Epiksoul Posted September 20, 2010 ID:315829 Share Posted September 20, 2010 Malwarebytes has identified a rootkit but is unable to remove it even after reboot. The following is the DDS report followed by the most recent mbam log.DDS (Ver_10-03-17.01) - NTFSx86 Run by Jon at 20:55:49.64 on 19/09/2010Internet Explorer: 8.0.6001.18943 BrowserJavaVersion: 1.6.0_14MicrosoftAttach.zip Link to post Share on other sites More sharing options...
MrCharlie Posted September 20, 2010 ID:315990 Share Posted September 20, 2010 Welcome to the forum.Download and unzip Rootrepeal to a folder from the link below:http://rootrepeal.googlepages.com/ Run rootrepeal.exe by double clicking on itClick on report tab on the bottom right of the software then press scanPut at check in all box's except the 2 SSDT option's then press OKPlace a check in drive to be scanned (it is usually C)Click OK, the scan will start and produce a logPlease save the logfile generated and copy and paste the contents of that log into your next reply.MrC Link to post Share on other sites More sharing options...
Epiksoul Posted September 20, 2010 Author ID:316167 Share Posted September 20, 2010 Thanks for your help MrC. After running RootRepeal the report is as follows:ROOTREPEAL © AD, 2007-2009==================================================Scan Start Time: 2010/09/20 17:19Program Version: Version 1.3.5.0Windows Version: Windows Vista SP2==================================================Drivers-------------------Name: dump_iaStor.sysImage Path: C:\Windows\System32\Drivers\dump_iaStor.sysAddress: 0x904DE000 Size: 851968 File Visible: No Signed: -Status: -Name: rootrepeal.exe.sysImage Path: C:\Windows\system32\drivers\rootrepeal.exe.sysAddress: 0x9DD83000 Size: 49152 File Visible: No Signed: -Status: -Hidden/Locked Files-------------------Path: C:\Documents and SettingsStatus: Locked to the Windows API!Path: C:\hiberfil.sysStatus: Locked to the Windows API!Path: C:\ProgramData\DesktopStatus: Locked to the Windows API!Path: C:\ProgramData\DocumentsStatus: Locked to the Windows API!Path: C:\ProgramData\FavoritesStatus: Locked to the Windows API!Path: C:\ProgramData\Start MenuStatus: Locked to the Windows API!Path: C:\ProgramData\TemplatesStatus: Locked to the Windows API!Path: C:\System Volume Information\{0e0255e4-c0ba-11df-86be-c87c0f76a3f3}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{10f7e259-bedb-11df-8887-dcb216a140b5}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{8d5d2c52-bffe-11df-acc3-ebabafac10af}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{c39a580c-bc25-11df-9c01-f9f77eee473f}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{ec4b9548-bdb3-11df-97fb-ccbad4a471f0}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{f612098e-c252-11df-a9f9-b45c74098ff0}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{f6120996-c252-11df-a9f9-b45c74098ff0}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{fdad6901-be74-11df-bf31-a7f6e44ce3f2}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{fdad690c-be74-11df-bf31-a7f6e44ce3f2}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{47a29b66-c2a4-11df-8af2-cc4133ce80f1}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{47a29b76-c2a4-11df-8af2-cc4133ce80f1}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{64d97873-c0e7-11df-889b-cdc3c9f8acb4}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{7252b01b-bcff-11df-bdad-f6265132b0f3}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\Users\All UsersStatus: Locked to the Windows API!Path: C:\Users\Default UserStatus: Locked to the Windows API!Path: C:\Users\Default\Application DataStatus: Locked to the Windows API!Path: C:\Users\Default\CookiesStatus: Locked to the Windows API!Path: C:\Users\Default\Local SettingsStatus: Locked to the Windows API!Path: C:\Users\Default\My DocumentsStatus: Locked to the Windows API!Path: C:\Users\Default\NetHoodStatus: Locked to the Windows API!Path: C:\Users\Default\PrintHoodStatus: Locked to the Windows API!Path: C:\Users\Default\RecentStatus: Locked to the Windows API!Path: C:\Users\Default\SendToStatus: Locked to the Windows API!Path: C:\Users\Default\Start MenuStatus: Locked to the Windows API!Path: C:\Users\Default\TemplatesStatus: Locked to the Windows API!Path: C:\Users\Default\Documents\My MusicStatus: Locked to the Windows API!Path: C:\Users\Default\Documents\My PicturesStatus: Locked to the Windows API!Path: C:\Users\Default\Documents\My VideosStatus: Locked to the Windows API!Path: C:\Users\Public\Documents\My MusicStatus: Locked to the Windows API!Path: C:\Users\Public\Documents\My PicturesStatus: Locked to the Windows API!Path: C:\Users\Public\Documents\My VideosStatus: Locked to the Windows API!Path: C:\Windows\System32\drivers\oopuhnpkpjv.sysStatus: Invisible to the Windows API!Path: C:\Windows\System32\drivers\str.sysStatus: Invisible to the Windows API!Path: C:\Windows\System32\wbem\MSFEED~1.MOFStatus: Locked to the Windows API!Path: C:\Windows\System32\wbem\PRINTF~1.MOFStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_none_d6c3e7af9bae13a2.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.4.20.microsoft.msxml2_6bd6b9abf345378f_4.20.9876.0_none_a6e4a7980e9b18a2.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.1.0.0_none_6c030d6fdc86522c.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_365945b9da656e4d.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d08d7da0442a985d.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9870.0_none_b7e00e6c7b30b69b.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_58b19c2866332652.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_none_60a5df56e60dc5df.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.42_none_45e008191e507087.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_none_bcb86ed6ac711f91.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_none_54c11df268b7c6d9.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_none_58843c41d2730d3f.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.42_none_7658964504b9f3b6.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_none_0e9c2a8d74fd3ce6.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_5c4003bc63e949f6.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.4.20.microsoft.msxml2_6bd6b9abf345378f_4.20.9870.0_none_a6dea5dc0ea08098.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_db5f52fb98cb24ad.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.0.0_none_3658456fda6654f6.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.4.1.microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_8b7b15c031cda6db.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9876.0_none_b7e610287b2b4ea5.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_516e2e610f48bda6.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\26340819d2ef86080d9001c6f2737d70fd6602ddf4b86b6c26b326ef81cc3342.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\2d3cb7907b1336ea5889a2b731d5e97ad40903a4efd2287c1c117bc30f208f46.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\a2492fa83366394b7c17fa6c9650ce5688b887d0ad0ad79743a3422debf4d997.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\34f4e1067328cece3ad510dbcdd746657fd91ee96f89f25201a7c658918512d1.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\7aefb85f3099da7d88809ade16e90c2e3d61c5eeb236093cddc0a546934b02ad.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\113260042a311e5a7871a6659a0a0cc23a5864196832c01f81f093942513b749.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\92a6d9ca6a73206405dc393c28776ea6cded8b6ef43bffcf248c1b852ccd4c2c.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\b3beb16c28db357e654a6b132f59cd48cb95cee949d7b97587f8f02f233f3ce1.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\f7bf65ca621d8ad32ead1500a08827be239d0f49d83dc20dabf57d2eb17adbd7.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\dd72f7ab2def5f75f58d01b24643b308750c38685daaed50bcddf61c18460dee.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\d14225a52543aa5a9605b00dd7574812bf89c605ebc73a9730e1e386bfc965f8.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\91ca50cec42075fff02b366323bf3b45d2053b24544bd12b622b65621bd0edd5.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\88b03fe13d2710ad787d5d96cd0e5cbeda3a61c2a0a2bdc0c0984a48365242e2.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\a951d53950c367acc37622f0dd619a954df5de2c4ec40296e6636605aa33714a.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-weblowtrust_config_default_b03f5f7f11d50a3a_6.0.6000.16720_none_c035c989242f4981\WEB_LO~1.DEFStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-weblowtrust_config_default_b03f5f7f11d50a3a_6.0.6000.20883_none_a96de02d3dd18e74\WEB_LO~1.DEFStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6000.16720_none_e2c358ab062e054b\WEB_MI~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6000.20883_none_cbfb6f4f1fd04a3e\WEB_MI~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6001.18111_none_e29e3d61068011ec\WEB_MI~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6001.22230_none_cbd2adfd20258aff\WEB_MI~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6001.22230_none_9a1350e27965368d\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~2.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~3.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~4.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WI1344~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WI5BF5~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~2.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~3.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~4.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WI1344~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WI5BF5~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~2.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~3.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~4.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WI1344~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WI5BF5~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~2.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~3.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~4.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WI1344~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WI5BF5~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\CONFIR~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WIZARD~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WIZARD~3.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WIZARD~4.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WI7FD4~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WI49C3~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WI2CD7~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WI3A48~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\CONFIR~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WIZARD~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WIZARD~3.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WIZARD~4.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WI7FD4~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WI49C3~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WI2CD7~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WI3A48~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\CONFIR~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WIZARD~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WIZARD~3.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WIZARD~4.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WI7FD4~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WI49C3~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WI2CD7~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WI3A48~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\CONFIR~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WIZARD~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WIZARD~3.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WIZARD~4.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WI7FD4~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WI49C3~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WI2CD7~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WI3A48~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\CHOOSE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\MANAGE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\MANAGE~2.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\CHOOSE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\MANAGE~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\PROVID~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\CHOOSE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\MANAGE~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\PROVID~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\CHOOSE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\MANAGE~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\PROVID~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\CHOOSE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\MANAGE~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\PROVID~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6000.16720_none_fc112931b73e055f\APPCON~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6000.16720_none_fc112931b73e055f\GLOBAL~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6000.20883_none_e5493fd5d0e04a52\APPCON~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6000.20883_none_e5493fd5d0e04a52\GLOBAL~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6001.18111_none_fbec0de7b7901200\APPCON~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6001.18111_none_fbec0de7b7901200\GLOBAL~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6001.22230_none_e5207e83d1358b13\APPCON~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6001.22230_none_e5207e83d1358b13\GLOBAL~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-uninstallsqlstate_sql_b03f5f7f11d50a3a_6.0.6000.16720_none_a2f69a4627a6df36\UNINST~1.SQLStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-uninstallsqlstate_sql_b03f5f7f11d50a3a_6.0.6000.20883_none_8c2eb0ea41492429\UNINST~1.SQLStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-uninstallsqlstate_sql_b03f5f7f11d50a3a_6.0.6001.18111_none_a2d17efc27f8ebd7\UNINST~1.SQLStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-uninstallsqlstate_sql_b03f5f7f11d50a3a_6.0.6001.22230_none_8c05ef98419e64ea\UNINST~1.SQLStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-vbc_exe_config_b03f5f7f11d50a3a_6.0.6000.16720_none_32a2a55c0f70152b\VBCEXE~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-vbc_exe_config_b03f5f7f11d50a3a_6.0.6000.20883_none_1bdabc0029125a1e\VBCEXE~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-vbc_exe_config_b03f5f7f11d50a3a_6.0.6001.18111_none_327d8a120fc221cc\VBCEXE~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-vbc_exe_config_b03f5f7f11d50a3a_6.0.6001.22230_none_1bb1faae29679adf\VBCEXE~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.0.6000.16720_none_2c88b9b71ca44e71\WEB_ME~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.0.6000.20883_none_15c0d05b36469364\WEB_ME~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.0.6001.18111_none_2c639e6d1cf65b12\WEB_ME~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.0.6001.22230_none_15980f09369bd425\WEB_ME~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.0.6000.16720_none_c39efe8a3f927437\SETUPA~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.0.6000.20883_none_acd7152e5934b92a\SETUPA~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.0.6001.18111_none_c379e3403fe480d8\SETUPA~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.0.6001.22230_none_acae53dc5989f9eb\SETUPA~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6000.16720_none_b103fb905f6db0d9\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6000.20883_none_9a3c1234790ff5cc\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6000.16720_none_950a4e2fda3ee0ba\CREATE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6000.16720_none_950a4e2fda3ee0ba\MANAGE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6000.20883_none_7e4264d3f3e125ad\CREATE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6000.20883_none_7e4264d3f3e125ad\MANAGE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6001.18111_none_94e532e5da90ed5b\CREATE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6001.18111_none_94e532e5da90ed5b\MANAGE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6001.22230_none_7e19a381f436666e\CREATE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6001.22230_none_7e19a381f436666e\MANAGE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.16720_none_4cb2b120b7498755\CREATE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.16720_none_4cb2b120b7498755\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.20883_none_35eac7c4d0ebcc48\CREATE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.20883_none_35eac7c4d0ebcc48\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6001.18111_none_4c8d95d6b79b93f6\CREATE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6001.18111_noProcesses-------------------Path: SystemPID: 4 Status: Locked to the Windows API!Path: C:\Windows\System32\audiodg.exePID: 1324 Status: Locked to the Windows API!Stealth Objects-------------------Object: Hidden Thread [ETHREAD: 0x8a0eb958, TID: 952]Process: svchost.exe (PID: 944) Address: 0x00032aab Size: -Object: Hidden Thread [ETHREAD: 0x860f8498, TID: 1876]Process: SearchIndexer.exe (PID: 2708) Address: 0x76ed2d40 Size: -Object: Hidden Module [Name: msgsres.dll]Process: msnmsgr.exe (PID: 5476) Address: 0x67220000 Size: 11403264Object: Hidden Module [Name: msgslang.14.0.8089.0726.dll]Process: msnmsgr.exe (PID: 5476) Address: 0x6c1b0000 Size: 315392Object: Hidden Module [Name: msgrvsta.thm]Process: msnmsgr.exe (PID: 5476) Address: 0x72b90000 Size: 20480Object: Hidden Code [ETHREAD: 0x85b96780]Process: System Address: 0x8659a77d Size: 1231Object: Hidden Code [ETHREAD: 0x85b9b780]Process: System Address: 0x8659a8bb Size: 913Hidden Services-------------------Service Name: khqlmxopImage Path: system32\drivers\oopuhnpkpjv.sys==EOF== Link to post Share on other sites More sharing options...
MrCharlie Posted September 20, 2010 ID:316181 Share Posted September 20, 2010 Run Rootrepeal again but this time only check FilesWhen it's done, highlight and right click on:Path: C:\Windows\System32\drivers\oopuhnpkpjv.sysStatus: Invisible to the Windows API!Choose wipe file then immediately reboot.Update and and run MBAM, post the log back here, MrC Link to post Share on other sites More sharing options...
Epiksoul Posted September 21, 2010 Author ID:316270 Share Posted September 21, 2010 I ran Rootrepeal and found oopuhnpkpjv.sys but after "wipe file" and reboot followed by updated MBAM scan and a reboot. The files have not been removed/fixed. The following are the reports/logs for MBAM and RootRepeal. Sorry about the work, I was hoping it'd be over after the wipe file.Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4661Windows 6.0.6002 Service Pack 2Internet Explorer 8.0.6001.1894320/09/2010 9:41:19 PMmbam-log-2010-09-20 (21-41-19).txtScan type: Quick scanObjects scanned: 145517Time elapsed: 8 minute(s), 36 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\Windows\system32\Drivers\str.sys (Rootkit.Agent) -> Delete on reboot.ROOTREPEAL © AD, 2007-2009==================================================Scan Start Time: 2010/09/20 21:43Program Version: Version 1.3.5.0Windows Version: Windows Vista SP2==================================================Hidden/Locked Files-------------------Path: C:\Documents and SettingsStatus: Locked to the Windows API!Path: C:\hiberfil.sysStatus: Locked to the Windows API!Path: C:\ProgramData\DesktopStatus: Locked to the Windows API!Path: C:\ProgramData\DocumentsStatus: Locked to the Windows API!Path: C:\ProgramData\FavoritesStatus: Locked to the Windows API!Path: C:\ProgramData\Start MenuStatus: Locked to the Windows API!Path: C:\ProgramData\TemplatesStatus: Locked to the Windows API!Path: C:\System Volume Information\{0e0255e4-c0ba-11df-86be-c87c0f76a3f3}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{10f7e259-bedb-11df-8887-dcb216a140b5}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{8d5d2c52-bffe-11df-acc3-ebabafac10af}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{c39a580c-bc25-11df-9c01-f9f77eee473f}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{ec4b9548-bdb3-11df-97fb-ccbad4a471f0}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{f612098e-c252-11df-a9f9-b45c74098ff0}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{f6120996-c252-11df-a9f9-b45c74098ff0}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{fdad6901-be74-11df-bf31-a7f6e44ce3f2}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{fdad690c-be74-11df-bf31-a7f6e44ce3f2}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{47a29b66-c2a4-11df-8af2-cc4133ce80f1}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{47a29b76-c2a4-11df-8af2-cc4133ce80f1}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{64d97873-c0e7-11df-889b-cdc3c9f8acb4}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\System Volume Information\{7252b01b-bcff-11df-bdad-f6265132b0f3}{3808876b-c176-4e48-b7ae-04046e6cc752}Status: Locked to the Windows API!Path: C:\Users\All UsersStatus: Locked to the Windows API!Path: C:\Users\Default UserStatus: Locked to the Windows API!Path: C:\Users\Default\Application DataStatus: Locked to the Windows API!Path: C:\Users\Default\CookiesStatus: Locked to the Windows API!Path: C:\Users\Default\Local SettingsStatus: Locked to the Windows API!Path: C:\Users\Default\My DocumentsStatus: Locked to the Windows API!Path: C:\Users\Default\NetHoodStatus: Locked to the Windows API!Path: C:\Users\Default\PrintHoodStatus: Locked to the Windows API!Path: C:\Users\Default\RecentStatus: Locked to the Windows API!Path: C:\Users\Default\SendToStatus: Locked to the Windows API!Path: C:\Users\Default\Start MenuStatus: Locked to the Windows API!Path: C:\Users\Default\TemplatesStatus: Locked to the Windows API!Path: C:\Users\Default\Documents\My MusicStatus: Locked to the Windows API!Path: C:\Users\Default\Documents\My PicturesStatus: Locked to the Windows API!Path: C:\Users\Default\Documents\My VideosStatus: Locked to the Windows API!Path: C:\Users\Public\Documents\My MusicStatus: Locked to the Windows API!Path: C:\Users\Public\Documents\My PicturesStatus: Locked to the Windows API!Path: C:\Users\Public\Documents\My VideosStatus: Locked to the Windows API!Path: c:\windows\softwaredistribution\eventcache\{2c1c7f35-da07-4723-a163-706b03f5a382}.binStatus: Allocation size mismatch (API: 8, Raw: 0)Path: C:\Windows\System32\drivers\oopuhnpkpjv.sysStatus: Invisible to the Windows API!Path: C:\Windows\System32\drivers\str.sysStatus: Invisible to the Windows API!Path: C:\Windows\System32\wbem\MSFEED~1.MOFStatus: Locked to the Windows API!Path: C:\Windows\System32\wbem\PRINTF~1.MOFStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_none_d6c3e7af9bae13a2.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.4.20.microsoft.msxml2_6bd6b9abf345378f_4.20.9876.0_none_a6e4a7980e9b18a2.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.1.0.0_none_6c030d6fdc86522c.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_365945b9da656e4d.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d08d7da0442a985d.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9870.0_none_b7e00e6c7b30b69b.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_58b19c2866332652.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_none_60a5df56e60dc5df.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.42_none_45e008191e507087.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_none_bcb86ed6ac711f91.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_none_54c11df268b7c6d9.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_none_58843c41d2730d3f.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.42_none_7658964504b9f3b6.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_none_0e9c2a8d74fd3ce6.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_5c4003bc63e949f6.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.4.20.microsoft.msxml2_6bd6b9abf345378f_4.20.9870.0_none_a6dea5dc0ea08098.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_db5f52fb98cb24ad.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.0.0_none_3658456fda6654f6.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.4.1.microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_8b7b15c031cda6db.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9876.0_none_b7e610287b2b4ea5.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_516e2e610f48bda6.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\26340819d2ef86080d9001c6f2737d70fd6602ddf4b86b6c26b326ef81cc3342.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\2d3cb7907b1336ea5889a2b731d5e97ad40903a4efd2287c1c117bc30f208f46.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\a2492fa83366394b7c17fa6c9650ce5688b887d0ad0ad79743a3422debf4d997.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\34f4e1067328cece3ad510dbcdd746657fd91ee96f89f25201a7c658918512d1.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\7aefb85f3099da7d88809ade16e90c2e3d61c5eeb236093cddc0a546934b02ad.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\113260042a311e5a7871a6659a0a0cc23a5864196832c01f81f093942513b749.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\92a6d9ca6a73206405dc393c28776ea6cded8b6ef43bffcf248c1b852ccd4c2c.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\b3beb16c28db357e654a6b132f59cd48cb95cee949d7b97587f8f02f233f3ce1.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\f7bf65ca621d8ad32ead1500a08827be239d0f49d83dc20dabf57d2eb17adbd7.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\dd72f7ab2def5f75f58d01b24643b308750c38685daaed50bcddf61c18460dee.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\d14225a52543aa5a9605b00dd7574812bf89c605ebc73a9730e1e386bfc965f8.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\91ca50cec42075fff02b366323bf3b45d2053b24544bd12b622b65621bd0edd5.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\88b03fe13d2710ad787d5d96cd0e5cbeda3a61c2a0a2bdc0c0984a48365242e2.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\Manifests\a951d53950c367acc37622f0dd619a954df5de2c4ec40296e6636605aa33714a.catStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-weblowtrust_config_default_b03f5f7f11d50a3a_6.0.6000.16720_none_c035c989242f4981\WEB_LO~1.DEFStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-weblowtrust_config_default_b03f5f7f11d50a3a_6.0.6000.20883_none_a96de02d3dd18e74\WEB_LO~1.DEFStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6000.16720_none_e2c358ab062e054b\WEB_MI~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6000.20883_none_cbfb6f4f1fd04a3e\WEB_MI~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6001.18111_none_e29e3d61068011ec\WEB_MI~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6001.22230_none_cbd2adfd20258aff\WEB_MI~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6001.22230_none_9a1350e27965368d\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~2.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~3.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~4.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WI1344~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WI5BF5~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~2.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~3.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~4.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WI1344~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WI5BF5~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~2.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~3.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~4.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WI1344~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WI5BF5~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~2.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~3.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~4.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WI1344~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WI5BF5~1.ASCStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\CONFIR~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WIZARD~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WIZARD~3.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WIZARD~4.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WI7FD4~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WI49C3~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WI2CD7~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.16720_none_a5a88a6ce272adc8\WI3A48~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\CONFIR~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WIZARD~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WIZARD~3.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WIZARD~4.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WI7FD4~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WI49C3~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WI2CD7~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6000.20883_none_8ee0a110fc14f2bb\WI3A48~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\CONFIR~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WIZARD~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WIZARD~3.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WIZARD~4.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WI7FD4~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WI49C3~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WI2CD7~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.18111_none_a5836f22e2c4ba69\WI3A48~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\CONFIR~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WIZARD~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WIZARD~3.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WIZARD~4.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WI7FD4~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WI49C3~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WI2CD7~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_6.0.6001.22230_none_8eb7dfbefc6a337c\WI3A48~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\CHOOSE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\MANAGE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\MANAGE~2.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\CHOOSE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\MANAGE~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\PROVID~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\CHOOSE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\MANAGE~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\PROVID~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\CHOOSE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\MANAGE~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\PROVID~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\CHOOSE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\MANAGE~2.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\PROVID~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6000.16720_none_fc112931b73e055f\APPCON~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6000.16720_none_fc112931b73e055f\GLOBAL~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6000.20883_none_e5493fd5d0e04a52\APPCON~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6000.20883_none_e5493fd5d0e04a52\GLOBAL~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6001.18111_none_fbec0de7b7901200\APPCON~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6001.18111_none_fbec0de7b7901200\GLOBAL~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6001.22230_none_e5207e83d1358b13\APPCON~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_res_res_b03f5f7f11d50a3a_6.0.6001.22230_none_e5207e83d1358b13\GLOBAL~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-uninstallsqlstate_sql_b03f5f7f11d50a3a_6.0.6000.16720_none_a2f69a4627a6df36\UNINST~1.SQLStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-uninstallsqlstate_sql_b03f5f7f11d50a3a_6.0.6000.20883_none_8c2eb0ea41492429\UNINST~1.SQLStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-uninstallsqlstate_sql_b03f5f7f11d50a3a_6.0.6001.18111_none_a2d17efc27f8ebd7\UNINST~1.SQLStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-uninstallsqlstate_sql_b03f5f7f11d50a3a_6.0.6001.22230_none_8c05ef98419e64ea\UNINST~1.SQLStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-vbc_exe_config_b03f5f7f11d50a3a_6.0.6000.16720_none_32a2a55c0f70152b\VBCEXE~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-vbc_exe_config_b03f5f7f11d50a3a_6.0.6000.20883_none_1bdabc0029125a1e\VBCEXE~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-vbc_exe_config_b03f5f7f11d50a3a_6.0.6001.18111_none_327d8a120fc221cc\VBCEXE~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-vbc_exe_config_b03f5f7f11d50a3a_6.0.6001.22230_none_1bb1faae29679adf\VBCEXE~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.0.6000.16720_none_2c88b9b71ca44e71\WEB_ME~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.0.6000.20883_none_15c0d05b36469364\WEB_ME~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.0.6001.18111_none_2c639e6d1cf65b12\WEB_ME~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webmedtrust_config_b03f5f7f11d50a3a_6.0.6001.22230_none_15980f09369bd425\WEB_ME~1.CONStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.0.6000.16720_none_c39efe8a3f927437\SETUPA~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.0.6000.20883_none_acd7152e5934b92a\SETUPA~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.0.6001.18111_none_c379e3403fe480d8\SETUPA~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_6.0.6001.22230_none_acae53dc5989f9eb\SETUPA~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6000.16720_none_b103fb905f6db0d9\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6000.20883_none_9a3c1234790ff5cc\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6000.16720_none_950a4e2fda3ee0ba\CREATE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6000.16720_none_950a4e2fda3ee0ba\MANAGE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6000.20883_none_7e4264d3f3e125ad\CREATE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6000.20883_none_7e4264d3f3e125ad\MANAGE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6001.18111_none_94e532e5da90ed5b\CREATE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6001.18111_none_94e532e5da90ed5b\MANAGE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6001.22230_none_7e19a381f436666e\CREATE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_6.0.6001.22230_none_7e19a381f436666e\MANAGE~1.ASPStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.16720_none_4cb2b120b7498755\CREATE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.16720_none_4cb2b120b7498755\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.20883_none_35eac7c4d0ebcc48\CREATE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6000.20883_none_35eac7c4d0ebcc48\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6001.18111_none_4c8d95d6b79b93f6\CREATE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6001.18111_none_4c8d95d6b79b93f6\MANAGE~1.RESStatus: Locked to the Windows API!Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.0.6001.22230_none_35c20672d1410d09\CREATE~1.RES==EOF== Link to post Share on other sites More sharing options...
MrCharlie Posted September 21, 2010 ID:316459 Share Posted September 21, 2010 Don't worry...we'll get it. What was the original reason you ran MBAM??------------------------------Vista and Windows 7 users:1. These tools MUST be run from the executable. (.exe) every time you run them 2. With Admin Rights (Right click, choose "Run as Administrator")---------------------Please do this:Download TDSSKiller to your Desktop. Doubleclick on TDSSKiller.exe to run the application, then click on Start Scan. If an infected file is detected, the default action will be Cure, click on Continue. If a suspicious file is detected, the default action will be Skip, click on Continue. You may be asked you to reboot the computer to complete the process. Click on Reboot Now To view the report: Click the Report button and copy/paste the contents of it into your next reply.Note:It will also create a log in the C:\ directory.---------------------------------Next:Download ComboFix from one of these locations:Link 1Link 2 ComboFix Guide* IMPORTANT !!! Save ComboFix.exe to your DesktopDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon and choose disable/exit. More info HEREThey may interfere with the running of ComboFix.Double click on ComboFix.exe & follow the prompts.Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7. Note: If you have SP3, use the SP2 package.If Vista or Windows 7, skip the Recovery Console partComboFix will check to see if the Microsoft Windows Recovery Console is installed. It's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.Notes:1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please let me know. 4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.5.Give it atleast 20-30 minutes to finish if needed.MrC Link to post Share on other sites More sharing options...
Epiksoul Posted September 21, 2010 Author ID:316513 Share Posted September 21, 2010 Thank you for the help. I have run the 2 things and here are the reports.2010/09/21 11:08:42.0100 TDSS rootkit removing tool 2.4.2.1 Sep 7 2010 14:43:442010/09/21 11:08:42.0100 ================================================================================2010/09/21 11:08:42.0100 SystemInfo:2010/09/21 11:08:42.0100 2010/09/21 11:08:42.0100 OS Version: 6.0.6002 ServicePack: 2.02010/09/21 11:08:42.0100 Product type: Workstation2010/09/21 11:08:42.0100 ComputerName: JON-PC2010/09/21 11:08:42.0100 UserName: Jon2010/09/21 11:08:42.0100 Windows directory: C:\Windows2010/09/21 11:08:42.0100 System windows directory: C:\Windows2010/09/21 11:08:42.0100 Processor architecture: Intel x862010/09/21 11:08:42.0100 Number of processors: 22010/09/21 11:08:42.0100 Page size: 0x10002010/09/21 11:08:42.0100 Boot type: Normal boot2010/09/21 11:08:42.0100 ================================================================================2010/09/21 11:08:42.0926 Initialize success2010/09/21 11:08:57.0122 ================================================================================2010/09/21 11:08:57.0122 Scan started2010/09/21 11:08:57.0122 Mode: Manual;2010/09/21 11:08:57.0122 ================================================================================2010/09/21 11:08:57.0559 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys2010/09/21 11:08:57.0622 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys2010/09/21 11:08:57.0653 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys2010/09/21 11:08:57.0684 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys2010/09/21 11:08:57.0731 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys2010/09/21 11:08:57.0793 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys2010/09/21 11:08:57.0856 AgereSoftModem (1cfeba39fc613e45b49d3eddfbcda289) C:\Windows\system32\DRIVERS\AGRSM.sys2010/09/21 11:08:57.0934 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys2010/09/21 11:08:57.0965 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys2010/09/21 11:08:57.0996 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys2010/09/21 11:08:58.0043 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys2010/09/21 11:08:58.0074 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys2010/09/21 11:08:58.0090 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys2010/09/21 11:08:58.0121 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys2010/09/21 11:08:58.0168 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys2010/09/21 11:08:58.0199 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys2010/09/21 11:08:58.0292 ASMMAP (7b4d08d2017ac06689d422e06c43f0aa) C:\Program Files\ATKGFNEX\ASMMAP.sys2010/09/21 11:08:58.0402 ASPI32 (b979979ab8027f7f53fb16ec4229b7db) C:\Windows\system32\drivers\ASPI32.sys2010/09/21 11:08:58.0448 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys2010/09/21 11:08:58.0495 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys2010/09/21 11:08:58.0573 athr (4df523f49694b2884f8e5d870bf3e253) C:\Windows\system32\DRIVERS\athr.sys2010/09/21 11:08:58.0636 ATSWPDRV (f70d2392158cb68e775f8c4cd3d12fbb) C:\Windows\system32\DRIVERS\ATSwpDrv.sys2010/09/21 11:08:58.0698 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys2010/09/21 11:08:58.0745 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys2010/09/21 11:08:58.0776 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys2010/09/21 11:08:58.0823 bpenum (a3f0b475e5bef7e4c85a59216fdd4a80) C:\Windows\system32\DRIVERS\bpenum.sys2010/09/21 11:08:58.0838 BPPROT (dac8d9625cd8500bd56f095dee5b54d3) C:\Windows\system32\DRIVERS\bpprot.sys2010/09/21 11:08:58.0885 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys2010/09/21 11:08:58.0916 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys2010/09/21 11:08:58.0948 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys2010/09/21 11:08:58.0979 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys2010/09/21 11:08:59.0010 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys2010/09/21 11:08:59.0057 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys2010/09/21 11:08:59.0104 BthEnum (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys2010/09/21 11:08:59.0150 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys2010/09/21 11:08:59.0182 BthPan (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys2010/09/21 11:08:59.0228 BTHPORT (5a3abaa2f8eece7aefb942773766e3db) C:\Windows\system32\Drivers\BTHport.sys2010/09/21 11:08:59.0260 BTHUSB (94e2941280e3756a5e0bcb467865c43a) C:\Windows\system32\Drivers\BTHUSB.sys2010/09/21 11:08:59.0306 btwaudio (f2f7342742180d5060285499dee50f99) C:\Windows\system32\drivers\btwaudio.sys2010/09/21 11:08:59.0322 btwavdt (32f59f26a30cfc508da11db3ea0f8b77) C:\Windows\system32\drivers\btwavdt.sys2010/09/21 11:08:59.0369 btwl2cap (ecb98391c756a7b9cfbae89d9d1235e1) C:\Windows\system32\DRIVERS\btwl2cap.sys2010/09/21 11:08:59.0400 btwrchid (03658734ef7d0f3b3f4636d3e8a38964) C:\Windows\system32\DRIVERS\btwrchid.sys2010/09/21 11:08:59.0447 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys2010/09/21 11:08:59.0509 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys2010/09/21 11:08:59.0540 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys2010/09/21 11:08:59.0587 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys2010/09/21 11:08:59.0650 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys2010/09/21 11:08:59.0681 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys2010/09/21 11:08:59.0712 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys2010/09/21 11:08:59.0728 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys2010/09/21 11:08:59.0774 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys2010/09/21 11:08:59.0837 DCamUSBET (699ce24fe6b5120af709a0b91582a02d) C:\Windows\system32\DRIVERS\etDevice.sys2010/09/21 11:08:59.0930 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys2010/09/21 11:08:59.0993 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys2010/09/21 11:09:00.0055 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys2010/09/21 11:09:00.0133 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys2010/09/21 11:09:00.0180 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys2010/09/21 11:09:00.0274 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys2010/09/21 11:09:00.0352 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys2010/09/21 11:09:00.0383 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys2010/09/21 11:09:00.0445 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys2010/09/21 11:09:00.0492 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys2010/09/21 11:09:00.0539 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys2010/09/21 11:09:00.0586 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys2010/09/21 11:09:00.0601 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys2010/09/21 11:09:00.0632 FiltUSBET (e50433dff5e6bf08693fa49a9205dee6) C:\Windows\system32\DRIVERS\etFilter.sys2010/09/21 11:09:00.0664 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys2010/09/21 11:09:00.0710 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys2010/09/21 11:09:00.0773 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys2010/09/21 11:09:00.0820 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys2010/09/21 11:09:00.0913 ghaio (31b40f40e09513addc460f6a297ad474) C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys2010/09/21 11:09:01.0007 hamachi (50595b5adc3e761bc9f3cf4832189eda) C:\Windows\system32\DRIVERS\hamachi.sys2010/09/21 11:09:01.0069 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys2010/09/21 11:09:01.0132 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys2010/09/21 11:09:01.0178 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys2010/09/21 11:09:01.0225 HidIr (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys2010/09/21 11:09:01.0272 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys2010/09/21 11:09:01.0319 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys2010/09/21 11:09:01.0366 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys2010/09/21 11:09:01.0412 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys2010/09/21 11:09:01.0444 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys2010/09/21 11:09:01.0475 iaStor (80c633722da72e97f3f5b3b11325696d) C:\Windows\system32\DRIVERS\iaStor.sys2010/09/21 11:09:01.0506 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys2010/09/21 11:09:01.0537 IcRecUsb (16e441dc4daf703fb0b0fe474830ff53) C:\Windows\system32\Drivers\IcRecUsb.sys2010/09/21 11:09:01.0568 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys2010/09/21 11:09:01.0662 IntcAzAudAddService (23ebcee9aaa4d6c88728791fab462456) C:\Windows\system32\drivers\RTKVHDA.sys2010/09/21 11:09:01.0787 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys2010/09/21 11:09:01.0834 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys2010/09/21 11:09:01.0880 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys2010/09/21 11:09:01.0943 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys2010/09/21 11:09:01.0974 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys2010/09/21 11:09:02.0021 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys2010/09/21 11:09:02.0052 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys2010/09/21 11:09:02.0099 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys2010/09/21 11:09:02.0146 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys2010/09/21 11:09:02.0177 itecir (8bcd857c7932ad005d5f9c89329da2e1) C:\Windows\system32\DRIVERS\itecir.sys2010/09/21 11:09:02.0224 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys2010/09/21 11:09:02.0255 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys2010/09/21 11:09:02.0286 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys2010/09/21 11:09:02.0348 kbfiltr (27bd4ac228ef6c0d490617c32e86a672) C:\Windows\system32\DRIVERS\kbfiltr.sys2010/09/21 11:09:02.0364 Suspicious service (Hidden): khqlmxop2010/09/21 11:09:02.0411 khqlmxop (7ec0f61797d6a7159ca446b2becf880e) C:\Windows\system32\drivers\oopuhnpkpjv.sys2010/09/21 11:09:02.0411 Suspicious file (Hidden): C:\Windows\system32\drivers\oopuhnpkpjv.sys. md5: 7ec0f61797d6a7159ca446b2becf880e2010/09/21 11:09:02.0426 khqlmxop - detected Hidden service (1)2010/09/21 11:09:02.0458 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys2010/09/21 11:09:02.0536 LHidFilt (3fa98339e8d9e007726be62f231e2015) C:\Windows\system32\DRIVERS\LHidFilt.Sys2010/09/21 11:09:02.0598 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys2010/09/21 11:09:02.0614 LMouFilt (f259f758e04d8fb8d48c6cdbe45223e8) C:\Windows\system32\DRIVERS\LMouFilt.Sys2010/09/21 11:09:02.0660 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys2010/09/21 11:09:02.0676 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys2010/09/21 11:09:02.0723 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys2010/09/21 11:09:02.0738 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys2010/09/21 11:09:02.0816 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys2010/09/21 11:09:02.0863 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys2010/09/21 11:09:02.0894 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys2010/09/21 11:09:02.0972 MODEMCSA (cbb59c41f19efea1a000793e08070a62) C:\Windows\system32\drivers\MODEMCSA.sys2010/09/21 11:09:03.0004 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys2010/09/21 11:09:03.0035 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys2010/09/21 11:09:03.0066 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys2010/09/21 11:09:03.0097 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys2010/09/21 11:09:03.0128 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys2010/09/21 11:09:03.0160 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys2010/09/21 11:09:03.0206 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys2010/09/21 11:09:03.0253 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys2010/09/21 11:09:03.0300 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys2010/09/21 11:09:03.0331 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys2010/09/21 11:09:03.0347 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys2010/09/21 11:09:03.0394 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys2010/09/21 11:09:03.0440 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys2010/09/21 11:09:03.0487 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys2010/09/21 11:09:03.0534 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys2010/09/21 11:09:03.0581 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys2010/09/21 11:09:03.0628 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys2010/09/21 11:09:03.0643 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys2010/09/21 11:09:03.0690 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys2010/09/21 11:09:03.0721 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys2010/09/21 11:09:03.0752 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys2010/09/21 11:09:03.0799 MTsensor (97affa9d95ffe20eee6229bc6be166cf) C:\Windows\system32\DRIVERS\ATKACPI.sys2010/09/21 11:09:03.0862 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys2010/09/21 11:09:03.0924 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys2010/09/21 11:09:03.0971 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys2010/09/21 11:09:04.0033 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys2010/09/21 11:09:04.0064 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys2010/09/21 11:09:04.0127 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys2010/09/21 11:09:04.0174 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys2010/09/21 11:09:04.0205 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys2010/09/21 11:09:04.0267 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys2010/09/21 11:09:04.0314 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys2010/09/21 11:09:04.0376 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys2010/09/21 11:09:04.0408 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys2010/09/21 11:09:04.0486 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys2010/09/21 11:09:04.0517 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys2010/09/21 11:09:04.0548 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys2010/09/21 11:09:04.0595 NVHDA (11be4b269549173cff542591e4be2c08) C:\Windows\system32\drivers\nvhda32v.sys2010/09/21 11:09:04.0798 nvlddmkm (440690da4358d9682dbcc56da7d419ab) C:\Windows\system32\DRIVERS\nvlddmkm.sys2010/09/21 11:09:05.0016 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys2010/09/21 11:09:05.0047 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys2010/09/21 11:09:05.0094 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys2010/09/21 11:09:05.0219 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys2010/09/21 11:09:05.0281 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys2010/09/21 11:09:05.0312 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys2010/09/21 11:09:05.0344 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys2010/09/21 11:09:05.0406 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys2010/09/21 11:09:05.0437 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys2010/09/21 11:09:05.0468 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys2010/09/21 11:09:05.0546 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys2010/09/21 11:09:05.0640 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys2010/09/21 11:09:05.0656 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys2010/09/21 11:09:05.0718 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys2010/09/21 11:09:05.0796 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys2010/09/21 11:09:05.0874 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys2010/09/21 11:09:05.0905 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys2010/09/21 11:09:05.0921 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys2010/09/21 11:09:05.0968 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys2010/09/21 11:09:05.0999 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys2010/09/21 11:09:06.0030 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys2010/09/21 11:09:06.0092 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys2010/09/21 11:09:06.0139 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys2010/09/21 11:09:06.0186 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys2010/09/21 11:09:06.0217 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys2010/09/21 11:09:06.0264 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys2010/09/21 11:09:06.0326 RFCOMM (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys2010/09/21 11:09:06.0389 rimmptsk (a5b12a4b3b774432db9b9fa221190e59) C:\Windows\system32\DRIVERS\rimmptsk.sys2010/09/21 11:09:06.0404 rimsptsk (c398bca91216755b098679a8da8a2300) C:\Windows\system32\DRIVERS\rimsptsk.sys2010/09/21 11:09:06.0436 rismxdp (2a2554cb24506e0a0508fc395c4a1b42) C:\Windows\system32\DRIVERS\rixdptsk.sys2010/09/21 11:09:06.0498 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys2010/09/21 11:09:06.0560 RTL8169 (abbe0f54ba3a378262c9cb86cf7d91f8) C:\Windows\system32\DRIVERS\Rtlh86.sys2010/09/21 11:09:06.0592 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys2010/09/21 11:09:06.0638 ScanUSBET (d4b6a94c007af4e398e1b78a90f254ea) C:\Windows\system32\DRIVERS\etScan.sys2010/09/21 11:09:06.0701 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys2010/09/21 11:09:06.0748 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys2010/09/21 11:09:06.0794 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys2010/09/21 11:09:06.0826 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys2010/09/21 11:09:06.0857 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys2010/09/21 11:09:06.0919 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys2010/09/21 11:09:06.0935 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys2010/09/21 11:09:06.0997 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys2010/09/21 11:09:07.0044 sfloppy (c33bfbd6e9e41fcd9ffef9729e9faed6) C:\Windows\system32\DRIVERS\sfloppy.sys2010/09/21 11:09:07.0075 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys2010/09/21 11:09:07.0122 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys2010/09/21 11:09:07.0153 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys2010/09/21 11:09:07.0216 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys2010/09/21 11:09:07.0278 smserial (c8a58fc905c9184fa70e37f71060c64d) C:\Windows\system32\DRIVERS\smserial.sys2010/09/21 11:09:07.0356 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys2010/09/21 11:09:07.0434 sptd (4f576e516cc76ec50a244586bcfa1c78) C:\Windows\system32\Drivers\sptd.sys2010/09/21 11:09:07.0434 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 4f576e516cc76ec50a244586bcfa1c782010/09/21 11:09:07.0450 sptd - detected Locked file (1)2010/09/21 11:09:07.0496 srv (96a5e2c642af8f591a7366429809506b) C:\Windows\system32\DRIVERS\srv.sys2010/09/21 11:09:07.0528 srv2 (71da2d64880c97e5ffc3c81761632751) C:\Windows\system32\DRIVERS\srv2.sys2010/09/21 11:09:07.0559 srvnet (0c5ab1892ae0fa504218db094bf6d041) C:\Windows\system32\DRIVERS\srvnet.sys2010/09/21 11:09:07.0637 StillCam (ef70b3d22b4bffda6ea851ecb063efaa) C:\Windows\system32\DRIVERS\serscan.sys2010/09/21 11:09:07.0668 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys2010/09/21 11:09:07.0699 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys2010/09/21 11:09:07.0762 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys2010/09/21 11:09:07.0777 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys2010/09/21 11:09:07.0840 SynTP (a59457258dc236f63d6eac759ef6c08b) C:\Windows\system32\DRIVERS\SynTP.sys2010/09/21 11:09:07.0933 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys2010/09/21 11:09:07.0996 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys2010/09/21 11:09:08.0042 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys2010/09/21 11:09:08.0105 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys2010/09/21 11:09:08.0120 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys2010/09/21 11:09:08.0152 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys2010/09/21 11:09:08.0214 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys2010/09/21 11:09:08.0308 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys2010/09/21 11:09:08.0354 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys2010/09/21 11:09:08.0401 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys2010/09/21 11:09:08.0417 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys2010/09/21 11:09:08.0479 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys2010/09/21 11:09:08.0526 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys2010/09/21 11:09:08.0557 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys2010/09/21 11:09:08.0588 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys2010/09/21 11:09:08.0620 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys2010/09/21 11:09:08.0635 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys2010/09/21 11:09:08.0698 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys2010/09/21 11:09:08.0760 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys2010/09/21 11:09:08.0807 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys2010/09/21 11:09:08.0838 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys2010/09/21 11:09:08.0916 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys2010/09/21 11:09:08.0947 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys2010/09/21 11:09:08.0978 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys2010/09/21 11:09:09.0025 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys2010/09/21 11:09:09.0088 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS2010/09/21 11:09:09.0119 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys2010/09/21 11:09:09.0181 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys2010/09/21 11:09:09.0228 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys2010/09/21 11:09:09.0259 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys2010/09/21 11:09:09.0290 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys2010/09/21 11:09:09.0306 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys2010/09/21 11:09:09.0337 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys2010/09/21 11:09:09.0353 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys2010/09/21 11:09:09.0400 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys2010/09/21 11:09:09.0446 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys2010/09/21 11:09:09.0478 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys2010/09/21 11:09:09.0524 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys2010/09/21 11:09:09.0556 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys2010/09/21 11:09:09.0587 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys2010/09/21 11:09:09.0634 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys2010/09/21 11:09:09.0680 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys2010/09/21 11:09:09.0805 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys2010/09/21 11:09:09.0868 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys2010/09/21 11:09:09.0899 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys2010/09/21 11:09:09.0977 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys2010/09/21 11:09:10.0024 yukonwlh (7d1f3b131d503ef43ee594b5a2b9b427) C:\Windows\system32\DRIVERS\yk60x86.sys2010/09/21 11:09:10.0086 ================================================================================2010/09/21 11:09:10.0086 Scan finished2010/09/21 11:09:10.0086 ================================================================================2010/09/21 11:09:10.0102 Detected object count: 22010/09/21 11:09:37.0074 Hidden service(khqlmxop) - User select action: Skip2010/09/21 11:09:37.0074 Locked file(sptd) - User select action: SkipComboFix 10-09-20.07 - Jon 21/09/2010 11:23:40.1.2 - x86Microsoft Link to post Share on other sites More sharing options...
MrCharlie Posted September 21, 2010 ID:316540 Share Posted September 21, 2010 You didn't answer this question:Why did you originally run MBAM??-----------------------1. Close any open browsers.2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it:4. If ComboFix wants to update.....please allow it to.Driver::khqlmxopFile::c:\windows\system32\drivers\oopuhnpkpjv.sys c:\windows\system32\drivers\str.sys Registry::[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\khqlmxop]Save this as CFScript.txt, in the same location as ComboFix.exeRefering to the picture above, drag CFScript into ComboFix.exeCAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.After reboot, (in case it asks to reboot)......Please provide the contents of the ComboFix log (C:\ComboFix.txt) in your next reply. MrC Link to post Share on other sites More sharing options...
Epiksoul Posted September 21, 2010 Author ID:316624 Share Posted September 21, 2010 I had been experiencing problems with my google links being redirected and ran the trendmicro antivirus I was using. It wasn't able to handle it which is the main reason why I googled and found malwarebytes. Please tell me if that doesn't answer the question I'll try to give a better answer. The new combofix log is:ComboFix 10-09-20.07 - Jon 21/09/2010 14:59:19.2.2 - x86Microsoft Link to post Share on other sites More sharing options...
MrCharlie Posted September 21, 2010 ID:316651 Share Posted September 21, 2010 Looks like its still there.TDSSKiller detected those two files:2010/09/21 11:09:10.0102 Detected object count: 22010/09/21 11:09:37.0074 Hidden service(khqlmxop) - User select action: Skip2010/09/21 11:09:37.0074 Locked file(sptd) - User select action: SkipLet run TDSSKiller again but this time don't skip those files, choose Delete.Post the log from TDSSKillerAfter a reboot, run ComboFix again, please make sure you disable Windows Defenderhttp://windows.microsoft.com/en-US/windows...ender-on-or-offPost the log from ComboFix, MrC Link to post Share on other sites More sharing options...
Epiksoul Posted September 21, 2010 Author ID:316746 Share Posted September 21, 2010 Hi, I know I disabled windows defender because the bottom security alert said so but for some reason the report still says that it's enabled. Also, this time TDSS only found 1 file.Here are the 2 reports from TDSS and combofix2010/09/21 18:39:54.0712 TDSS rootkit removing tool 2.4.2.1 Sep 7 2010 14:43:442010/09/21 18:39:54.0712 ================================================================================2010/09/21 18:39:54.0712 SystemInfo:2010/09/21 18:39:54.0712 2010/09/21 18:39:54.0712 OS Version: 6.0.6002 ServicePack: 2.02010/09/21 18:39:54.0712 Product type: Workstation2010/09/21 18:39:54.0712 ComputerName: JON-PC2010/09/21 18:39:54.0712 UserName: Jon2010/09/21 18:39:54.0712 Windows directory: C:\Windows2010/09/21 18:39:54.0712 System windows directory: C:\Windows2010/09/21 18:39:54.0712 Processor architecture: Intel x862010/09/21 18:39:54.0712 Number of processors: 22010/09/21 18:39:54.0712 Page size: 0x10002010/09/21 18:39:54.0712 Boot type: Normal boot2010/09/21 18:39:54.0712 ================================================================================2010/09/21 18:39:55.0133 Initialize success2010/09/21 18:39:57.0988 ================================================================================2010/09/21 18:39:57.0988 Scan started2010/09/21 18:39:57.0988 Mode: Manual;2010/09/21 18:39:57.0988 ================================================================================2010/09/21 18:39:58.0409 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys2010/09/21 18:39:58.0549 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys2010/09/21 18:39:58.0580 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys2010/09/21 18:39:58.0596 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys2010/09/21 18:39:58.0627 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys2010/09/21 18:39:58.0768 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys2010/09/21 18:39:58.0939 AgereSoftModem (1cfeba39fc613e45b49d3eddfbcda289) C:\Windows\system32\DRIVERS\AGRSM.sys2010/09/21 18:39:59.0095 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys2010/09/21 18:39:59.0111 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys2010/09/21 18:39:59.0142 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys2010/09/21 18:39:59.0204 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys2010/09/21 18:39:59.0220 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys2010/09/21 18:39:59.0314 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys2010/09/21 18:39:59.0345 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys2010/09/21 18:39:59.0454 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys2010/09/21 18:39:59.0532 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys2010/09/21 18:39:59.0657 ASMMAP (7b4d08d2017ac06689d422e06c43f0aa) C:\Program Files\ATKGFNEX\ASMMAP.sys2010/09/21 18:39:59.0750 ASPI32 (b979979ab8027f7f53fb16ec4229b7db) C:\Windows\system32\drivers\ASPI32.sys2010/09/21 18:39:59.0813 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys2010/09/21 18:39:59.0860 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys2010/09/21 18:39:59.0938 athr (4df523f49694b2884f8e5d870bf3e253) C:\Windows\system32\DRIVERS\athr.sys2010/09/21 18:40:00.0000 ATSWPDRV (f70d2392158cb68e775f8c4cd3d12fbb) C:\Windows\system32\DRIVERS\ATSwpDrv.sys2010/09/21 18:40:00.0062 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys2010/09/21 18:40:00.0125 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys2010/09/21 18:40:00.0156 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys2010/09/21 18:40:00.0250 bpenum (a3f0b475e5bef7e4c85a59216fdd4a80) C:\Windows\system32\DRIVERS\bpenum.sys2010/09/21 18:40:00.0281 BPPROT (dac8d9625cd8500bd56f095dee5b54d3) C:\Windows\system32\DRIVERS\bpprot.sys2010/09/21 18:40:00.0328 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys2010/09/21 18:40:00.0359 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys2010/09/21 18:40:00.0390 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys2010/09/21 18:40:00.0421 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys2010/09/21 18:40:00.0437 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys2010/09/21 18:40:00.0468 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys2010/09/21 18:40:00.0530 BthEnum (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys2010/09/21 18:40:00.0593 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys2010/09/21 18:40:00.0640 BthPan (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys2010/09/21 18:40:00.0686 BTHPORT (5a3abaa2f8eece7aefb942773766e3db) C:\Windows\system32\Drivers\BTHport.sys2010/09/21 18:40:00.0718 BTHUSB (94e2941280e3756a5e0bcb467865c43a) C:\Windows\system32\Drivers\BTHUSB.sys2010/09/21 18:40:00.0780 btwaudio (f2f7342742180d5060285499dee50f99) C:\Windows\system32\drivers\btwaudio.sys2010/09/21 18:40:00.0811 btwavdt (32f59f26a30cfc508da11db3ea0f8b77) C:\Windows\system32\drivers\btwavdt.sys2010/09/21 18:40:00.0889 btwl2cap (ecb98391c756a7b9cfbae89d9d1235e1) C:\Windows\system32\DRIVERS\btwl2cap.sys2010/09/21 18:40:00.0905 btwrchid (03658734ef7d0f3b3f4636d3e8a38964) C:\Windows\system32\DRIVERS\btwrchid.sys2010/09/21 18:40:00.0998 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys2010/09/21 18:40:01.0061 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys2010/09/21 18:40:01.0092 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys2010/09/21 18:40:01.0139 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys2010/09/21 18:40:01.0264 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys2010/09/21 18:40:01.0295 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys2010/09/21 18:40:01.0310 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys2010/09/21 18:40:01.0420 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys2010/09/21 18:40:01.0451 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys2010/09/21 18:40:01.0498 DCamUSBET (699ce24fe6b5120af709a0b91582a02d) C:\Windows\system32\DRIVERS\etDevice.sys2010/09/21 18:40:01.0544 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys2010/09/21 18:40:01.0716 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys2010/09/21 18:40:01.0825 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys2010/09/21 18:40:01.0872 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys2010/09/21 18:40:01.0950 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys2010/09/21 18:40:02.0059 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys2010/09/21 18:40:02.0137 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys2010/09/21 18:40:02.0231 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys2010/09/21 18:40:02.0324 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys2010/09/21 18:40:02.0371 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys2010/09/21 18:40:02.0449 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys2010/09/21 18:40:02.0496 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys2010/09/21 18:40:02.0543 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys2010/09/21 18:40:02.0590 FiltUSBET (e50433dff5e6bf08693fa49a9205dee6) C:\Windows\system32\DRIVERS\etFilter.sys2010/09/21 18:40:02.0636 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys2010/09/21 18:40:02.0683 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys2010/09/21 18:40:02.0761 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys2010/09/21 18:40:02.0792 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys2010/09/21 18:40:02.0886 ghaio (31b40f40e09513addc460f6a297ad474) C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys2010/09/21 18:40:02.0964 hamachi (50595b5adc3e761bc9f3cf4832189eda) C:\Windows\system32\DRIVERS\hamachi.sys2010/09/21 18:40:03.0026 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys2010/09/21 18:40:03.0073 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys2010/09/21 18:40:03.0120 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys2010/09/21 18:40:03.0151 HidIr (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys2010/09/21 18:40:03.0198 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys2010/09/21 18:40:03.0245 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys2010/09/21 18:40:03.0276 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys2010/09/21 18:40:03.0307 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys2010/09/21 18:40:03.0338 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys2010/09/21 18:40:03.0370 iaStor (80c633722da72e97f3f5b3b11325696d) C:\Windows\system32\DRIVERS\iaStor.sys2010/09/21 18:40:03.0401 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys2010/09/21 18:40:03.0463 IcRecUsb (16e441dc4daf703fb0b0fe474830ff53) C:\Windows\system32\Drivers\IcRecUsb.sys2010/09/21 18:40:03.0494 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys2010/09/21 18:40:03.0572 IntcAzAudAddService (23ebcee9aaa4d6c88728791fab462456) C:\Windows\system32\drivers\RTKVHDA.sys2010/09/21 18:40:03.0682 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys2010/09/21 18:40:03.0713 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys2010/09/21 18:40:03.0775 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys2010/09/21 18:40:03.0822 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys2010/09/21 18:40:03.0853 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys2010/09/21 18:40:03.0884 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys2010/09/21 18:40:03.0900 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys2010/09/21 18:40:03.0947 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys2010/09/21 18:40:03.0962 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys2010/09/21 18:40:04.0009 itecir (8bcd857c7932ad005d5f9c89329da2e1) C:\Windows\system32\DRIVERS\itecir.sys2010/09/21 18:40:04.0056 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys2010/09/21 18:40:04.0072 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys2010/09/21 18:40:04.0118 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys2010/09/21 18:40:04.0181 kbfiltr (27bd4ac228ef6c0d490617c32e86a672) C:\Windows\system32\DRIVERS\kbfiltr.sys2010/09/21 18:40:04.0196 Suspicious service (Hidden): khqlmxop2010/09/21 18:40:04.0243 khqlmxop (7ec0f61797d6a7159ca446b2becf880e) C:\Windows\system32\drivers\oopuhnpkpjv.sys2010/09/21 18:40:04.0321 Suspicious file (Hidden): C:\Windows\system32\drivers\oopuhnpkpjv.sys. md5: 7ec0f61797d6a7159ca446b2becf880e2010/09/21 18:40:04.0321 khqlmxop - detected Hidden service (1)2010/09/21 18:40:04.0352 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys2010/09/21 18:40:04.0430 LHidFilt (3fa98339e8d9e007726be62f231e2015) C:\Windows\system32\DRIVERS\LHidFilt.Sys2010/09/21 18:40:04.0477 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys2010/09/21 18:40:04.0493 LMouFilt (f259f758e04d8fb8d48c6cdbe45223e8) C:\Windows\system32\DRIVERS\LMouFilt.Sys2010/09/21 18:40:04.0540 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys2010/09/21 18:40:04.0555 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys2010/09/21 18:40:04.0586 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys2010/09/21 18:40:04.0633 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys2010/09/21 18:40:04.0711 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys2010/09/21 18:40:04.0774 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys2010/09/21 18:40:04.0805 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys2010/09/21 18:40:04.0852 MODEMCSA (cbb59c41f19efea1a000793e08070a62) C:\Windows\system32\drivers\MODEMCSA.sys2010/09/21 18:40:04.0898 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys2010/09/21 18:40:04.0914 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys2010/09/21 18:40:04.0930 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys2010/09/21 18:40:04.0961 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys2010/09/21 18:40:05.0023 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys2010/09/21 18:40:05.0039 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys2010/09/21 18:40:05.0086 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys2010/09/21 18:40:05.0132 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys2010/09/21 18:40:05.0164 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys2010/09/21 18:40:05.0195 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys2010/09/21 18:40:05.0226 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys2010/09/21 18:40:05.0273 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys2010/09/21 18:40:05.0304 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys2010/09/21 18:40:05.0398 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys2010/09/21 18:40:05.0444 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys2010/09/21 18:40:05.0507 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys2010/09/21 18:40:05.0554 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys2010/09/21 18:40:05.0569 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys2010/09/21 18:40:05.0616 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys2010/09/21 18:40:05.0647 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys2010/09/21 18:40:05.0694 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys2010/09/21 18:40:05.0741 MTsensor (97affa9d95ffe20eee6229bc6be166cf) C:\Windows\system32\DRIVERS\ATKACPI.sys2010/09/21 18:40:05.0788 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys2010/09/21 18:40:05.0834 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys2010/09/21 18:40:05.0897 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys2010/09/21 18:40:05.0928 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys2010/09/21 18:40:05.0944 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys2010/09/21 18:40:06.0006 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys2010/09/21 18:40:06.0053 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys2010/09/21 18:40:06.0068 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys2010/09/21 18:40:06.0131 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys2010/09/21 18:40:06.0271 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys2010/09/21 18:40:06.0349 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys2010/09/21 18:40:06.0443 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys2010/09/21 18:40:06.0505 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys2010/09/21 18:40:06.0599 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys2010/09/21 18:40:06.0630 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys2010/09/21 18:40:06.0770 NVHDA (11be4b269549173cff542591e4be2c08) C:\Windows\system32\drivers\nvhda32v.sys2010/09/21 18:40:07.0114 nvlddmkm (440690da4358d9682dbcc56da7d419ab) C:\Windows\system32\DRIVERS\nvlddmkm.sys2010/09/21 18:40:07.0176 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys2010/09/21 18:40:07.0207 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys2010/09/21 18:40:07.0254 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys2010/09/21 18:40:07.0472 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys2010/09/21 18:40:07.0519 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys2010/09/21 18:40:07.0628 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys2010/09/21 18:40:07.0660 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys2010/09/21 18:40:07.0753 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys2010/09/21 18:40:07.0784 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys2010/09/21 18:40:07.0816 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys2010/09/21 18:40:07.0894 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys2010/09/21 18:40:07.0987 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys2010/09/21 18:40:08.0034 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys2010/09/21 18:40:08.0159 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys2010/09/21 18:40:08.0237 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys2010/09/21 18:40:08.0315 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys2010/09/21 18:40:08.0377 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys2010/09/21 18:40:08.0471 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys2010/09/21 18:40:08.0502 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys2010/09/21 18:40:08.0580 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys2010/09/21 18:40:08.0627 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys2010/09/21 18:40:08.0674 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys2010/09/21 18:40:08.0689 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys2010/09/21 18:40:08.0752 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys2010/09/21 18:40:08.0767 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys2010/09/21 18:40:08.0798 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys2010/09/21 18:40:08.0876 RFCOMM (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys2010/09/21 18:40:08.0939 rimmptsk (a5b12a4b3b774432db9b9fa221190e59) C:\Windows\system32\DRIVERS\rimmptsk.sys2010/09/21 18:40:08.0954 rimsptsk (c398bca91216755b098679a8da8a2300) C:\Windows\system32\DRIVERS\rimsptsk.sys2010/09/21 18:40:08.0986 rismxdp (2a2554cb24506e0a0508fc395c4a1b42) C:\Windows\system32\DRIVERS\rixdptsk.sys2010/09/21 18:40:09.0048 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys2010/09/21 18:40:09.0126 RTL8169 (abbe0f54ba3a378262c9cb86cf7d91f8) C:\Windows\system32\DRIVERS\Rtlh86.sys2010/09/21 18:40:09.0173 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys2010/09/21 18:40:09.0204 ScanUSBET (d4b6a94c007af4e398e1b78a90f254ea) C:\Windows\system32\DRIVERS\etScan.sys2010/09/21 18:40:09.0313 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys2010/09/21 18:40:09.0360 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys2010/09/21 18:40:09.0422 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys2010/09/21 18:40:09.0454 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys2010/09/21 18:40:09.0485 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys2010/09/21 18:40:09.0532 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys2010/09/21 18:40:09.0563 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys2010/09/21 18:40:09.0594 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys2010/09/21 18:40:09.0625 sfloppy (c33bfbd6e9e41fcd9ffef9729e9faed6) C:\Windows\system32\DRIVERS\sfloppy.sys2010/09/21 18:40:09.0656 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys2010/09/21 18:40:09.0672 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys2010/09/21 18:40:09.0703 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys2010/09/21 18:40:09.0766 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys2010/09/21 18:40:09.0828 smserial (c8a58fc905c9184fa70e37f71060c64d) C:\Windows\system32\DRIVERS\smserial.sys2010/09/21 18:40:09.0906 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys2010/09/21 18:40:09.0984 sptd (4f576e516cc76ec50a244586bcfa1c78) C:\Windows\system32\Drivers\sptd.sys2010/09/21 18:40:10.0062 srv (96a5e2c642af8f591a7366429809506b) C:\Windows\system32\DRIVERS\srv.sys2010/09/21 18:40:10.0109 srv2 (71da2d64880c97e5ffc3c81761632751) C:\Windows\system32\DRIVERS\srv2.sys2010/09/21 18:40:10.0140 srvnet (0c5ab1892ae0fa504218db094bf6d041) C:\Windows\system32\DRIVERS\srvnet.sys2010/09/21 18:40:10.0234 StillCam (ef70b3d22b4bffda6ea851ecb063efaa) C:\Windows\system32\DRIVERS\serscan.sys2010/09/21 18:40:10.0265 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys2010/09/21 18:40:10.0296 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys2010/09/21 18:40:10.0343 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys2010/09/21 18:40:10.0358 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys2010/09/21 18:40:10.0421 SynTP (a59457258dc236f63d6eac759ef6c08b) C:\Windows\system32\DRIVERS\SynTP.sys2010/09/21 18:40:10.0499 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys2010/09/21 18:40:10.0546 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys2010/09/21 18:40:10.0592 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys2010/09/21 18:40:10.0624 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys2010/09/21 18:40:10.0655 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys2010/09/21 18:40:10.0702 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys2010/09/21 18:40:10.0748 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys2010/09/21 18:40:10.0795 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys2010/09/21 18:40:10.0842 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys2010/09/21 18:40:10.0889 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys2010/09/21 18:40:10.0904 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys2010/09/21 18:40:10.0967 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys2010/09/21 18:40:11.0014 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys2010/09/21 18:40:11.0045 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys2010/09/21 18:40:11.0076 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys2010/09/21 18:40:11.0107 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys2010/09/21 18:40:11.0138 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys2010/09/21 18:40:11.0216 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys2010/09/21 18:40:11.0263 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys2010/09/21 18:40:11.0326 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys2010/09/21 18:40:11.0372 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys2010/09/21 18:40:11.0419 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys2010/09/21 18:40:11.0450 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys2010/09/21 18:40:11.0544 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys2010/09/21 18:40:11.0591 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys2010/09/21 18:40:11.0638 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS2010/09/21 18:40:11.0684 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys2010/09/21 18:40:11.0747 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys2010/09/21 18:40:11.0778 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys2010/09/21 18:40:11.0809 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys2010/09/21 18:40:11.0856 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys2010/09/21 18:40:11.0903 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys2010/09/21 18:40:11.0934 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys2010/09/21 18:40:11.0965 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys2010/09/21 18:40:12.0043 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys2010/09/21 18:40:12.0090 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys2010/09/21 18:40:12.0152 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys2010/09/21 18:40:12.0184 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys2010/09/21 18:40:12.0215 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys2010/09/21 18:40:12.0230 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys2010/09/21 18:40:12.0293 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys2010/09/21 18:40:12.0324 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys2010/09/21 18:40:12.0402 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys2010/09/21 18:40:12.0464 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys2010/09/21 18:40:12.0480 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys2010/09/21 18:40:12.0574 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys2010/09/21 18:40:12.0605 yukonwlh (7d1f3b131d503ef43ee594b5a2b9b427) C:\Windows\system32\DRIVERS\yk60x86.sys2010/09/21 18:40:12.0652 ================================================================================2010/09/21 18:40:12.0652 Scan finished2010/09/21 18:40:12.0652 ================================================================================2010/09/21 18:40:12.0667 Detected object count: 12010/09/21 18:40:30.0139 HKLM\SYSTEM\ControlSet001\services\khqlmxop - will be deleted after reboot2010/09/21 18:40:30.0155 HKLM\SYSTEM\ControlSet002\services\khqlmxop - will be deleted after reboot2010/09/21 18:40:30.0155 C:\Windows\system32\drivers\oopuhnpkpjv.sys - will be deleted after reboot2010/09/21 18:40:30.0155 Hidden service(khqlmxop) - User select action: Delete2010/09/21 18:40:39.0047 Deinitialize successComboFix 10-09-20.07 - Jon 21/09/2010 18:47:18.3.2 - x86Microsoft Link to post Share on other sites More sharing options...
MrCharlie Posted September 21, 2010 ID:316753 Share Posted September 21, 2010 OK, update and run a quick scan with MBAM, post the log back here, MrC Link to post Share on other sites More sharing options...
Epiksoul Posted September 21, 2010 Author ID:316760 Share Posted September 21, 2010 THANK YOU so much! I think it's all clean now. You were amazing and I really appreciate it. Here is the mbam report. How does it look?Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4667Windows 6.0.6002 Service Pack 2Internet Explorer 8.0.6001.1894321/09/2010 7:42:46 PMmbam-log-2010-09-21 (19-42-46).txtScan type: Quick scanObjects scanned: 142325Time elapsed: 5 minute(s), 47 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
MrCharlie Posted September 21, 2010 ID:316764 Share Posted September 21, 2010 Looks Good. Well Done! Before I let you go I'd like you to run an online scan and I want to check your security programs.But first....Please Uninstall ComboFix:Go to start > run and copy and paste next command in the field:ComboFix /uninstallMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point-----------------------Next......Download Security Check by screen317 from HERE or HERE.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt; please post the contents of that document.----------------------------Last......Run this online scan as outlined in the link below:http://forums.malwarebytes.org/index.php?s...st&p=304801...... post back the results.MrC Link to post Share on other sites More sharing options...
Epiksoul Posted September 22, 2010 Author ID:316811 Share Posted September 22, 2010 THANK YOU once again. Here are the results for Security Check. The online ESET scan took very long but found 0 threats. Results of screen317's Security Check version 0.99.5 Windows Vista Service Pack 2 (UAC is disabled!) Internet Explorer 8 `````````````````````````````` Antivirus/Firewall Check: Windows Firewall Enabled! WMI entry may not exist for antivirus; attempting automatic update. ``````````````````````````````` Anti-malware/Other Utilities Check: Malwarebytes' Anti-Malware Java 6 Update 14 Java 6 Update 7 Out of date Java installed! Adobe Flash Player 10.1.53.64 Adobe Reader 9.1 Korean Fonts Support For Adobe Reader 9 ```````````````````````````````` Process Check: objlist.exe by Laurent Windows Defender MSASCui.exe Windows Defender MSASCui.exe ````````````````````````````````DNS Vulnerability Check:``````````End of Log```````````` Link to post Share on other sites More sharing options...
MrCharlie Posted September 22, 2010 ID:316814 Share Posted September 22, 2010 OK, a couple of things....UAC is disabled! Info on this:http://www.howtogeek.com/howto/windows-vis...-windows-vista/--------------------------------Your Java is out of date, older versions are vulnerable to malware. Java Link to post Share on other sites More sharing options...
Epiksoul Posted September 22, 2010 Author ID:316829 Share Posted September 22, 2010 Thank you very much. You were amazing! I don't have any questions because you explained everything very clearly. Thanks again! Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 23, 2010 ID:317321 Share Posted September 23, 2010 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts