Jump to content

Need help fixing computer after multiple attacks

Inkwax

By Inkwax
in Resolved Malware Removal Logs

 Share

Recommended Posts

Inkwax

Inkwax

Posted
Posted

I am trying to fix my Aunt's computer but they certainly buggered it up this time. They handed the computer to me a few days ago and nothing seems to be working for me, so I thought I'd try here.

It appears from MBAM logs that in the end of Oct/Beginning of Nov they had multiple attacks.

Trojan.Agent.MRGGEN

Trojan.Happili

Trojan.0Access

Trojan.Ransom.Gen

Trojan.Delf

Trojan.Dropper.BCMiner

Rootkit.0Access

Spyware.Passwords

PUP.Funmoods (more of an annoyance I know, but full disclosure is best)

I have no idea what they attempted to do before handing the computer to me.

Here are the logs you requested from DDS.

Thanks in advance for any help you guys can provide.

DDS.txt

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18702

Run by Jolly Household at 16:28:11 on 2012-11-29

.

============== Running Processes ================

.

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\HP\KBD\KBD.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Documents and Settings\Jolly Household\Local Settings\Application Data\Google\Update\1.3.21.123\GoogleCrashHandler.exe

C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\WINDOWS\system32\SearchFilterHost.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k rpcss

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\System32\svchost.exe -k netsvcs

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.comcast.net/

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>

BHO: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - <orphaned>

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.7529.1424\swg.dll

BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - <orphaned>

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - <orphaned>

BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [Google Update] "c:\documents and settings\jolly household\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [HP Photosmart 6510 series (NET)] "c:\program files\hp\hp photosmart 6510 series\bin\ScanToPCActivationApp.exe" -deviceID "CN1A7411H305QB:NW" -scfn "HP Photosmart 6510 series (NET)" -AutoStart 1

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [KBD] c:\hp\kbd\KBD.EXE

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

uPolicies-Explorer: NoDriveTypeAutoRun = dword:323

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

LSP: mswsock.dll

.

INFO: HKLM has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1353863602656

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1327016373125

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://www.gamehouse.com/games/zuma/popcaploader.cab

TCP: NameServer = 192.168.0.1

TCP: Interfaces\{770D3A4B-D751-4560-9975-108D24CCFB9F} : DHCPNameServer = 192.168.0.1

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

.

============= SERVICES / DRIVERS ===============

.

R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86

R? fsssvc;Windows Live Family Safety Service

R? GALKNJKE;GALKNJKE

R? HVGAA;HVGAA

R? RDFYUATO;RDFYUATO

R? WinRM;Windows Remote Management (WS-Management)

R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0

S? AntiVirSchedulerService;Avira Scheduler

S? AntiVirService;Avira Real-Time Protection

S? avgntflt;avgntflt

S? avkmgr;avkmgr

S? fssfltr;fssfltr

.

=============== Created Last 30 ================

.

2012-11-28 22:03:40 -------- d-sha-r- C:\cmdcons

2012-11-27 00:35:03 -------- d-----w- c:\windows\system32\NtmsData

2012-11-26 20:38:00 -------- d-----w- c:\documents and settings\jolly household\application data\Avira

2012-11-26 20:37:10 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys

2012-11-26 20:37:09 83432 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2012-11-26 20:37:08 -------- d-----w- c:\program files\Avira

2012-11-26 20:37:08 -------- d-----w- c:\documents and settings\all users\application data\Avira

2012-11-26 19:23:19 -------- d-----w- c:\documents and settings\jolly household\local settings\application data\PCHealth

2012-11-19 22:29:50 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-11-19 22:29:50 477168 ----a-w- c:\windows\system32\npdeployJava1.dll

.

==================== Find3M ====================

.

2012-11-26 19:40:04 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-11-26 19:40:04 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-11-19 22:28:42 473072 ----a-w- c:\windows\system32\deployJava1.dll

2012-09-29 23:54:26 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-02 22:33:42 33958 ----a-w- c:\documents and settings\all users\application data\uninstaller.exe

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: WDC_WD2500JS-60NCB1 rev.10.02E02 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x88DBC4B1]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x88dc393c]; MOV EAX, [0x88dc3ab0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\Harddisk0\DR0[0x89CB0AB8]

3 CLASSPNP[0xBA108FD7] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\0000006c[0x89CDBE98]

5 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> [0x89CDA940]

\Driver\atapi[0x88E468F0] -> IRP_MJ_CREATE -> 0x88DBC4B1

error: Read A device attached to the system is not functioning.

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x88DBC2E2

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 16:29:41.51 ===============

Attach.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 1/14/2012 7:17:19 PM

System Uptime: 11/29/2012 3:27:55 PM (1 hours ago)

.

Motherboard: ASUSTek Computer INC. | | NODUSM

Processor: AMD Athlon 64 X2 Dual Core Processor 4200+ | Socket AM2 | 2204/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 233 GiB total, 134.809 GiB free.

D: is CDROM ()

E: is Removable

F: is Removable

G: is Removable

H: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description:

Device ID: ACPI\AWY0001\2&DABA3FF&0

Manufacturer:

Name:

PNP Device ID: ACPI\AWY0001\2&DABA3FF&0

Service:

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

2570

2570_Help

2570Trb

Adobe Flash Player 11 ActiveX

Adobe Reader X (10.1.4)

AiO_Scan_CDA

AiOSoftwareNPI

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ASPCA Reminder by We-Care.com v4.1.18.1

Avira Free Antivirus

Bing Rewards Client Installer

Bonjour

BufferChm

Coupon Printer for Windows

CP_CalendarTemplates1

cp_OnlineProjectsConfig

CP_Package_Basic1

CP_Panorama1Config

cp_PosterPrintConfig

CueTour

CustomerResearchQFolder

Data Fax SoftModem with SmartCP

Destinations

DeviceManagementQFolder

DocProc

DocProcQFolder

DocumentViewer

DocumentViewerQFolder

Enhanced Multimedia Keyboard Solution

eSupportQFolder

Fax_CDA

FrostWire 5.2.11

FullDPAppQFolder

Google Chrome

Google Toolbar for Internet Explorer

Google Update Helper

Hewlett-Packard ACLM.NET v1.1.0.0

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB915800-v4)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB954708)

Hotfix for Windows XP (KB961118)

HP Customer Participation Program 7.0

HP Document Viewer 7.0

HP Imaging Device Functions 7.0

HP Photo Creations

HP Photosmart 6510 series Basic Device Software

HP Photosmart 6510 series Help

HP Photosmart 6510 series Product Improvement Study

HP Photosmart Premier Software 6.5

HP Photosmart, Officejet and Deskjet 7.0.A

HP Product Assistant

HP Product Detection

HP Solution Center 7.0

HP Update

HPPhotoSmartExpress

HPProductAssistant

InstantShareAlert

InstantShareDevices

InstantShareDevicesMFC

iTunes

Java Auto Updater

Java 6 Update 37

Junk Mail filter update

Malwarebytes Anti-Malware version 1.65.1.1000

MarketResearch

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2656353)

Microsoft .NET Framework 1.1 Security Update (KB2656370)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Base Smart Card Cryptographic Service Provider Package

Microsoft Choice Guard

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Default Manager

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Live Add-in 1.5

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook Connector

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft Software Update for Web Folders (English) 12

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Sync Framework Runtime Native v1.0 (x86)

Microsoft Sync Framework Services Native v1.0 (x86)

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

NewCopy_CDA

NVIDIA Drivers

OCR Software by I.R.I.S 7.0

PanoStandAlone

PhotoGallery

ProductContextNPI

QuickTime

RandMap

Readme

RealNetworks - Microsoft Visual C++ 2008 Runtime

RealPlayer

Realtek High Definition Audio Driver

RealUpgrade 1.1

Scan

ScannerCopy

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2618444)

Security Update for Windows Internet Explorer 8 (KB2647516)

Security Update for Windows Internet Explorer 8 (KB2675157)

Security Update for Windows Internet Explorer 8 (KB2699988)

Security Update for Windows Internet Explorer 8 (KB2722913)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows Search 4 - KB963093

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2510581)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2544521)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618444)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2655992)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB2676562)

Security Update for Windows XP (KB2685939)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2691442)

Security Update for Windows XP (KB2695962)

Security Update for Windows XP (KB2698365)

Security Update for Windows XP (KB2705219)

Security Update for Windows XP (KB2707511)

Security Update for Windows XP (KB2709162)

Security Update for Windows XP (KB2712808)

Security Update for Windows XP (KB2718523)

Security Update for Windows XP (KB2719985)

Security Update for Windows XP (KB2723135)

Security Update for Windows XP (KB2731847)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923789)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982665)

Segoe UI

SkinsHP1

SlideShow

SolutionCenter

Sonic_PrimoSDK

Spybot - Search & Destroy

Status

Toolbox

TrayApp

Unload

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Infopath 2007 Help (KB963662)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687400) 32-Bit Edition

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Update for Windows Internet Explorer 8 (KB2598845)

Update for Windows Internet Explorer 8 (KB2632503)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2492386)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2641690)

Update for Windows XP (KB2718704)

Update for Windows XP (KB898461)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB961503)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

VLC media player 2.0.0

WebFldrs XP

WebReg

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 8

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Family Safety

Windows Live Mail

Windows Live Messenger

Windows Live Photo Gallery

Windows Live Sign-in Assistant

Windows Live Sync

Windows Live Upload Tool

Windows Live Writer

Windows Management Framework Core

Windows Media Format 11 runtime

Windows Media Player 11

Windows Search 4.0

Windows XP Service Pack 3

Yontoo 1.10.02

Zuma Deluxe

.

==== End Of File ===========================

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable (.exe) every time you run them

with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

---------

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

**WARNING**Unfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.

Unfortunately I have found what is known as the ZeroAccess rootkit on your system. It is an especially nasty infection that can take quite some time to clean as well as may have damaged your system files itself. As a warning, during the cleaning (if you choose to do so) you may lose internet access with this computer and in the end we may need to reinstall the operating system anyway depending on the extent of the infection.

If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help. :)

----------

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RCUpdate1.png

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC2-1.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

4. If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.

----------

Link to post
Share on other sites
Inkwax

Inkwax

Posted
  • Author
Posted

I ran Combofix as you requested. I ended up running it twice. The first time I ran it, when it was finished it restarted the computer and I was unable to save the log file.

So the text I am attaching is from the second time I ran it after the restart.

ComboFix 12-11-29.02 - Jolly Household 11/29/2012 22:14:06.3.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1411 [GMT -5:00]

Running from: c:\documents and settings\Jolly Household\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

.

((((((((((((((((((((((((( Files Created from 2012-10-28 to 2012-11-30 )))))))))))))))))))))))))))))))

.

.

2012-11-27 00:35 . 2012-11-28 20:40 -------- d-----w- c:\windows\system32\NtmsData

2012-11-26 20:38 . 2012-11-26 20:38 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\Avira

2012-11-26 20:37 . 2012-11-17 01:17 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys

2012-11-26 20:37 . 2012-11-17 01:17 133824 ----a-w- c:\windows\system32\drivers\avipbb.sys

2012-11-26 20:37 . 2012-11-17 01:17 83432 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2012-11-26 20:37 . 2012-11-26 20:37 -------- d-----w- c:\program files\Avira

2012-11-26 20:37 . 2012-11-26 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2012-11-26 19:23 . 2012-11-26 19:23 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\PCHealth

2012-11-19 22:30 . 2012-11-19 22:30 -------- d-----w- c:\program files\Common Files\Java

2012-11-19 22:29 . 2012-11-19 22:28 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-11-19 22:29 . 2012-11-19 22:28 477168 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-11-19 22:27 . 2012-11-19 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2012-11-18 23:03 . 2012-11-18 23:03 -------- d-----w- c:\documents and settings\Administrator

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-26 19:40 . 2012-04-08 13:24 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-11-26 19:40 . 2012-01-24 23:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-11-19 22:28 . 2012-01-25 23:55 473072 ----a-w- c:\windows\system32\deployJava1.dll

2012-09-29 23:54 . 2012-01-15 01:12 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HP Photosmart 6510 series (NET)"="c:\program files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe" [2011-05-25 1801064]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-27 39408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360]

"nwiz"="nwiz.exe" [2006-05-10 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016]

"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]

"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-19 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-11-16 384800]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\FrostWire 5\\FrostWire.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

.

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [11/26/2012 3:37 PM 36552]

R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/26/2012 3:37 PM 85280]

S4 GALKNJKE;GALKNJKE;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\GALKNJKE.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\GALKNJKE.exe [?]

S4 HVGAA;HVGAA;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\HVGAA.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\HVGAA.exe [?]

S4 RDFYUATO;RDFYUATO;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\RDFYUATO.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\RDFYUATO.exe [?]

.

Contents of the 'Scheduled Tasks' folder

.

2012-11-29 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 19:40]

.

2012-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]

.

2012-11-27 c:\windows\Tasks\At1.job

- c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13]

.

2012-11-27 c:\windows\Tasks\At2.job

- c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13]

.

2012-11-27 c:\windows\Tasks\At3.job

- c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13]

.

2012-11-27 c:\windows\Tasks\At4.job

- c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13]

.

2012-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21]

.

2012-11-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21]

.

2012-11-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003Core.job

- c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47]

.

2012-11-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003UA.job

- c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47]

.

2012-11-30 c:\windows\Tasks\HP Photo Creations Messager.job

- c:\documents and settings\All Users\Application Data\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]

.

2012-11-30 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-651377827-725345543-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]

.

2012-11-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-651377827-725345543-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.comcast.net/

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-11-29 22:32

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: WDC_WD2500JS-60NCB1 rev.10.02E02 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5

.

device: opened successfully

user: MBR read successfully

error: Read A device attached to the system is not functioning.

kernel: MBR read successfully

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x88D212E2

user & kernel MBR OK

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@DACL=(02 0010)

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

@DACL=(02 0010)

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@DACL=(02 0010)

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@DACL=(02 0010)

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(736)

c:\windows\system32\WININET.dll

.

- - - - - - - > 'lsass.exe'(796)

c:\windows\system32\WININET.dll

.

Completion time: 2012-11-29 22:38:36

ComboFix-quarantined-files.txt 2012-11-30 03:38

.

Pre-Run: 144,344,576,000 bytes free

Post-Run: 147,267,661,824 bytes free

.

- - End Of File - - 772440A33E5ECD6A552C371C33A6165E

Link to post
Share on other sites
Inkwax

Inkwax

Posted
  • Author
Posted

Also, I forgot to mention, when running Combofix, it was complaining that AVG Free 2012 was still running in the background except that AVG Free 2012 is not installed on this computer any longer. Avira is installed, that's what it came to with although I do know that at one point AVG was installed.

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

Thanks for letting me know....

Please download TDSSKiller

  • Double click TDSSKiller.exe
  • Press Start Scan
  • Do Not Attempt To Fix Anything Now. We just need to look over the report and be sure we are removing the correct
    items.
  • Attach the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)

----------

Link to post
Share on other sites
Inkwax

Inkwax

Posted
  • Author
Posted

Here is the report for which you requested.

13:51:08.0703 3516 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

13:51:09.0000 3516 ============================================================

13:51:09.0000 3516 Current date / time: 2012/11/30 13:51:09.0000

13:51:09.0000 3516 SystemInfo:

13:51:09.0000 3516

13:51:09.0000 3516 OS Version: 5.1.2600 ServicePack: 3.0

13:51:09.0000 3516 Product type: Workstation

13:51:09.0000 3516 ComputerName: JOLLY-DESKTOP

13:51:09.0000 3516 UserName: Jolly Household

13:51:09.0000 3516 Windows directory: C:\WINDOWS

13:51:09.0000 3516 System windows directory: C:\WINDOWS

13:51:09.0000 3516 Processor architecture: Intel x86

13:51:09.0000 3516 Number of processors: 2

13:51:09.0000 3516 Page size: 0x1000

13:51:09.0000 3516 Boot type: Normal boot

13:51:09.0000 3516 ============================================================

13:51:10.0343 3516 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x7E2D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054

13:51:10.0359 3516 ============================================================

13:51:10.0359 3516 \Device\Harddisk0\DR0:

13:51:10.0359 3516 MBR partitions:

13:51:10.0359 3516 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1D1C0681

13:51:10.0359 3516 ============================================================

13:51:10.0406 3516 C: <-> \Device\Harddisk0\DR0\Partition1

13:51:10.0406 3516 ============================================================

13:51:10.0406 3516 Initialize success

13:51:10.0406 3516 ============================================================

13:51:21.0265 2336 ============================================================

13:51:21.0265 2336 Scan started

13:51:21.0265 2336 Mode: Manual;

13:51:21.0265 2336 ============================================================

13:51:21.0828 2336 ================ Scan system memory ========================

13:51:21.0828 2336 System memory - ok

13:51:21.0828 2336 ================ Scan services =============================

13:51:21.0921 2336 Abiosdsk - ok

13:51:21.0921 2336 abp480n5 - ok

13:51:21.0984 2336 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys

13:51:21.0984 2336 ACPI - ok

13:51:22.0015 2336 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys

13:51:22.0015 2336 ACPIEC - ok

13:51:22.0125 2336 [ 0CB0AA071C7B86A64F361DCFDF357329 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

13:51:22.0125 2336 AdobeFlashPlayerUpdateSvc - ok

13:51:22.0125 2336 adpu160m - ok

13:51:22.0187 2336 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys

13:51:22.0187 2336 aec - ok

13:51:22.0250 2336 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys

13:51:22.0250 2336 AFD - ok

13:51:22.0250 2336 Aha154x - ok

13:51:22.0265 2336 aic78u2 - ok

13:51:22.0265 2336 aic78xx - ok

13:51:22.0312 2336 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll

13:51:22.0312 2336 Alerter - ok

13:51:22.0343 2336 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe

13:51:22.0343 2336 ALG - ok

13:51:22.0343 2336 AliIde - ok

13:51:22.0406 2336 [ 033448D435E65C4BD72E70521FD05C76 ] AmdPPM C:\WINDOWS\system32\DRIVERS\AmdPPM.sys

13:51:22.0406 2336 AmdPPM - ok

13:51:22.0406 2336 amsint - ok

13:51:22.0562 2336 [ 99EEA1B057FA11CF069A4870D218A003 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe

13:51:22.0562 2336 AntiVirSchedulerService - ok

13:51:22.0609 2336 [ 4C040249F009A4807B2955D5E5210104 ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe

13:51:22.0609 2336 AntiVirService - ok

13:51:22.0703 2336 [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

13:51:22.0703 2336 Apple Mobile Device - ok

13:51:22.0734 2336 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll

13:51:22.0734 2336 AppMgmt - ok

13:51:22.0765 2336 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys

13:51:22.0765 2336 Arp1394 - ok

13:51:22.0765 2336 asc - ok

13:51:22.0765 2336 asc3350p - ok

13:51:22.0781 2336 asc3550 - ok

13:51:22.0921 2336 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

13:51:22.0921 2336 aspnet_state - ok

13:51:22.0937 2336 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys

13:51:22.0937 2336 AsyncMac - ok

13:51:22.0968 2336 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys

13:51:22.0968 2336 atapi - ok

13:51:22.0968 2336 Atdisk - ok

13:51:22.0984 2336 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys

13:51:22.0984 2336 Atmarpc - ok

13:51:23.0015 2336 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll

13:51:23.0015 2336 AudioSrv - ok

13:51:23.0078 2336 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys

13:51:23.0078 2336 audstub - ok

13:51:23.0093 2336 [ 680B3A1BE559B5D5AAC04C7949469DD6 ] avgntflt C:\WINDOWS\system32\DRIVERS\avgntflt.sys

13:51:23.0093 2336 avgntflt - ok

13:51:23.0140 2336 [ 6B289080B9752DAD39C1C2B98B479DCE ] avipbb C:\WINDOWS\system32\DRIVERS\avipbb.sys

13:51:23.0140 2336 avipbb - ok

13:51:23.0218 2336 [ FFB78D74E1EA5F811341A6E7AC547A46 ] avkmgr C:\WINDOWS\system32\DRIVERS\avkmgr.sys

13:51:23.0218 2336 avkmgr - ok

13:51:23.0265 2336 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys

13:51:23.0265 2336 Beep - ok

13:51:23.0343 2336 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll

13:51:23.0343 2336 BITS - ok

13:51:23.0359 2336 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe

13:51:23.0375 2336 Bonjour Service - ok

13:51:23.0421 2336 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll

13:51:23.0421 2336 Browser - ok

13:51:23.0578 2336 catchme - ok

13:51:23.0625 2336 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys

13:51:23.0625 2336 cbidf2k - ok

13:51:23.0625 2336 cd20xrnt - ok

13:51:23.0656 2336 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys

13:51:23.0656 2336 Cdaudio - ok

13:51:23.0718 2336 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys

13:51:23.0718 2336 Cdfs - ok

13:51:23.0734 2336 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys

13:51:23.0734 2336 Cdrom - ok

13:51:23.0750 2336 Changer - ok

13:51:23.0796 2336 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe

13:51:23.0796 2336 CiSvc - ok

13:51:23.0828 2336 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe

13:51:23.0828 2336 ClipSrv - ok

13:51:23.0890 2336 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

13:51:23.0890 2336 clr_optimization_v2.0.50727_32 - ok

13:51:23.0984 2336 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

13:51:23.0984 2336 clr_optimization_v4.0.30319_32 - ok

13:51:24.0000 2336 CmdIde - ok

13:51:24.0000 2336 COMSysApp - ok

13:51:24.0015 2336 Cpqarray - ok

13:51:24.0015 2336 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll

13:51:24.0015 2336 CryptSvc - ok

13:51:24.0031 2336 dac2w2k - ok

13:51:24.0031 2336 dac960nt - ok

13:51:24.0078 2336 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll

13:51:24.0093 2336 DcomLaunch - ok

13:51:24.0140 2336 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll

13:51:24.0140 2336 Dhcp - ok

13:51:24.0156 2336 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys

13:51:24.0156 2336 Disk - ok

13:51:24.0156 2336 dmadmin - ok

13:51:24.0234 2336 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys

13:51:24.0234 2336 dmboot - ok

13:51:24.0234 2336 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys

13:51:24.0234 2336 dmio - ok

13:51:24.0250 2336 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys

13:51:24.0250 2336 dmload - ok

13:51:24.0296 2336 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll

13:51:24.0296 2336 dmserver - ok

13:51:24.0343 2336 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys

13:51:24.0343 2336 DMusic - ok

13:51:24.0406 2336 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll

13:51:24.0406 2336 Dnscache - ok

13:51:24.0515 2336 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll

13:51:24.0515 2336 Dot3svc - ok

13:51:24.0515 2336 dpti2o - ok

13:51:24.0609 2336 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys

13:51:24.0609 2336 drmkaud - ok

13:51:24.0718 2336 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll

13:51:24.0718 2336 EapHost - ok

13:51:24.0781 2336 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll

13:51:24.0781 2336 ERSvc - ok

13:51:24.0796 2336 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe

13:51:24.0796 2336 Eventlog - ok

13:51:24.0843 2336 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll

13:51:24.0859 2336 EventSystem - ok

13:51:24.0890 2336 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys

13:51:24.0890 2336 Fastfat - ok

13:51:24.0937 2336 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll

13:51:24.0937 2336 FastUserSwitchingCompatibility - ok

13:51:24.0953 2336 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys

13:51:24.0953 2336 Fdc - ok

13:51:24.0968 2336 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys

13:51:24.0968 2336 Fips - ok

13:51:25.0000 2336 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys

13:51:25.0000 2336 Flpydisk - ok

13:51:25.0046 2336 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys

13:51:25.0046 2336 FltMgr - ok

13:51:25.0140 2336 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

13:51:25.0140 2336 FontCache3.0.0.0 - ok

13:51:25.0203 2336 [ E0087225B137E57239FF40F8AE82059B ] fssfltr C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys

13:51:25.0203 2336 fssfltr - ok

13:51:25.0328 2336 [ 45B52394F9624237F33A8A3D73C0B221 ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe

13:51:25.0328 2336 fsssvc - ok

13:51:25.0343 2336 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys

13:51:25.0343 2336 Fs_Rec - ok

13:51:25.0390 2336 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys

13:51:25.0390 2336 Ftdisk - ok

13:51:25.0390 2336 GALKNJKE - ok

13:51:25.0453 2336 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

13:51:25.0453 2336 GEARAspiWDM - ok

13:51:25.0500 2336 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys

13:51:25.0500 2336 Gpc - ok

13:51:25.0609 2336 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe

13:51:25.0609 2336 gupdate - ok

13:51:25.0625 2336 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe

13:51:25.0625 2336 gupdatem - ok

13:51:25.0687 2336 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

13:51:25.0687 2336 gusvc - ok

13:51:25.0703 2336 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

13:51:25.0703 2336 HDAudBus - ok

13:51:25.0812 2336 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

13:51:25.0812 2336 helpsvc - ok

13:51:25.0843 2336 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll

13:51:25.0843 2336 HidServ - ok

13:51:25.0875 2336 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys

13:51:25.0875 2336 HidUsb - ok

13:51:25.0921 2336 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll

13:51:25.0921 2336 hkmsvc - ok

13:51:26.0031 2336 [ C5F00D15AA15CB7F55A027FF75E44BB7 ] HP Port Resolver C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE

13:51:26.0031 2336 HP Port Resolver - ok

13:51:26.0093 2336 [ C5A288E4CEEF5A26D105117BAA3763AB ] HP Status Server C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE

13:51:26.0093 2336 HP Status Server - ok

13:51:26.0109 2336 hpn - ok

13:51:26.0140 2336 [ 30CA91E657CEDE2F95359D6EF186F650 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys

13:51:26.0140 2336 HPZid412 - ok

13:51:26.0171 2336 [ EFD31AFA752AA7C7BBB57BCBE2B01C78 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys

13:51:26.0171 2336 HPZipr12 - ok

13:51:26.0203 2336 [ 7AC43C38CA8FD7ED0B0A4466F753E06E ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys

13:51:26.0203 2336 HPZius12 - ok

13:51:26.0234 2336 [ 5DF616ADDB75C1AD36C1F9E4DE0F7654 ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys

13:51:26.0250 2336 HSFHWBS2 - ok

13:51:26.0281 2336 [ DFA8F86C0DBCA7DB948043AA3BE6793B ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys

13:51:26.0281 2336 HSF_DP - ok

13:51:26.0343 2336 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys

13:51:26.0359 2336 HTTP - ok

13:51:26.0406 2336 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll

13:51:26.0406 2336 HTTPFilter - ok

13:51:26.0406 2336 HVGAA - ok

13:51:26.0421 2336 i2omgmt - ok

13:51:26.0421 2336 i2omp - ok

13:51:26.0484 2336 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys

13:51:26.0484 2336 i8042prt - ok

13:51:26.0593 2336 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

13:51:26.0593 2336 idsvc - ok

13:51:26.0625 2336 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys

13:51:26.0625 2336 Imapi - ok

13:51:26.0687 2336 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe

13:51:26.0687 2336 ImapiService - ok

13:51:26.0703 2336 ini910u - ok

13:51:26.0890 2336 [ 14B48553BE78472D2BD3A518658A1710 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys

13:51:26.0921 2336 IntcAzAudAddService - ok

13:51:26.0937 2336 IntelIde - ok

13:51:26.0984 2336 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys

13:51:26.0984 2336 Ip6Fw - ok

13:51:27.0015 2336 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

13:51:27.0031 2336 IpFilterDriver - ok

13:51:27.0046 2336 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys

13:51:27.0046 2336 IpInIp - ok

13:51:27.0078 2336 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys

13:51:27.0078 2336 IpNat - ok

13:51:27.0140 2336 [ E6BE7A41A28D8F2DB174957454D32448 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe

13:51:27.0156 2336 iPod Service - ok

13:51:27.0218 2336 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys

13:51:27.0218 2336 IPSec - ok

13:51:27.0265 2336 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys

13:51:27.0265 2336 IRENUM - ok

13:51:27.0296 2336 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys

13:51:27.0296 2336 isapnp - ok

13:51:27.0453 2336 [ 691B9B7C0CC1653732717D292D6B305D ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe

13:51:27.0453 2336 JavaQuickStarterService - ok

13:51:27.0484 2336 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys

13:51:27.0484 2336 Kbdclass - ok

13:51:27.0484 2336 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys

13:51:27.0484 2336 kbdhid - ok

13:51:27.0531 2336 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys

13:51:27.0531 2336 kmixer - ok

13:51:27.0562 2336 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys

13:51:27.0578 2336 KSecDD - ok

13:51:27.0609 2336 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll

13:51:27.0609 2336 lanmanserver - ok

13:51:27.0671 2336 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll

13:51:27.0671 2336 lanmanworkstation - ok

13:51:27.0671 2336 lbrtfdc - ok

13:51:27.0687 2336 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll

13:51:27.0687 2336 LmHosts - ok

13:51:27.0750 2336 [ 3C318B9CD391371BED62126581EE9961 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

13:51:27.0750 2336 mdmxsdk - ok

13:51:27.0781 2336 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll

13:51:27.0781 2336 Messenger - ok

13:51:27.0859 2336 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe

13:51:27.0875 2336 Microsoft Office Groove Audit Service - ok

13:51:27.0906 2336 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys

13:51:27.0906 2336 mnmdd - ok

13:51:27.0906 2336 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe

13:51:27.0906 2336 mnmsrvc - ok

13:51:27.0937 2336 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys

13:51:27.0937 2336 Modem - ok

13:51:27.0953 2336 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys

13:51:27.0953 2336 Mouclass - ok

13:51:28.0015 2336 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys

13:51:28.0015 2336 mouhid - ok

13:51:28.0015 2336 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys

13:51:28.0015 2336 MountMgr - ok

13:51:28.0015 2336 mraid35x - ok

13:51:28.0046 2336 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys

13:51:28.0046 2336 MRxDAV - ok

13:51:28.0109 2336 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

13:51:28.0109 2336 MRxSmb - ok

13:51:28.0171 2336 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe

13:51:28.0171 2336 MSDTC - ok

13:51:28.0171 2336 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys

13:51:28.0171 2336 Msfs - ok

13:51:28.0187 2336 MSIServer - ok

13:51:28.0218 2336 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys

13:51:28.0218 2336 MSKSSRV - ok

13:51:28.0250 2336 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys

13:51:28.0250 2336 MSPCLOCK - ok

13:51:28.0281 2336 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys

13:51:28.0281 2336 MSPQM - ok

13:51:28.0328 2336 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys

13:51:28.0328 2336 mssmbios - ok

13:51:28.0343 2336 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys

13:51:28.0343 2336 Mup - ok

13:51:28.0375 2336 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll

13:51:28.0390 2336 napagent - ok

13:51:28.0390 2336 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys

13:51:28.0390 2336 NDIS - ok

13:51:28.0390 2336 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys

13:51:28.0390 2336 NdisTapi - ok

13:51:28.0437 2336 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys

13:51:28.0437 2336 Ndisuio - ok

13:51:28.0453 2336 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys

13:51:28.0453 2336 NdisWan - ok

13:51:28.0484 2336 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys

13:51:28.0484 2336 NDProxy - ok

13:51:28.0500 2336 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys

13:51:28.0500 2336 NetBIOS - ok

13:51:28.0531 2336 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys

13:51:28.0546 2336 NetBT - ok

13:51:28.0593 2336 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe

13:51:28.0593 2336 NetDDE - ok

13:51:28.0609 2336 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe

13:51:28.0609 2336 NetDDEdsdm - ok

13:51:28.0625 2336 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe

13:51:28.0625 2336 Netlogon - ok

13:51:28.0671 2336 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll

13:51:28.0671 2336 Netman - ok

13:51:28.0765 2336 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

13:51:28.0765 2336 NetTcpPortSharing - ok

13:51:28.0796 2336 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys

13:51:28.0796 2336 NIC1394 - ok

13:51:28.0812 2336 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll

13:51:28.0812 2336 Nla - ok

13:51:28.0812 2336 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys

13:51:28.0812 2336 Npfs - ok

13:51:28.0843 2336 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys

13:51:28.0843 2336 Ntfs - ok

13:51:28.0843 2336 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe

13:51:28.0843 2336 NtLmSsp - ok

13:51:28.0906 2336 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll

13:51:28.0921 2336 NtmsSvc - ok

13:51:28.0937 2336 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys

13:51:28.0937 2336 Null - ok

13:51:29.0093 2336 [ 642A87877F83313EB5302749CD479024 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

13:51:29.0109 2336 nv - ok

13:51:29.0125 2336 [ 22EEDB34C4D7613A25B10C347C6C4C21 ] NVENETFD C:\WINDOWS\system32\DRIVERS\NVENETFD.sys

13:51:29.0125 2336 NVENETFD - ok

13:51:29.0156 2336 [ 5E3F6AD5CAD0F12D3CCCD06FD964087A ] nvnetbus C:\WINDOWS\system32\DRIVERS\nvnetbus.sys

13:51:29.0156 2336 nvnetbus - ok

13:51:29.0187 2336 [ B0903C021BFCD6055C053A569EF98AEF ] NVSvc C:\WINDOWS\system32\nvsvc32.exe

13:51:29.0187 2336 NVSvc - ok

13:51:29.0218 2336 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

13:51:29.0218 2336 NwlnkFlt - ok

13:51:29.0250 2336 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

13:51:29.0250 2336 NwlnkFwd - ok

13:51:29.0375 2336 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

13:51:29.0390 2336 odserv - ok

13:51:29.0390 2336 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys

13:51:29.0390 2336 ohci1394 - ok

13:51:29.0468 2336 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

13:51:29.0468 2336 ose - ok

13:51:29.0515 2336 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys

13:51:29.0515 2336 Parport - ok

13:51:29.0531 2336 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys

13:51:29.0531 2336 PartMgr - ok

13:51:29.0578 2336 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys

13:51:29.0578 2336 ParVdm - ok

13:51:29.0578 2336 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys

13:51:29.0578 2336 PCI - ok

13:51:29.0578 2336 PCIDump - ok

13:51:29.0593 2336 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys

13:51:29.0593 2336 PCIIde - ok

13:51:29.0625 2336 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys

13:51:29.0640 2336 Pcmcia - ok

13:51:29.0640 2336 PDCOMP - ok

13:51:29.0640 2336 PDFRAME - ok

13:51:29.0656 2336 PDRELI - ok

13:51:29.0656 2336 PDRFRAME - ok

13:51:29.0656 2336 perc2 - ok

13:51:29.0671 2336 perc2hib - ok

13:51:29.0703 2336 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe

13:51:29.0718 2336 PlugPlay - ok

13:51:29.0765 2336 [ D31F88C5F19EEFA366A415D6BC5F2ABC ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe

13:51:29.0765 2336 Pml Driver HPZ12 - ok

13:51:29.0765 2336 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe

13:51:29.0765 2336 PolicyAgent - ok

13:51:29.0781 2336 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys

13:51:29.0781 2336 PptpMiniport - ok

13:51:29.0796 2336 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys

13:51:29.0796 2336 Processor - ok

13:51:29.0796 2336 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe

13:51:29.0796 2336 ProtectedStorage - ok

13:51:29.0968 2336 [ 390C204CED3785609AB24E9C52054A84 ] Ps2 C:\WINDOWS\system32\DRIVERS\PS2.sys

13:51:29.0968 2336 Ps2 - ok

13:51:29.0968 2336 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys

13:51:29.0968 2336 PSched - ok

13:51:30.0078 2336 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys

13:51:30.0078 2336 Ptilink - ok

13:51:30.0156 2336 [ 0457E25BB122B854E267CF552DCDC370 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys

13:51:30.0156 2336 PxHelp20 - ok

13:51:30.0156 2336 ql1080 - ok

13:51:30.0171 2336 Ql10wnt - ok

13:51:30.0171 2336 ql12160 - ok

13:51:30.0187 2336 ql1240 - ok

13:51:30.0187 2336 ql1280 - ok

13:51:30.0265 2336 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys

13:51:30.0265 2336 RasAcd - ok

13:51:30.0312 2336 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll

13:51:30.0312 2336 RasAuto - ok

13:51:30.0343 2336 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

13:51:30.0343 2336 Rasl2tp - ok

13:51:30.0406 2336 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll

13:51:30.0406 2336 RasMan - ok

13:51:30.0421 2336 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys

13:51:30.0421 2336 RasPppoe - ok

13:51:30.0421 2336 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys

13:51:30.0421 2336 Raspti - ok

13:51:30.0437 2336 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys

13:51:30.0453 2336 Rdbss - ok

13:51:30.0453 2336 RDFYUATO - ok

13:51:30.0468 2336 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

13:51:30.0468 2336 RDPCDD - ok

13:51:30.0484 2336 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys

13:51:30.0484 2336 rdpdr - ok

13:51:30.0531 2336 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys

13:51:30.0546 2336 RDPWD - ok

13:51:30.0578 2336 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe

13:51:30.0578 2336 RDSessMgr - ok

13:51:30.0609 2336 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys

13:51:30.0609 2336 redbook - ok

13:51:30.0640 2336 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll

13:51:30.0640 2336 RemoteAccess - ok

13:51:30.0671 2336 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll

13:51:30.0671 2336 RemoteRegistry - ok

13:51:30.0687 2336 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe

13:51:30.0703 2336 RpcLocator - ok

13:51:30.0734 2336 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll

13:51:30.0734 2336 RpcSs - ok

13:51:30.0781 2336 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe

13:51:30.0796 2336 RSVP - ok

13:51:30.0796 2336 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe

13:51:30.0796 2336 SamSs - ok

13:51:30.0812 2336 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe

13:51:30.0812 2336 SCardSvr - ok

13:51:30.0875 2336 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll

13:51:30.0875 2336 Schedule - ok

13:51:30.0937 2336 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys

13:51:30.0937 2336 Secdrv - ok

13:51:30.0984 2336 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll

13:51:30.0984 2336 seclogon - ok

13:51:31.0015 2336 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll

13:51:31.0015 2336 SENS - ok

13:51:31.0062 2336 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\drivers\Serial.sys

13:51:31.0062 2336 Serial - ok

13:51:31.0125 2336 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys

13:51:31.0125 2336 Sfloppy - ok

13:51:31.0187 2336 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll

13:51:31.0187 2336 SharedAccess - ok

13:51:31.0203 2336 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll

13:51:31.0203 2336 ShellHWDetection - ok

13:51:31.0203 2336 Simbad - ok

13:51:31.0218 2336 Sparrow - ok

13:51:31.0281 2336 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys

13:51:31.0281 2336 splitter - ok

13:51:31.0343 2336 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe

13:51:31.0343 2336 Spooler - ok

13:51:31.0359 2336 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys

13:51:31.0359 2336 sr - ok

13:51:31.0406 2336 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll

13:51:31.0421 2336 srservice - ok

13:51:31.0484 2336 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys

13:51:31.0484 2336 Srv - ok

13:51:31.0546 2336 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll

13:51:31.0546 2336 SSDPSRV - ok

13:51:31.0593 2336 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

13:51:31.0593 2336 ssmdrv - ok

13:51:31.0656 2336 [ A9573045BAA16EAB9B1085205B82F1ED ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys

13:51:31.0656 2336 StillCam - ok

13:51:31.0718 2336 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll

13:51:31.0718 2336 stisvc - ok

13:51:31.0750 2336 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys

13:51:31.0750 2336 swenum - ok

13:51:31.0781 2336 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys

13:51:31.0781 2336 swmidi - ok

13:51:31.0796 2336 SwPrv - ok

13:51:31.0796 2336 symc810 - ok

13:51:31.0796 2336 symc8xx - ok

13:51:31.0812 2336 sym_hi - ok

13:51:31.0812 2336 sym_u3 - ok

13:51:31.0843 2336 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys

13:51:31.0843 2336 sysaudio - ok

13:51:31.0875 2336 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe

13:51:31.0875 2336 SysmonLog - ok

13:51:31.0921 2336 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll

13:51:31.0921 2336 TapiSrv - ok

13:51:31.0953 2336 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys

13:51:31.0968 2336 Tcpip - ok

13:51:32.0000 2336 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys

13:51:32.0000 2336 TDPIPE - ok

13:51:32.0015 2336 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys

13:51:32.0015 2336 TDTCP - ok

13:51:32.0046 2336 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys

13:51:32.0046 2336 TermDD - ok

13:51:32.0125 2336 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll

13:51:32.0125 2336 TermService - ok

13:51:32.0140 2336 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll

13:51:32.0140 2336 Themes - ok

13:51:32.0203 2336 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe

13:51:32.0203 2336 TlntSvr - ok

13:51:32.0218 2336 TosIde - ok

13:51:32.0250 2336 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll

13:51:32.0250 2336 TrkWks - ok

13:51:32.0281 2336 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys

13:51:32.0281 2336 Udfs - ok

13:51:32.0281 2336 ultra - ok

13:51:32.0359 2336 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys

13:51:32.0359 2336 Update - ok

13:51:32.0390 2336 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll

13:51:32.0390 2336 upnphost - ok

13:51:32.0390 2336 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe

13:51:32.0390 2336 UPS - ok

13:51:32.0453 2336 [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys

13:51:32.0453 2336 USBAAPL - ok

13:51:32.0500 2336 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys

13:51:32.0500 2336 usbccgp - ok

13:51:32.0546 2336 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys

13:51:32.0546 2336 usbehci - ok

13:51:32.0562 2336 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys

13:51:32.0562 2336 usbhub - ok

13:51:32.0609 2336 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys

13:51:32.0609 2336 usbohci - ok

13:51:32.0625 2336 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys

13:51:32.0625 2336 usbprint - ok

13:51:32.0656 2336 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys

13:51:32.0656 2336 usbscan - ok

13:51:32.0703 2336 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

13:51:32.0703 2336 usbstor - ok

13:51:32.0750 2336 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys

13:51:32.0750 2336 VgaSave - ok

13:51:32.0765 2336 ViaIde - ok

13:51:32.0828 2336 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys

13:51:32.0828 2336 VolSnap - ok

13:51:32.0890 2336 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe

13:51:32.0890 2336 VSS - ok

13:51:32.0953 2336 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll

13:51:32.0953 2336 W32Time - ok

13:51:33.0000 2336 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys

13:51:33.0000 2336 Wanarp - ok

13:51:33.0015 2336 WDICA - ok

13:51:33.0031 2336 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys

13:51:33.0031 2336 wdmaud - ok

13:51:33.0078 2336 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll

13:51:33.0078 2336 WebClient - ok

13:51:33.0156 2336 [ 473EE64C368CE2EED110376C11960259 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys

13:51:33.0156 2336 winachsf - ok

13:51:33.0265 2336 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll

13:51:33.0265 2336 winmgmt - ok

13:51:33.0375 2336 [ 18F347402DA544A780949B8FDF83351B ] WinRM C:\WINDOWS\system32\WsmSvc.dll

13:51:33.0375 2336 WinRM - ok

13:51:33.0437 2336 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll

13:51:33.0437 2336 WmdmPmSN - ok

13:51:33.0484 2336 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll

13:51:33.0484 2336 Wmi - ok

13:51:33.0546 2336 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe

13:51:33.0546 2336 WmiApSrv - ok

13:51:33.0656 2336 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe

13:51:33.0656 2336 WMPNetworkSvc - ok

13:51:33.0781 2336 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

13:51:33.0781 2336 WPFFontCache_v0400 - ok

13:51:33.0828 2336 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys

13:51:33.0828 2336 WS2IFSL - ok

13:51:33.0875 2336 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll

13:51:33.0890 2336 wscsvc - ok

13:51:33.0890 2336 WSearch - ok

13:51:33.0937 2336 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll

13:51:33.0937 2336 wuauserv - ok

13:51:34.0000 2336 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys

13:51:34.0000 2336 WudfPf - ok

13:51:34.0031 2336 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys

13:51:34.0031 2336 WudfRd - ok

13:51:34.0062 2336 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll

13:51:34.0078 2336 WudfSvc - ok

13:51:34.0140 2336 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll

13:51:34.0156 2336 WZCSVC - ok

13:51:34.0187 2336 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll

13:51:34.0187 2336 xmlprov - ok

13:51:34.0187 2336 ================ Scan global ===============================

13:51:34.0250 2336 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll

13:51:34.0296 2336 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll

13:51:34.0312 2336 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll

13:51:34.0328 2336 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe

13:51:34.0328 2336 [Global] - ok

13:51:34.0328 2336 ================ Scan MBR ==================================

13:51:34.0359 2336 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0

13:51:34.0359 2336 Suspicious mbr (Forged): \Device\Harddisk0\DR0

13:51:34.0390 2336 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected

13:51:34.0390 2336 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)

13:51:34.0390 2336 ================ Scan VBR ==================================

13:51:34.0390 2336 [ 2B94AFEE9341CC63EE629935CF7ECE74 ] \Device\Harddisk0\DR0\Partition1

13:51:34.0390 2336 \Device\Harddisk0\DR0\Partition1 - ok

13:51:34.0390 2336 ============================================================

13:51:34.0390 2336 Scan finished

13:51:34.0390 2336 ============================================================

13:51:34.0406 2520 Detected object count: 1

13:51:34.0406 2520 Actual detected object count: 1

13:55:24.0468 2520 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - skipped by user

13:55:24.0468 2520 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Skip

13:57:26.0984 2400 Deinitialize success

Link to post
Share on other sites
Inkwax

Inkwax

Posted
  • Author
Posted

Jeff, I have two logs for you. 1 from when I "cured" the system and one from after the reboot. TDSSKiller auto-started on the reboot so I figured it couldnt hurt to run it again.

15:38:56.0515 1248 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

15:38:56.0796 1248 ============================================================

15:38:56.0796 1248 Current date / time: 2012/11/30 15:38:56.0796

15:38:56.0796 1248 SystemInfo:

15:38:56.0796 1248

15:38:56.0796 1248 OS Version: 5.1.2600 ServicePack: 3.0

15:38:56.0796 1248 Product type: Workstation

15:38:56.0796 1248 ComputerName: JOLLY-DESKTOP

15:38:56.0796 1248 UserName: Jolly Household

15:38:56.0796 1248 Windows directory: C:\WINDOWS

15:38:56.0796 1248 System windows directory: C:\WINDOWS

15:38:56.0796 1248 Processor architecture: Intel x86

15:38:56.0796 1248 Number of processors: 2

15:38:56.0796 1248 Page size: 0x1000

15:38:56.0796 1248 Boot type: Normal boot

15:38:56.0796 1248 ============================================================

15:38:59.0140 1248 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x7E2D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054

15:38:59.0156 1248 ============================================================

15:38:59.0156 1248 \Device\Harddisk0\DR0:

15:38:59.0156 1248 MBR partitions:

15:38:59.0156 1248 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1D1C0681

15:38:59.0156 1248 ============================================================

15:38:59.0187 1248 C: <-> \Device\Harddisk0\DR0\Partition1

15:38:59.0187 1248 ============================================================

15:38:59.0187 1248 Initialize success

15:38:59.0187 1248 ============================================================

15:39:13.0265 2416 ============================================================

15:39:13.0265 2416 Scan started

15:39:13.0265 2416 Mode: Manual;

15:39:13.0265 2416 ============================================================

15:39:13.0968 2416 ================ Scan system memory ========================

15:39:13.0968 2416 System memory - ok

15:39:13.0968 2416 ================ Scan services =============================

15:39:14.0015 2416 Abiosdsk - ok

15:39:14.0031 2416 abp480n5 - ok

15:39:14.0093 2416 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys

15:39:14.0093 2416 ACPI - ok

15:39:14.0156 2416 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys

15:39:14.0156 2416 ACPIEC - ok

15:39:14.0234 2416 [ 0CB0AA071C7B86A64F361DCFDF357329 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

15:39:14.0250 2416 AdobeFlashPlayerUpdateSvc - ok

15:39:14.0265 2416 adpu160m - ok

15:39:14.0312 2416 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys

15:39:14.0343 2416 aec - ok

15:39:14.0390 2416 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys

15:39:14.0406 2416 AFD - ok

15:39:14.0406 2416 Aha154x - ok

15:39:14.0421 2416 aic78u2 - ok

15:39:14.0421 2416 aic78xx - ok

15:39:14.0484 2416 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll

15:39:14.0484 2416 Alerter - ok

15:39:14.0531 2416 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe

15:39:14.0531 2416 ALG - ok

15:39:14.0531 2416 AliIde - ok

15:39:14.0625 2416 [ 033448D435E65C4BD72E70521FD05C76 ] AmdPPM C:\WINDOWS\system32\DRIVERS\AmdPPM.sys

15:39:14.0640 2416 AmdPPM - ok

15:39:14.0640 2416 amsint - ok

15:39:14.0828 2416 [ 99EEA1B057FA11CF069A4870D218A003 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe

15:39:14.0875 2416 AntiVirSchedulerService - ok

15:39:14.0953 2416 [ 4C040249F009A4807B2955D5E5210104 ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe

15:39:14.0968 2416 AntiVirService - ok

15:39:15.0062 2416 [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

15:39:15.0062 2416 Apple Mobile Device - ok

15:39:15.0109 2416 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll

15:39:15.0109 2416 AppMgmt - ok

15:39:15.0187 2416 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys

15:39:15.0187 2416 Arp1394 - ok

15:39:15.0187 2416 asc - ok

15:39:15.0203 2416 asc3350p - ok

15:39:15.0203 2416 asc3550 - ok

15:39:15.0359 2416 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

15:39:15.0375 2416 aspnet_state - ok

15:39:15.0421 2416 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys

15:39:15.0421 2416 AsyncMac - ok

15:39:15.0484 2416 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys

15:39:15.0484 2416 atapi - ok

15:39:15.0484 2416 Atdisk - ok

15:39:15.0500 2416 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys

15:39:15.0500 2416 Atmarpc - ok

15:39:15.0562 2416 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll

15:39:15.0640 2416 AudioSrv - ok

15:39:15.0703 2416 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys

15:39:15.0843 2416 audstub - ok

15:39:15.0843 2416 [ 680B3A1BE559B5D5AAC04C7949469DD6 ] avgntflt C:\WINDOWS\system32\DRIVERS\avgntflt.sys

15:39:15.0859 2416 avgntflt - ok

15:39:15.0906 2416 [ 6B289080B9752DAD39C1C2B98B479DCE ] avipbb C:\WINDOWS\system32\DRIVERS\avipbb.sys

15:39:15.0921 2416 avipbb - ok

15:39:15.0953 2416 [ FFB78D74E1EA5F811341A6E7AC547A46 ] avkmgr C:\WINDOWS\system32\DRIVERS\avkmgr.sys

15:39:15.0968 2416 avkmgr - ok

15:39:16.0000 2416 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys

15:39:16.0000 2416 Beep - ok

15:39:16.0062 2416 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll

15:39:16.0125 2416 BITS - ok

15:39:16.0140 2416 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe

15:39:16.0156 2416 Bonjour Service - ok

15:39:16.0218 2416 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll

15:39:16.0218 2416 Browser - ok

15:39:16.0375 2416 catchme - ok

15:39:16.0437 2416 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys

15:39:16.0453 2416 cbidf2k - ok

15:39:16.0453 2416 cd20xrnt - ok

15:39:16.0484 2416 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys

15:39:16.0484 2416 Cdaudio - ok

15:39:16.0515 2416 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys

15:39:16.0515 2416 Cdfs - ok

15:39:16.0546 2416 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys

15:39:16.0562 2416 Cdrom - ok

15:39:16.0562 2416 Changer - ok

15:39:16.0625 2416 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe

15:39:16.0625 2416 CiSvc - ok

15:39:16.0671 2416 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe

15:39:16.0687 2416 ClipSrv - ok

15:39:16.0734 2416 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

15:39:16.0765 2416 clr_optimization_v2.0.50727_32 - ok

15:39:16.0890 2416 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

15:39:16.0890 2416 clr_optimization_v4.0.30319_32 - ok

15:39:16.0890 2416 CmdIde - ok

15:39:16.0890 2416 COMSysApp - ok

15:39:16.0906 2416 Cpqarray - ok

15:39:16.0921 2416 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll

15:39:16.0937 2416 CryptSvc - ok

15:39:16.0937 2416 dac2w2k - ok

15:39:16.0953 2416 dac960nt - ok

15:39:17.0015 2416 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll

15:39:17.0015 2416 DcomLaunch - ok

15:39:17.0078 2416 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll

15:39:17.0078 2416 Dhcp - ok

15:39:17.0125 2416 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys

15:39:17.0140 2416 Disk - ok

15:39:17.0140 2416 dmadmin - ok

15:39:17.0265 2416 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys

15:39:17.0343 2416 dmboot - ok

15:39:17.0375 2416 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys

15:39:17.0453 2416 dmio - ok

15:39:17.0468 2416 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys

15:39:17.0468 2416 dmload - ok

15:39:17.0500 2416 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll

15:39:17.0515 2416 dmserver - ok

15:39:17.0562 2416 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys

15:39:17.0562 2416 DMusic - ok

15:39:17.0640 2416 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll

15:39:17.0640 2416 Dnscache - ok

15:39:17.0781 2416 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll

15:39:17.0812 2416 Dot3svc - ok

15:39:17.0812 2416 dpti2o - ok

15:39:17.0875 2416 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys

15:39:17.0875 2416 drmkaud - ok

15:39:17.0921 2416 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll

15:39:17.0921 2416 EapHost - ok

15:39:18.0015 2416 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll

15:39:18.0015 2416 ERSvc - ok

15:39:18.0078 2416 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe

15:39:18.0093 2416 Eventlog - ok

15:39:18.0156 2416 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll

15:39:18.0171 2416 EventSystem - ok

15:39:18.0218 2416 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys

15:39:18.0218 2416 Fastfat - ok

15:39:18.0265 2416 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll

15:39:18.0281 2416 FastUserSwitchingCompatibility - ok

15:39:18.0281 2416 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys

15:39:18.0296 2416 Fdc - ok

15:39:18.0312 2416 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys

15:39:18.0312 2416 Fips - ok

15:39:18.0359 2416 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys

15:39:18.0390 2416 Flpydisk - ok

15:39:18.0468 2416 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys

15:39:18.0515 2416 FltMgr - ok

15:39:18.0625 2416 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

15:39:18.0640 2416 FontCache3.0.0.0 - ok

15:39:18.0703 2416 [ E0087225B137E57239FF40F8AE82059B ] fssfltr C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys

15:39:18.0703 2416 fssfltr - ok

15:39:18.0843 2416 [ 45B52394F9624237F33A8A3D73C0B221 ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe

15:39:18.0937 2416 fsssvc - ok

15:39:18.0937 2416 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys

15:39:18.0953 2416 Fs_Rec - ok

15:39:18.0984 2416 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys

15:39:19.0000 2416 Ftdisk - ok

15:39:19.0000 2416 GALKNJKE - ok

15:39:19.0062 2416 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

15:39:19.0062 2416 GEARAspiWDM - ok

15:39:19.0078 2416 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys

15:39:19.0078 2416 Gpc - ok

15:39:19.0187 2416 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe

15:39:19.0187 2416 gupdate - ok

15:39:19.0187 2416 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe

15:39:19.0187 2416 gupdatem - ok

15:39:19.0265 2416 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

15:39:19.0265 2416 gusvc - ok

15:39:19.0328 2416 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

15:39:19.0328 2416 HDAudBus - ok

15:39:19.0656 2416 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

15:39:19.0671 2416 helpsvc - ok

15:39:19.0718 2416 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll

15:39:19.0718 2416 HidServ - ok

15:39:19.0875 2416 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys

15:39:19.0953 2416 HidUsb - ok

15:39:20.0015 2416 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll

15:39:20.0062 2416 hkmsvc - ok

15:39:20.0296 2416 [ C5F00D15AA15CB7F55A027FF75E44BB7 ] HP Port Resolver C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE

15:39:20.0296 2416 HP Port Resolver - ok

15:39:20.0468 2416 [ C5A288E4CEEF5A26D105117BAA3763AB ] HP Status Server C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE

15:39:20.0531 2416 HP Status Server - ok

15:39:20.0546 2416 hpn - ok

15:39:20.0562 2416 [ 30CA91E657CEDE2F95359D6EF186F650 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys

15:39:20.0578 2416 HPZid412 - ok

15:39:20.0609 2416 [ EFD31AFA752AA7C7BBB57BCBE2B01C78 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys

15:39:20.0609 2416 HPZipr12 - ok

15:39:20.0656 2416 [ 7AC43C38CA8FD7ED0B0A4466F753E06E ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys

15:39:20.0875 2416 HPZius12 - ok

15:39:20.0937 2416 [ 5DF616ADDB75C1AD36C1F9E4DE0F7654 ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys

15:39:20.0953 2416 HSFHWBS2 - ok

15:39:20.0984 2416 [ DFA8F86C0DBCA7DB948043AA3BE6793B ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys

15:39:21.0046 2416 HSF_DP - ok

15:39:21.0109 2416 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys

15:39:21.0109 2416 HTTP - ok

15:39:21.0156 2416 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll

15:39:21.0187 2416 HTTPFilter - ok

15:39:21.0187 2416 HVGAA - ok

15:39:21.0203 2416 i2omgmt - ok

15:39:21.0203 2416 i2omp - ok

15:39:21.0265 2416 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys

15:39:21.0281 2416 i8042prt - ok

15:39:21.0421 2416 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

15:39:21.0500 2416 idsvc - ok

15:39:21.0546 2416 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys

15:39:21.0562 2416 Imapi - ok

15:39:21.0625 2416 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe

15:39:21.0625 2416 ImapiService - ok

15:39:21.0640 2416 ini910u - ok

15:39:21.0828 2416 [ 14B48553BE78472D2BD3A518658A1710 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys

15:39:21.0875 2416 IntcAzAudAddService - ok

15:39:21.0890 2416 IntelIde - ok

15:39:21.0937 2416 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys

15:39:21.0953 2416 Ip6Fw - ok

15:39:21.0984 2416 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

15:39:22.0000 2416 IpFilterDriver - ok

15:39:22.0031 2416 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys

15:39:22.0031 2416 IpInIp - ok

15:39:22.0046 2416 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys

15:39:22.0062 2416 IpNat - ok

15:39:22.0140 2416 [ E6BE7A41A28D8F2DB174957454D32448 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe

15:39:22.0156 2416 iPod Service - ok

15:39:22.0171 2416 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys

15:39:22.0203 2416 IPSec - ok

15:39:22.0218 2416 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys

15:39:22.0312 2416 IRENUM - ok

15:39:22.0343 2416 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys

15:39:22.0343 2416 isapnp - ok

15:39:22.0500 2416 [ 691B9B7C0CC1653732717D292D6B305D ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe

15:39:22.0515 2416 JavaQuickStarterService - ok

15:39:22.0578 2416 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys

15:39:22.0578 2416 Kbdclass - ok

15:39:22.0578 2416 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys

15:39:22.0593 2416 kbdhid - ok

15:39:22.0625 2416 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys

15:39:22.0625 2416 kmixer - ok

15:39:22.0656 2416 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys

15:39:22.0671 2416 KSecDD - ok

15:39:22.0750 2416 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll

15:39:22.0765 2416 lanmanserver - ok

15:39:22.0843 2416 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll

15:39:22.0875 2416 lanmanworkstation - ok

15:39:22.0890 2416 lbrtfdc - ok

15:39:22.0953 2416 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll

15:39:22.0953 2416 LmHosts - ok

15:39:23.0015 2416 [ 3C318B9CD391371BED62126581EE9961 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

15:39:23.0015 2416 mdmxsdk - ok

15:39:23.0062 2416 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll

15:39:23.0062 2416 Messenger - ok

15:39:23.0187 2416 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe

15:39:23.0203 2416 Microsoft Office Groove Audit Service - ok

15:39:23.0265 2416 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys

15:39:23.0281 2416 mnmdd - ok

15:39:23.0328 2416 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe

15:39:23.0328 2416 mnmsrvc - ok

15:39:23.0390 2416 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys

15:39:23.0406 2416 Modem - ok

15:39:23.0453 2416 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys

15:39:23.0453 2416 Mouclass - ok

15:39:23.0531 2416 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys

15:39:23.0546 2416 mouhid - ok

15:39:23.0546 2416 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys

15:39:23.0562 2416 MountMgr - ok

15:39:23.0562 2416 mraid35x - ok

15:39:23.0609 2416 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys

15:39:23.0625 2416 MRxDAV - ok

15:39:23.0687 2416 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

15:39:23.0718 2416 MRxSmb - ok

15:39:23.0765 2416 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe

15:39:23.0765 2416 MSDTC - ok

15:39:23.0796 2416 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys

15:39:23.0796 2416 Msfs - ok

15:39:23.0812 2416 MSIServer - ok

15:39:23.0843 2416 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys

15:39:23.0843 2416 MSKSSRV - ok

15:39:23.0875 2416 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys

15:39:23.0890 2416 MSPCLOCK - ok

15:39:23.0906 2416 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys

15:39:23.0921 2416 MSPQM - ok

15:39:23.0953 2416 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys

15:39:23.0953 2416 mssmbios - ok

15:39:23.0984 2416 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys

15:39:24.0000 2416 Mup - ok

15:39:24.0031 2416 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll

15:39:24.0078 2416 napagent - ok

15:39:24.0078 2416 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys

15:39:24.0093 2416 NDIS - ok

15:39:24.0125 2416 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys

15:39:24.0125 2416 NdisTapi - ok

15:39:24.0140 2416 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys

15:39:24.0140 2416 Ndisuio - ok

15:39:24.0156 2416 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys

15:39:24.0156 2416 NdisWan - ok

15:39:24.0187 2416 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys

15:39:24.0203 2416 NDProxy - ok

15:39:24.0203 2416 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys

15:39:24.0203 2416 NetBIOS - ok

15:39:24.0296 2416 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys

15:39:24.0343 2416 NetBT - ok

15:39:24.0406 2416 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe

15:39:24.0406 2416 NetDDE - ok

15:39:24.0421 2416 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe

15:39:24.0421 2416 NetDDEdsdm - ok

15:39:24.0468 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe

15:39:24.0484 2416 Netlogon - ok

15:39:24.0531 2416 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll

15:39:24.0531 2416 Netman - ok

15:39:24.0625 2416 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

15:39:24.0640 2416 NetTcpPortSharing - ok

15:39:24.0687 2416 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys

15:39:24.0687 2416 NIC1394 - ok

15:39:24.0718 2416 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll

15:39:24.0718 2416 Nla - ok

15:39:24.0734 2416 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys

15:39:24.0734 2416 Npfs - ok

15:39:24.0812 2416 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys

15:39:24.0828 2416 Ntfs - ok

15:39:24.0828 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe

15:39:24.0828 2416 NtLmSsp - ok

15:39:24.0906 2416 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll

15:39:24.0984 2416 NtmsSvc - ok

15:39:25.0031 2416 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys

15:39:25.0031 2416 Null - ok

15:39:25.0171 2416 [ 642A87877F83313EB5302749CD479024 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

15:39:25.0343 2416 nv - ok

15:39:25.0406 2416 [ 22EEDB34C4D7613A25B10C347C6C4C21 ] NVENETFD C:\WINDOWS\system32\DRIVERS\NVENETFD.sys

15:39:25.0421 2416 NVENETFD - ok

15:39:25.0468 2416 [ 5E3F6AD5CAD0F12D3CCCD06FD964087A ] nvnetbus C:\WINDOWS\system32\DRIVERS\nvnetbus.sys

15:39:25.0468 2416 nvnetbus - ok

15:39:25.0484 2416 [ B0903C021BFCD6055C053A569EF98AEF ] NVSvc C:\WINDOWS\system32\nvsvc32.exe

15:39:25.0500 2416 NVSvc - ok

15:39:25.0546 2416 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

15:39:25.0546 2416 NwlnkFlt - ok

15:39:25.0578 2416 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

15:39:25.0593 2416 NwlnkFwd - ok

15:39:25.0718 2416 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

15:39:25.0765 2416 odserv - ok

15:39:25.0796 2416 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys

15:39:25.0812 2416 ohci1394 - ok

15:39:25.0906 2416 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

15:39:25.0921 2416 ose - ok

15:39:25.0968 2416 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys

15:39:25.0968 2416 Parport - ok

15:39:25.0984 2416 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys

15:39:25.0984 2416 PartMgr - ok

15:39:26.0031 2416 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys

15:39:26.0031 2416 ParVdm - ok

15:39:26.0031 2416 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys

15:39:26.0046 2416 PCI - ok

15:39:26.0078 2416 PCIDump - ok

15:39:26.0109 2416 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys

15:39:26.0109 2416 PCIIde - ok

15:39:26.0140 2416 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys

15:39:26.0156 2416 Pcmcia - ok

15:39:26.0156 2416 PDCOMP - ok

15:39:26.0171 2416 PDFRAME - ok

15:39:26.0171 2416 PDRELI - ok

15:39:26.0171 2416 PDRFRAME - ok

15:39:26.0187 2416 perc2 - ok

15:39:26.0187 2416 perc2hib - ok

15:39:26.0234 2416 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe

15:39:26.0234 2416 PlugPlay - ok

15:39:26.0281 2416 [ D31F88C5F19EEFA366A415D6BC5F2ABC ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe

15:39:26.0281 2416 Pml Driver HPZ12 - ok

15:39:26.0281 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe

15:39:26.0296 2416 PolicyAgent - ok

15:39:26.0296 2416 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys

15:39:26.0312 2416 PptpMiniport - ok

15:39:26.0312 2416 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys

15:39:26.0328 2416 Processor - ok

15:39:26.0328 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe

15:39:26.0328 2416 ProtectedStorage - ok

15:39:26.0390 2416 [ 390C204CED3785609AB24E9C52054A84 ] Ps2 C:\WINDOWS\system32\DRIVERS\PS2.sys

15:39:26.0421 2416 Ps2 - ok

15:39:26.0421 2416 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys

15:39:26.0421 2416 PSched - ok

15:39:26.0437 2416 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys

15:39:26.0453 2416 Ptilink - ok

15:39:26.0484 2416 [ 0457E25BB122B854E267CF552DCDC370 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys

15:39:26.0500 2416 PxHelp20 - ok

15:39:26.0500 2416 ql1080 - ok

15:39:26.0515 2416 Ql10wnt - ok

15:39:26.0515 2416 ql12160 - ok

15:39:26.0531 2416 ql1240 - ok

15:39:26.0531 2416 ql1280 - ok

15:39:26.0546 2416 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys

15:39:26.0546 2416 RasAcd - ok

15:39:26.0609 2416 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll

15:39:26.0625 2416 RasAuto - ok

15:39:26.0671 2416 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

15:39:26.0671 2416 Rasl2tp - ok

15:39:26.0734 2416 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll

15:39:26.0750 2416 RasMan - ok

15:39:26.0796 2416 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys

15:39:26.0796 2416 RasPppoe - ok

15:39:26.0796 2416 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys

15:39:26.0812 2416 Raspti - ok

15:39:26.0828 2416 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys

15:39:26.0828 2416 Rdbss - ok

15:39:26.0843 2416 RDFYUATO - ok

15:39:26.0859 2416 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

15:39:26.0859 2416 RDPCDD - ok

15:39:26.0875 2416 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys

15:39:26.0890 2416 rdpdr - ok

15:39:26.0937 2416 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys

15:39:26.0937 2416 RDPWD - ok

15:39:26.0984 2416 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe

15:39:27.0000 2416 RDSessMgr - ok

15:39:27.0015 2416 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys

15:39:27.0031 2416 redbook - ok

15:39:27.0062 2416 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll

15:39:27.0078 2416 RemoteAccess - ok

15:39:27.0109 2416 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll

15:39:27.0125 2416 RemoteRegistry - ok

15:39:27.0125 2416 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe

15:39:27.0140 2416 RpcLocator - ok

15:39:27.0156 2416 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll

15:39:27.0156 2416 RpcSs - ok

15:39:27.0218 2416 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe

15:39:27.0218 2416 RSVP - ok

15:39:27.0234 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe

15:39:27.0234 2416 SamSs - ok

15:39:27.0250 2416 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe

15:39:27.0265 2416 SCardSvr - ok

15:39:27.0328 2416 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll

15:39:27.0343 2416 Schedule - ok

15:39:27.0406 2416 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys

15:39:27.0406 2416 Secdrv - ok

15:39:27.0468 2416 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll

15:39:27.0468 2416 seclogon - ok

15:39:27.0500 2416 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll

15:39:27.0500 2416 SENS - ok

15:39:27.0531 2416 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\drivers\Serial.sys

15:39:27.0531 2416 Serial - ok

15:39:27.0609 2416 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys

15:39:27.0609 2416 Sfloppy - ok

15:39:27.0687 2416 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll

15:39:27.0687 2416 SharedAccess - ok

15:39:27.0703 2416 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll

15:39:27.0703 2416 ShellHWDetection - ok

15:39:27.0718 2416 Simbad - ok

15:39:27.0718 2416 Sparrow - ok

15:39:27.0796 2416 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys

15:39:27.0796 2416 splitter - ok

15:39:27.0859 2416 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe

15:39:27.0859 2416 Spooler - ok

15:39:27.0875 2416 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys

15:39:27.0890 2416 sr - ok

15:39:27.0937 2416 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll

15:39:28.0234 2416 srservice - ok

15:39:28.0343 2416 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys

15:39:28.0390 2416 Srv - ok

15:39:28.0453 2416 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll

15:39:28.0453 2416 SSDPSRV - ok

15:39:28.0500 2416 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

15:39:28.0500 2416 ssmdrv - ok

15:39:28.0562 2416 [ A9573045BAA16EAB9B1085205B82F1ED ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys

15:39:28.0562 2416 StillCam - ok

15:39:28.0640 2416 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll

15:39:28.0687 2416 stisvc - ok

15:39:28.0734 2416 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys

15:39:28.0734 2416 swenum - ok

15:39:28.0781 2416 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys

15:39:28.0781 2416 swmidi - ok

15:39:28.0796 2416 SwPrv - ok

15:39:28.0796 2416 symc810 - ok

15:39:28.0812 2416 symc8xx - ok

15:39:28.0812 2416 sym_hi - ok

15:39:28.0812 2416 sym_u3 - ok

15:39:28.0843 2416 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys

15:39:28.0843 2416 sysaudio - ok

15:39:28.0859 2416 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe

15:39:28.0859 2416 SysmonLog - ok

15:39:28.0921 2416 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll

15:39:28.0937 2416 TapiSrv - ok

15:39:28.0968 2416 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys

15:39:29.0015 2416 Tcpip - ok

15:39:29.0062 2416 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys

15:39:29.0062 2416 TDPIPE - ok

15:39:29.0062 2416 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys

15:39:29.0078 2416 TDTCP - ok

15:39:29.0125 2416 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys

15:39:29.0125 2416 TermDD - ok

15:39:29.0203 2416 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll

15:39:29.0218 2416 TermService - ok

15:39:29.0250 2416 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll

15:39:29.0250 2416 Themes - ok

15:39:29.0312 2416 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe

15:39:29.0312 2416 TlntSvr - ok

15:39:29.0328 2416 TosIde - ok

15:39:29.0375 2416 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll

15:39:29.0390 2416 TrkWks - ok

15:39:29.0421 2416 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys

15:39:29.0421 2416 Udfs - ok

15:39:29.0437 2416 ultra - ok

15:39:29.0500 2416 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys

15:39:29.0515 2416 Update - ok

15:39:29.0546 2416 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll

15:39:29.0562 2416 upnphost - ok

15:39:29.0562 2416 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe

15:39:29.0578 2416 UPS - ok

15:39:29.0625 2416 [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys

15:39:29.0625 2416 USBAAPL - ok

15:39:29.0687 2416 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys

15:39:29.0687 2416 usbccgp - ok

15:39:29.0750 2416 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys

15:39:29.0750 2416 usbehci - ok

15:39:29.0796 2416 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys

15:39:29.0796 2416 usbhub - ok

15:39:29.0843 2416 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys

15:39:29.0843 2416 usbohci - ok

15:39:29.0875 2416 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys

15:39:29.0890 2416 usbprint - ok

15:39:29.0921 2416 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys

15:39:29.0921 2416 usbscan - ok

15:39:29.0968 2416 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

15:39:29.0968 2416 usbstor - ok

15:39:30.0031 2416 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys

15:39:30.0031 2416 VgaSave - ok

15:39:30.0046 2416 ViaIde - ok

15:39:30.0093 2416 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys

15:39:30.0109 2416 VolSnap - ok

15:39:30.0171 2416 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe

15:39:30.0203 2416 VSS - ok

15:39:30.0234 2416 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll

15:39:30.0250 2416 W32Time - ok

15:39:30.0296 2416 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys

15:39:30.0312 2416 Wanarp - ok

15:39:30.0312 2416 WDICA - ok

15:39:30.0328 2416 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys

15:39:30.0343 2416 wdmaud - ok

15:39:30.0343 2416 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll

15:39:30.0359 2416 WebClient - ok

15:39:30.0390 2416 [ 473EE64C368CE2EED110376C11960259 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys

15:39:30.0484 2416 winachsf - ok

15:39:30.0593 2416 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll

15:39:30.0609 2416 winmgmt - ok

15:39:30.0687 2416 [ 18F347402DA544A780949B8FDF83351B ] WinRM C:\WINDOWS\system32\WsmSvc.dll

15:39:30.0765 2416 WinRM - ok

15:39:30.0828 2416 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll

15:39:30.0828 2416 WmdmPmSN - ok

15:39:30.0859 2416 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll

15:39:30.0890 2416 Wmi - ok

15:39:30.0906 2416 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe

15:39:30.0921 2416 WmiApSrv - ok

15:39:31.0031 2416 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe

15:39:31.0109 2416 WMPNetworkSvc - ok

15:39:31.0218 2416 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

15:39:31.0265 2416 WPFFontCache_v0400 - ok

15:39:31.0312 2416 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys

15:39:31.0312 2416 WS2IFSL - ok

15:39:31.0375 2416 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll

15:39:31.0406 2416 wscsvc - ok

15:39:31.0421 2416 WSearch - ok

15:39:31.0484 2416 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll

15:39:31.0484 2416 wuauserv - ok

15:39:31.0546 2416 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys

15:39:31.0546 2416 WudfPf - ok

15:39:31.0578 2416 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys

15:39:31.0593 2416 WudfRd - ok

15:39:31.0625 2416 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll

15:39:31.0640 2416 WudfSvc - ok

15:39:31.0718 2416 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll

15:39:31.0734 2416 WZCSVC - ok

15:39:31.0781 2416 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll

15:39:31.0796 2416 xmlprov - ok

15:39:31.0796 2416 ================ Scan global ===============================

15:39:31.0843 2416 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll

15:39:31.0921 2416 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll

15:39:31.0953 2416 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll

15:39:31.0984 2416 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe

15:39:31.0984 2416 [Global] - ok

15:39:31.0984 2416 ================ Scan MBR ==================================

15:39:32.0015 2416 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0

15:39:32.0015 2416 Suspicious mbr (Forged): \Device\Harddisk0\DR0

15:39:32.0046 2416 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected

15:39:32.0046 2416 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)

15:39:32.0046 2416 ================ Scan VBR ==================================

15:39:32.0078 2416 [ 2B94AFEE9341CC63EE629935CF7ECE74 ] \Device\Harddisk0\DR0\Partition1

15:39:32.0078 2416 \Device\Harddisk0\DR0\Partition1 - ok

15:39:32.0078 2416 ============================================================

15:39:32.0078 2416 Scan finished

15:39:32.0078 2416 ============================================================

15:39:32.0078 1816 Detected object count: 1

15:39:32.0078 1816 Actual detected object count: 1

15:39:41.0046 1816 \Device\Harddisk0\DR0\# - copied to quarantine

15:39:41.0046 1816 \Device\Harddisk0\DR0 - copied to quarantine

15:39:41.0062 1816 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine

15:39:41.0078 1816 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine

15:39:41.0078 1816 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine

15:39:41.0078 1816 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine

15:39:41.0093 1816 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine

15:39:41.0125 1816 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine

15:39:41.0125 1816 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine

15:39:41.0125 1816 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine

15:39:41.0171 1816 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine

15:39:41.0171 1816 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine

15:39:41.0171 1816 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine

15:39:41.0171 1816 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine

15:39:41.0187 1816 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot

15:39:41.0187 1816 \Device\Harddisk0\DR0 - ok

15:39:41.0218 1816 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure

15:40:01.0562 1212 Deinitialize success

Now after reboot.....

15:41:49.0906 2192 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

15:41:51.0031 2192 ============================================================

15:41:51.0031 2192 Current date / time: 2012/11/30 15:41:51.0031

15:41:51.0031 2192 SystemInfo:

15:41:51.0031 2192

15:41:51.0031 2192 OS Version: 5.1.2600 ServicePack: 3.0

15:41:51.0031 2192 Product type: Workstation

15:41:51.0031 2192 ComputerName: JOLLY-DESKTOP

15:41:51.0125 2192 UserName: Jolly Household

15:41:51.0125 2192 Windows directory: C:\WINDOWS

15:41:51.0125 2192 System windows directory: C:\WINDOWS

15:41:51.0140 2192 Processor architecture: Intel x86

15:41:51.0140 2192 Number of processors: 2

15:41:51.0140 2192 Page size: 0x1000

15:41:51.0140 2192 Boot type: Normal boot

15:41:51.0140 2192 ============================================================

15:41:55.0375 2192 BG loaded

15:41:57.0484 2192 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x7E2D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054

15:41:57.0500 2192 ============================================================

15:41:57.0500 2192 \Device\Harddisk0\DR0:

15:41:57.0515 2192 MBR partitions:

15:41:57.0515 2192 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1D1C0681

15:41:57.0515 2192 ============================================================

15:41:57.0578 2192 C: <-> \Device\Harddisk0\DR0\Partition1

15:41:57.0593 2192 ============================================================

15:41:57.0593 2192 Initialize success

15:41:57.0593 2192 ============================================================

15:43:44.0125 2908 ============================================================

15:43:44.0125 2908 Scan started

15:43:44.0125 2908 Mode: Manual;

15:43:44.0125 2908 ============================================================

15:43:44.0828 2908 ================ Scan system memory ========================

15:43:44.0828 2908 System memory - ok

15:43:44.0828 2908 ================ Scan services =============================

15:43:44.0906 2908 Abiosdsk - ok

15:43:44.0906 2908 abp480n5 - ok

15:43:44.0968 2908 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys

15:43:44.0984 2908 ACPI - ok

15:43:45.0015 2908 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys

15:43:45.0015 2908 ACPIEC - ok

15:43:45.0156 2908 [ 0CB0AA071C7B86A64F361DCFDF357329 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

15:43:45.0156 2908 AdobeFlashPlayerUpdateSvc - ok

15:43:45.0156 2908 adpu160m - ok

15:43:45.0234 2908 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys

15:43:45.0250 2908 aec - ok

15:43:45.0328 2908 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys

15:43:45.0328 2908 AFD - ok

15:43:45.0343 2908 Aha154x - ok

15:43:45.0343 2908 aic78u2 - ok

15:43:45.0343 2908 aic78xx - ok

15:43:45.0406 2908 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll

15:43:45.0406 2908 Alerter - ok

15:43:45.0453 2908 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe

15:43:45.0453 2908 ALG - ok

15:43:45.0468 2908 AliIde - ok

15:43:45.0531 2908 [ 033448D435E65C4BD72E70521FD05C76 ] AmdPPM C:\WINDOWS\system32\DRIVERS\AmdPPM.sys

15:43:45.0531 2908 AmdPPM - ok

15:43:45.0546 2908 amsint - ok

15:43:45.0656 2908 [ 99EEA1B057FA11CF069A4870D218A003 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe

15:43:45.0703 2908 AntiVirSchedulerService - ok

15:43:45.0781 2908 [ 4C040249F009A4807B2955D5E5210104 ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe

15:43:45.0796 2908 AntiVirService - ok

15:43:45.0828 2908 [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

15:43:45.0828 2908 Apple Mobile Device - ok

15:43:45.0906 2908 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll

15:43:45.0921 2908 AppMgmt - ok

15:43:45.0953 2908 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys

15:43:45.0953 2908 Arp1394 - ok

15:43:45.0968 2908 asc - ok

15:43:45.0968 2908 asc3350p - ok

15:43:45.0968 2908 asc3550 - ok

15:43:46.0156 2908 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

15:43:46.0203 2908 aspnet_state - ok

15:43:46.0218 2908 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys

15:43:46.0250 2908 AsyncMac - ok

15:43:46.0296 2908 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys

15:43:46.0296 2908 atapi - ok

15:43:46.0296 2908 Atdisk - ok

15:43:46.0312 2908 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys

15:43:46.0328 2908 Atmarpc - ok

15:43:46.0375 2908 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll

15:43:46.0375 2908 AudioSrv - ok

15:43:46.0437 2908 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys

15:43:46.0437 2908 audstub - ok

15:43:46.0437 2908 [ 680B3A1BE559B5D5AAC04C7949469DD6 ] avgntflt C:\WINDOWS\system32\DRIVERS\avgntflt.sys

15:43:46.0453 2908 avgntflt - ok

15:43:46.0500 2908 [ 6B289080B9752DAD39C1C2B98B479DCE ] avipbb C:\WINDOWS\system32\DRIVERS\avipbb.sys

15:43:46.0515 2908 avipbb - ok

15:43:46.0578 2908 [ FFB78D74E1EA5F811341A6E7AC547A46 ] avkmgr C:\WINDOWS\system32\DRIVERS\avkmgr.sys

15:43:46.0578 2908 avkmgr - ok

15:43:46.0640 2908 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys

15:43:46.0640 2908 Beep - ok

15:43:46.0703 2908 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll

15:43:46.0796 2908 BITS - ok

15:43:46.0828 2908 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe

15:43:46.0843 2908 Bonjour Service - ok

15:43:46.0890 2908 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll

15:43:46.0906 2908 Browser - ok

15:43:47.0046 2908 catchme - ok

15:43:47.0093 2908 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys

15:43:47.0093 2908 cbidf2k - ok

15:43:47.0093 2908 cd20xrnt - ok

15:43:47.0140 2908 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys

15:43:47.0156 2908 Cdaudio - ok

15:43:47.0187 2908 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys

15:43:47.0203 2908 Cdfs - ok

15:43:47.0218 2908 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys

15:43:47.0234 2908 Cdrom - ok

15:43:47.0234 2908 Changer - ok

15:43:47.0296 2908 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe

15:43:47.0296 2908 CiSvc - ok

15:43:47.0312 2908 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe

15:43:47.0328 2908 ClipSrv - ok

15:43:47.0375 2908 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

15:43:47.0390 2908 clr_optimization_v2.0.50727_32 - ok

15:43:47.0500 2908 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

15:43:47.0500 2908 clr_optimization_v4.0.30319_32 - ok

15:43:47.0515 2908 CmdIde - ok

15:43:47.0515 2908 COMSysApp - ok

15:43:47.0531 2908 Cpqarray - ok

15:43:47.0531 2908 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll

15:43:47.0546 2908 CryptSvc - ok

15:43:47.0546 2908 dac2w2k - ok

15:43:47.0562 2908 dac960nt - ok

15:43:47.0625 2908 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll

15:43:47.0625 2908 DcomLaunch - ok

15:43:47.0687 2908 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll

15:43:47.0687 2908 Dhcp - ok

15:43:47.0734 2908 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys

15:43:47.0750 2908 Disk - ok

15:43:47.0750 2908 dmadmin - ok

15:43:47.0812 2908 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys

15:43:47.0890 2908 dmboot - ok

15:43:47.0921 2908 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys

15:43:47.0937 2908 dmio - ok

15:43:47.0968 2908 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys

15:43:47.0968 2908 dmload - ok

15:43:48.0031 2908 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll

15:43:48.0046 2908 dmserver - ok

15:43:48.0093 2908 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys

15:43:48.0109 2908 DMusic - ok

15:43:48.0156 2908 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll

15:43:48.0171 2908 Dnscache - ok

15:43:48.0218 2908 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll

15:43:48.0234 2908 Dot3svc - ok

15:43:48.0234 2908 dpti2o - ok

15:43:48.0281 2908 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys

15:43:48.0281 2908 drmkaud - ok

15:43:48.0328 2908 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll

15:43:48.0343 2908 EapHost - ok

15:43:48.0390 2908 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll

15:43:48.0390 2908 ERSvc - ok

15:43:48.0453 2908 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe

15:43:48.0468 2908 Eventlog - ok

15:43:48.0531 2908 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll

15:43:48.0531 2908 EventSystem - ok

15:43:48.0593 2908 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys

15:43:48.0593 2908 Fastfat - ok

15:43:48.0640 2908 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll

15:43:48.0656 2908 FastUserSwitchingCompatibility - ok

15:43:48.0703 2908 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys

15:43:48.0718 2908 Fdc - ok

15:43:48.0718 2908 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys

15:43:48.0734 2908 Fips - ok

15:43:48.0750 2908 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys

15:43:48.0765 2908 Flpydisk - ok

15:43:48.0796 2908 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys

15:43:48.0812 2908 FltMgr - ok

15:43:48.0906 2908 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

15:43:48.0921 2908 FontCache3.0.0.0 - ok

15:43:48.0968 2908 [ E0087225B137E57239FF40F8AE82059B ] fssfltr C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys

15:43:48.0968 2908 fssfltr - ok

15:43:49.0109 2908 [ 45B52394F9624237F33A8A3D73C0B221 ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe

15:43:49.0156 2908 fsssvc - ok

15:43:49.0171 2908 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys

15:43:49.0171 2908 Fs_Rec - ok

15:43:49.0171 2908 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys

15:43:49.0187 2908 Ftdisk - ok

15:43:49.0187 2908 GALKNJKE - ok

15:43:49.0250 2908 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

15:43:49.0250 2908 GEARAspiWDM - ok

15:43:49.0296 2908 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys

15:43:49.0312 2908 Gpc - ok

15:43:49.0640 2908 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe

15:43:49.0656 2908 gupdate - ok

15:43:49.0671 2908 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe

15:43:49.0671 2908 gupdatem - ok

15:43:49.0734 2908 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

15:43:49.0750 2908 gusvc - ok

15:43:49.0796 2908 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

15:43:49.0796 2908 HDAudBus - ok

15:43:49.0906 2908 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

15:43:49.0906 2908 helpsvc - ok

15:43:49.0937 2908 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll

15:43:49.0953 2908 HidServ - ok

15:43:49.0984 2908 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys

15:43:49.0984 2908 HidUsb - ok

15:43:50.0046 2908 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll

15:43:50.0093 2908 hkmsvc - ok

15:43:50.0328 2908 [ C5F00D15AA15CB7F55A027FF75E44BB7 ] HP Port Resolver C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE

15:43:50.0406 2908 HP Port Resolver - ok

15:43:50.0421 2908 [ C5A288E4CEEF5A26D105117BAA3763AB ] HP Status Server C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE

15:43:50.0437 2908 HP Status Server - ok

15:43:50.0453 2908 hpn - ok

15:43:50.0468 2908 [ 30CA91E657CEDE2F95359D6EF186F650 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys

15:43:50.0484 2908 HPZid412 - ok

15:43:50.0515 2908 [ EFD31AFA752AA7C7BBB57BCBE2B01C78 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys

15:43:50.0515 2908 HPZipr12 - ok

15:43:50.0546 2908 [ 7AC43C38CA8FD7ED0B0A4466F753E06E ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys

15:43:50.0562 2908 HPZius12 - ok

15:43:50.0593 2908 [ 5DF616ADDB75C1AD36C1F9E4DE0F7654 ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys

15:43:50.0609 2908 HSFHWBS2 - ok

15:43:50.0640 2908 [ DFA8F86C0DBCA7DB948043AA3BE6793B ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys

15:43:50.0656 2908 HSF_DP - ok

15:43:50.0734 2908 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys

15:43:50.0734 2908 HTTP - ok

15:43:50.0781 2908 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll

15:43:50.0796 2908 HTTPFilter - ok

15:43:50.0796 2908 HVGAA - ok

15:43:50.0796 2908 i2omgmt - ok

15:43:50.0812 2908 i2omp - ok

15:43:50.0859 2908 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys

15:43:50.0859 2908 i8042prt - ok

15:43:50.0968 2908 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

15:43:51.0046 2908 idsvc - ok

15:43:51.0109 2908 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys

15:43:51.0109 2908 Imapi - ok

15:43:51.0250 2908 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe

15:43:51.0250 2908 ImapiService - ok

15:43:51.0265 2908 ini910u - ok

15:43:51.0453 2908 [ 14B48553BE78472D2BD3A518658A1710 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys

15:43:51.0500 2908 IntcAzAudAddService - ok

15:43:51.0500 2908 IntelIde - ok

15:43:51.0531 2908 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys

15:43:51.0531 2908 Ip6Fw - ok

15:43:51.0578 2908 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

15:43:51.0593 2908 IpFilterDriver - ok

15:43:51.0609 2908 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys

15:43:51.0625 2908 IpInIp - ok

15:43:51.0640 2908 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys

15:43:51.0656 2908 IpNat - ok

15:43:51.0718 2908 [ E6BE7A41A28D8F2DB174957454D32448 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe

15:43:51.0734 2908 iPod Service - ok

15:43:51.0781 2908 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys

15:43:51.0781 2908 IPSec - ok

15:43:51.0828 2908 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys

15:43:51.0828 2908 IRENUM - ok

15:43:51.0859 2908 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys

15:43:51.0875 2908 isapnp - ok

15:43:52.0015 2908 [ 691B9B7C0CC1653732717D292D6B305D ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe

15:43:52.0031 2908 JavaQuickStarterService - ok

15:43:52.0062 2908 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys

15:43:52.0078 2908 Kbdclass - ok

15:43:52.0078 2908 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys

15:43:52.0078 2908 kbdhid - ok

15:43:52.0125 2908 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys

15:43:52.0156 2908 kmixer - ok

15:43:52.0203 2908 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys

15:43:52.0234 2908 KSecDD - ok

15:43:52.0359 2908 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll

15:43:52.0375 2908 lanmanserver - ok

15:43:52.0468 2908 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll

15:43:52.0484 2908 lanmanworkstation - ok

15:43:52.0484 2908 lbrtfdc - ok

15:43:52.0515 2908 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll

15:43:52.0515 2908 LmHosts - ok

15:43:52.0578 2908 [ 3C318B9CD391371BED62126581EE9961 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

15:43:52.0578 2908 mdmxsdk - ok

15:43:52.0609 2908 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll

15:43:52.0625 2908 Messenger - ok

15:43:52.0765 2908 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe

15:43:52.0765 2908 Microsoft Office Groove Audit Service - ok

15:43:52.0843 2908 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys

15:43:52.0843 2908 mnmdd - ok

15:43:52.0875 2908 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe

15:43:52.0875 2908 mnmsrvc - ok

15:43:52.0921 2908 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys

15:43:52.0921 2908 Modem - ok

15:43:52.0937 2908 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys

15:43:52.0937 2908 Mouclass - ok

15:43:53.0000 2908 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys

15:43:53.0000 2908 mouhid - ok

15:43:53.0000 2908 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys

15:43:53.0015 2908 MountMgr - ok

15:43:53.0015 2908 mraid35x - ok

15:43:53.0046 2908 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys

15:43:53.0062 2908 MRxDAV - ok

15:43:53.0093 2908 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

15:43:53.0109 2908 MRxSmb - ok

15:43:53.0140 2908 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe

15:43:53.0156 2908 MSDTC - ok

15:43:53.0171 2908 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys

15:43:53.0187 2908 Msfs - ok

15:43:53.0187 2908 MSIServer - ok

15:43:53.0218 2908 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys

15:43:53.0250 2908 MSKSSRV - ok

15:43:53.0312 2908 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys

15:43:53.0343 2908 MSPCLOCK - ok

15:43:53.0359 2908 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys

15:43:53.0359 2908 MSPQM - ok

15:43:53.0390 2908 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys

15:43:53.0406 2908 mssmbios - ok

15:43:53.0453 2908 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys

15:43:53.0468 2908 Mup - ok

15:43:53.0515 2908 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll

15:43:53.0562 2908 napagent - ok

15:43:53.0562 2908 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys

15:43:53.0593 2908 NDIS - ok

15:43:53.0609 2908 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys

15:43:53.0609 2908 NdisTapi - ok

15:43:53.0656 2908 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys

15:43:53.0671 2908 Ndisuio - ok

15:43:53.0671 2908 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys

15:43:53.0687 2908 NdisWan - ok

15:43:53.0718 2908 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys

15:43:53.0718 2908 NDProxy - ok

15:43:53.0734 2908 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys

15:43:53.0734 2908 NetBIOS - ok

15:43:53.0765 2908 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys

15:43:53.0781 2908 NetBT - ok

15:43:53.0843 2908 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe

15:43:53.0843 2908 NetDDE - ok

15:43:53.0859 2908 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe

15:43:53.0859 2908 NetDDEdsdm - ok

15:43:53.0875 2908 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe

15:43:53.0875 2908 Netlogon - ok

15:43:53.0937 2908 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll

15:43:53.0937 2908 Netman - ok

15:43:54.0015 2908 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

15:43:54.0031 2908 NetTcpPortSharing - ok

15:43:54.0078 2908 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys

15:43:54.0093 2908 NIC1394 - ok

15:43:54.0109 2908 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll

15:43:54.0109 2908 Nla - ok

15:43:54.0109 2908 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys

15:43:54.0125 2908 Npfs - ok

15:43:54.0187 2908 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys

15:43:54.0250 2908 Ntfs - ok

15:43:54.0265 2908 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe

15:43:54.0265 2908 NtLmSsp - ok

15:43:54.0375 2908 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll

15:43:54.0468 2908 NtmsSvc - ok

15:43:54.0484 2908 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys

15:43:54.0484 2908 Null - ok

15:43:54.0625 2908 [ 642A87877F83313EB5302749CD479024 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

15:43:54.0671 2908 nv - ok

15:43:54.0734 2908 [ 22EEDB34C4D7613A25B10C347C6C4C21 ] NVENETFD C:\WINDOWS\system32\DRIVERS\NVENETFD.sys

15:43:54.0750 2908 NVENETFD - ok

15:43:54.0796 2908 [ 5E3F6AD5CAD0F12D3CCCD06FD964087A ] nvnetbus C:\WINDOWS\system32\DRIVERS\nvnetbus.sys

15:43:54.0812 2908 nvnetbus - ok

15:43:54.0828 2908 [ B0903C021BFCD6055C053A569EF98AEF ] NVSvc C:\WINDOWS\system32\nvsvc32.exe

15:43:54.0828 2908 NVSvc - ok

15:43:54.0875 2908 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

15:43:54.0875 2908 NwlnkFlt - ok

15:43:54.0921 2908 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

15:43:54.0937 2908 NwlnkFwd - ok

15:43:55.0218 2908 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

15:43:55.0265 2908 odserv - ok

15:43:55.0265 2908 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys

15:43:55.0281 2908 ohci1394 - ok

15:43:55.0359 2908 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

15:43:55.0359 2908 ose - ok

15:43:55.0406 2908 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys

15:43:55.0421 2908 Parport - ok

15:43:55.0453 2908 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys

15:43:55.0453 2908 PartMgr - ok

15:43:55.0500 2908 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys

15:43:55.0531 2908 ParVdm - ok

15:43:55.0562 2908 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys

15:43:55.0640 2908 PCI - ok

15:43:55.0640 2908 PCIDump - ok

15:43:55.0703 2908 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys

15:43:55.0734 2908 PCIIde - ok

15:43:55.0796 2908 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys

15:43:55.0796 2908 Pcmcia - ok

15:43:55.0812 2908 PDCOMP - ok

15:43:55.0812 2908 PDFRAME - ok

15:43:55.0812 2908 PDRELI - ok

15:43:55.0828 2908 PDRFRAME - ok

15:43:55.0828 2908 perc2 - ok

15:43:55.0828 2908 perc2hib - ok

15:43:55.0875 2908 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe

15:43:55.0875 2908 PlugPlay - ok

15:43:55.0921 2908 [ D31F88C5F19EEFA366A415D6BC5F2ABC ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe

15:43:55.0937 2908 Pml Driver HPZ12 - ok

15:43:55.0937 2908 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe

15:43:55.0937 2908 PolicyAgent - ok

15:43:56.0000 2908 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys

15:43:56.0000 2908 PptpMiniport - ok

15:43:56.0046 2908 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys

15:43:56.0062 2908 Processor - ok

15:43:56.0062 2908 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe

15:43:56.0062 2908 ProtectedStorage - ok

15:43:56.0109 2908 [ 390C204CED3785609AB24E9C52054A84 ] Ps2 C:\WINDOWS\system32\DRIVERS\PS2.sys

15:43:56.0125 2908 Ps2 - ok

15:43:56.0140 2908 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys

15:43:56.0156 2908 PSched - ok

15:43:56.0156 2908 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys

15:43:56.0156 2908 Ptilink - ok

15:43:56.0187 2908 [ 0457E25BB122B854E267CF552DCDC370 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys

15:43:56.0218 2908 PxHelp20 - ok

15:43:56.0218 2908 ql1080 - ok

15:43:56.0234 2908 Ql10wnt - ok

15:43:56.0234 2908 ql12160 - ok

15:43:56.0250 2908 ql1240 - ok

15:43:56.0250 2908 ql1280 - ok

15:43:56.0312 2908 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys

15:43:56.0312 2908 RasAcd - ok

15:43:56.0375 2908 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll

15:43:56.0390 2908 RasAuto - ok

15:43:56.0421 2908 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

15:43:56.0421 2908 Rasl2tp - ok

15:43:56.0500 2908 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll

15:43:56.0500 2908 RasMan - ok

15:43:56.0515 2908 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys

15:43:56.0531 2908 RasPppoe - ok

15:43:56.0531 2908 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys

15:43:56.0531 2908 Raspti - ok

15:43:56.0546 2908 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys

15:43:56.0562 2908 Rdbss - ok

15:43:56.0562 2908 RDFYUATO - ok

15:43:56.0578 2908 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

15:43:56.0578 2908 RDPCDD - ok

15:43:56.0609 2908 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys

15:43:56.0609 2908 rdpdr - ok

15:43:56.0656 2908 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys

15:43:56.0671 2908 RDPWD - ok

15:43:56.0750 2908 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe

15:43:56.0765 2908 RDSessMgr - ok

15:43:56.0812 2908 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys

15:43:56.0828 2908 redbook - ok

15:43:56.0859 2908 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll

15:43:56.0875 2908 RemoteAccess - ok

15:43:56.0906 2908 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll

15:43:56.0921 2908 RemoteRegistry - ok

15:43:56.0921 2908 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe

15:43:56.0937 2908 RpcLocator - ok

15:43:56.0953 2908 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll

15:43:56.0953 2908 RpcSs - ok

15:43:57.0015 2908 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe

15:43:57.0015 2908 RSVP - ok

15:43:57.0062 2908 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe

15:43:57.0062 2908 SamSs - ok

15:43:57.0093 2908 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe

15:43:57.0109 2908 SCardSvr - ok

15:43:57.0156 2908 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll

15:43:57.0171 2908 Schedule - ok

15:43:57.0218 2908 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys

15:43:57.0250 2908 Secdrv - ok

15:43:57.0281 2908 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll

15:43:57.0296 2908 seclogon - ok

15:43:57.0312 2908 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll

15:43:57.0312 2908 SENS - ok

15:43:57.0359 2908 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\drivers\Serial.sys

15:43:57.0359 2908 Serial - ok

15:43:57.0421 2908 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys

15:43:57.0421 2908 Sfloppy - ok

15:43:57.0484 2908 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll

15:43:57.0500 2908 SharedAccess - ok

15:43:57.0515 2908 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll

15:43:57.0515 2908 ShellHWDetection - ok

15:43:57.0515 2908 Simbad - ok

15:43:57.0531 2908 Sparrow - ok

15:43:57.0593 2908 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys

15:43:57.0593 2908 splitter - ok

15:43:57.0640 2908 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe

15:43:57.0656 2908 Spooler - ok

15:43:57.0671 2908 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys

15:43:57.0671 2908 sr - ok

15:43:57.0750 2908 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll

15:43:57.0750 2908 srservice - ok

15:43:57.0828 2908 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys

15:43:57.0843 2908 Srv - ok

15:43:57.0890 2908 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll

15:43:57.0906 2908 SSDPSRV - ok

15:43:57.0953 2908 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

15:43:57.0968 2908 ssmdrv - ok

15:43:58.0031 2908 [ A9573045BAA16EAB9B1085205B82F1ED ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys

15:43:58.0031 2908 StillCam - ok

15:43:58.0093 2908 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll

15:43:58.0109 2908 stisvc - ok

15:43:58.0140 2908 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys

15:43:58.0140 2908 swenum - ok

15:43:58.0187 2908 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys

15:43:58.0187 2908 swmidi - ok

15:43:58.0187 2908 SwPrv - ok

15:43:58.0203 2908 symc810 - ok

15:43:58.0203 2908 symc8xx - ok

15:43:58.0218 2908 sym_hi - ok

15:43:58.0218 2908 sym_u3 - ok

15:43:58.0234 2908 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys

15:43:58.0250 2908 sysaudio - ok

15:43:58.0250 2908 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe

15:43:58.0281 2908 SysmonLog - ok

15:43:58.0375 2908 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll

15:43:58.0390 2908 TapiSrv - ok

15:43:58.0421 2908 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys

15:43:58.0437 2908 Tcpip - ok

15:43:58.0468 2908 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys

15:43:58.0468 2908 TDPIPE - ok

15:43:58.0500 2908 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys

15:43:58.0500 2908 TDTCP - ok

15:43:58.0531 2908 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys

15:43:58.0531 2908 TermDD - ok

15:43:58.0609 2908 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll

15:43:58.0625 2908 TermService - ok

15:43:58.0640 2908 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll

15:43:58.0640 2908 Themes - ok

15:43:58.0703 2908 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe

15:43:58.0718 2908 TlntSvr - ok

15:43:58.0718 2908 TosIde - ok

15:43:58.0781 2908 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll

15:43:58.0796 2908 TrkWks - ok

15:43:58.0812 2908 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys

15:43:58.0828 2908 Udfs - ok

15:43:58.0828 2908 ultra - ok

15:43:58.0890 2908 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys

15:43:58.0906 2908 Update - ok

15:43:58.0937 2908 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll

15:43:58.0953 2908 upnphost - ok

15:43:58.0953 2908 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe

15:43:58.0968 2908 UPS - ok

15:43:59.0031 2908 [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys

15:43:59.0031 2908 USBAAPL - ok

15:43:59.0109 2908 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys

15:43:59.0109 2908 usbccgp - ok

15:43:59.0156 2908 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys

15:43:59.0156 2908 usbehci - ok

15:43:59.0171 2908 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys

15:43:59.0171 2908 usbhub - ok

15:43:59.0234 2908 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys

15:43:59.0234 2908 usbohci - ok

15:43:59.0250 2908 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys

15:43:59.0265 2908 usbprint - ok

15:43:59.0281 2908 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys

15:43:59.0296 2908 usbscan - ok

15:43:59.0328 2908 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

15:43:59.0328 2908 usbstor - ok

15:43:59.0390 2908 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys

15:43:59.0406 2908 VgaSave - ok

15:43:59.0406 2908 ViaIde - ok

15:43:59.0468 2908 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys

15:43:59.0468 2908 VolSnap - ok

15:43:59.0531 2908 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe

15:43:59.0562 2908 VSS - ok

15:43:59.0625 2908 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll

15:43:59.0640 2908 W32Time - ok

15:43:59.0687 2908 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys

15:43:59.0687 2908 Wanarp - ok

15:43:59.0703 2908 WDICA - ok

15:43:59.0734 2908 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys

15:43:59.0734 2908 wdmaud - ok

15:43:59.0796 2908 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll

15:43:59.0796 2908 WebClient - ok

15:43:59.0828 2908 [ 473EE64C368CE2EED110376C11960259 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys

15:43:59.0843 2908 winachsf - ok

15:44:00.0171 2908 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll

15:44:00.0171 2908 winmgmt - ok

15:44:00.0406 2908 [ 18F347402DA544A780949B8FDF83351B ] WinRM C:\WINDOWS\system32\WsmSvc.dll

15:44:00.0437 2908 WinRM - ok

15:44:00.0500 2908 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll

15:44:00.0500 2908 WmdmPmSN - ok

15:44:00.0531 2908 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll

15:44:00.0546 2908 Wmi - ok

15:44:00.0578 2908 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe

15:44:00.0578 2908 WmiApSrv - ok

15:44:00.0703 2908 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe

15:44:00.0812 2908 WMPNetworkSvc - ok

15:44:00.0921 2908 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

15:44:01.0046 2908 WPFFontCache_v0400 - ok

15:44:01.0093 2908 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys

15:44:01.0109 2908 WS2IFSL - ok

15:44:01.0171 2908 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll

15:44:01.0187 2908 wscsvc - ok

15:44:01.0187 2908 WSearch - ok

15:44:01.0234 2908 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll

15:44:01.0234 2908 wuauserv - ok

15:44:01.0281 2908 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys

15:44:01.0296 2908 WudfPf - ok

15:44:01.0343 2908 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys

15:44:01.0343 2908 WudfRd - ok

15:44:01.0390 2908 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll

15:44:01.0406 2908 WudfSvc - ok

15:44:01.0468 2908 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll

15:44:01.0468 2908 WZCSVC - ok

15:44:01.0515 2908 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll

15:44:01.0531 2908 xmlprov - ok

15:44:01.0546 2908 ================ Scan global ===============================

15:44:01.0578 2908 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll

15:44:01.0656 2908 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll

15:44:01.0687 2908 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll

15:44:01.0734 2908 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe

15:44:01.0734 2908 [Global] - ok

15:44:01.0734 2908 ================ Scan MBR ==================================

15:44:01.0765 2908 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0

15:44:01.0953 2908 \Device\Harddisk0\DR0 - ok

15:44:01.0953 2908 ================ Scan VBR ==================================

15:44:01.0953 2908 [ 2B94AFEE9341CC63EE629935CF7ECE74 ] \Device\Harddisk0\DR0\Partition1

15:44:01.0953 2908 \Device\Harddisk0\DR0\Partition1 - ok

15:44:01.0953 2908 ============================================================

15:44:01.0953 2908 Scan finished

15:44:01.0953 2908 ============================================================

15:44:01.0968 2900 Detected object count: 0

15:44:01.0968 2900 Actual detected object count: 0

15:44:05.0000 2144 Deinitialize success

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

Very good....

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RCUpdate1.png

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC2-1.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

4. If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.

----------

Link to post
Share on other sites
Inkwax

Inkwax

Posted
  • Author
Posted

ComboFix 12-11-30.02 - Jolly Household 11/30/2012 15:52:12.5.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1361 [GMT -5:00]

Running from: c:\documents and settings\Jolly Household\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

.

((((((((((((((((((((((((( Files Created from 2012-10-28 to 2012-11-30 )))))))))))))))))))))))))))))))

.

.

2012-11-30 20:39 . 2012-11-30 20:39 -------- d-----w- C:\TDSSKiller_Quarantine

2012-11-27 00:35 . 2012-11-28 20:40 -------- d-----w- c:\windows\system32\NtmsData

2012-11-26 20:38 . 2012-11-26 20:38 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\Avira

2012-11-26 20:37 . 2012-11-17 01:17 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys

2012-11-26 20:37 . 2012-11-17 01:17 133824 ----a-w- c:\windows\system32\drivers\avipbb.sys

2012-11-26 20:37 . 2012-11-17 01:17 83432 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2012-11-26 20:37 . 2012-11-26 20:37 -------- d-----w- c:\program files\Avira

2012-11-26 20:37 . 2012-11-26 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2012-11-26 19:23 . 2012-11-26 19:23 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\PCHealth

2012-11-19 22:30 . 2012-11-19 22:30 -------- d-----w- c:\program files\Common Files\Java

2012-11-19 22:29 . 2012-11-19 22:28 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-11-19 22:29 . 2012-11-19 22:28 477168 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-11-19 22:27 . 2012-11-19 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2012-11-18 23:03 . 2012-11-18 23:03 -------- d-----w- c:\documents and settings\Administrator

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-26 19:40 . 2012-04-08 13:24 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-11-26 19:40 . 2012-01-24 23:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-11-19 22:28 . 2012-01-25 23:55 473072 ----a-w- c:\windows\system32\deployJava1.dll

2012-09-29 23:54 . 2012-01-15 01:12 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HP Photosmart 6510 series (NET)"="c:\program files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe" [2011-05-25 1801064]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-27 39408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360]

"nwiz"="nwiz.exe" [2006-05-10 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016]

"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]

"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-19 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-11-16 384800]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\FrostWire 5\\FrostWire.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

.

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [11/26/2012 3:37 PM 36552]

R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/26/2012 3:37 PM 85280]

S4 GALKNJKE;GALKNJKE;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\GALKNJKE.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\GALKNJKE.exe [?]

S4 HVGAA;HVGAA;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\HVGAA.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\HVGAA.exe [?]

S4 RDFYUATO;RDFYUATO;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\RDFYUATO.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\RDFYUATO.exe [?]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - 59211306

*NewlyCreated* - 79973197

*Deregistered* - 59211306

*Deregistered* - 79973197

.

Contents of the 'Scheduled Tasks' folder

.

2012-11-30 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 19:40]

.

2012-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]

.

2012-11-27 c:\windows\Tasks\At1.job

- c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13]

.

2012-11-27 c:\windows\Tasks\At2.job

- c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13]

.

2012-11-27 c:\windows\Tasks\At3.job

- c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13]

.

2012-11-30 c:\windows\Tasks\At4.job

- c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13]

.

2012-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21]

.

2012-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21]

.

2012-11-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003Core.job

- c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47]

.

2012-11-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003UA.job

- c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47]

.

2012-11-30 c:\windows\Tasks\HP Photo Creations Messager.job

- c:\documents and settings\All Users\Application Data\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]

.

2012-11-30 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-651377827-725345543-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]

.

2012-11-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-651377827-725345543-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.comcast.net/

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

.

- - - - ORPHANS REMOVED - - - -

.

SafeBoot-79973197.sys

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-11-30 15:58

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@DACL=(02 0010)

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

@DACL=(02 0010)

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@DACL=(02 0010)

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@DACL=(02 0010)

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(1496)

c:\windows\system32\WININET.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2012-11-30 16:00:17

ComboFix-quarantined-files.txt 2012-11-30 21:00

ComboFix2.txt 2012-11-30 18:50

ComboFix3.txt 2012-11-30 03:38

.

Pre-Run: 147,148,849,152 bytes free

Post-Run: 147,141,197,824 bytes free

.

- - End Of File - - C40118B6E1086BAA834A8BB13A5DF42A

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

I notice that you have both AVG and Avira running at the same time. Having more than one antivirus program running at the same time can seriously degrade the performance of your system. Please uninstall either AVG or Avira (which ever you prefer) using either the provided uninstall feature that is part of the antivirus program or through Add/Remove Programs (for Vista and Win 7 users to go to Programs and Features in the Control Panel). As a rule of thumb one should run one firewall, one antivirus program in memory, and one antispyware utility in memory. It's fine to have other security tools available on an as-needed or on-demand basis, but when multiple tools simultaneously perform the same function, you're asking for trouble.

----------

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:

    ClearJavaCache::
    AtJob::
    File::
    c:\docume~1\JOLLYH~1\LOCALS~1\Temp\GALKNJKE.exe
    c:\docume~1\JOLLYH~1\LOCALS~1\Temp\HVGAA.exe
    c:\docume~1\JOLLYH~1\LOCALS~1\Temp\RDFYUATO.exe
    c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe
    Driver::
    GALKNJKE
    HVGAA
    RDFYUATO
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
    CFScriptB-4.gif
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Post the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

----------

Please post the new ComboFix log and let me know how your system is running now. :)

Link to post
Share on other sites
Inkwax

Inkwax

Posted
  • Author
Posted

Jeff, I had to reinstall AVG and uninstall Avira. It appears they had attempted to uninstall AVG in the past and it did not uninstall cleanly.

The computer is running much smoother now, here is the log you requested.

Thanks for all of your help.

ComboFix 12-12-01.01 - Jolly Household 12/01/2012 10:40:16.6.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1362 [GMT -5:00]

Running from: c:\documents and settings\Jolly Household\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Jolly Household\Desktop\CFScript.txt

AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

FILE ::

"c:\docume~1\JOLLYH~1\LOCALS~1\Temp\GALKNJKE.exe"

"c:\docume~1\JOLLYH~1\LOCALS~1\Temp\HVGAA.exe"

"c:\docume~1\JOLLYH~1\LOCALS~1\Temp\RDFYUATO.exe"

"c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe"

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe

c:\windows\Tasks\At1.job

c:\windows\Tasks\At2.job

c:\windows\Tasks\At3.job

c:\windows\Tasks\At4.job

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_GALKNJKE

-------\Legacy_HVGAA

-------\Legacy_RDFYUATO

-------\Service_GALKNJKE

-------\Service_HVGAA

-------\Service_RDFYUATO

.

.

((((((((((((((((((((((((( Files Created from 2012-11-01 to 2012-12-01 )))))))))))))))))))))))))))))))

.

.

2012-12-01 15:26 . 2012-12-01 15:26 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\AVG2013

2012-12-01 15:24 . 2012-12-01 15:24 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\TuneUp Software

2012-12-01 15:23 . 2012-12-01 15:23 -------- d-----w- C:\$AVG

2012-12-01 15:23 . 2012-12-01 15:25 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2013

2012-12-01 15:21 . 2012-12-01 15:21 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\MFAData

2012-12-01 15:21 . 2012-12-01 15:21 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\Avg2013

2012-11-30 20:39 . 2012-11-30 20:39 -------- d-----w- C:\TDSSKiller_Quarantine

2012-11-27 00:35 . 2012-12-01 00:55 -------- d-----w- c:\windows\system32\NtmsData

2012-11-26 19:23 . 2012-11-26 19:23 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\PCHealth

2012-11-19 22:30 . 2012-11-19 22:30 -------- d-----w- c:\program files\Common Files\Java

2012-11-19 22:29 . 2012-11-19 22:28 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-11-19 22:29 . 2012-11-19 22:28 477168 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-11-19 22:27 . 2012-11-19 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2012-11-18 23:03 . 2012-11-18 23:03 -------- d-----w- c:\documents and settings\Administrator

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-26 19:40 . 2012-04-08 13:24 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-11-26 19:40 . 2012-01-24 23:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-11-19 22:28 . 2012-01-25 23:55 473072 ----a-w- c:\windows\system32\deployJava1.dll

2012-10-22 18:02 . 2012-10-22 18:02 179936 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys

2012-10-22 08:37 . 2004-08-04 03:17 1866368 ----a-w- c:\windows\system32\win32k.sys

2012-10-15 08:48 . 2012-10-15 08:48 55776 ----a-w- c:\windows\system32\drivers\avgidshx.sys

2012-10-05 08:32 . 2012-10-05 08:32 93536 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2012-10-02 18:04 . 2004-08-04 04:56 58368 ----a-w- c:\windows\system32\synceng.dll

2012-10-02 08:30 . 2012-10-02 08:30 159712 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2012-09-29 23:54 . 2012-01-15 01:12 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-21 08:46 . 2012-09-21 08:46 164832 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2012-09-21 08:46 . 2012-09-21 08:46 177376 ----a-w- c:\windows\system32\drivers\avglogx.sys

2012-09-21 08:45 . 2012-09-21 08:45 19936 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys

2012-09-14 08:05 . 2012-09-14 08:05 35552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HP Photosmart 6510 series (NET)"="c:\program files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe" [2011-05-25 1801064]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-27 39408]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360]

"nwiz"="nwiz.exe" [2006-05-10 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016]

"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]

"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-19 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]

"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-11-07 3143800]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\FrostWire 5\\FrostWire.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

.

R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [10/15/2012 3:48 AM 55776]

R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [9/21/2012 3:46 AM 177376]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/14/2012 3:05 AM 35552]

R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [10/22/2012 1:02 PM 179936]

R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [9/21/2012 3:45 AM 19936]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/2/2012 3:30 AM 159712]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [9/21/2012 3:46 AM 164832]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [11/6/2012 7:00 PM 5814392]

R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [10/22/2012 1:05 PM 196664]

.

Contents of the 'Scheduled Tasks' folder

.

2012-12-01 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 19:40]

.

2012-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]

.

2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21]

.

2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21]

.

2012-12-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003Core.job

- c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47]

.

2012-12-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003UA.job

- c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47]

.

2012-12-01 c:\windows\Tasks\HP Photo Creations Messager.job

- c:\documents and settings\All Users\Application Data\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]

.

2012-12-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-651377827-725345543-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]

.

2012-11-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-651377827-725345543-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.comcast.net/

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-12-01 10:50

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@DACL=(02 0010)

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

@DACL=(02 0010)

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@DACL=(02 0010)

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@DACL=(02 0010)

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(148)

c:\windows\system32\WININET.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\RTHDCPL.EXE

c:\windows\system32\SearchIndexer.exe

c:\program files\HP\Digital Imaging\bin\hpqimzone.exe

c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Completion time: 2012-12-01 10:53:36 - machine was rebooted

ComboFix-quarantined-files.txt 2012-12-01 15:53

ComboFix2.txt 2012-11-30 21:00

ComboFix3.txt 2012-11-30 18:50

ComboFix4.txt 2012-11-30 03:38

.

Pre-Run: 147,083,939,840 bytes free

Post-Run: 146,947,272,704 bytes free

.

- - End Of File - - 71951F2666F432DF1B17E3229D15C35B

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted
Also, Do you have recommendations as to which antispyware, antivirus, etc... to run?
I think that what you have on your system right now was just fine.

--------

I see that your Java software is out of date. Please go to Start >> Control Panel >> Programs and Features >> uninstall all versions of Java.

Now download and install the newest version from here >> http://java.com/en/download/index.jsp

-------------

Clear Java Cache

See this page for instructions on how to clear java's cache.

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)

  • Under Temporary Internet Files, click the Delete Files button.
  • There are three options in the window to clear the cache - Leave ALL 3 Checked

    • Downloaded Applets
      Downloaded Applications
      Other Files

    [*]Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

    [*]Click OK to leave the Java Control Panel.

----------

Malwarebytes

Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.

----------

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.

----------

Link to post
Share on other sites
Inkwax

Inkwax

Posted
  • Author
Posted

Jeff,

Here are the results from the two scans you asked for. I also updated Java and cleaned its cache as requested.

MBAM log

Malwarebytes Anti-Malware 1.65.1.1000

www.malwarebytes.org

Database version: v2012.12.01.11

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Jolly Household :: JOLLY-DESKTOP [administrator]

12/1/2012 9:26:19 PM

mbam-log-2012-12-01 (21-26-19).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 225455

Time elapsed: 9 minute(s), 32 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

ESET log

C:\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application

C:\Documents and Settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application

C:\Documents and Settings\Jolly Household\Local Settings\Application Data\Google\Chrome\User Data\Default\Default\aagbdcdadfgegbdfdhgedjdbdedcdgdg\background.html Win32/BHO.OEI trojan

C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0001.dta a variant of Win32/Olmarik.AYI trojan

C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0002.dta a variant of Win64/Olmarik.AM trojan

C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0003.dta a variant of Win32/Rootkit.Kryptik.PR trojan

C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0004.dta Win64/Olmarik.AN trojan

C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0008.dta Win32/Olmarik.AFK trojan

C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0009.dta Win64/Olmarik.AK trojan

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

Good job!

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:

    ClearJavaCache::
    File::
    C:\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
    C:\Documents and Settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll
    C:\Documents and Settings\Jolly Household\Local Settings\Application Data\Google\Chrome\User Data\Default\Default\aagbdcdadfgegbdfdhgedjdbdedcdgdg\background.html
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
    CFScriptB-4.gif
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Post the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

----------

Post the new ComboFix log and let me know how your system is running. :)

Link to post
Share on other sites
Inkwax

Inkwax

Posted
  • Author
Posted

Jeff,

I ran the CFScript.txt via ComboFix and it rebooted my computer but did not produce a logfile. I reran ComboFix without the CFScript and I am posting that log here.

ComboFix 12-12-01.02 - Jolly Household 12/02/2012 14:31:10.8.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1406 [GMT -5:00]

Running from: c:\documents and settings\Jolly Household\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Previous Run -------

.

c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll

c:\documents and settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll

c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Chrome\User Data\Default\Default\aagbdcdadfgegbdfdhgedjdbdedcdgdg\background.html

.

.

((((((((((((((((((((((((( Files Created from 2012-11-02 to 2012-12-02 )))))))))))))))))))))))))))))))

.

.

2012-12-02 04:08 . 2012-12-02 04:08 -------- d-----w- c:\program files\ESET

2012-12-02 02:25 . 2012-12-02 02:25 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\Sun

2012-12-02 02:24 . 2012-12-02 02:24 -------- d-----w- c:\program files\Common Files\Java

2012-12-02 02:24 . 2012-12-02 02:24 143872 ----a-w- c:\windows\system32\javacpl.cpl

2012-12-02 02:24 . 2012-12-02 02:24 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2012-12-02 02:18 . 2012-12-02 02:18 -------- d-----w- c:\program files\iPod

2012-12-02 02:18 . 2012-12-02 02:19 -------- d-----w- c:\program files\iTunes

2012-12-02 02:18 . 2012-12-02 02:19 -------- d-----w- c:\documents and settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1

2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll

2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll

2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll

2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll

2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll

2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll

2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll

2012-12-02 02:11 . 2012-12-02 02:11 -------- d-----w- c:\program files\QuickTime

2012-12-01 15:26 . 2012-12-01 15:26 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\AVG2013

2012-12-01 15:24 . 2012-12-01 15:24 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\TuneUp Software

2012-12-01 15:23 . 2012-12-01 15:23 -------- d-----w- C:\$AVG

2012-12-01 15:23 . 2012-12-01 15:25 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2013

2012-12-01 15:21 . 2012-12-01 15:59 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\Avg2013

2012-12-01 15:21 . 2012-12-01 15:21 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\MFAData

2012-11-30 20:39 . 2012-11-30 20:39 -------- d-----w- C:\TDSSKiller_Quarantine

2012-11-27 00:35 . 2012-12-01 00:55 -------- d-----w- c:\windows\system32\NtmsData

2012-11-26 19:23 . 2012-11-26 19:23 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\PCHealth

2012-11-19 22:29 . 2012-12-02 02:24 821736 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-11-19 22:27 . 2012-11-19 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2012-11-18 23:03 . 2012-11-18 23:03 -------- d-----w- c:\documents and settings\Administrator

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-12-02 02:24 . 2012-01-25 23:55 746984 ----a-w- c:\windows\system32\deployJava1.dll

2012-11-26 19:40 . 2012-04-08 13:24 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-11-26 19:40 . 2012-01-24 23:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-10-25 08:12 . 2012-10-25 08:12 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2012-10-25 08:12 . 2012-10-25 08:12 69632 ----a-w- c:\windows\system32\QuickTime.qts

2012-10-22 18:02 . 2012-10-22 18:02 179936 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys

2012-10-22 08:37 . 2004-08-04 03:17 1866368 ----a-w- c:\windows\system32\win32k.sys

2012-10-15 08:48 . 2012-10-15 08:48 55776 ----a-w- c:\windows\system32\drivers\avgidshx.sys

2012-10-05 08:32 . 2012-10-05 08:32 93536 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2012-10-02 18:04 . 2004-08-04 04:56 58368 ----a-w- c:\windows\system32\synceng.dll

2012-10-02 08:30 . 2012-10-02 08:30 159712 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2012-09-29 23:54 . 2012-01-15 01:12 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-21 08:46 . 2012-09-21 08:46 164832 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2012-09-21 08:46 . 2012-09-21 08:46 177376 ----a-w- c:\windows\system32\drivers\avglogx.sys

2012-09-21 08:45 . 2012-09-21 08:45 19936 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys

2012-09-14 08:05 . 2012-09-14 08:05 35552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HP Photosmart 6510 series (NET)"="c:\program files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe" [2011-05-25 1801064]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-27 39408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360]

"nwiz"="nwiz.exe" [2006-05-10 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016]

"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]

"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-11-07 3143800]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-11-29 151952]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\FrostWire 5\\FrostWire.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

.

R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [10/15/2012 3:48 AM 55776]

R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [9/21/2012 3:46 AM 177376]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/14/2012 3:05 AM 35552]

R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [10/22/2012 1:02 PM 179936]

R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [9/21/2012 3:45 AM 19936]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/2/2012 3:30 AM 159712]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [9/21/2012 3:46 AM 164832]

R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [10/22/2012 1:05 PM 196664]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [11/6/2012 7:00 PM 5814392]

.

Contents of the 'Scheduled Tasks' folder

.

2012-12-02 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 19:40]

.

2012-12-02 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]

.

2012-12-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21]

.

2012-12-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21]

.

2012-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003Core.job

- c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47]

.

2012-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003UA.job

- c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47]

.

2012-12-02 c:\windows\Tasks\HP Photo Creations Messager.job

- c:\documents and settings\All Users\Application Data\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]

.

2012-12-02 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-651377827-725345543-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]

.

2012-11-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-651377827-725345543-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.comcast.net/

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-12-02 14:38

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@DACL=(02 0010)

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

@DACL=(02 0010)

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@DACL=(02 0010)

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@DACL=(02 0010)

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(1832)

c:\windows\system32\WININET.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2012-12-02 14:39:55

ComboFix-quarantined-files.txt 2012-12-02 19:39

ComboFix2.txt 2012-12-01 15:53

ComboFix3.txt 2012-11-30 21:00

ComboFix4.txt 2012-11-30 18:50

ComboFix5.txt 2012-12-02 19:04

.

Pre-Run: 146,280,235,008 bytes free

Post-Run: 146,267,893,760 bytes free

.

- - End Of File - - 9C8460320101A04501468814886E2B89

Link to post
Share on other sites
jeffce

jeffce

Posted
Posted

Providing there are no other malware related problems...

IT APPEARS THAT YOUR LOGS ARE NOW CLEAN SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!!

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.

----------

The following will implement some cleanup procedures as well as reset System Restore points:

Press the Windows key + R and this will open the Run box. Copy/paste the following text into the Run box as shown and click OK.

Combofix /Uninstall

(Note: There is a space between the ..X and the /U that needs to be there.)

CF.jpg

----------

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

If you didn't already have it I would keep Malwarebytes AntiMalware though.

Here are some tips to reduce the potential for spyware infection in the future:

1. Internet Explorer. Even if you don't use it as your main browser it should be kept up-to-date because that is the browser Windows uses for updates.

Make your Internet Explorer more secure - This can be done by following these simple instructions:

  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.

2. FireFox. If you use Firefox, I recommend installing the following add-ons to help make your Firefox browser more secure:

NoScript

AdBlock Plus

3. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:

  • Open Internet Explorer
  • Click on Tools > Internet Options
  • Press Security tab
  • Select Internet zone then place check next to Enable Protected Mode if not already done
  • Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
  • Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

4. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

5. Firewall

Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. I would personally only recommend using one of the following two below:

Online Armor Free

Agnitum Outpost Firewall Free

6. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

7. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

8.Finally, I strongly recommend that you read How to Prevent Malware found here and also PC Safety and Security - What Do I Need?.

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Link to post
Share on other sites
Inkwax

Inkwax

Posted
  • Author
Posted

Jeff,

I want to thank you for all your help. I have finished the last few things you suggested. Other than the hardware issue I ran into last night, the computer is back to its good old self. Your services are greatly appreciated and I will be sure to donate.

Thanks again.

Kevin

Link to post
Share on other sites
LDTate

LDTate

Posted
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.