok

09:12:15.0562 2568 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

09:12:15.0562 2568 MSPQM - ok

09:12:15.0609 2568 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

09:12:15.0609 2568 mssmbios - ok

09:12:15.0640 2568 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

09:12:15.0640 2568 Mup - ok

09:12:15.0750 2568 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll

09:12:15.0750 2568 napagent - ok

09:12:15.0812 2568 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

09:12:15.0812 2568 NDIS - ok

09:12:15.0843 2568 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

09:12:15.0843 2568 NdisTapi - ok

09:12:15.0875 2568 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

09:12:15.0875 2568 Ndisuio - ok

09:12:15.0890 2568 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

09:12:15.0890 2568 NdisWan - ok

09:12:15.0921 2568 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

09:12:15.0921 2568 NDProxy - ok

09:12:15.0968 2568 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

09:12:15.0968 2568 NetBIOS - ok

09:12:16.0000 2568 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

09:12:16.0000 2568 NetBT - ok

09:12:16.0062 2568 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

09:12:16.0078 2568 NetDDE - ok

09:12:16.0078 2568 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

09:12:16.0078 2568 NetDDEdsdm - ok

09:12:16.0171 2568 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

09:12:16.0171 2568 Netlogon - ok

09:12:16.0218 2568 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll

09:12:16.0218 2568 Netman - ok

09:12:16.0375 2568 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

09:12:16.0390 2568 NetTcpPortSharing - ok

09:12:16.0453 2568 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll

09:12:16.0453 2568 Nla - ok

09:12:16.0515 2568 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

09:12:16.0515 2568 Npfs - ok

09:12:16.0546 2568 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

09:12:16.0562 2568 Ntfs - ok

09:12:16.0562 2568 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

09:12:16.0562 2568 NtLmSsp - ok

09:12:16.0640 2568 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll

09:12:16.0640 2568 NtmsSvc - ok

09:12:16.0687 2568 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

09:12:16.0687 2568 Null - ok

09:12:16.0750 2568 NWADI (091a1284aa583288b64dcd370d1b421e) C:\WINDOWS\system32\DRIVERS\NWADIenum.sys

09:12:16.0765 2568 NWADI - ok

09:12:16.0796 2568 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

09:12:16.0796 2568 NwlnkFlt - ok

09:12:16.0812 2568 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

09:12:16.0812 2568 NwlnkFwd - ok

09:12:16.0890 2568 OMCI (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS

09:12:16.0890 2568 OMCI - ok

09:12:16.0937 2568 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys

09:12:16.0937 2568 Parport - ok

09:12:16.0953 2568 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

09:12:16.0953 2568 PartMgr - ok

09:12:16.0984 2568 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

09:12:17.0000 2568 ParVdm - ok

09:12:17.0000 2568 PCASp50 - ok

09:12:17.0015 2568 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

09:12:17.0015 2568 PCI - ok

09:12:17.0015 2568 PCIDump - ok

09:12:17.0046 2568 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

09:12:17.0062 2568 PCIIde - ok

09:12:17.0078 2568 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

09:12:17.0078 2568 Pcmcia - ok

09:12:17.0093 2568 PDCOMP - ok

09:12:17.0093 2568 PDFRAME - ok

09:12:17.0109 2568 PDRELI - ok

09:12:17.0109 2568 PDRFRAME - ok

09:12:17.0125 2568 perc2 - ok

09:12:17.0125 2568 perc2hib - ok

09:12:17.0203 2568 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

09:12:17.0203 2568 PlugPlay - ok

09:12:17.0203 2568 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

09:12:17.0218 2568 PolicyAgent - ok

09:12:17.0265 2568 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

09:12:17.0265 2568 PptpMiniport - ok

09:12:17.0281 2568 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys

09:12:17.0296 2568 Processor - ok

09:12:17.0296 2568 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

09:12:17.0296 2568 ProtectedStorage - ok

09:12:17.0312 2568 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

09:12:17.0328 2568 PSched - ok

09:12:17.0375 2568 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

09:12:17.0375 2568 Ptilink - ok

09:12:17.0437 2568 pwd_2k (d8b90616a8bd53de281dbdb664c0984a) C:\WINDOWS\system32\drivers\pwd_2k.sys

09:12:17.0437 2568 pwd_2k - ok

09:12:17.0437 2568 ql1080 - ok

09:12:17.0453 2568 Ql10wnt - ok

09:12:17.0453 2568 ql12160 - ok

09:12:17.0468 2568 ql1240 - ok

09:12:17.0468 2568 ql1280 - ok

09:12:17.0484 2568 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

09:12:17.0484 2568 RasAcd - ok

09:12:17.0546 2568 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll

09:12:17.0546 2568 RasAuto - ok

09:12:17.0546 2568 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

09:12:17.0546 2568 Rasl2tp - ok

09:12:17.0609 2568 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll

09:12:17.0609 2568 RasMan - ok

09:12:17.0625 2568 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

09:12:17.0625 2568 RasPppoe - ok

09:12:17.0625 2568 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

09:12:17.0625 2568 Raspti - ok

09:12:17.0656 2568 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

09:12:17.0656 2568 Rdbss - ok

09:12:17.0703 2568 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

09:12:17.0703 2568 RDPCDD - ok

09:12:17.0750 2568 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys

09:12:17.0750 2568 RDPWD - ok

09:12:17.0781 2568 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe

09:12:17.0796 2568 RDSessMgr - ok

09:12:17.0843 2568 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

09:12:17.0843 2568 redbook - ok

09:12:17.0890 2568 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll

09:12:17.0937 2568 RemoteAccess - ok

09:12:17.0984 2568 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\WINDOWS\system32\DRIVERS\rimmptsk.sys

09:12:17.0984 2568 rimmptsk - ok

09:12:18.0015 2568 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe

09:12:18.0015 2568 RpcLocator - ok

09:12:18.0078 2568 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

09:12:18.0078 2568 RpcSs - ok

09:12:18.0140 2568 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe

09:12:18.0140 2568 RSVP - ok

09:12:18.0156 2568 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

09:12:18.0156 2568 SamSs - ok

09:12:18.0171 2568 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe

09:12:18.0171 2568 SCardSvr - ok

09:12:18.0187 2568 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll

09:12:18.0203 2568 Schedule - ok

09:12:18.0218 2568 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys

09:12:18.0234 2568 sdbus - ok

09:12:18.0265 2568 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

09:12:18.0265 2568 Secdrv - ok

09:12:18.0296 2568 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll

09:12:18.0296 2568 seclogon - ok

09:12:18.0312 2568 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll

09:12:18.0328 2568 SENS - ok

09:12:18.0343 2568 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys

09:12:18.0343 2568 Serial - ok

09:12:18.0406 2568 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

09:12:18.0406 2568 Sfloppy - ok

09:12:18.0484 2568 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll

09:12:18.0484 2568 SharedAccess - ok

09:12:18.0546 2568 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

09:12:18.0546 2568 ShellHWDetection - ok

09:12:18.0562 2568 Simbad - ok

09:12:18.0578 2568 Sparrow - ok

09:12:18.0640 2568 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

09:12:18.0640 2568 splitter - ok

09:12:18.0656 2568 Spooler - ok

09:12:18.0781 2568 sprtsvc_dellsupportcenter - ok

09:12:18.0812 2568 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

09:12:18.0828 2568 sr - ok

09:12:18.0984 2568 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll

09:12:19.0015 2568 srservice - ok

09:12:19.0093 2568 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

09:12:19.0093 2568 Srv - ok

09:12:19.0125 2568 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll

09:12:19.0125 2568 SSDPSRV - ok

09:12:19.0250 2568 STHDA (951801dfb54d86f611f0af47825476f9) C:\WINDOWS\system32\drivers\sthda.sys

09:12:19.0281 2568 STHDA - ok

09:12:19.0390 2568 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll

09:12:19.0406 2568 stisvc - ok

09:12:19.0515 2568 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

09:12:19.0531 2568 swenum - ok

09:12:19.0546 2568 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

09:12:19.0562 2568 swmidi - ok

09:12:19.0562 2568 SwPrv - ok

09:12:19.0578 2568 symc810 - ok

09:12:19.0593 2568 symc8xx - ok

09:12:19.0609 2568 sym_hi - ok

09:12:19.0625 2568 sym_u3 - ok

09:12:19.0687 2568 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

09:12:19.0687 2568 sysaudio - ok

09:12:19.0734 2568 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe

09:12:19.0734 2568 SysmonLog - ok

09:12:19.0781 2568 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll

09:12:19.0781 2568 TapiSrv - ok

09:12:19.0921 2568 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

09:12:19.0921 2568 Tcpip - ok

09:12:19.0984 2568 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

09:12:19.0984 2568 TDPIPE - ok

09:12:20.0015 2568 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

09:12:20.0015 2568 TDTCP - ok

09:12:20.0046 2568 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

09:12:20.0046 2568 TermDD - ok

09:12:20.0078 2568 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll

09:12:20.0078 2568 TermService - ok

09:12:20.0156 2568 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

09:12:20.0156 2568 Themes - ok

09:12:20.0156 2568 TosIde - ok

09:12:20.0250 2568 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll

09:12:20.0250 2568 TrkWks - ok

09:12:20.0328 2568 UdfReadr_xp (4e75005b74be901c30f2636df40b0c15) C:\WINDOWS\system32\drivers\UdfReadr_xp.sys

09:12:20.0343 2568 UdfReadr_xp - ok

09:12:20.0375 2568 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

09:12:20.0375 2568 Udfs - ok

09:12:20.0375 2568 ultra - ok

09:12:20.0468 2568 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

09:12:20.0468 2568 Update - ok

09:12:20.0531 2568 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll

09:12:20.0531 2568 upnphost - ok

09:12:20.0562 2568 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe

09:12:20.0562 2568 UPS - ok

09:12:20.0593 2568 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

09:12:20.0593 2568 usbehci - ok

09:12:20.0640 2568 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

09:12:20.0640 2568 usbhub - ok

09:12:20.0656 2568 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

09:12:20.0656 2568 usbohci - ok

09:12:20.0750 2568 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

09:12:20.0750 2568 USBSTOR - ok

09:12:20.0750 2568 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

09:12:20.0765 2568 VgaSave - ok

09:12:20.0765 2568 ViaIde - ok

09:12:20.0828 2568 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

09:12:20.0828 2568 VolSnap - ok

09:12:20.0859 2568 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe

09:12:20.0875 2568 VSS - ok

09:12:20.0921 2568 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll

09:12:20.0921 2568 W32Time - ok

09:12:21.0031 2568 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

09:12:21.0031 2568 Wanarp - ok

09:12:21.0046 2568 WDICA - ok

09:12:21.0093 2568 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

09:12:21.0109 2568 wdmaud - ok

09:12:21.0156 2568 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll

09:12:21.0171 2568 WebClient - ok

09:12:21.0250 2568 winachsf (a8596cf86d445269a42ecc08b7066a4c) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys

09:12:21.0265 2568 winachsf - ok

09:12:21.0437 2568 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll

09:12:21.0437 2568 winmgmt - ok

09:12:21.0453 2568 wltrysvc - ok

09:12:21.0515 2568 WmdmPmSN (c7e39ea41233e9f5b86c8da3a9f1e4a8) C:\WINDOWS\system32\mspmsnsv.dll

09:12:21.0515 2568 WmdmPmSN - ok

09:12:21.0562 2568 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys

09:12:21.0562 2568 WmiAcpi - ok

09:12:21.0593 2568 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe

09:12:21.0593 2568 WmiApSrv - ok

09:12:21.0656 2568 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll

09:12:21.0671 2568 wscsvc - ok

09:12:21.0687 2568 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll

09:12:21.0687 2568 wuauserv - ok

09:12:21.0765 2568 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll

09:12:21.0765 2568 WZCSVC - ok

09:12:21.0796 2568 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll

09:12:21.0812 2568 xmlprov - ok

09:12:21.0843 2568 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0

09:12:21.0875 2568 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected

09:12:21.0875 2568 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)

09:12:21.0875 2568 Boot (0x1200) (6dc708d0b5cb83508aa17ad797cca25a) \Device\Harddisk0\DR0\Partition0

09:12:21.0875 2568 \Device\Harddisk0\DR0\Partition0 - ok

09:12:21.0875 2568 ============================================================

09:12:21.0875 2568 Scan finished

09:12:21.0875 2568 ============================================================

09:12:21.0890 1816 Detected object count: 1

09:12:21.0890 1816 Actual detected object count: 1

09:12:34.0875 1816 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - skipped by user

09:12:34.0875 1816 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Skip

09:13:14.0750 3380 ============================================================

09:13:14.0750 3380 Scan started

09:13:14.0750 3380 Mode: Manual;

09:13:14.0750 3380 ============================================================

09:13:15.0000 3380 Abiosdsk - ok

09:13:15.0015 3380 abp480n5 - ok

09:13:15.0062 3380 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

09:13:15.0078 3380 ACPI - ok

09:13:15.0093 3380 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys

09:13:15.0093 3380 ACPIEC - ok

09:13:15.0171 3380 AdobeFlashPlayerUpdateSvc (f19c98ad81d2c0e1bbfd8153d2c80ee8) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

09:13:15.0171 3380 AdobeFlashPlayerUpdateSvc - ok

09:13:15.0171 3380 adpu160m - ok

09:13:15.0250 3380 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

09:13:15.0250 3380 aec - ok

09:13:15.0312 3380 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

09:13:15.0312 3380 AFD - ok

09:13:15.0312 3380 Aha154x - ok

09:13:15.0328 3380 aic78u2 - ok

09:13:15.0328 3380 aic78xx - ok

09:13:15.0390 3380 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll

09:13:15.0390 3380 Alerter - ok

09:13:15.0437 3380 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe

09:13:15.0437 3380 ALG - ok

09:13:15.0437 3380 AliIde - ok

09:13:15.0500 3380 AmdK8 (efbb0956baed786e137351b5ca272aef) C:\WINDOWS\system32\DRIVERS\AmdK8.sys

09:13:15.0500 3380 AmdK8 - ok

09:13:15.0515 3380 amsint - ok

09:13:15.0562 3380 APPDRV (ec94e05b76d033b74394e7b2175103cf) C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS

09:13:15.0562 3380 APPDRV - ok

09:13:15.0562 3380 AppMgmt - ok

09:13:15.0578 3380 asc - ok

09:13:15.0578 3380 asc3350p - ok

09:13:15.0593 3380 asc3550 - ok

09:13:15.0718 3380 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

09:13:15.0718 3380 aspnet_state - ok

09:13:15.0750 3380 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

09:13:15.0750 3380 AsyncMac - ok

09:13:15.0781 3380 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

09:13:15.0781 3380 atapi - ok

09:13:15.0796 3380 Atdisk - ok

09:13:15.0921 3380 Ati HotKey Poller (8bb6a2488a93259fddc18d040008c1a4) C:\WINDOWS\system32\Ati2evxx.exe

09:13:15.0921 3380 Ati HotKey Poller - ok

09:13:16.0078 3380 ati2mtag (e78b73eb84c257d0d940e041742d2699) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

09:13:16.0093 3380 ati2mtag - ok

09:13:16.0265 3380 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

09:13:16.0265 3380 Atmarpc - ok

09:13:16.0312 3380 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll

09:13:16.0312 3380 AudioSrv - ok

09:13:16.0375 3380 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

09:13:16.0375 3380 audstub - ok

09:13:16.0859 3380 AVGIDSAgent (ba60fd7a64b9759a14c0fba4a9ed4c7b) C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

09:13:16.0906 3380 AVGIDSAgent - ok

09:13:17.0046 3380 AVGIDSDriver (1074f787080068c71303b61fae7e7ca4) C:\WINDOWS\system32\DRIVERS\avgidsdriverx.sys

09:13:17.0046 3380 AVGIDSDriver - ok

09:13:17.0078 3380 AVGIDSFilter (61a7e0b02f82cff3db2445bbe50b3589) C:\WINDOWS\system32\DRIVERS\avgidsfilterx.sys

09:13:17.0078 3380 AVGIDSFilter - ok

09:13:17.0093 3380 AVGIDSHX (d63d83659eedf60b3a3e620281a888e5) C:\WINDOWS\system32\DRIVERS\avgidshx.sys

09:13:17.0093 3380 AVGIDSHX - ok

09:13:17.0109 3380 AVGIDSShim (baf975b72062f53d327788e99d64197e) C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys

09:13:17.0109 3380 AVGIDSShim - ok

09:13:17.0171 3380 Avgldx86 (dda6a2a18841e4c9172bb85958b8d948) C:\WINDOWS\system32\DRIVERS\avgldx86.sys

09:13:17.0171 3380 Avgldx86 - ok

09:13:17.0187 3380 Avgmfx86 (ccdd61545aaea265977e4b1efdc74e8c) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys

09:13:17.0187 3380 Avgmfx86 - ok

09:13:17.0234 3380 Avgrkx86 (1fd90b28d2c3100bf4500199c8ad6358) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys

09:13:17.0234 3380 Avgrkx86 - ok

09:13:17.0296 3380 Avgtdix (1263f2554ace925c237a40b4c568d815) C:\WINDOWS\system32\DRIVERS\avgtdix.sys

09:13:17.0312 3380 Avgtdix - ok

09:13:17.0484 3380 avgwd (ea1145debcd508fd25bd1e95c4346929) C:\Program Files\AVG\AVG2012\avgwdsvc.exe

09:13:17.0484 3380 avgwd - ok

09:13:17.0562 3380 BCM43XX (b89bcf0a25aeb3b47030ac83287f894a) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys

09:13:17.0578 3380 BCM43XX - ok

09:13:17.0625 3380 bcm4sbxp (cd4646067cc7dcba1907fa0acf7e3966) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys

09:13:17.0625 3380 bcm4sbxp - ok

09:13:17.0687 3380 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

09:13:17.0687 3380 Beep - ok

09:13:17.0750 3380 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll

09:13:17.0750 3380 BITS - ok

09:13:17.0812 3380 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll

09:13:17.0812 3380 Browser - ok

09:13:17.0859 3380 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

09:13:17.0859 3380 cbidf2k - ok

09:13:17.0875 3380 cd20xrnt - ok

09:13:17.0921 3380 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

09:13:17.0921 3380 Cdaudio - ok

09:13:17.0968 3380 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

09:13:17.0968 3380 Cdfs - ok

09:13:18.0015 3380 Cdr4_xp (297acc7d7c66ec86ee0b4eb5af9a8fd3) C:\WINDOWS\system32\drivers\Cdr4_xp.sys

09:13:18.0015 3380 Cdr4_xp - ok

09:13:18.0015 3380 Cdralw2k (5e31abf467a6fd857710c0927c88ee4c) C:\WINDOWS\system32\drivers\Cdralw2k.sys

09:13:18.0015 3380 Cdralw2k - ok

09:13:18.0031 3380 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

09:13:18.0031 3380 Cdrom - ok

09:13:18.0140 3380 cdudf_xp (cfd81f2140193fc7f1812e6d6eaf6795) C:\WINDOWS\system32\drivers\cdudf_xp.sys

09:13:18.0140 3380 cdudf_xp - ok

09:13:18.0187 3380 cercsr6 (84853b3fd012251690570e9e7e43343f) C:\WINDOWS\system32\drivers\cercsr6.sys

09:13:18.0187 3380 cercsr6 - ok

09:13:18.0187 3380 Changer - ok

09:13:18.0218 3380 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe

09:13:18.0218 3380 CiSvc - ok

09:13:18.0250 3380 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe

09:13:18.0250 3380 ClipSrv - ok

09:13:18.0406 3380 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

09:13:18.0406 3380 clr_optimization_v2.0.50727_32 - ok

09:13:18.0421 3380 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys

09:13:18.0421 3380 CmBatt - ok

09:13:18.0421 3380 CmdIde - ok

09:13:18.0437 3380 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys

09:13:18.0437 3380 Compbatt - ok

09:13:18.0453 3380 COMSysApp - ok

09:13:18.0468 3380 Cpqarray - ok

09:13:18.0515 3380 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll

09:13:18.0515 3380 CryptSvc - ok

09:13:18.0531 3380 dac2w2k - ok

09:13:18.0531 3380 dac960nt - ok

09:13:18.0609 3380 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

09:13:18.0609 3380 DcomLaunch - ok

09:13:18.0671 3380 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll

09:13:18.0687 3380 Dhcp - ok

09:13:18.0703 3380 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

09:13:18.0703 3380 Disk - ok

09:13:18.0703 3380 dmadmin - ok

09:13:18.0843 3380 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

09:13:18.0843 3380 dmboot - ok

09:13:18.0875 3380 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

09:13:18.0875 3380 dmio - ok

09:13:18.0906 3380 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

09:13:18.0906 3380 dmload - ok

09:13:18.0953 3380 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll

09:13:18.0953 3380 dmserver - ok

09:13:18.0984 3380 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

09:13:18.0984 3380 DMusic - ok

09:13:19.0046 3380 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll

09:13:19.0046 3380 Dnscache - ok

09:13:19.0093 3380 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll

09:13:19.0093 3380 Dot3svc - ok

09:13:19.0109 3380 dpti2o - ok

09:13:19.0156 3380 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

09:13:19.0156 3380 drmkaud - ok

09:13:19.0203 3380 dvd_2K (677829f7010768eeeed8d0083e510dab) C:\WINDOWS\system32\drivers\dvd_2K.sys

09:13:19.0203 3380 dvd_2K - ok

09:13:19.0218 3380 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll

09:13:19.0234 3380 EapHost - ok

09:13:19.0312 3380 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll

09:13:19.0312 3380 ERSvc - ok

09:13:19.0375 3380 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

09:13:19.0375 3380 Eventlog - ok

09:13:19.0437 3380 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll

09:13:19.0453 3380 EventSystem - ok

09:13:19.0468 3380 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

09:13:19.0468 3380 Fastfat - ok

09:13:19.0531 3380 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

09:13:19.0531 3380 FastUserSwitchingCompatibility - ok

09:13:19.0578 3380 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

09:13:19.0578 3380 Fdc - ok

09:13:19.0593 3380 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

09:13:19.0593 3380 Fips - ok

09:13:19.0609 3380 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

09:13:19.0609 3380 Flpydisk - ok

09:13:19.0671 3380 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

09:13:19.0671 3380 FltMgr - ok

09:13:19.0828 3380 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

09:13:19.0828 3380 FontCache3.0.0.0 - ok

09:13:19.0890 3380 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

09:13:19.0890 3380 Fs_Rec - ok

09:13:19.0921 3380 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

09:13:19.0921 3380 Ftdisk - ok

09:13:19.0968 3380 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

09:13:19.0968 3380 Gpc - ok

09:13:20.0000 3380 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

09:13:20.0000 3380 HDAudBus - ok

09:13:20.0062 3380 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

09:13:20.0062 3380 helpsvc - ok

09:13:20.0062 3380 HidServ - ok

09:13:20.0109 3380 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll

09:13:20.0125 3380 hkmsvc - ok

09:13:20.0125 3380 hpn - ok

09:13:20.0203 3380 HSFHWAZL (290cdbb05903742ea06b7203c5a662f5) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys

09:13:20.0203 3380 HSFHWAZL - ok

09:13:20.0265 3380 HSF_DPV (7ab812355f98858b9ecdd46e6fcc221f) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys

09:13:20.0281 3380 HSF_DPV - ok

09:13:20.0453 3380 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

09:13:20.0468 3380 HTTP - ok

09:13:20.0515 3380 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll

09:13:20.0515 3380 HTTPFilter - ok

09:13:20.0515 3380 i2omgmt - ok

09:13:20.0531 3380 i2omp - ok

09:13:20.0546 3380 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

09:13:20.0546 3380 i8042prt - ok

09:13:20.0781 3380 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

09:13:20.0796 3380 idsvc - ok

09:13:20.0828 3380 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

09:13:20.0828 3380 Imapi - ok

09:13:20.0890 3380 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe

09:13:20.0890 3380 ImapiService - ok

09:13:20.0906 3380 ini910u - ok

09:13:20.0921 3380 IntelIde - ok

09:13:20.0968 3380 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

09:13:20.0968 3380 Ip6Fw - ok

09:13:21.0000 3380 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

09:13:21.0000 3380 IpFilterDriver - ok

09:13:21.0015 3380 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

09:13:21.0015 3380 IpInIp - ok

09:13:21.0140 3380 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

09:13:21.0140 3380 IpNat - ok

09:13:21.0156 3380 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

09:13:21.0156 3380 IPSec - ok

09:13:21.0187 3380 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

09:13:21.0203 3380 IRENUM - ok

09:13:21.0234 3380 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

09:13:21.0234 3380 isapnp - ok

09:13:21.0437 3380 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe

09:13:21.0437 3380 JavaQuickStarterService - ok

09:13:21.0453 3380 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

09:13:21.0453 3380 Kbdclass - ok

09:13:21.0484 3380 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

09:13:21.0484 3380 kmixer - ok

09:13:21.0515 3380 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

09:13:21.0515 3380 KSecDD - ok

09:13:21.0562 3380 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll

09:13:21.0562 3380 lanmanserver - ok

09:13:21.0593 3380 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll

09:13:21.0593 3380 lanmanworkstation - ok

09:13:21.0593 3380 lbrtfdc - ok

09:13:21.0656 3380 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll

09:13:21.0656 3380 LmHosts - ok

09:13:21.0718 3380 MBAMProtector (6dfe7f2e8e8a337263aa5c92a215f161) C:\WINDOWS\system32\drivers\mbam.sys

09:13:21.0718 3380 MBAMProtector - ok

09:13:21.0796 3380 MBAMService (43683e970f008c93c9429ef428147a54) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

09:13:21.0796 3380 MBAMService - ok

09:13:21.0828 3380 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

09:13:21.0828 3380 mdmxsdk - ok

09:13:21.0859 3380 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll

09:13:21.0859 3380 Messenger - ok

09:13:21.0906 3380 mmc_2K (9b90303a9c9405a6ce1466ff4aa20fdd) C:\WINDOWS\system32\drivers\mmc_2K.sys

09:13:21.0906 3380 mmc_2K - ok

09:13:21.0953 3380 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

09:13:21.0953 3380 mnmdd - ok

09:13:22.0015 3380 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe

09:13:22.0015 3380 mnmsrvc - ok

09:13:22.0078 3380 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

09:13:22.0078 3380 Modem - ok

09:13:22.0078 3380 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

09:13:22.0078 3380 Mouclass - ok

09:13:22.0093 3380 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

09:13:22.0109 3380 MountMgr - ok

09:13:22.0109 3380 mraid35x - ok

09:13:22.0140 3380 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

09:13:22.0140 3380 MRxDAV - ok

09:13:22.0265 3380 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

09:13:22.0281 3380 MRxSmb - ok

09:13:22.0281 3380 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe

09:13:22.0281 3380 MSDTC - ok

09:13:22.0296 3380 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

09:13:22.0296 3380 Msfs - ok

09:13:22.0296 3380 MSIServer - ok

09:13:22.0328 3380 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

09:13:22.0328 3380 MSKSSRV - ok

09:13:22.0359 3380 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

09:13:22.0359 3380 MSPCLOCK - ok

09:13:22.0375 3380 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

09:13:22.0375 3380 MSPQM - ok

09:13:22.0406 3380 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

09:13:22.0406 3380 mssmbios - ok

09:13:22.0468 3380 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

09:13:22.0468 3380 Mup - ok

09:13:22.0515 3380 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll

09:13:22.0515 3380 napagent - ok

09:13:22.0578 3380 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

09:13:22.0578 3380 NDIS - ok

09:13:22.0625 3380 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

09:13:22.0625 3380 NdisTapi - ok

09:13:22.0640 3380 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

09:13:22.0640 3380 Ndisuio - ok

09:13:22.0656 3380 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

09:13:22.0656 3380 NdisWan - ok

09:13:22.0687 3380 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

09:13:22.0687 3380 NDProxy - ok

09:13:22.0718 3380 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

09:13:22.0718 3380 NetBIOS - ok

09:13:22.0734 3380 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

09:13:22.0750 3380 NetBT - ok

09:13:22.0796 3380 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

09:13:22.0796 3380 NetDDE - ok

09:13:22.0796 3380 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

09:13:22.0812 3380 NetDDEdsdm - ok

09:13:22.0859 3380 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

09:13:22.0859 3380 Netlogon - ok

09:13:22.0953 3380 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll

09:13:22.0953 3380 Netman - ok

09:13:23.0140 3380 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

09:13:23.0140 3380 NetTcpPortSharing - ok

09:13:23.0203 3380 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll

09:13:23.0203 3380 Nla - ok

09:13:23.0265 3380 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

09:13:23.0265 3380 Npfs - ok

09:13:23.0296 3380 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

09:13:23.0296 3380 Ntfs - ok

09:13:23.0312 3380 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

09:13:23.0312 3380 NtLmSsp - ok

09:13:23.0437 3380 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll

09:13:23.0437 3380 NtmsSvc - ok

09:13:23.0484 3380 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

09:13:23.0484 3380 Null - ok

09:13:23.0546 3380 NWADI (091a1284aa583288b64dcd370d1b421e) C:\WINDOWS\system32\DRIVERS\NWADIenum.sys

09:13:23.0546 3380 NWADI - ok

09:13:23.0578 3380 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

09:13:23.0578 3380 NwlnkFlt - ok

09:13:23.0593 3380 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

09:13:23.0593 3380 NwlnkFwd - ok

09:13:23.0640 3380 OMCI (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS

09:13:23.0640 3380 OMCI - ok

09:13:23.0703 3380 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys

09:13:23.0703 3380 Parport - ok

09:13:23.0718 3380 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

09:13:23.0718 3380 PartMgr - ok

09:13:23.0750 3380 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

09:13:23.0750 3380 ParVdm - ok

09:13:23.0765 3380 PCASp50 - ok

09:13:23.0765 3380 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

09:13:23.0765 3380 PCI - ok

09:13:23.0781 3380 PCIDump - ok

09:13:23.0796 3380 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

09:13:23.0796 3380 PCIIde - ok

09:13:23.0843 3380 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

09:13:23.0859 3380 Pcmcia - ok

09:13:23.0859 3380 PDCOMP - ok

09:13:23.0859 3380 PDFRAME - ok

09:13:23.0875 3380 PDRELI - ok

09:13:23.0875 3380 PDRFRAME - ok

09:13:23.0890 3380 perc2 - ok

09:13:23.0906 3380 perc2hib - ok

09:13:23.0968 3380 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

09:13:23.0968 3380 PlugPlay - ok

09:13:23.0968 3380 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

09:13:23.0968 3380 PolicyAgent - ok

09:13:23.0984 3380 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

09:13:23.0984 3380 PptpMiniport - ok

09:13:24.0000 3380 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys

09:13:24.0000 3380 Processor - ok

09:13:24.0015 3380 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

09:13:24.0015 3380 ProtectedStorage - ok

09:13:24.0109 3380 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

09:13:24.0109 3380 PSched - ok

09:13:24.0156 3380 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

09:13:24.0156 3380 Ptilink - ok

09:13:24.0218 3380 pwd_2k (d8b90616a8bd53de281dbdb664c0984a) C:\WINDOWS\system32\drivers\pwd_2k.sys

09:13:24.0218 3380 pwd_2k - ok

09:13:24.0218 3380 ql1080 - ok

09:13:24.0234 3380 Ql10wnt - ok

09:13:24.0234 3380 ql12160 - ok

09:13:24.0250 3380 ql1240 - ok

09:13:24.0250 3380 ql1280 - ok

09:13:24.0265 3380 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

09:13:24.0265 3380 RasAcd - ok

09:13:24.0312 3380 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll

09:13:24.0312 3380 RasAuto - ok

09:13:24.0328 3380 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

09:13:24.0328 3380 Rasl2tp - ok

09:13:24.0453 3380 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll

09:13:24.0453 3380 RasMan - ok

09:13:24.0453 3380 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

09:13:24.0468 3380 RasPppoe - ok

09:13:24.0468 3380 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

09:13:24.0468 3380 Raspti - ok

09:13:24.0500 3380 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

09:13:24.0500 3380 Rdbss - ok

09:13:24.0515 3380 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

09:13:24.0515 3380 RDPCDD - ok

09:13:24.0578 3380 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys

09:13:24.0578 3380 RDPWD - ok

09:13:24.0609 3380 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe

09:13:24.0609 3380 RDSessMgr - ok

09:13:24.0875 3380 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

09:13:24.0875 3380 redbook - ok

09:13:24.0906 3380 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll

09:13:24.0906 3380 RemoteAccess - ok

09:13:24.0968 3380 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\WINDOWS\system32\DRIVERS\rimmptsk.sys

09:13:24.0968 3380 rimmptsk - ok

09:13:25.0000 3380 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe

09:13:25.0000 3380 RpcLocator - ok

09:13:25.0062 3380 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

09:13:25.0062 3380 RpcSs - ok

09:13:25.0250 3380 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe

09:13:25.0250 3380 RSVP - ok

09:13:25.0265 3380 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

09:13:25.0265 3380 SamSs - ok

09:13:25.0296 3380 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe

09:13:25.0296 3380 SCardSvr - ok

09:13:25.0328 3380 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll

09:13:25.0343 3380 Schedule - ok

09:13:25.0359 3380 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys

09:13:25.0359 3380 sdbus - ok

09:13:25.0406 3380 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

09:13:25.0406 3380 Secdrv - ok

09:13:25.0468 3380 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll

09:13:25.0468 3380 seclogon - ok

09:13:25.0500 3380 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll

09:13:25.0500 3380 SENS - ok

09:13:25.0531 3380 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys

09:13:25.0531 3380 Serial - ok

09:13:25.0562 3380 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

09:13:25.0562 3380 Sfloppy - ok

09:13:25.0625 3380 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll

09:13:25.0640 3380 SharedAccess - ok

09:13:25.0796 3380 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

09:13:25.0796 3380 ShellHWDetection - ok

09:13:25.0796 3380 Simbad - ok

09:13:25.0812 3380 Sparrow - ok

09:13:25.0843 3380 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

09:13:25.0843 3380 splitter - ok

09:13:25.0843 3380 Spooler - ok

09:13:25.0984 3380 sprtsvc_dellsupportcenter - ok

09:13:26.0015 3380 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

09:13:26.0015 3380 sr - ok

09:13:26.0093 3380 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll

09:13:26.0093 3380 srservice - ok

09:13:26.0171 3380 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

09:13:26.0171 3380 Srv - ok

09:13:26.0203 3380 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll

09:13:26.0203 3380 SSDPSRV - ok

09:13:26.0375 3380 STHDA (951801dfb54d86f611f0af47825476f9) C:\WINDOWS\system32\drivers\sthda.sys

09:13:26.0390 3380 STHDA - ok

09:13:26.0515 3380 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll

09:13:26.0531 3380 stisvc - ok

09:13:26.0625 3380 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

09:13:26.0625 3380 swenum - ok

09:13:26.0656 3380 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

09:13:26.0656 3380 swmidi - ok

09:13:26.0656 3380 SwPrv - ok

09:13:26.0671 3380 symc810 - ok

09:13:26.0671 3380 symc8xx - ok

09:13:26.0687 3380 sym_hi - ok

09:13:26.0687 3380 sym_u3 - ok

09:13:26.0703 3380 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

09:13:26.0703 3380 sysaudio - ok

09:13:26.0765 3380 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe

09:13:26.0765 3380 SysmonLog - ok

09:13:26.0812 3380 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll

09:13:26.0812 3380 TapiSrv - ok

09:13:26.0890 3380 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

09:13:26.0890 3380 Tcpip - ok

09:13:26.0937 3380 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

09:13:26.0937 3380 TDPIPE - ok

09:13:26.0953 3380 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

09:13:26.0953 3380 TDTCP - ok

09:13:26.0984 3380 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

09:13:26.0984 3380 TermDD - ok

09:13:27.0015 3380 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll

09:13:27.0015 3380 TermService - ok

09:13:27.0218 3380 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

09:13:27.0218 3380 Themes - ok

09:13:27.0218 3380 TosIde - ok

09:13:27.0328 3380 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll

09:13:27.0328 3380 TrkWks - ok

09:13:27.0484 3380 UdfReadr_xp (4e75005b74be901c30f2636df40b0c15) C:\WINDOWS\system32\drivers\UdfReadr_xp.sys

09:13:27.0484 3380 UdfReadr_xp - ok

09:13:27.0515 3380 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

09:13:27.0515 3380 Udfs - ok

09:13:27.0531 3380 ultra - ok

09:13:27.0625 3380 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

09:13:27.0625 3380 Update - ok

09:13:27.0671 3380 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll

09:13:27.0671 3380 upnphost - ok

09:13:27.0687 3380 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe

09:13:27.0687 3380 UPS - ok

09:13:27.0734 3380 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

09:13:27.0734 3380 usbehci - ok

09:13:27.0843 3380 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

09:13:27.0843 3380 usbhub - ok

09:13:27.0906 3380 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

09:13:27.0906 3380 usbohci - ok

09:13:27.0968 3380 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

09:13:27.0968 3380 USBSTOR - ok

09:13:27.0968 3380 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

09:13:27.0968 3380 VgaSave - ok

09:13:27.0984 3380 ViaIde - ok

09:13:28.0046 3380 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

09:13:28.0046 3380 VolSnap - ok

09:13:28.0109 3380 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe

09:13:28.0109 3380 VSS - ok

09:13:28.0265 3380 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll

09:13:28.0265 3380 W32Time - ok

09:13:28.0312 3380 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

09:13:28.0312 3380 Wanarp - ok

09:13:28.0312 3380 WDICA - ok

09:13:28.0390 3380 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

09:13:28.0390 3380 wdmaud - ok

09:13:28.0406 3380 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll

09:13:28.0421 3380 WebClient - ok

09:13:28.0546 3380 winachsf (a8596cf86d445269a42ecc08b7066a4c) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys

09:13:28.0546 3380 winachsf - ok

09:13:28.0765 3380 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll

09:13:28.0765 3380 winmgmt - ok

09:13:28.0781 3380 wltrysvc - ok

09:13:28.0843 3380 WmdmPmSN (c7e39ea41233e9f5b86c8da3a9f1e4a8) C:\WINDOWS\system32\mspmsnsv.dll

09:13:28.0843 3380 WmdmPmSN - ok

09:13:28.0890 3380 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys

09:13:28.0890 3380 WmiAcpi - ok

09:13:28.0921 3380 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe

09:13:28.0921 3380 WmiApSrv - ok

09:13:29.0125 3380 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll

09:13:29.0125 3380 wscsvc - ok

09:13:29.0156 3380 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll

09:13:29.0156 3380 wuauserv - ok

09:13:29.0234 3380 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll

09:13:29.0250 3380 WZCSVC - ok

09:13:29.0281 3380 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll

09:13:29.0296 3380 xmlprov - ok

09:13:29.0328 3380 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0

09:13:29.0359 3380 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected

09:13:29.0359 3380 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)

09:13:29.0375 3380 Boot (0x1200) (6dc708d0b5cb83508aa17ad797cca25a) \Device\Harddisk0\DR0\Partition0

09:13:29.0375 3380 \Device\Harddisk0\DR0\Partition0 - ok

09:13:29.0375 3380 ============================================================

09:13:29.0375 3380 Scan finished

09:13:29.0375 3380 ============================================================

09:13:29.0390 0992 Detected object count: 1

09:13:29.0390 0992 Actual detected object count: 1

09:17:35.0703 0992 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - skipped by user

09:17:35.0703 0992 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Skip

Link to post
Share on other sites

Execute TDSSKiller.exe and press Start Scan.

  • Ensure Cure is selected ( it should be by default )
    Note: If Cure is not an option, Skip instead, do not choose Delete unless instructed
  • Click Continue then click Reboot now.

Once complete, a log will be produced at the root drive which is typically C:\

For example, C:\TDSSKiller.2.4.0.0_24.07.2010_13.10.52_log.txt.

Please post the contents of that log in your next reply.

Download ComboFix from this location:

Link 1

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to this topic How to disable your security applications

====================================================

Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RC_update.png

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

cfRC_screen_2.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

Link to post
Share on other sites

Larussa, you are awesome! :wub:

I just did the tdsskiller thing, and I have no idea how to get to the c:\ text so I went back into the program and found this report. Is this what you need? I know I have to do something similar for combofix, so I want to make sure I'm doing it right.

11:27:15.0421 3436 TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32

11:27:16.0453 3436 ============================================================

11:27:16.0453 3436 Current date / time: 2012/08/12 11:27:16.0453

11:27:16.0453 3436 SystemInfo:

11:27:16.0453 3436

11:27:16.0453 3436 OS Version: 5.1.2600 ServicePack: 3.0

11:27:16.0453 3436 Product type: Workstation

11:27:16.0453 3436 ComputerName: PATTI-A333147A3

11:27:16.0453 3436 UserName: Patti Chase

11:27:16.0453 3436 Windows directory: C:\WINDOWS

11:27:16.0453 3436 System windows directory: C:\WINDOWS

11:27:16.0453 3436 Processor architecture: Intel x86

11:27:16.0453 3436 Number of processors: 2

11:27:16.0453 3436 Page size: 0x1000

11:27:16.0453 3436 Boot type: Normal boot

11:27:16.0453 3436 ============================================================

11:27:18.0515 3436 Drive \Device\Harddisk0\DR0 - Size: 0xDF8F90000 (55.89 Gb), SectorSize: 0x200, Cylinders: 0x1C80, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

11:27:18.0515 3436 ============================================================

11:27:18.0515 3436 \Device\Harddisk0\DR0:

11:27:18.0515 3436 MBR partitions:

11:27:18.0515 3436 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x6FC3D80

11:27:18.0515 3436 ============================================================

11:27:18.0531 3436 C: <-> \Device\Harddisk0\DR0\Partition0

11:27:18.0531 3436 ============================================================

11:27:18.0531 3436 Initialize success

11:27:18.0531 3436 ============================================================

Thank you!

Link to post
Share on other sites

You are welcome.

Isn't there a .txt file on your C: Drive ( Computer --> doubleclick on C: ) like this ? TDSSKiller.2.4.0.0_24.07.2010_13.10.52_log.txt.

If yes, please post this one.

If not, move on with Combofix.

Link to post
Share on other sites

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.