pum.hijack. startmenu

plugandplay · May 25, 2013

Hi,

I was infected by pum.hijack. startmenu but removed it through your free scan & removal tool; however, I have problems starting up and they have gradually got worse. Sometimes, it can take hours to boot up, as though it is stuck in a loop - for example: I can hear the CD drive keep trying to start but constantly 'clicking'.

Please advise on what I should do next; I know this appears to be a recurring theme on your forums but not sure if each incident is a unique case for resolution, depending on how it is affected?

I have a HP 6735s laptop, running Windows XP, I had it downgraded from Vista when I bought it.

Cheers.

D-FRED-BROWN · May 25, 2013

Hello plugandplay and welcome to Malwarebytes!

I am D-FRED-BROWN and I will be helping you.

Please print or save this topic. It will make it easier for you to follow the instructions and complete all of the necessary steps.

----------Step 1----------------

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!

Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
Vista/Windows 7 users right-click and select Run As Administrator.
If TDSSKiller does not run, try renaming it.
To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
Click the Start Scan button.
Do not use the computer during the scan
If the scan completes with nothing found, click Close to exit.
If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
Note: If Cure is not an option, Skip instead, do not choose Delete unless instructed.
A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
Copy and paste the contents of that file in your next reply.

----------Step 2----------------

Please download Malwarebytes Anti-Rootkit from HERE

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt

----------Step 3----------------

Please download ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingc...to-use-combofix

***IMPORTANT: save ComboFix to your Desktop***

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please go here to see a list of programs that should be disabled.

**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall**

Please include the C:\ComboFix.txt in your next reply for further review.

NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

----------Step 4----------------

Please download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

----------Step 5----------------

In your next reply, please include the following:

TDSSKiller's logfile
MBAR mbar-log.txt and system-log.txt
ComboFix's report (C:\ComboFix.txt)
Security Check checkup.txt

After that, please let me know: How is your computer running now? Do you have any questions or concerns you'd like me to address? Don't hesitate to ask.

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Note:

Please make sure you are subscribed to this topic: Click on the "Follow This Topic" Button (at the top right of this page), make sure that the "Receive notification" box is checked and that it is set to "Instantly"

-------> Your topic will be closed if you haven't replied within 3 days! <--------

(If I don't respond within 24 hours, please send me a PM)

-DFB

plugandplay · May 25, 2013

Hi DFB,

Thanks for your prompt reply; I will begin the process first thing tomorrow & reply with the relevant info as each step is completed.

D-FRED-BROWN · May 25, 2013

Sounds good.

plugandplay · May 26, 2013

Hi,

I have run TDSSKiller.exe and it found 1 threat, as below:

~~~~~~~~~~~~~~~~

Locked File

Service: safeboot

Suspicious object, medium risk

~~~~~~~~~~~~~~~~~~~~~~

The Cure option was not available, so chose Skip, as instructed.

Log below:

~~~~~~~~~~~~~~~~~~~

12:30:10.0203 11700 TDSS rootkit removing tool 2.8.16.0 Mar 21 2013 15:53:02

12:30:10.0218 11700 ============================================================

12:30:10.0218 11700 Current date / time: 2013/05/26 12:30:10.0218

12:30:10.0218 11700 SystemInfo:

12:30:10.0218 11700

12:30:10.0218 11700 OS Version: 5.1.2600 ServicePack: 3.0

12:30:10.0218 11700 Product type: Workstation

12:30:10.0218 11700 ComputerName: LAPTOP

12:30:10.0218 11700 UserName: Paul

12:30:10.0218 11700 Windows directory: C:\WINDOWS

12:30:10.0218 11700 System windows directory: C:\WINDOWS

12:30:10.0218 11700 Processor architecture: Intel x86

12:30:10.0218 11700 Number of processors: 2

12:30:10.0218 11700 Page size: 0x1000

12:30:10.0218 11700 Boot type: Normal boot

12:30:10.0218 11700 ============================================================

12:30:13.0437 11700 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000058

12:30:13.0531 11700 ============================================================

12:30:13.0531 11700 \Device\Harddisk0\DR0:

12:30:13.0531 11700 MBR partitions:

12:30:13.0531 11700 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12812EFE

12:30:13.0531 11700 \Device\Harddisk0\DR0\Partition2: MBR, Type 0xC, StartLBA 0x12816DFE, BlocksNum 0x201CC3

12:30:13.0531 11700 ============================================================

12:30:13.0562 11700 C: <-> \Device\Harddisk0\DR0\Partition1

12:30:13.0578 11700 D: <-> \Device\Harddisk0\DR0\Partition2

12:30:13.0578 11700 ============================================================

12:30:13.0578 11700 Initialize success

12:30:13.0578 11700 ============================================================

12:30:21.0609 12192 ============================================================

12:30:21.0609 12192 Scan started

12:30:21.0609 12192 Mode: Manual;

12:30:21.0609 12192 ============================================================

12:30:22.0625 12192 ================ Scan system memory ========================

12:30:22.0625 12192 System memory - ok

12:30:22.0625 12192 ================ Scan services =============================

12:30:22.0781 12192 Abiosdsk - ok

12:30:22.0796 12192 abp480n5 - ok

12:30:22.0828 12192 [ A0BAABB7D3549460E3F8C5AD6F778683 ] Accelerometer C:\WINDOWS\system32\DRIVERS\Accelerometer.sys

12:30:22.0875 12192 Accelerometer - ok

12:30:22.0953 12192 [ 2E20D1A28D6B7759B0431AE6BFAE788F ] accoca c:\Program Files\ActivIdentity\ActivClient\accoca.exe

12:30:23.0562 12192 accoca - ok

12:30:23.0609 12192 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys

12:30:23.0671 12192 ACPI - ok

12:30:23.0718 12192 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\DRIVERS\ACPIEC.sys

12:30:23.0734 12192 ACPIEC - ok

12:30:23.0781 12192 [ FF60DB2ACA88543C025EACBA25CEE5C1 ] ADIHdAudAddService C:\WINDOWS\system32\drivers\ADIHdAud.sys

12:30:23.0828 12192 ADIHdAudAddService - ok

12:30:23.0890 12192 [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

12:30:24.0046 12192 AdobeFlashPlayerUpdateSvc - ok

12:30:24.0062 12192 adpu160m - ok

12:30:24.0078 12192 [ FFF87A9B1AB36EE4B7BEC98A4CB01B79 ] AEAudio C:\WINDOWS\system32\drivers\AEAudio.sys

12:30:24.0140 12192 AEAudio - ok

12:30:24.0171 12192 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys

12:30:24.0234 12192 aec - ok

12:30:24.0281 12192 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys

12:30:24.0281 12192 AFD - ok

12:30:24.0328 12192 [ 8ED60797908FD394EEE0D6949F493224 ] AgereModemAudio C:\WINDOWS\system32\agrsmsvc.exe

12:30:24.0375 12192 AgereModemAudio - ok

12:30:24.0437 12192 [ 38325C6AA8EAE011897D61CE48EC6435 ] AgereSoftModem C:\WINDOWS\system32\DRIVERS\AGRSM.sys

12:30:24.0562 12192 AgereSoftModem - ok

12:30:24.0578 12192 Aha154x - ok

12:30:24.0609 12192 [ 15DA079FF09BE5FA6602041EE286DE80 ] ahcix86 C:\WINDOWS\system32\DRIVERS\ahcix86.sys

12:30:24.0609 12192 ahcix86 - ok

12:30:24.0625 12192 aic78u2 - ok

12:30:24.0625 12192 aic78xx - ok

12:30:24.0687 12192 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll

12:30:24.0718 12192 Alerter - ok

12:30:24.0750 12192 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe

12:30:24.0781 12192 ALG - ok

12:30:24.0796 12192 [ 1140AB9938809700B46BB88E46D72A96 ] AliIde C:\WINDOWS\system32\DRIVERS\aliide.sys

12:30:24.0812 12192 AliIde - ok

12:30:24.0843 12192 [ C26488BFB5278B3D357F99D3BBC790C9 ] Amddfltr C:\WINDOWS\system32\DRIVERS\Amddfltr.sys

12:30:24.0875 12192 Amddfltr - ok

12:30:24.0906 12192 [ 033448D435E65C4BD72E70521FD05C76 ] AmdPPM C:\WINDOWS\system32\DRIVERS\AmdPPM.sys

12:30:24.0937 12192 AmdPPM - ok

12:30:24.0953 12192 amsint - ok

12:30:24.0984 12192 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll

12:30:25.0046 12192 AppMgmt - ok

12:30:25.0062 12192 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys

12:30:25.0109 12192 Arp1394 - ok

12:30:25.0125 12192 asc - ok

12:30:25.0125 12192 asc3350p - ok

12:30:25.0140 12192 asc3550 - ok

12:30:25.0218 12192 [ C348A8DF7B6E5326B41AC20327F972FD ] ASChannel c:\Program Files\Hewlett-Packard\IAM\Bin\AsChnl.dll

12:30:25.0281 12192 ASChannel - ok

12:30:25.0421 12192 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

12:30:25.0453 12192 aspnet_state - ok

12:30:25.0453 12192 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys

12:30:25.0484 12192 AsyncMac - ok

12:30:25.0515 12192 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys

12:30:25.0593 12192 atapi - ok

12:30:25.0593 12192 Atdisk - ok

12:30:25.0656 12192 [ 3BE397289C3F0773829598E7C093C362 ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe

12:30:26.0015 12192 Ati HotKey Poller - ok

12:30:26.0140 12192 [ BC1030FA3B251B3915D6076018586F92 ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

12:30:26.0718 12192 ati2mtag - ok

12:30:26.0781 12192 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys

12:30:26.0828 12192 Atmarpc - ok

12:30:26.0875 12192 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll

12:30:26.0921 12192 AudioSrv - ok

12:30:26.0968 12192 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys

12:30:26.0984 12192 audstub - ok

12:30:27.0078 12192 [ 9208C78BD9283F79A30252AD954C77A2 ] BCM43XX C:\WINDOWS\system32\DRIVERS\bcmwl5.sys

12:30:27.0093 12192 BCM43XX - ok

12:30:27.0109 12192 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys

12:30:27.0156 12192 Beep - ok

12:30:27.0203 12192 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll

12:30:27.0250 12192 BITS - ok

12:30:27.0296 12192 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll

12:30:27.0296 12192 Browser - ok

12:30:27.0343 12192 [ 5BCF6090B825DEF29065BDBD59691DBE ] btaudio C:\WINDOWS\system32\drivers\btaudio.sys

12:30:27.0359 12192 btaudio - ok

12:30:27.0406 12192 [ 58A49BD10E08D3D4333A60DEDCB1CED8 ] BTDriver C:\WINDOWS\system32\DRIVERS\btport.sys

12:30:27.0437 12192 BTDriver - ok

12:30:27.0500 12192 [ EF5E0DE0A7CA2977A9255F36F4D915AB ] BTKRNL C:\WINDOWS\system32\DRIVERS\btkrnl.sys

12:30:27.0562 12192 BTKRNL - ok

12:30:27.0625 12192 [ 565C79C4C00AF8D1C7500146B0B09562 ] btwdins C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

12:30:27.0718 12192 btwdins - ok

12:30:27.0750 12192 [ 80F61DE965C116051614AC2F04222FF7 ] BTWDNDIS C:\WINDOWS\system32\DRIVERS\btwdndis.sys

12:30:27.0750 12192 BTWDNDIS - ok

12:30:27.0765 12192 [ 053DC5BE74621B63BB48C2B86BAFC7B0 ] BTWUSB C:\WINDOWS\system32\Drivers\btwusb.sys

12:30:27.0765 12192 BTWUSB - ok

12:30:27.0812 12192 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys

12:30:27.0843 12192 cbidf2k - ok

12:30:27.0875 12192 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

12:30:27.0906 12192 CCDECODE - ok

12:30:27.0906 12192 cd20xrnt - ok

12:30:27.0937 12192 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys

12:30:27.0984 12192 Cdaudio - ok

12:30:28.0046 12192 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys

12:30:28.0093 12192 Cdfs - ok

12:30:28.0109 12192 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys

12:30:28.0171 12192 Cdrom - ok

12:30:28.0171 12192 Changer - ok

12:30:28.0234 12192 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe

12:30:28.0265 12192 CiSvc - ok

12:30:28.0281 12192 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe

12:30:28.0328 12192 ClipSrv - ok

12:30:28.0375 12192 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

12:30:28.0421 12192 clr_optimization_v2.0.50727_32 - ok

12:30:28.0500 12192 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

12:30:28.0546 12192 clr_optimization_v4.0.30319_32 - ok

12:30:28.0562 12192 [ 0F6C187D38D98F8DF904589A5F94D411 ] CmBatt C:\WINDOWS\system32\DRIVERS\CmBatt.sys

12:30:28.0578 12192 CmBatt - ok

12:30:28.0593 12192 CmdIde - ok

12:30:28.0687 12192 [ 7795F8CEBC284A426B53F541E538695F ] Com4QLBEx C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

12:30:28.0796 12192 Com4QLBEx - ok

12:30:28.0828 12192 [ 6E4C9F21F0FAE8940661144F41B13203 ] Compbatt C:\WINDOWS\system32\DRIVERS\compbatt.sys

12:30:28.0859 12192 Compbatt - ok

12:30:28.0859 12192 COMSysApp - ok

12:30:28.0890 12192 Cpqarray - ok

12:30:28.0937 12192 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll

12:30:28.0968 12192 CryptSvc - ok

12:30:28.0984 12192 dac2w2k - ok

12:30:28.0984 12192 dac960nt - ok

12:30:29.0046 12192 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll

12:30:29.0046 12192 DcomLaunch - ok

12:30:29.0218 12192 [ D17845A5385BFCB838CDC532AF5E3E47 ] DevoloNetworkService C:\Program Files\devolo\dlan\devolonetsvc.exe

12:30:30.0234 12192 DevoloNetworkService - ok

12:30:30.0281 12192 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll

12:30:30.0312 12192 Dhcp - ok

12:30:30.0328 12192 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys

12:30:30.0375 12192 Disk - ok

12:30:30.0390 12192 dmadmin - ok

12:30:30.0453 12192 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys

12:30:30.0515 12192 dmboot - ok

12:30:30.0531 12192 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys

12:30:30.0578 12192 dmio - ok

12:30:30.0593 12192 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys

12:30:30.0609 12192 dmload - ok

12:30:30.0656 12192 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll

12:30:30.0687 12192 dmserver - ok

12:30:30.0703 12192 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys

12:30:30.0734 12192 DMusic - ok

12:30:30.0781 12192 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll

12:30:30.0781 12192 Dnscache - ok

12:30:30.0812 12192 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll

12:30:30.0859 12192 Dot3svc - ok

12:30:30.0859 12192 dpti2o - ok

12:30:30.0890 12192 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys

12:30:30.0906 12192 drmkaud - ok

12:30:30.0921 12192 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll

12:30:31.0015 12192 EapHost - ok

12:30:31.0015 12192 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll

12:30:31.0046 12192 ERSvc - ok

12:30:31.0109 12192 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe

12:30:31.0109 12192 Eventlog - ok

12:30:31.0156 12192 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll

12:30:31.0171 12192 EventSystem - ok

12:30:31.0218 12192 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys

12:30:31.0250 12192 Fastfat - ok

12:30:31.0296 12192 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll

12:30:31.0296 12192 FastUserSwitchingCompatibility - ok

12:30:31.0312 12192 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys

12:30:31.0343 12192 Fdc - ok

12:30:31.0390 12192 [ 5C329E2AB8DD62310213CBFAC0178539 ] FilterService C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys

12:30:31.0468 12192 FilterService - ok

12:30:31.0500 12192 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys

12:30:31.0531 12192 Fips - ok

12:30:31.0531 12192 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys

12:30:31.0562 12192 Flpydisk - ok

12:30:31.0593 12192 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys

12:30:31.0625 12192 FltMgr - ok

12:30:31.0687 12192 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

12:30:31.0718 12192 FontCache3.0.0.0 - ok

12:30:31.0750 12192 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys

12:30:31.0781 12192 Fs_Rec - ok

12:30:31.0796 12192 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys

12:30:31.0828 12192 Ftdisk - ok

12:30:31.0890 12192 [ 5EE6360A45C7EAD9B18FC77F98203269 ] Garmin Core Update Service C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe

12:30:31.0984 12192 Garmin Core Update Service - ok

12:30:32.0046 12192 [ 0879DC7444A201DF84E69C5DD5083D61 ] getPlusHelper C:\Program Files\NOS\bin\getPlus_Helper.dll

12:30:32.0281 12192 getPlusHelper - ok

12:30:32.0312 12192 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys

12:30:32.0359 12192 Gpc - ok

12:30:32.0421 12192 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe

12:30:32.0421 12192 gupdate - ok

12:30:32.0421 12192 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe

12:30:32.0421 12192 gupdatem - ok

12:30:32.0484 12192 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

12:30:32.0609 12192 gusvc - ok

12:30:32.0656 12192 [ 407E41DDB2BFECE109132AEC296E0D98 ] HBtnKey C:\WINDOWS\system32\DRIVERS\cpqbttn.sys

12:30:32.0687 12192 HBtnKey - ok

12:30:32.0734 12192 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

12:30:32.0781 12192 HDAudBus - ok

12:30:32.0812 12192 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

12:30:32.0843 12192 helpsvc - ok

12:30:32.0843 12192 HidServ - ok

12:30:32.0890 12192 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys

12:30:32.0906 12192 HidUsb - ok

12:30:32.0953 12192 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll

12:30:33.0046 12192 hkmsvc - ok

12:30:33.0078 12192 [ 88BCB3D9EAD6B693D7D36316C434757A ] HP ProtectTools Service c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe

12:30:33.0125 12192 HP ProtectTools Service - ok

12:30:33.0156 12192 [ 9F620E11B80B74F4DAB50A81A5DF357F ] hpdskflt C:\WINDOWS\system32\DRIVERS\hpdskflt.sys

12:30:33.0187 12192 hpdskflt - ok

12:30:33.0250 12192 [ 0A799AFFFCFD5F73FEFFD96AABDAD4AD ] HpFkCryptService c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe

12:30:33.0390 12192 HpFkCryptService - ok

12:30:33.0390 12192 hpn - ok

12:30:33.0437 12192 [ 35956140E686D53BF676CF0C778880FC ] HpqKbFiltr C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys

12:30:33.0484 12192 HpqKbFiltr - ok

12:30:33.0531 12192 [ 1665C7121A026DF10C903DB9BC5E9D43 ] hpqwmiex C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

12:30:33.0531 12192 hpqwmiex - ok

12:30:33.0578 12192 [ 30CA91E657CEDE2F95359D6EF186F650 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys

12:30:33.0625 12192 HPZid412 - ok

12:30:33.0640 12192 [ EFD31AFA752AA7C7BBB57BCBE2B01C78 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys

12:30:33.0656 12192 HPZipr12 - ok

12:30:33.0687 12192 [ 7AC43C38CA8FD7ED0B0A4466F753E06E ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys

12:30:33.0718 12192 HPZius12 - ok

12:30:33.0781 12192 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys

12:30:33.0781 12192 HTTP - ok

12:30:33.0812 12192 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll

12:30:33.0843 12192 HTTPFilter - ok

12:30:33.0843 12192 i2omgmt - ok

12:30:33.0859 12192 i2omp - ok

12:30:33.0890 12192 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys

12:30:33.0921 12192 i8042prt - ok

12:30:34.0015 12192 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

12:30:34.0078 12192 IDriverT - ok

12:30:34.0156 12192 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

12:30:34.0312 12192 idsvc - ok

12:30:34.0359 12192 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys

12:30:34.0406 12192 Imapi - ok

12:30:34.0453 12192 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe

12:30:34.0531 12192 ImapiService - ok

12:30:34.0546 12192 ini910u - ok

12:30:34.0578 12192 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys

12:30:34.0593 12192 IntelIde - ok

12:30:34.0625 12192 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys

12:30:34.0687 12192 Ip6Fw - ok

12:30:34.0703 12192 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

12:30:34.0734 12192 IpFilterDriver - ok

12:30:34.0750 12192 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys

12:30:34.0796 12192 IpInIp - ok

12:30:34.0843 12192 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys

12:30:34.0875 12192 IpNat - ok

12:30:34.0890 12192 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys

12:30:34.0953 12192 IPSec - ok

12:30:34.0968 12192 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys

12:30:35.0000 12192 IRENUM - ok

12:30:35.0015 12192 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys

12:30:35.0046 12192 isapnp - ok

12:30:35.0078 12192 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys

12:30:35.0109 12192 Kbdclass - ok

12:30:35.0125 12192 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys

12:30:35.0156 12192 kbdhid - ok

12:30:35.0171 12192 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys

12:30:35.0171 12192 kmixer - ok

12:30:35.0218 12192 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys

12:30:35.0218 12192 KSecDD - ok

12:30:35.0406 12192 [ 0423BC118534EC23A063E54EBCA9B92D ] KService C:\Program Files\Kontiki\KService.exe

12:30:36.0125 12192 KService - ok

12:30:36.0187 12192 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll

12:30:36.0187 12192 lanmanserver - ok

12:30:36.0234 12192 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll

12:30:36.0234 12192 lanmanworkstation - ok

12:30:36.0250 12192 lbrtfdc - ok

12:30:36.0312 12192 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll

12:30:36.0359 12192 LmHosts - ok

12:30:36.0468 12192 [ 9A3D4FC6B86E7E36473079AB76AC703D ] LVcKap C:\WINDOWS\system32\DRIVERS\LVcKap.sys

12:30:36.0562 12192 LVcKap - ok

12:30:36.0656 12192 [ 0ACBC11F19320AF6C19F2E20013D9095 ] LVMVDrv C:\WINDOWS\system32\DRIVERS\LVMVDrv.sys

12:30:36.0781 12192 LVMVDrv - ok

12:30:36.0875 12192 [ E8ACF6DD83956FB63CEB058D5F51B18A ] lvpopflt C:\WINDOWS\system32\DRIVERS\lvpopflt.sys

12:30:36.0953 12192 lvpopflt - ok

12:30:37.0015 12192 [ 12866641284EBB41E627BB53C04DA959 ] LVPr2Mon C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys

12:30:37.0046 12192 LVPr2Mon - ok

12:30:37.0109 12192 [ 995D0B52870C7A5CAF3EA165FD674A35 ] LVPrcSrv c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe

12:30:37.0218 12192 LVPrcSrv - ok

12:30:37.0250 12192 [ A005CEE9BE199C5E375FAA559CA9A7A9 ] LVSrvLauncher C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

12:30:37.0343 12192 LVSrvLauncher - ok

12:30:37.0375 12192 [ 64BC29C3A0388BFC580BB8B1346F7659 ] LVUSBSta C:\WINDOWS\system32\drivers\LVUSBSta.sys

12:30:37.0375 12192 LVUSBSta - ok

12:30:37.0500 12192 [ 922BE6770499220DC27B529CA236815A ] LVUVC C:\WINDOWS\system32\DRIVERS\lvuvc.sys

12:30:37.0609 12192 LVUVC - ok

12:30:37.0625 12192 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll

12:30:37.0656 12192 Messenger - ok

12:30:37.0703 12192 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys

12:30:37.0718 12192 mnmdd - ok

12:30:37.0750 12192 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe

12:30:37.0828 12192 mnmsrvc - ok

12:30:37.0859 12192 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys

12:30:37.0921 12192 Modem - ok

12:30:37.0953 12192 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys

12:30:37.0984 12192 Mouclass - ok

12:30:38.0015 12192 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys

12:30:38.0046 12192 mouhid - ok

12:30:38.0062 12192 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys

12:30:38.0109 12192 MountMgr - ok

12:30:38.0140 12192 [ CF105EE42E3F71E648CEBB3F666E1CF0 ] MpFilter C:\WINDOWS\system32\DRIVERS\MpFilter.sys

12:30:38.0187 12192 MpFilter - ok

12:30:38.0296 12192 [ A69630D039C38018689190234F866D77 ] MpKsl9ab5c64c c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C12FE1AA-A084-4C71-AD28-62EB45E3E9E0}\MpKsl9ab5c64c.sys

12:30:38.0296 12192 MpKsl9ab5c64c - ok

12:30:38.0343 12192 [ 70C14F5CCA5CF73F8A645C73A01D8726 ] MQAC C:\WINDOWS\system32\drivers\mqac.sys

12:30:38.0375 12192 MQAC - ok

12:30:38.0375 12192 mraid35x - ok

12:30:38.0406 12192 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys

12:30:38.0437 12192 MRxDAV - ok

12:30:38.0484 12192 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

12:30:38.0500 12192 MRxSmb - ok

12:30:38.0531 12192 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe

12:30:38.0562 12192 MSDTC - ok

12:30:38.0609 12192 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys

12:30:38.0703 12192 Msfs - ok

12:30:38.0703 12192 MSIServer - ok

12:30:38.0734 12192 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys

12:30:38.0765 12192 MSKSSRV - ok

12:30:38.0828 12192 [ C1F19D2BACBEE9AB64D9AE69E9859AC0 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe

12:30:38.0859 12192 MsMpSvc - ok

12:30:38.0906 12192 [ AFB909B537AAE1BEAE7BBDB6A36D40B0 ] MSMQ C:\WINDOWS\system32\mqsvc.exe

12:30:38.0937 12192 MSMQ - ok

12:30:38.0953 12192 [ 7F955FF3B1BB93376EBE75D5ACCDC6DB ] MSMQTriggers C:\WINDOWS\system32\mqtgsvc.exe

12:30:39.0781 12192 MSMQTriggers - ok

12:30:39.0812 12192 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys

12:30:39.0859 12192 MSPCLOCK - ok

12:30:39.0906 12192 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys

12:30:39.0937 12192 MSPQM - ok

12:30:39.0953 12192 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys

12:30:39.0984 12192 mssmbios - ok

12:30:40.0015 12192 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys

12:30:40.0031 12192 MSTEE - ok

12:30:40.0078 12192 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys

12:30:40.0078 12192 Mup - ok

12:30:40.0125 12192 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

12:30:40.0171 12192 NABTSFEC - ok

12:30:40.0234 12192 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll

12:30:40.0312 12192 napagent - ok

12:30:40.0343 12192 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys

12:30:40.0421 12192 NDIS - ok

12:30:40.0453 12192 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys

12:30:40.0500 12192 NdisIP - ok

12:30:40.0546 12192 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys

12:30:40.0546 12192 NdisTapi - ok

12:30:40.0593 12192 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys

12:30:40.0609 12192 Ndisuio - ok

12:30:40.0625 12192 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys

12:30:40.0687 12192 NdisWan - ok

12:30:40.0734 12192 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys

12:30:40.0734 12192 NDProxy - ok

12:30:40.0750 12192 Net6IM - ok

12:30:40.0750 12192 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys

12:30:40.0796 12192 NetBIOS - ok

12:30:40.0812 12192 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys

12:30:40.0859 12192 NetBT - ok

12:30:40.0921 12192 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe

12:30:41.0031 12192 NetDDE - ok

12:30:41.0031 12192 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe

12:30:41.0031 12192 NetDDEdsdm - ok

12:30:41.0093 12192 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe

12:30:41.0093 12192 Netlogon - ok

12:30:41.0109 12192 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll

12:30:41.0171 12192 Netman - ok

12:30:41.0187 12192 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

12:30:41.0234 12192 NetTcpPortSharing - ok

12:30:41.0265 12192 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys

12:30:41.0312 12192 NIC1394 - ok

12:30:41.0328 12192 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll

12:30:41.0343 12192 Nla - ok

12:30:41.0359 12192 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys

12:30:41.0390 12192 Npfs - ok

12:30:41.0453 12192 [ 75AC610A7481CB1F343DC971249BCB19 ] NPF_devolo C:\WINDOWS\system32\drivers\npf_devolo.sys

12:30:41.0656 12192 NPF_devolo - ok

12:30:41.0703 12192 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys

12:30:41.0765 12192 Ntfs - ok

12:30:41.0781 12192 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe

12:30:41.0781 12192 NtLmSsp - ok

12:30:41.0843 12192 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll

12:30:41.0906 12192 NtmsSvc - ok

12:30:41.0953 12192 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys

12:30:41.0984 12192 Null - ok

12:30:41.0984 12192 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

12:30:42.0015 12192 NwlnkFlt - ok

12:30:42.0015 12192 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

12:30:42.0062 12192 NwlnkFwd - ok

12:30:42.0062 12192 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys

12:30:42.0109 12192 ohci1394 - ok

12:30:42.0125 12192 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys

12:30:42.0171 12192 Parport - ok

12:30:42.0187 12192 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys

12:30:42.0234 12192 PartMgr - ok

12:30:42.0250 12192 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys

12:30:42.0281 12192 ParVdm - ok

12:30:42.0281 12192 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys

12:30:42.0343 12192 PCI - ok

12:30:42.0343 12192 PCIDump - ok

12:30:42.0359 12192 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys

12:30:42.0375 12192 PCIIde - ok

12:30:42.0390 12192 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\DRIVERS\pcmcia.sys

12:30:42.0453 12192 Pcmcia - ok

12:30:42.0453 12192 PDCOMP - ok

12:30:42.0468 12192 PDFRAME - ok

12:30:42.0468 12192 PDRELI - ok

12:30:42.0484 12192 PDRFRAME - ok

12:30:42.0484 12192 perc2 - ok

12:30:42.0500 12192 perc2hib - ok

12:30:42.0546 12192 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe

12:30:42.0546 12192 PlugPlay - ok

12:30:42.0593 12192 [ D31F88C5F19EEFA366A415D6BC5F2ABC ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe

12:30:42.0921 12192 Pml Driver HPZ12 - ok

12:30:42.0968 12192 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe

12:30:42.0968 12192 PolicyAgent - ok

12:30:43.0015 12192 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys

12:30:43.0062 12192 PptpMiniport - ok

12:30:43.0078 12192 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys

12:30:43.0125 12192 Processor - ok

12:30:43.0125 12192 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe

12:30:43.0125 12192 ProtectedStorage - ok

12:30:43.0140 12192 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys

12:30:43.0187 12192 PSched - ok

12:30:43.0218 12192 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys

12:30:43.0250 12192 Ptilink - ok

12:30:43.0250 12192 ql1080 - ok

12:30:43.0265 12192 Ql10wnt - ok

12:30:43.0265 12192 ql12160 - ok

12:30:43.0281 12192 ql1240 - ok

12:30:43.0281 12192 ql1280 - ok

12:30:43.0312 12192 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys

12:30:43.0328 12192 RasAcd - ok

12:30:43.0359 12192 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll

12:30:43.0390 12192 RasAuto - ok

12:30:43.0406 12192 [ 0207D26DDF796A193CCD9F83047BB5FC ] Rasirda C:\WINDOWS\system32\DRIVERS\rasirda.sys

12:30:43.0421 12192 Rasirda - ok

12:30:43.0453 12192 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

12:30:43.0484 12192 Rasl2tp - ok

12:30:43.0546 12192 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll

12:30:43.0578 12192 RasMan - ok

12:30:43.0593 12192 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys

12:30:43.0625 12192 RasPppoe - ok

12:30:43.0640 12192 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys

12:30:43.0671 12192 Raspti - ok

12:30:43.0703 12192 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys

12:30:43.0718 12192 Rdbss - ok

12:30:43.0734 12192 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

12:30:43.0750 12192 RDPCDD - ok

12:30:43.0796 12192 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys

12:30:43.0828 12192 rdpdr - ok

12:30:43.0859 12192 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys

12:30:43.0859 12192 RDPWD - ok

12:30:43.0890 12192 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys

12:30:43.0937 12192 redbook - ok

12:30:43.0984 12192 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll

12:30:44.0031 12192 RemoteAccess - ok

12:30:44.0078 12192 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll

12:30:44.0109 12192 RemoteRegistry - ok

12:30:44.0140 12192 [ F17713D108ACA124A139FDE877EEF68A ] RimUsb C:\WINDOWS\system32\Drivers\RimUsb.sys

12:30:44.0187 12192 RimUsb - ok

12:30:44.0234 12192 [ 96F7A9A7BF0C9C0440A967440065D33C ] RMCAST C:\WINDOWS\system32\drivers\RMCast.sys

12:30:44.0234 12192 RMCAST - ok

12:30:44.0296 12192 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe

12:30:44.0343 12192 RpcLocator - ok

12:30:44.0390 12192 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\system32\rpcss.dll

12:30:44.0390 12192 RpcSs - ok

12:30:44.0437 12192 [ 085CED4621302B27D86358AD6239DABE ] RsvLock C:\WINDOWS\system32\drivers\RsvLock.sys

12:30:44.0500 12192 RsvLock - ok

12:30:44.0515 12192 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe

12:30:44.0578 12192 RSVP - ok

12:30:44.0609 12192 [ 26AF84A03E2C2C5AD7ABFECEFC43BC4D ] SafeBoot C:\WINDOWS\system32\drivers\SafeBoot.sys

12:30:44.0609 12192 Suspicious file (NoAccess): C:\WINDOWS\system32\drivers\SafeBoot.sys. md5: 26AF84A03E2C2C5AD7ABFECEFC43BC4D

12:30:44.0609 12192 SafeBoot ( LockedFile.Multi.Generic ) - warning

12:30:44.0609 12192 SafeBoot - detected LockedFile.Multi.Generic (1)

12:30:44.0625 12192 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe

12:30:44.0625 12192 SamSs - ok

12:30:44.0640 12192 [ 587674B8CBB440691692335F7ED28E02 ] SbAlg C:\WINDOWS\system32\drivers\SbAlg.sys

12:30:44.0703 12192 SbAlg - ok

12:30:44.0703 12192 [ 41C08F2DA137340855BB2E4FDE8FD765 ] SbFsLock C:\WINDOWS\system32\drivers\SbFsLock.sys

12:30:44.0734 12192 SbFsLock - ok

12:30:44.0796 12192 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe

12:30:44.0875 12192 SCardSvr - ok

12:30:44.0921 12192 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll

12:30:44.0937 12192 Schedule - ok

12:30:44.0984 12192 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys

12:30:45.0015 12192 Secdrv - ok

12:30:45.0031 12192 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll

12:30:45.0062 12192 seclogon - ok

12:30:45.0078 12192 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll

12:30:45.0078 12192 SENS - ok

12:30:45.0093 12192 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys

12:30:45.0109 12192 serenum - ok

12:30:45.0140 12192 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys

12:30:45.0218 12192 Serial - ok

12:30:45.0265 12192 [ B6401608579B6431994425BA7653F774 ] SFAUDIO C:\WINDOWS\system32\drivers\sfaudio.sys

12:30:45.0296 12192 SFAUDIO - ok

12:30:45.0312 12192 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys

12:30:45.0328 12192 Sfloppy - ok

12:30:45.0406 12192 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll

12:30:45.0484 12192 SharedAccess - ok

12:30:45.0500 12192 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll

12:30:45.0515 12192 ShellHWDetection - ok

12:30:45.0515 12192 Simbad - ok

12:30:45.0562 12192 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys

12:30:45.0578 12192 SLIP - ok

12:30:45.0640 12192 [ 707647A1AA0EDB6CBEF61B0C75C28ED3 ] SMCIRDA C:\WINDOWS\system32\DRIVERS\smcirda.sys

12:30:45.0671 12192 SMCIRDA - ok

12:30:45.0718 12192 [ A1ECEEAA5C5E74B2499EB51D38185B84 ] SONYPVU1 C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS

12:30:45.0734 12192 SONYPVU1 - ok

12:30:45.0750 12192 Sparrow - ok

12:30:45.0796 12192 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys

12:30:45.0828 12192 splitter - ok

12:30:45.0859 12192 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe

12:30:45.0859 12192 Spooler - ok

12:30:45.0906 12192 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys

12:30:45.0968 12192 sr - ok

12:30:46.0015 12192 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll

12:30:46.0062 12192 srservice - ok

12:30:46.0109 12192 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys

12:30:46.0125 12192 Srv - ok

12:30:46.0140 12192 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll

12:30:46.0187 12192 SSDPSRV - ok

12:30:46.0218 12192 [ 5A1D0CA8A5F1E7B4EC50B9D76C001F0E ] ss_bus C:\WINDOWS\system32\DRIVERS\ss_bus.sys

12:30:46.0281 12192 ss_bus - ok

12:30:46.0296 12192 [ F0A85580E36A3A85059037D39A9CF079 ] ss_mdfl C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys

12:30:46.0328 12192 ss_mdfl - ok

12:30:46.0328 12192 [ 84C3DBFD1BFA4ADC0A950B3D5506CB00 ] ss_mdm C:\WINDOWS\system32\DRIVERS\ss_mdm.sys

12:30:46.0406 12192 ss_mdm - ok

12:30:46.0421 12192 [ 306521935042FC0A6988D528643619B3 ] StarOpen C:\WINDOWS\system32\drivers\StarOpen.sys

12:30:46.0453 12192 StarOpen - ok

12:30:46.0468 12192 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll

12:30:46.0546 12192 stisvc - ok

12:30:46.0578 12192 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys

12:30:46.0609 12192 streamip - ok

12:30:46.0656 12192 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys

12:30:46.0703 12192 swenum - ok

12:30:46.0734 12192 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys

12:30:46.0765 12192 swmidi - ok

12:30:46.0781 12192 SwPrv - ok

12:30:46.0796 12192 symc810 - ok

12:30:46.0796 12192 symc8xx - ok

12:30:46.0812 12192 sym_hi - ok

12:30:46.0812 12192 sym_u3 - ok

12:30:46.0875 12192 [ 926E0BB4CAC05D9A0C3B59DC16FE2F1C ] SynTP C:\WINDOWS\system32\DRIVERS\SynTP.sys

12:30:46.0953 12192 SynTP - ok

12:30:46.0968 12192 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys

12:30:47.0031 12192 sysaudio - ok

12:30:47.0062 12192 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe

12:30:47.0125 12192 SysmonLog - ok

12:30:47.0156 12192 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll

12:30:47.0203 12192 TapiSrv - ok

12:30:47.0265 12192 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys

12:30:47.0281 12192 Tcpip - ok

12:30:47.0312 12192 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys

12:30:47.0343 12192 TDPIPE - ok

12:30:47.0375 12192 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys

12:30:47.0406 12192 TDTCP - ok

12:30:47.0421 12192 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys

12:30:47.0468 12192 TermDD - ok

12:30:47.0531 12192 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll

12:30:47.0578 12192 TermService - ok

12:30:47.0609 12192 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll

12:30:47.0609 12192 Themes - ok

12:30:47.0625 12192 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe

12:30:47.0703 12192 TlntSvr - ok

12:30:47.0703 12192 TosIde - ok

12:30:47.0734 12192 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll

12:30:47.0781 12192 TrkWks - ok

12:30:47.0796 12192 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys

12:30:47.0843 12192 Udfs - ok

12:30:47.0843 12192 ultra - ok

12:30:47.0906 12192 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys

12:30:47.0937 12192 Update - ok

12:30:47.0953 12192 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll

12:30:48.0000 12192 upnphost - ok

12:30:48.0031 12192 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe

12:30:48.0125 12192 UPS - ok

12:30:48.0171 12192 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys

12:30:48.0218 12192 usbaudio - ok

12:30:48.0281 12192 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys

12:30:48.0312 12192 usbccgp - ok

12:30:48.0343 12192 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys

12:30:48.0375 12192 usbehci - ok

12:30:48.0406 12192 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys

12:30:48.0453 12192 usbhub - ok

12:30:48.0484 12192 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys

12:30:48.0515 12192 usbohci - ok

12:30:48.0515 12192 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys

12:30:48.0546 12192 usbprint - ok

12:30:48.0578 12192 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys

12:30:48.0593 12192 usbscan - ok

12:30:48.0671 12192 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

12:30:48.0703 12192 USBSTOR - ok

12:30:48.0703 12192 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys

12:30:48.0734 12192 usbuhci - ok

12:30:48.0765 12192 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys

12:30:48.0796 12192 VgaSave - ok

12:30:48.0812 12192 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys

12:30:48.0828 12192 ViaIde - ok

12:30:48.0843 12192 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys

12:30:48.0890 12192 VolSnap - ok

12:30:48.0953 12192 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe

12:30:49.0031 12192 VSS - ok

12:30:49.0062 12192 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll

12:30:49.0109 12192 W32Time - ok

12:30:49.0171 12192 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys

12:30:49.0218 12192 Wanarp - ok

12:30:49.0265 12192 [ FD47474BD21794508AF449D9D91AF6E6 ] Wdf01000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys

12:30:49.0312 12192 Wdf01000 - ok

12:30:49.0328 12192 WDICA - ok

12:30:49.0359 12192 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys

12:30:49.0421 12192 wdmaud - ok

12:30:49.0468 12192 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll

12:30:49.0500 12192 WebClient - ok

12:30:49.0609 12192 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll

12:30:49.0687 12192 winmgmt - ok

12:30:49.0703 12192 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll

12:30:49.0750 12192 WmdmPmSN - ok

12:30:49.0796 12192 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll

12:30:49.0812 12192 Wmi - ok

12:30:49.0812 12192 [ C42584FD66CE9E17403AEBCA199F7BDB ] WmiAcpi C:\WINDOWS\system32\DRIVERS\wmiacpi.sys

12:30:49.0843 12192 WmiAcpi - ok

12:30:49.0875 12192 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe

12:30:49.0953 12192 WmiApSrv - ok

12:30:50.0046 12192 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe

12:30:50.0375 12192 WMPNetworkSvc - ok

12:30:50.0406 12192 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys

12:30:50.0453 12192 WpdUsb - ok

12:30:50.0531 12192 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

12:30:50.0640 12192 WPFFontCache_v0400 - ok

12:30:50.0687 12192 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll

12:30:50.0734 12192 wscsvc - ok

12:30:50.0750 12192 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

12:30:50.0796 12192 WSTCODEC - ok

12:30:50.0859 12192 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll

12:30:50.0890 12192 wuauserv - ok

12:30:50.0937 12192 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys

12:30:51.0000 12192 WudfPf - ok

12:30:51.0000 12192 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys

12:30:51.0078 12192 WudfRd - ok

12:30:51.0093 12192 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll

12:30:51.0125 12192 WudfSvc - ok

12:30:51.0187 12192 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll

12:30:51.0234 12192 WZCSVC - ok

12:30:51.0250 12192 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll

12:30:51.0296 12192 xmlprov - ok

12:30:51.0359 12192 [ D57A909F1A9114D5D18A2EACB1AFECD5 ] yukonwxp C:\WINDOWS\system32\DRIVERS\yk51x86.sys

12:30:51.0390 12192 yukonwxp - ok

12:30:51.0406 12192 ================ Scan global ===============================

12:30:51.0453 12192 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll

12:30:51.0500 12192 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll

12:30:51.0515 12192 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll

12:30:51.0562 12192 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe

12:30:51.0562 12192 [Global] - ok

12:30:51.0562 12192 ================ Scan MBR ==================================

12:30:51.0593 12192 [ E5FA06ACA0D60BA9C870D0EF3D9898C9 ] \Device\Harddisk0\DR0

12:30:51.0828 12192 \Device\Harddisk0\DR0 - ok

12:30:51.0828 12192 ================ Scan VBR ==================================

12:30:51.0828 12192 [ 93369DC93ECC31DDF4CF136BEC771FC2 ] \Device\Harddisk0\DR0\Partition1

12:30:51.0828 12192 \Device\Harddisk0\DR0\Partition1 - ok

12:30:51.0859 12192 [ E427D2A1FFB7DD96EEDA855F744747F1 ] \Device\Harddisk0\DR0\Partition2

12:30:51.0859 12192 \Device\Harddisk0\DR0\Partition2 - ok

12:30:51.0859 12192 ============================================================

12:30:51.0859 12192 Scan finished

12:30:51.0859 12192 ============================================================

12:30:51.0875 12180 Detected object count: 1

12:30:51.0875 12180 Actual detected object count: 1

12:33:56.0390 12180 SafeBoot ( LockedFile.Multi.Generic ) - skipped by user

12:33:56.0390 12180 SafeBoot ( LockedFile.Multi.Generic ) - User select action: Skip

12:35:36.0187 11764 Deinitialize success

~~~~~~~~~~~~~~~

Is it ok to proceed to step 2?

plugandplay · May 26, 2013

Hi,

I have now done step 2 & run Malwarebytes Anti-Rootkit; at the start it found AppInit_dlls and said either Remove or select NO if not sure; I selected NO, just in case & ran the scan.

~~~~~~~~~~~~~~~~~~

mbar log

Malwarebytes Anti-Rootkit BETA 1.06.0.1003

www.malwarebytes.org

Database version: v2013.05.26.04

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Paul :: LAPTOP [administrator]

26/05/2013 14:55:45

mbar-log-2013-05-26 (14-55-45).txt

Scan type: Quick scan

Scan options disabled: Deep Anti-Rootkit Scan | PUP

Objects scanned: 295945

Time elapsed: 56 minute(s), 4 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

system-log

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.06.0.1003

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 2.099000 GHz

Memory total: 2949427200, free: 2091208704

Host not found

Net Exception

Downloaded database version: v2013.05.26.04

Downloaded database version: v2013.05.22.01

Initializing...

------------ Kernel report ------------

05/26/2013 14:55:32

------------ Loaded modules -----------

\WINDOWS\system32\ntkrnlpa.exe

\WINDOWS\system32\hal.dll

\WINDOWS\system32\KDCOM.DLL

\WINDOWS\system32\BOOTVID.dll

ACPI.sys

\WINDOWS\system32\DRIVERS\WMILIB.SYS

pci.sys

isapnp.sys

ohci1394.sys

\WINDOWS\system32\DRIVERS\1394BUS.SYS

compbatt.sys

\WINDOWS\system32\DRIVERS\BATTC.SYS

pciide.sys

\WINDOWS\system32\DRIVERS\PCIIDEX.SYS

intelide.sys

viaide.sys

aliide.sys

pcmcia.sys

MountMgr.sys

ftdisk.sys

dmload.sys

dmio.sys

ACPIEC.sys

\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS

PartMgr.sys

VolSnap.sys

atapi.sys

ahcix86.sys

\WINDOWS\System32\DRIVERS\SCSIPORT.SYS

SbAlg.sys

disk.sys

\WINDOWS\system32\DRIVERS\CLASSPNP.SYS

fltmgr.sys

SbFsLock.sys

sr.sys

MpFilter.sys

KSecDD.sys

WudfPf.sys

Ntfs.sys

NDIS.sys

sfaudio.sys

SafeBoot.sys

Mup.sys

hpdskflt.sys

Amddfltr.sys

\SystemRoot\system32\DRIVERS\AmdPPM.sys

\SystemRoot\system32\DRIVERS\ati2mtag.sys

\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

\SystemRoot\system32\DRIVERS\yk51x86.sys

\SystemRoot\system32\DRIVERS\imapi.sys

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\system32\DRIVERS\redbook.sys

\SystemRoot\system32\DRIVERS\ks.sys

\SystemRoot\system32\DRIVERS\usbohci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\i8042prt.sys

\SystemRoot\system32\DRIVERS\HpqKbFiltr.sys

\SystemRoot\system32\DRIVERS\WDFLDR.SYS

\SystemRoot\system32\DRIVERS\Wdf01000.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\SynTP.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\DRIVERS\Accelerometer.sys

\SystemRoot\system32\DRIVERS\CmBatt.sys

\SystemRoot\system32\DRIVERS\cpqbttn.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\wmiacpi.sys

\SystemRoot\system32\DRIVERS\btkrnl.sys

\SystemRoot\system32\DRIVERS\audstub.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\DRIVERS\psched.sys

\SystemRoot\system32\DRIVERS\msgpc.sys

\SystemRoot\system32\DRIVERS\ptilink.sys

\SystemRoot\system32\DRIVERS\raspti.sys

\SystemRoot\system32\DRIVERS\rdpdr.sys

\SystemRoot\system32\DRIVERS\termdd.sys

\SystemRoot\system32\DRIVERS\swenum.sys

\SystemRoot\system32\DRIVERS\update.sys

\SystemRoot\system32\DRIVERS\mssmbios.sys

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\system32\DRIVERS\btport.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\system32\drivers\ADIHdAud.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\drivers\AEAudio.sys

\SystemRoot\system32\DRIVERS\AGRSM.sys

\SystemRoot\System32\Drivers\Modem.SYS

\SystemRoot\System32\Drivers\Fs_Rec.SYS

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\Drivers\mnmdd.SYS

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\rasacd.sys

\SystemRoot\system32\DRIVERS\ipsec.sys

\SystemRoot\system32\DRIVERS\tcpip.sys

\SystemRoot\system32\DRIVERS\netbt.sys

\SystemRoot\system32\DRIVERS\ipnat.sys

\SystemRoot\System32\drivers\afd.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\System32\Drivers\StarOpen.SYS

\SystemRoot\System32\Drivers\RsvLock.SYS

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\System32\Drivers\Fastfat.SYS

\SystemRoot\System32\Drivers\Fips.SYS

\SystemRoot\System32\Drivers\dump_diskdump.sys

\SystemRoot\System32\Drivers\dump_ahcix86.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\System32\watchdog.sys

\SystemRoot\System32\drivers\dxg.sys

\SystemRoot\System32\drivers\dxgthk.sys

\SystemRoot\System32\ati2dvag.dll

\SystemRoot\System32\ati2cqag.dll

\SystemRoot\System32\atikvmag.dll

\SystemRoot\System32\atiok3x2.dll

\SystemRoot\System32\ati3duag.dll

\SystemRoot\System32\ativvaxx.dll

\SystemRoot\System32\ATMFD.DLL

\SystemRoot\system32\DRIVERS\ndisuio.sys

\SystemRoot\system32\DRIVERS\srv.sys

\??\C:\WINDOWS\system32\drivers\mqac.sys

\SystemRoot\system32\drivers\npf_devolo.sys

\??\C:\WINDOWS\system32\drivers\RMCast.sys

\SystemRoot\system32\DRIVERS\LVPr2Mon.sys

\SystemRoot\system32\drivers\wdmaud.sys

\SystemRoot\system32\drivers\sysaudio.sys

\SystemRoot\System32\Drivers\Cdfs.SYS

\??\c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{5F05A567-49B8-4FE7-8416-D5A14E2299BE}\MpKsl1dba4d5b.sys

\??\c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C12FE1AA-A084-4C71-AD28-62EB45E3E9E0}\MpKsl9ab5c64c.sys

\SystemRoot\system32\drivers\kmixer.sys

\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys

\??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys

\WINDOWS\system32\ntdll.dll

----------- End -----------

Done!

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xffffffff8abdb7f0

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Scsi\ahcix861Port0Path0Target0Lun0\

Lower Device Object: 0xffffffff8ac5c030

Lower Device Driver Name: \Driver\ahcix86\

<<<2>>>

Device number: 0, partition: 1

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xffffffff8abdb7f0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff8ab87a00, DeviceName: Unknown, DriverName: \Driver\PartMgr\

DevicePointer: 0xffffffff8a669020, DeviceName: Unknown, DriverName: \Driver\SafeBoot\

DevicePointer: 0xffffffff8abdb7f0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff8abdbd58, DeviceName: Unknown, DriverName: \Driver\hpdskflt\

DevicePointer: 0xffffffff8abc48d8, DeviceName: Unknown, DriverName: \Driver\Amddfltr\

DevicePointer: 0xffffffff8ac5c920, DeviceName: \Device\00000087\, DriverName: \Driver\ACPI\

DevicePointer: 0xffffffff8ac5c030, DeviceName: \Device\Scsi\ahcix861Port0Path0Target0Lun0\, DriverName: \Driver\ahcix86\

------------ End ----------

Alternate DeviceName: Unknown, DriverName: \Driver\SafeBoot\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

Device number: 0, partition: 1

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\system32\drivers...

<<<2>>>

Device number: 0, partition: 1

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

File user open failed: C:\WINDOWS\system32\drivers\SafeBoot.sys (0x00000020)

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 95AA95AA

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 63 Numsec = 310456062

Partition file system is NTFS

Partition is bootable

Partition 1 type is Other (0xc)

Partition is NOT ACTIVE.

Partition starts at LBA: 310472190 Numsec = 2104515

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 160041885696 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-312561808-312581808)...

Done!

Scan finished

=======================================

Removal queue found; removal started

Removing c:\documents and settings\all users\application data\malwarebytes' anti-malware (portable)\mbr_0_i.mbam...

Removing c:\documents and settings\all users\application data\malwarebytes' anti-malware (portable)\bootstrap_0_0_63_i.mbam...

Removing c:\documents and settings\all users\application data\malwarebytes' anti-malware (portable)\mbr_0_r.mbam...

Removal finished

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.06.0.1003

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 2.099000 GHz

Memory total: 2949427200, free: 2134679552

=======================================

It said that no malicious items were found.

I shall wait to hear from you before Step 3.

D-FRED-BROWN · May 26, 2013

Hi, I need the other logs as well. Let me know how things go.

plugandplay · May 27, 2013

Hi DFB,

Steps 3 & 4 reports below:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ComboFix

ComboFix 13-05-27.02 - Paul 27/05/2013 20:48:23.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2813.1819 [GMT 1:00]

Running from: c:\documents and settings\Paul\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Paul\System

c:\documents and settings\Paul\System\win_qs8.jqx

c:\windows\EventSystem.log

c:\windows\system32\URTTemp

c:\windows\system32\URTTemp\fusion.dll

c:\windows\system32\URTTemp\mscoree.dll

c:\windows\system32\URTTemp\mscoree.dll.local

c:\windows\system32\URTTemp\mscorsn.dll

c:\windows\system32\URTTemp\mscorwks.dll

c:\windows\system32\URTTemp\msvcr71.dll

c:\windows\system32\URTTemp\regtlib.exe

.

((((((((((((((((((((((((( Files Created from 2013-04-27 to 2013-05-27 )))))))))))))))))))))))))))))))

.

2013-05-27 17:24 . 2013-05-13 06:19 7016152 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C06C03FE-AD8C-4F78-8213-093BE8308639}\mpengine.dll

2013-05-26 13:55 . 2013-05-26 14:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)

2013-05-26 09:54 . 2013-05-13 06:19 7016152 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-05-25 08:42 . 2013-05-25 08:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2013-05-25 08:42 . 2013-04-04 13:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-05-09 13:11 . 2013-05-09 13:11 -------- d-----w- c:\documents and settings\Alyson\Application Data\Foxit Software

2013-05-04 15:15 . 2013-05-04 15:15 -------- d-----w- c:\documents and settings\LocalService\Application Data\Foxit Software

2013-05-04 15:14 . 2013-05-04 15:14 -------- d-----w- c:\program files\Foxit Software

2013-05-04 13:57 . 2013-05-25 14:39 -------- d-----w- c:\program files\Common Files\Adobe AIR

2013-05-04 13:57 . 2013-05-04 13:57 -------- d-----w- c:\program files\devolo

2013-05-04 13:46 . 2013-05-04 15:15 -------- d-----w- c:\documents and settings\Paul\Application Data\Foxit Software

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-23 14:57 . 2012-04-10 17:32 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-05-23 14:57 . 2011-05-15 16:58 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-05-02 15:28 . 2013-03-19 21:32 238872 ------w- c:\windows\system32\MpSigStub.exe

2013-04-16 22:17 . 2004-08-04 08:00 920064 ----a-w- c:\windows\system32\wininet.dll

2013-04-16 22:17 . 2004-08-04 08:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

2013-04-16 22:17 . 2004-08-04 08:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

2013-04-12 23:28 . 2004-08-04 08:00 385024 ----a-w- c:\windows\system32\html.iec

2013-04-10 01:31 . 2004-08-04 08:00 1876352 ----a-w- c:\windows\system32\win32k.sys

2013-03-08 08:36 . 2004-08-04 08:00 293376 ----a-w- c:\windows\system32\winsrv.dll

2013-03-07 01:32 . 2004-08-04 08:00 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-03-07 00:50 . 2004-08-04 08:00 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-02-27 07:56 . 2004-08-04 08:00 2067456 ----a-w- c:\windows\system32\mstscax.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-24 39408]

"kdx"="c:\program files\Kontiki\KHost.exe" [2009-01-02 1041960]

"GarminExpressTrayApp"="c:\program files\Garmin\Express Tray\ExpressTray.exe" [2013-02-05 1099576]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-06-02 296056]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1040384]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1044480]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]

"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456]

"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-10-07 349488]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]

"MsmqIntCert"="mqrt.dll" [2008-04-14 177152]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]

"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 774168]

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 488984]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]

"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2008-05-14 61440]

"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-09-23 24848]

"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-11-27 298536]

"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.Exe" [2008-06-09 82224]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-5-12 576104]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]

2007-11-27 16:41 109568 ----a-w- c:\windows\system32\ackpbsc.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]

2007-11-27 16:40 286720 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\APSHook.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mqsvc.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\mstsc.exe"=

"c:\\Program Files\\Kontiki\\KService.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\WINDOWS\\system32\\dxdiag.exe"=

"c:\\WINDOWS\\system32\\dpnsvr.exe"=

"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=

"c:\\Program Files\\devolo\\dlan\\devolonetsvc.exe"=

.

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [27/06/2008 07:57 174600]

R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [27/06/2008 08:21 15416]

R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [01/10/2008 15:01 109216]

R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [01/10/2008 15:02 51408]

R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [01/10/2008 15:02 12960]

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [28/03/2008 11:14 24064]

R1 MpKsl9ab5c64c;MpKsl9ab5c64c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C12FE1AA-A084-4C71-AD28-62EB45E3E9E0}\MpKsl9ab5c64c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C12FE1AA-A084-4C71-AD28-62EB45E3E9E0}\MpKsl9ab5c64c.sys [?]

R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [01/10/2008 15:02 12528]

R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [27/11/2007 17:42 185896]

R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [04/08/2004 09:00 14336]

R2 DevoloNetworkService;devolo Network Service;c:\program files\devolo\dlan\devolonetsvc.exe [23/12/2010 11:41 3304768]

R2 Garmin Core Update Service;Garmin Core Update Service;c:\program files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [05/02/2013 19:08 185144]

R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [01/10/2008 15:01 256544]

R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [25/05/2013 09:42 418376]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [25/05/2013 09:42 701512]

R2 NPF_devolo;NetGroup Packet Filter Driver (devolo);c:\windows\system32\drivers\npf_devolo.sys [10/06/2010 12:32 35840]

R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [27/06/2008 09:21 193840]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [25/05/2013 09:42 22856]

S3 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [07/10/2008 14:17 45056]

S3 Net6IM;Net6;c:\windows\system32\DRIVERS\net6im51.sys --> c:\windows\system32\DRIVERS\net6im51.sys [?]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

getPlusHelper REG_MULTI_SZ getPlusHelper

Cognizance REG_MULTI_SZ ASChannel

.

Contents of the 'Scheduled Tasks' folder

.

2013-05-27 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 14:57]

.

2013-05-20 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]

.

2013-05-26 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-24 16:15]

.

2013-05-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-11 19:37]

.

2013-05-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-11 19:37]

.

2013-05-27 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job

- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 11:11]

.

2013-05-27 c:\windows\Tasks\MpIdleTask.job

- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 11:11]

.

2013-05-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-692129560-3622723548-494710042-1005.job