Jump to content
Due to inclement weather in Southwest Florida, our Clearwater support team is offline. Our other offices are available to assist you, however their responses may be delayed. We appreciate your patience and understanding during this time. ×

Google searches redirected


antoineg
 Share

Recommended Posts

Hi.

When I do searches with Google Chrome, Google.com answers are often redirected to obvious ad websites, like k-directory.com and other variant. IE is not having this behavior. I tried to remove all my cookies and browsing data, but Chrome kept redirecting my Google's answers. I uninstalled Chrome, cleared every pieces of it I could find on my system (while some files, cookies, were impossible to delete), reinstalled Chrome and the same issue reappeared.

I runned an antivirus scan (ESET NOD32) and Malwarebytes quick-scan and full scan. The NOD32 scan found nothing, as the Malwarebytes quick-scan, while the full scan found some infected objects.

I followed the procedure detailed in the post-it, (DeFogger, DDS and Rootkit finder). The rootkit scanner has not found anything, so I have no scan log for it. Here are my Malwarebytes and DDS results, along with a log from HijackThis.

Link to post
Share on other sites

Yes, thanks much for your help!

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 2010-11-27 00:03:36

System Uptime: 2010-12-25 21:57:10 (1 hours ago)

Motherboard: ASRock | | 870 Extreme3

Processor: AMD Phenom II X6 1055T Processor | CPUSocket | 2800/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 932 GiB total, 760,383 GiB free.

D: is FIXED (NTFS) - 932 GiB total, 127,483 GiB free.

E: is CDROM ()

G: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4d36e96b-e325-11ce-bfc1-08002be10318}

Description: Standard PS/2 Keyboard

Device ID: ACPI\PNP0303\4&17E7F7A6&0

Manufacturer: (Standard keyboards)

Name: Standard PS/2 Keyboard

PNP Device ID: ACPI\PNP0303\4&17E7F7A6&0

Service: i8042prt

==== System Restore Points ===================

RP34: 2010-12-12 04:37:43 - Scheduled Checkpoint

RP35: 2010-12-13 14:27:04 - Installed Adobe Reader X.

RP36: 2010-12-14 21:51:30 - Installed Java 6 Update 23

RP37: 2010-12-22 02:47:55 - Scheduled Checkpoint

RP38: 2010-12-24 18:04:11 - Installed DirectX

RP39: 2010-12-25 01:51:19 - Removed LogMeIn Hamachi

RP40: 2010-12-25 01:52:12 - Installed LogMeIn Hamachi

RP41: 2010-12-25 14:04:31 - Installed ProductName from default.wxl

RP42: 2010-12-25 14:10:30 - Configur

Link to post
Share on other sites

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Open Notepad, click on Format and uncheck Word Wrap.

Internet Explorer (Windows)

1. Click "Tools", then click "Internet Options". This will bring up the Internet Options window.

2. Click the "Connections" tab, then click the "LAN Settings" button.

3. Uncheck the box labeled "Use a proxy server for your LAN". Click "OK", and click "OK" in the previous window. This will remove the proxy server settings in Internet Explorer.

Firefox (Windows)

1. Click "Tools", then click "Options" to bring up the Options window.

2. Click the "Advanced" button, then click the "Network" tab.

3. Click the "Settings" button, located next to "Configure how Firefox connects to the Internet".

4. Click the radio button labeled "No proxy". Click "OK" twice. This will remove the proxy server settings in Firefox.

Next:

Disable Internet Explorer Proxy Settings and Reset TCP/IP and Winsock

Disable Internet Explorer Proxy Settings and Reset TCP/IP

It is very important that these steps be carried out exactly as shown otherwise the fix will not work.

If you have any questions please ask before moving on.

  • Please start Notepad and using your mouse make sure you select and copy all the information below in the Code box into your new document.
  • Then save the file as "fixme.bat" to your Desktop
  • In the drop down box for Save as type: make sure you select All Files (*.*) and keep the quotes on the name as well. Then close the new file.
    @ECHO OFF
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride /f
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v GlobalUserOffline /t REG_DWORD /d 0 /f
    netsh int ip reset resetlog.txt
    netsh winsock reset catalog


  • On Windows XP you can double-click the file to run it.
  • On Vista/Win7 you need to Right click the file and choose Run as administrator to run it. With User Account Control on it should ask permission to run it. Click Yes
  • This will flash a black DOS box very quickly and go away, this is normal.
  • Restart your computer now.
  • Launch Internet Explorer and see if you can connect to the Internet.
  • Launch MBAM and check for Updates

Link to post
Share on other sites

Thank you for your fast answers :D

Proxy wasn't checked, created and executed the batch file, rebooted and updated MBAM. Meanwhile, Windows Update installed some updates.

I'm sorry for using HJT, I wa confused by the name of the board and thought it would be convenient to provide a scan log. I haven't tried any fixes in it.

Link to post
Share on other sites

Here you go:

DDS (Ver_10-12-12.02) - NTFS_AMD64

Run by Antoine at 12:49:26,28 on 2010-12-27

Internet Explorer: 8.0.7600.16385

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.4095.2158 [GMT -5:00]

AV: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Program Files (x86)\TightVNC\tvnserver.exe

C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\System32\dinotify.exe

C:\Program Files (x86)\Fraps\fraps.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe

C:\Program Files (x86)\Steam\Steam.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files\Logitech\SetPoint II\SetPointII.exe

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\Program Files (x86)\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe

C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe

C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Program Files (x86)\CyberLink\Shared Files\brs.exe

C:\Program Files (x86)\TightVNC\tvnserver.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Users\Antoine\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\newdev.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe

C:\Users\Antoine\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Antoine\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Antoine\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Antoine\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Users\Antoine\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Antoine\AppData\Local\Temp\Lifecam3.0.204.0.exe

C:\Program Files (x86)\Common Files\Steam\SteamService.exe

c:\16afcec83d350fc777b1a242139f48\setup.exe

C:\16afcec83d350fc777b1a242139f48\setupstb.exe

C:\Program Files (x86)\Fraps\fraps64.dat

C:\Users\Antoine\AppData\Local\Temp\LifeCamSetup\setupstb.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Microsoft LifeCam\MSCamS64.exe

C:\Windows\system32\wuauclt.exe

C:\Users\Antoine\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

D:\Antoine\Desktop\dds.scr

C:\Windows\system32\conhost.exe

============== Pseudo HJT Report ===============

uInternet Settings,ProxyServer = 174.74.84.50:27977

mWinlogon: Userinit=userinit.exe

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO: Programme d'aide de l'Assistant de connexion Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

uRun: [Google Update] "C:\Users\Antoine\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet

uRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent

uRun: [ASRockOCTuner]

uRun: [ASRockIES]

uRun: [zASRockInstantBoot]

uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"

uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized

mRun: [sAOB Monitor] C:\Program Files (x86)\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe

mRun: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"

mRun: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

mRun: [RemoteControl8] "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"

mRun: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"

mRun: [bDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe

mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

mRun: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start

mRun: [tvncontrol] "C:\Program Files (x86)\TightVNC\tvnserver.exe" -controlservice -slave

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"

mRunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

StartupFolder: C:\Users\Antoine\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\GIGABY~1.LNK - C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU\OC_GURU.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SETPOI~1.LNK - C:\Program Files\Logitech\SetPoint II\SetPointII.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: EnableLinkedConnections = 1 (0x1)

mPolicies-system: SoftwareSASGeneration = 1 (0x1)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

mRun-x64: [set] c:\programdata\SetWallpaper.cmd

mRun-x64: [Acronis Scheduler2 Service] "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"

mRun-x64: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

mRun-x64: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

STS-X64: FencesShlExt Class: {1984DD45-52CF-49cd-AB77-18F378FEA264} - C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll

============= SERVICES / DRIVERS ===============

R0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);C:\Windows\System32\drivers\tdrpm273.sys [2010-11-27 1263200]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]

R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2010/11/27 01:07:27];C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl [2010-1-12 146928]

R2 afcdpsrv;Acronis Nonstop Backup service;C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2010-11-27 3975088]

R2 eamonm;eamonm;C:\Windows\System32\drivers\eamonm.sys [2010-9-3 170104]

R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2010-11-4 810144]

R2 epfwwfpr;epfwwfpr;C:\Windows\System32\drivers\epfwwfpr.sys [2010-7-29 126320]

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2010-3-30 1823112]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]

R2 tvnserver;TightVNC Server;C:\Program Files (x86)\TightVNC\tvnserver.exe [2010-7-8 815704]

R3 afcdp;afcdp;C:\Windows\System32\drivers\afcdp.sys [2010-11-27 279136]

R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;C:\Windows\System32\drivers\nx6000.sys [2010-5-20 36720]

R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2010-1-22 77824]

R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2010-1-22 180224]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\System32\drivers\nvhda64v.sys [2010-11-27 155752]

R3 rt61x64;Linksys Wireless-G PCI Adapter Driver;C:\Windows\System32\drivers\WMP54Gv41x64.sys [2010-4-7 446304]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-11-27 346144]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2010-11-27 38456]

S3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;C:\Windows\System32\drivers\netr28x.sys [2009-6-10 620544]

S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832]

=============== Created Last 30 ================

2010-12-27 17:36:17 -------- d-----w- C:\Users\Antoine\AppData\Roaming\Malwarebytes

2010-12-27 17:36:03 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

2010-12-27 17:36:02 -------- d-----w- C:\PROGRA~3\Malwarebytes

2010-12-27 17:35:55 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys

2010-12-27 17:35:55 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2010-12-27 17:35:40 -------- d-----w- C:\Program Files\Microsoft LifeCam

2010-12-27 17:35:40 -------- d-----w- C:\Program Files (x86)\Microsoft LifeCam

2010-12-27 17:34:28 -------- d-----w- C:\16afcec83d350fc777b1a242139f48

2010-12-27 14:23:03 14336 ----a-w- C:\Windows\System32\drivers\sffp_sd.sys

2010-12-27 13:57:41 311808 ----a-w- C:\Windows\System32\msv1_0.dll

2010-12-27 13:57:41 257024 ----a-w- C:\Windows\SysWow64\msv1_0.dll

2010-12-27 13:54:52 8199504 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2010-12-27 13:54:51 8199504 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{AECA8055-B980-457D-A2A1-570910539097}\mpengine.dll

2010-12-27 13:53:50 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll

2010-12-27 13:53:50 49472 ----a-w- C:\Windows\SysWow64\netfxperf.dll

2010-12-27 13:53:50 48960 ----a-w- C:\Windows\System32\netfxperf.dll

2010-12-27 13:53:50 444752 ----a-w- C:\Windows\System32\mscoree.dll

2010-12-27 13:53:50 320352 ----a-w- C:\Windows\System32\PresentationHost.exe

2010-12-27 13:53:50 297808 ----a-w- C:\Windows\SysWow64\mscoree.dll

2010-12-27 13:53:50 295264 ----a-w- C:\Windows\SysWow64\PresentationHost.exe

2010-12-27 13:53:50 1942856 ----a-w- C:\Windows\System32\dfshim.dll

2010-12-27 13:53:50 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll

2010-12-27 13:53:50 109912 ----a-w- C:\Windows\System32\PresentationHostProxy.dll

2010-12-27 13:43:54 738816 ----a-w- C:\Windows\SysWow64\wmpmde.dll

2010-12-27 13:42:02 220672 ----a-w- C:\Windows\System32\wintrust.dll

2010-12-27 13:42:02 172032 ----a-w- C:\Windows\SysWow64\wintrust.dll

2010-12-27 13:42:02 139264 ----a-w- C:\Windows\System32\cabview.dll

2010-12-27 13:42:02 132608 ----a-w- C:\Windows\SysWow64\cabview.dll

2010-12-24 21:50:07 3106656 ----a-w- C:\Windows\System32\AutoPartNt.exe

2010-12-19 19:57:29 -------- d-----w- C:\Users\Antoine\AppData\Roaming\Stardock

2010-12-19 19:57:27 -------- dc-h--w- C:\PROGRA~3\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}

2010-12-19 19:57:26 -------- d-----w- C:\Program Files (x86)\Stardock

2010-12-19 19:57:18 -------- d-----w- C:\Users\Antoine\AppData\Local\PackageAware

2010-12-15 02:52:14 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2010-12-14 17:56:11 87040 ----a-w- C:\Windows\System32\pdfcmnnt.dll

2010-12-14 17:56:11 662288 ----a-w- C:\Windows\SysWow64\MSCOMCT2.OCX

2010-12-14 17:56:11 137000 ----a-w- C:\Windows\SysWow64\MSMAPI32.OCX

2010-12-14 17:56:10 23552 ----a-w- C:\Windows\SysWow64\MSMPIDE.DLL

2010-12-14 17:56:10 -------- d-----w- C:\Program Files (x86)\PDFCreator

2010-12-13 01:27:22 -------- d-----w- C:\Users\Antoine\AppData\Local\CCP

2010-12-08 20:03:34 -------- d-----w- C:\Program Files (x86)\Badaboom

2010-12-08 05:01:04 -------- d-----w- C:\Users\Antoine\AppData\Local\HandBrake

2010-12-08 05:01:00 -------- d-----w- C:\Users\Antoine\AppData\Roaming\HandBrake

2010-12-07 19:07:56 438784 ----a-w- C:\Windows\System32\drivers\netr6164.sys

2010-12-07 19:07:56 -------- d-----w- C:\PROGRA~3\Ralink Driver

2010-12-06 04:33:34 -------- d-----w- C:\Users\Antoine\AppData\Roaming\TightVNC

2010-12-04 22:59:12 -------- d-----w- C:\Users\Antoine\AppData\Roaming\Mumble

2010-12-04 22:59:00 -------- d-----w- C:\Program Files (x86)\Mumble

2010-12-04 22:32:47 -------- d-----w- C:\Users\Antoine\AppData\Local\My Games

2010-12-04 22:27:46 -------- d-----w- C:\Program Files (x86)\Sid Meier's Civilization V

2010-12-04 20:06:16 -------- d-----w- C:\Program Files (x86)\TightVNC

2010-12-04 20:02:50 -------- d-----w- C:\Program Files (x86)\CCP

2010-12-04 20:02:50 -------- d-----w- C:\PROGRA~3\CCP

2010-12-04 07:55:43 -------- d-----w- C:\Users\Antoine\AppData\Local\Badaboom

2010-12-04 06:29:50 48471 ----a-w- C:\Windows\SysWow64\ForceBindIP-Uninstaller.exe

2010-12-04 05:54:09 -------- d-----w- C:\Program Files (x86)\Borderlands

2010-12-04 05:50:19 -------- d-----w- C:\Users\Antoine\AppData\Local\LogMeIn Hamachi

2010-12-04 05:50:00 -------- d-----w- C:\Program Files (x86)\LogMeIn Hamachi

2010-12-03 18:52:37 65024 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\PPhp1020.DLL

2010-12-02 20:41:15 -------- d-----w- C:\Program Files (x86)\VideoLAN

2010-12-02 16:05:17 -------- d-----w- C:\Users\Antoine\AppData\Local\4A Games

2010-12-02 15:55:39 -------- d-----w- C:\Program Files (x86)\METRO 2033

2010-11-30 22:48:38 501760 ----a-w- C:\Windows\System32\ZSHP1020.EXE

2010-11-30 22:48:38 192512 ----a-w- C:\Windows\System32\ZLhp1020.DLL

2010-11-30 22:48:10 245248 ----a-w- C:\Windows\System32\zshp1020s.dll

2010-11-30 20:33:26 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8

2010-11-30 20:32:49 -------- d-----w- C:\Users\Antoine\AppData\Local\Microsoft Help

2010-11-29 23:50:34 -------- d-----w- C:\Users\Antoine\AppData\Local\HiddenPath

2010-11-29 22:17:04 -------- d-----w- C:\Program Files (x86)\Quick Memory Editor

2010-11-29 17:54:06 -------- d-----w- C:\Program Files (x86)\oZone3D

2010-11-28 17:43:08 -------- d-----w- C:\Users\Antoine\AppData\Local\AliensVsPredator

2010-11-28 17:23:33 -------- d-----w- C:\Windows\SysWow64\xlive

2010-11-28 17:23:33 -------- d-----w- C:\Program Files (x86)\Microsoft Games for Windows - LIVE

2010-11-28 16:59:17 519000 ----a-w- C:\Windows\System32\d3dx10_40.dll

2010-11-28 16:59:17 452440 ----a-w- C:\Windows\SysWow64\d3dx10_40.dll

2010-11-28 16:59:17 2605920 ----a-w- C:\Windows\System32\D3DCompiler_40.dll

2010-11-28 16:59:17 2036576 ----a-w- C:\Windows\SysWow64\D3DCompiler_40.dll

2010-11-28 16:59:16 5631312 ----a-w- C:\Windows\System32\D3DX9_40.dll

2010-11-28 16:59:16 4379984 ----a-w- C:\Windows\SysWow64\D3DX9_40.dll

2010-11-28 16:55:11 -------- d-----w- C:\Program Files (x86)\JoWooD Entertainment AG

2010-11-28 16:04:56 -------- d-----w- C:\Program Files (x86)\Aliens Vs Predator

2010-11-28 02:03:23 -------- d-----w- C:\Users\Antoine\Tracing

2010-11-28 02:02:46 -------- d-----w- C:\Program Files (x86)\Microsoft

2010-11-28 02:02:30 -------- d-----w- C:\Program Files (x86)\Windows Live SkyDrive

2010-11-28 02:02:00 -------- d-----w- C:\Windows\PCHEALTH

2010-11-28 02:00:28 -------- d-----w- C:\Program Files (x86)\Common Files\Windows Live

2010-11-28 01:33:24 -------- d-----w- C:\Program Files (x86)\Activision

2010-11-27 22:12:17 -------- d-----w- C:\Program Files (x86)\Heroes of Newerth

2010-11-27 21:27:20 -------- d-----w- C:\Windows\506DDFBE983F4BC384B865F423B2D798.TMP

2010-11-27 21:17:39 -------- d-----w- C:\Program Files (x86)\Fraps

2010-11-27 20:30:19 -------- d-----w- C:\Users\Antoine\AppData\Roaming\NVIDIA

2010-11-27 20:29:42 -------- d-----w- C:\Users\Antoine\AppData\Local\Ascaron Entertainment

2010-11-27 20:27:57 540688 ----a-w- C:\Windows\System32\d3dx10_39.dll

2010-11-27 20:27:57 467984 ----a-w- C:\Windows\SysWow64\d3dx10_39.dll

2010-11-27 20:27:57 1942552 ----a-w- C:\Windows\System32\D3DCompiler_39.dll

2010-11-27 20:27:57 1493528 ----a-w- C:\Windows\SysWow64\D3DCompiler_39.dll

2010-11-27 20:27:56 4992520 ----a-w- C:\Windows\System32\D3DX9_39.dll

2010-11-27 20:27:56 3851784 ----a-w- C:\Windows\SysWow64\D3DX9_39.dll

2010-11-27 20:27:19 419840 ----a-w- C:\Windows\System32\wrap_oal.dll

2010-11-27 20:27:19 413696 ----a-w- C:\Windows\SysWow64\wrap_oal.dll

2010-11-27 20:27:19 133632 ----a-w- C:\Windows\System32\OpenAL32.dll

2010-11-27 20:27:19 110592 ----a-w- C:\Windows\SysWow64\OpenAL32.dll

2010-11-27 20:24:04 749568 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll

2010-11-27 20:24:04 69715 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll

2010-11-27 20:24:04 5632 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe

2010-11-27 20:24:04 274432 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll

2010-11-27 20:24:04 180224 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll

2010-11-27 20:24:00 323716 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll

2010-11-27 20:24:00 192644 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll

2010-11-27 19:56:01 -------- d-----w- C:\Program Files (x86)\cdv Software Entertainment USA

2010-11-27 19:55:35 -------- d-----w- C:\Windows\95FC26FB19FD4A96BBB1B1062E8648F5.TMP

2010-11-27 19:15:09 -------- d-----w- C:\Program Files (x86)\CAPCOM

2010-11-27 18:53:01 -------- d-----w- C:\temp

2010-11-27 18:46:29 -------- d-----w- C:\PROGRA~3\Media Center Programs

2010-11-27 18:31:14 -------- d-----w- C:\Program Files (x86)\THQ

2010-11-27 18:12:51 -------- d-----w- C:\Users\Antoine\AppData\Local\ESET

2010-11-27 18:00:39 -------- d-----w- C:\Users\Antoine\AppData\Local\Adobe

2010-11-27 18:00:29 178800 ----a-w- C:\Windows\SysWow64\CmdLineExt_x64.dll

2010-11-27 17:54:21 -------- dc-h--w- C:\PROGRA~3\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}

==================== Find3M ====================

2010-11-27 17:35:44 1482 ----a-w- C:\Windows\SysWow64\ealregsnapshot1.reg

2010-11-27 06:06:45 505128 ----a-w- C:\Windows\SysWow64\msvcp71.dll

2010-11-27 06:06:45 353576 ----a-w- C:\Windows\SysWow64\msvcr71.dll

2010-11-27 06:06:45 29480 ----a-w- C:\Windows\SysWow64\msxml3a.dll

2010-11-27 05:36:23 279136 ----a-w- C:\Windows\System32\drivers\afcdp.sys

2010-11-27 05:36:22 1263200 ----a-w- C:\Windows\System32\drivers\tdrpm273.sys

2010-11-27 05:36:21 970336 ----a-w- C:\Windows\System32\drivers\timntr.sys

2010-11-27 05:36:17 277088 ----a-w- C:\Windows\System32\drivers\snapman.sys

2010-11-04 06:35:53 1194496 ----a-w- C:\Windows\System32\wininet.dll

2010-11-04 06:31:34 57856 ----a-w- C:\Windows\System32\licmgr10.dll

2010-11-04 05:52:17 978944 ----a-w- C:\Windows\SysWow64\wininet.dll

2010-11-04 05:48:36 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll

2010-11-04 05:16:14 482816 ----a-w- C:\Windows\System32\html.iec

2010-11-04 04:41:26 386048 ----a-w- C:\Windows\SysWow64\html.iec

2010-11-04 04:35:37 1638912 ----a-w- C:\Windows\System32\mshtml.tlb

2010-11-04 04:08:54 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2010-11-02 05:18:17 524288 ----a-w- C:\Windows\System32\wmicmiplugin.dll

2010-11-02 05:17:38 473600 ----a-w- C:\Windows\System32\taskcomp.dll

2010-11-02 05:17:38 1169408 ----a-w- C:\Windows\System32\taskschd.dll

2010-11-02 05:16:53 1114624 ----a-w- C:\Windows\System32\schedsvc.dll

2010-11-02 05:10:47 464384 ----a-w- C:\Windows\System32\taskeng.exe

2010-11-02 05:10:32 285696 ----a-w- C:\Windows\System32\schtasks.exe

2010-11-02 04:40:36 496128 ----a-w- C:\Windows\SysWow64\taskschd.dll

2010-11-02 04:40:36 305152 ----a-w- C:\Windows\SysWow64\taskcomp.dll

2010-11-02 04:34:44 192000 ----a-w- C:\Windows\SysWow64\taskeng.exe

2010-11-02 04:34:33 179712 ----a-w- C:\Windows\SysWow64\schtasks.exe

2010-10-27 05:06:22 2048 ----a-w- C:\Windows\System32\tzres.dll

2010-10-27 04:32:36 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2010-10-20 05:20:01 46080 ----a-w- C:\Windows\System32\atmlib.dll

2010-10-20 04:54:18 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll

2010-10-20 03:09:15 3124224 ----a-w- C:\Windows\System32\win32k.sys

2010-10-20 03:05:46 367104 ----a-w- C:\Windows\System32\atmfd.dll

2010-10-20 02:58:41 294400 ----a-w- C:\Windows\SysWow64\atmfd.dll

2010-10-19 15:41:44 270720 ------w- C:\Windows\System32\MpSigStub.exe

2010-10-16 18:13:54 5901416 ----a-w- C:\Windows\System32\nvcpl.dll

2010-10-16 18:13:34 989800 ----a-w- C:\Windows\System32\nvvsvc.exe

2010-10-16 18:13:34 61032 ----a-w- C:\Windows\System32\nvshext.dll

2010-10-16 18:13:34 2590824 ----a-w- C:\Windows\System32\nvsvc64.dll

2010-10-16 18:13:34 116328 ----a-w- C:\Windows\System32\nvmctray.dll

2010-10-16 05:23:13 112000 ----a-w- C:\Windows\System32\consent.exe

2010-10-16 05:19:41 395776 ----a-w- C:\Windows\System32\webio.dll

2010-10-16 04:36:10 314368 ----a-w- C:\Windows\SysWow64\webio.dll

============= FINISH: 12:49:57,55 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 2010-11-27 00:03:36

System Uptime: 2010-12-27 12:25:50 (0 hours ago)

Motherboard: ASRock | | 870 Extreme3

Processor: AMD Phenom II X6 1055T Processor | CPUSocket | 2800/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 932 GiB total, 762,924 GiB free.

D: is FIXED (NTFS) - 932 GiB total, 129,4 GiB free.

E: is CDROM ()

G: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4d36e96b-e325-11ce-bfc1-08002be10318}

Description: Standard PS/2 Keyboard

Device ID: ACPI\PNP0303\4&17E7F7A6&0

Manufacturer: (Standard keyboards)

Name: Standard PS/2 Keyboard

PNP Device ID: ACPI\PNP0303\4&17E7F7A6&0

Service: i8042prt

==== System Restore Points ===================

RP34: 2010-12-12 04:37:43 - Scheduled Checkpoint

RP35: 2010-12-13 14:27:04 - Installed Adobe Reader X.

RP36: 2010-12-14 21:51:30 - Installed Java 6 Update 23

RP37: 2010-12-22 02:47:55 - Scheduled Checkpoint

RP38: 2010-12-27 08:48:46 - Windows Update

RP39: 2010-12-27 09:21:14 - Windows Update

RP40: 2010-12-27 12:35:16 - Installed DirectX

==== Installed Programs ======================

2007 Microsoft Office Suite Service Pack 1 (SP1)

Acronis

Link to post
Share on other sites

uInternet Settings,ProxyServer = 174.74.84.50:27977

You're still getting redirected by a proxy server.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner

Link to post
Share on other sites

Here it is:

2010/12/27 13:00:58.0123 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46

2010/12/27 13:00:58.0124 ================================================================================

2010/12/27 13:00:58.0124 SystemInfo:

2010/12/27 13:00:58.0124

2010/12/27 13:00:58.0124 OS Version: 6.1.7600 ServicePack: 0.0

2010/12/27 13:00:58.0124 Product type: Workstation

2010/12/27 13:00:58.0124 ComputerName: ANTOINE-DESKTOP

2010/12/27 13:00:58.0124 UserName: Antoine

2010/12/27 13:00:58.0124 Windows directory: C:\Windows

2010/12/27 13:00:58.0124 System windows directory: C:\Windows

2010/12/27 13:00:58.0124 Running under WOW64

2010/12/27 13:00:58.0124 Processor architecture: Intel x64

2010/12/27 13:00:58.0124 Number of processors: 6

2010/12/27 13:00:58.0124 Page size: 0x1000

2010/12/27 13:00:58.0124 Boot type: Normal boot

2010/12/27 13:00:58.0124 ================================================================================

2010/12/27 13:00:58.0125 Utility is running under WOW64

2010/12/27 13:00:58.0321 Initialize success

2010/12/27 13:01:03.0305 ================================================================================

2010/12/27 13:01:03.0305 Scan started

2010/12/27 13:01:03.0305 Mode: Manual;

2010/12/27 13:01:03.0305 ================================================================================

2010/12/27 13:01:04.0722 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys

2010/12/27 13:01:04.0745 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys

2010/12/27 13:01:04.0764 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys

2010/12/27 13:01:04.0783 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

2010/12/27 13:01:04.0798 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

2010/12/27 13:01:04.0818 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

2010/12/27 13:01:04.0859 afcdp (3cb8a6bb25eb8b8d5e56123b52df9412) C:\Windows\system32\DRIVERS\afcdp.sys

2010/12/27 13:01:04.0885 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys

2010/12/27 13:01:04.0904 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys

2010/12/27 13:01:04.0924 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys

2010/12/27 13:01:04.0940 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys

2010/12/27 13:01:04.0951 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

2010/12/27 13:01:04.0979 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

2010/12/27 13:01:04.0999 amdsata (7a4b413614c055935567cf88a9734d38) C:\Windows\system32\DRIVERS\amdsata.sys

2010/12/27 13:01:05.0015 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

2010/12/27 13:01:05.0035 amdxata (b4ad0cacbab298671dd6f6ef7e20679d) C:\Windows\system32\DRIVERS\amdxata.sys

2010/12/27 13:01:05.0052 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys

2010/12/27 13:01:05.0071 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

2010/12/27 13:01:05.0090 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

2010/12/27 13:01:05.0161 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

2010/12/27 13:01:05.0178 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys

2010/12/27 13:01:05.0212 athr (e857eee6b92aaa473ebb3465add8f7e7) C:\Windows\system32\DRIVERS\athrx.sys

2010/12/27 13:01:05.0244 AtiPcie (7c5d273e29dcc5505469b299c6f29163) C:\Windows\system32\DRIVERS\AtiPcie.sys

2010/12/27 13:01:05.0267 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

2010/12/27 13:01:05.0290 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

2010/12/27 13:01:05.0432 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

2010/12/27 13:01:05.0459 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

2010/12/27 13:01:05.0480 bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys

2010/12/27 13:01:05.0500 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

2010/12/27 13:01:05.0510 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

2010/12/27 13:01:05.0526 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

2010/12/27 13:01:05.0537 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

2010/12/27 13:01:05.0548 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

2010/12/27 13:01:05.0560 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

2010/12/27 13:01:05.0572 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

2010/12/27 13:01:05.0601 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

2010/12/27 13:01:05.0623 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys

2010/12/27 13:01:05.0637 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

2010/12/27 13:01:05.0668 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

2010/12/27 13:01:05.0686 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

2010/12/27 13:01:05.0713 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys

2010/12/27 13:01:05.0734 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys

2010/12/27 13:01:05.0756 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

2010/12/27 13:01:05.0777 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys

2010/12/27 13:01:05.0791 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

2010/12/27 13:01:05.0836 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys

2010/12/27 13:01:05.0852 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

2010/12/27 13:01:05.0872 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

2010/12/27 13:01:05.0899 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

2010/12/27 13:01:05.0941 DXGKrnl (ebce0b0924835f635f620d19f0529dce) C:\Windows\System32\drivers\dxgkrnl.sys

2010/12/27 13:01:05.0980 eamonm (72a1aa3c6c79b928d02a6fad387b1349) C:\Windows\system32\DRIVERS\eamonm.sys

2010/12/27 13:01:06.0041 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

2010/12/27 13:01:06.0115 ehdrv (e99457900012b53b2226f146ecaf9136) C:\Windows\system32\DRIVERS\ehdrv.sys

2010/12/27 13:01:06.0141 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

2010/12/27 13:01:06.0159 epfwwfpr (a2af094dcbe8bff7e898d327750506a0) C:\Windows\system32\DRIVERS\epfwwfpr.sys

2010/12/27 13:01:06.0174 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys

2010/12/27 13:01:06.0200 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

2010/12/27 13:01:06.0224 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

2010/12/27 13:01:06.0238 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

2010/12/27 13:01:06.0268 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

2010/12/27 13:01:06.0288 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

2010/12/27 13:01:06.0298 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

2010/12/27 13:01:06.0323 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys

2010/12/27 13:01:06.0347 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

2010/12/27 13:01:06.0358 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

2010/12/27 13:01:06.0391 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys

2010/12/27 13:01:06.0419 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

2010/12/27 13:01:06.0448 hamachi (1e6438d4ea6e1174a3b3b1edc4de660b) C:\Windows\system32\DRIVERS\hamachi.sys

2010/12/27 13:01:06.0470 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

2010/12/27 13:01:06.0493 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys

2010/12/27 13:01:06.0517 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys

2010/12/27 13:01:06.0528 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

2010/12/27 13:01:06.0540 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

2010/12/27 13:01:06.0551 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

2010/12/27 13:01:06.0572 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys

2010/12/27 13:01:06.0598 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys

2010/12/27 13:01:06.0632 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys

2010/12/27 13:01:06.0650 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys

2010/12/27 13:01:06.0670 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys

2010/12/27 13:01:06.0690 iaStorV (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys

2010/12/27 13:01:06.0718 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

2010/12/27 13:01:06.0783 IntcAzAudAddService (e9befd8c6a1db3b544b61647dda35f62) C:\Windows\system32\drivers\RTKVHD64.sys

2010/12/27 13:01:06.0820 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys

2010/12/27 13:01:06.0847 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

2010/12/27 13:01:06.0862 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2010/12/27 13:01:06.0876 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys

2010/12/27 13:01:06.0892 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

2010/12/27 13:01:06.0912 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

2010/12/27 13:01:06.0929 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys

2010/12/27 13:01:06.0950 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys

2010/12/27 13:01:07.0018 ISODrive (ae4a946d545b18cdd8f36215e8c21190) C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys

2010/12/27 13:01:07.0031 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

2010/12/27 13:01:07.0050 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys

2010/12/27 13:01:07.0074 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys

2010/12/27 13:01:07.0110 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys

2010/12/27 13:01:07.0118 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

2010/12/27 13:01:07.0166 LHidFilt (b6552d382ff070b4ed34cbd6737277c0) C:\Windows\system32\DRIVERS\LHidFilt.Sys

2010/12/27 13:01:07.0189 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

2010/12/27 13:01:07.0214 LMouFilt (73c1f563ab73d459dffe682d66476558) C:\Windows\system32\DRIVERS\LMouFilt.Sys

2010/12/27 13:01:07.0232 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

2010/12/27 13:01:07.0254 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

2010/12/27 13:01:07.0279 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

2010/12/27 13:01:07.0297 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

2010/12/27 13:01:07.0313 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

2010/12/27 13:01:07.0336 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

2010/12/27 13:01:07.0355 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

2010/12/27 13:01:07.0381 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

2010/12/27 13:01:07.0398 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

2010/12/27 13:01:07.0417 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

2010/12/27 13:01:07.0439 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

2010/12/27 13:01:07.0456 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys

2010/12/27 13:01:07.0476 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys

2010/12/27 13:01:07.0504 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

2010/12/27 13:01:07.0527 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys

2010/12/27 13:01:07.0556 mrxsmb (767a4c3bcf9410c286ced15a2db17108) C:\Windows\system32\DRIVERS\mrxsmb.sys

2010/12/27 13:01:07.0571 mrxsmb10 (920ee0ff995fcfdeb08c41605a959e1c) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2010/12/27 13:01:07.0586 mrxsmb20 (740d7ea9d72c981510a5292cf6adc941) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2010/12/27 13:01:07.0608 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys

2010/12/27 13:01:07.0635 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys

2010/12/27 13:01:07.0663 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

2010/12/27 13:01:07.0682 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

2010/12/27 13:01:07.0727 MSHUSBVideo (55218f924e55fd2786ed40edf4ed79c3) C:\Windows\system32\Drivers\nx6000.sys

2010/12/27 13:01:07.0752 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys

2010/12/27 13:01:07.0772 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

2010/12/27 13:01:07.0786 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

2010/12/27 13:01:07.0800 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

2010/12/27 13:01:07.0823 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys

2010/12/27 13:01:07.0844 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys

2010/12/27 13:01:07.0858 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

2010/12/27 13:01:07.0868 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

2010/12/27 13:01:07.0887 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

2010/12/27 13:01:07.0915 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

2010/12/27 13:01:07.0952 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys

2010/12/27 13:01:07.0968 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

2010/12/27 13:01:07.0983 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

2010/12/27 13:01:07.0999 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys

2010/12/27 13:01:08.0021 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys

2010/12/27 13:01:08.0036 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys

2010/12/27 13:01:08.0046 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

2010/12/27 13:01:08.0062 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys

2010/12/27 13:01:08.0118 netr28x (b72bb9496a126fcfc7fc5945ded9b411) C:\Windows\system32\DRIVERS\netr28x.sys

2010/12/27 13:01:08.0136 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

2010/12/27 13:01:08.0160 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

2010/12/27 13:01:08.0182 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

2010/12/27 13:01:08.0220 Ntfs (356698a13c4630d5b31c37378d469196) C:\Windows\system32\drivers\Ntfs.sys

2010/12/27 13:01:08.0247 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

2010/12/27 13:01:08.0281 nusb3hub (8ebcb9165ee7f1571842f4d9d624a74c) C:\Windows\system32\DRIVERS\nusb3hub.sys

2010/12/27 13:01:08.0318 nusb3xhc (5d54dbb12bbfe07cc283fd39f2cd6d63) C:\Windows\system32\DRIVERS\nusb3xhc.sys

2010/12/27 13:01:08.0365 NVHDA (ed9380f201c8126425c09bed96dbe1e5) C:\Windows\system32\drivers\nvhda64v.sys

2010/12/27 13:01:08.0575 nvlddmkm (bbe872a814b00798c2d568d46c42a71b) C:\Windows\system32\DRIVERS\nvlddmkm.sys

2010/12/27 13:01:08.0752 nvraid (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys

2010/12/27 13:01:08.0771 nvstor (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys

2010/12/27 13:01:08.0797 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys

2010/12/27 13:01:08.0811 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys

2010/12/27 13:01:08.0839 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

2010/12/27 13:01:08.0856 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys

2010/12/27 13:01:08.0880 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys

2010/12/27 13:01:08.0896 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys

2010/12/27 13:01:08.0914 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

2010/12/27 13:01:08.0934 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

2010/12/27 13:01:08.0949 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

2010/12/27 13:01:09.0014 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys

2010/12/27 13:01:09.0025 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

2010/12/27 13:01:09.0053 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys

2010/12/27 13:01:09.0092 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

2010/12/27 13:01:09.0122 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

2010/12/27 13:01:09.0146 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

2010/12/27 13:01:09.0157 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

2010/12/27 13:01:09.0175 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

2010/12/27 13:01:09.0199 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys

2010/12/27 13:01:09.0221 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

2010/12/27 13:01:09.0240 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

2010/12/27 13:01:09.0253 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys

2010/12/27 13:01:09.0272 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

2010/12/27 13:01:09.0289 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

2010/12/27 13:01:09.0303 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

2010/12/27 13:01:09.0319 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

2010/12/27 13:01:09.0333 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys

2010/12/27 13:01:09.0361 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys

2010/12/27 13:01:09.0407 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

2010/12/27 13:01:09.0457 rt61x64 (60eb8a87357ca5b088b422d1e55a2405) C:\Windows\system32\DRIVERS\WMP54Gv41x64.sys

2010/12/27 13:01:09.0504 RTL8167 (7ea8d2eb9bbfd2ab8a3117a1e96d3b3a) C:\Windows\system32\DRIVERS\Rt64win7.sys

2010/12/27 13:01:09.0528 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys

2010/12/27 13:01:09.0542 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys

2010/12/27 13:01:09.0564 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

2010/12/27 13:01:09.0591 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

2010/12/27 13:01:09.0602 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

2010/12/27 13:01:09.0621 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

2010/12/27 13:01:09.0670 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys

2010/12/27 13:01:09.0707 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys

2010/12/27 13:01:09.0749 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys

2010/12/27 13:01:09.0770 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

2010/12/27 13:01:09.0787 SiSGbeLH (1bc348cf6baa90ec8e533ef6e6a69933) C:\Windows\system32\DRIVERS\SiSG664.sys

2010/12/27 13:01:09.0815 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

2010/12/27 13:01:09.0827 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

2010/12/27 13:01:09.0845 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

2010/12/27 13:01:09.0882 snapman (b2c19ae46c5a109679b4fb38058df05a) C:\Windows\system32\DRIVERS\snapman.sys

2010/12/27 13:01:09.0905 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

2010/12/27 13:01:09.0956 srv (de6f5658da951c4bc8e498570b5b0d5f) C:\Windows\system32\DRIVERS\srv.sys

2010/12/27 13:01:09.0981 srv2 (4d33d59c0b930c523d29f9bd40cda9d2) C:\Windows\system32\DRIVERS\srv2.sys

2010/12/27 13:01:10.0003 srvnet (5a663fd67049267bc5c3f3279e631ffb) C:\Windows\system32\DRIVERS\srvnet.sys

2010/12/27 13:01:10.0062 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

2010/12/27 13:01:10.0081 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys

2010/12/27 13:01:10.0145 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys

2010/12/27 13:01:10.0197 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys

2010/12/27 13:01:10.0217 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys

2010/12/27 13:01:10.0243 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

2010/12/27 13:01:10.0275 tdrpman273 (99527d49ee0a96fc25537c61b270a372) C:\Windows\system32\DRIVERS\tdrpm273.sys

2010/12/27 13:01:10.0293 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys

2010/12/27 13:01:10.0314 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys

2010/12/27 13:01:10.0335 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys

2010/12/27 13:01:10.0374 timounter (ebbaea02f0095a798000c7e06b16d41b) C:\Windows\system32\DRIVERS\timntr.sys

2010/12/27 13:01:10.0407 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys

2010/12/27 13:01:10.0470 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys

2010/12/27 13:01:10.0484 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

2010/12/27 13:01:10.0504 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys

2010/12/27 13:01:10.0526 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys

2010/12/27 13:01:10.0543 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys

2010/12/27 13:01:10.0553 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

2010/12/27 13:01:10.0594 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys

2010/12/27 13:01:10.0608 usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys

2010/12/27 13:01:10.0628 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys

2010/12/27 13:01:10.0639 usbehci (2ea4aff7be7eb4632e3aa8595b0803b5) C:\Windows\system32\DRIVERS\usbehci.sys

2010/12/27 13:01:10.0668 usbfilter (2c780746dc44a28fe67004dc58173f05) C:\Windows\system32\DRIVERS\usbfilter.sys

2010/12/27 13:01:10.0682 usbhub (4c9042b8df86c1e8e6240c218b99b39b) C:\Windows\system32\DRIVERS\usbhub.sys

2010/12/27 13:01:10.0703 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys

2010/12/27 13:01:10.0718 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

2010/12/27 13:01:10.0731 USBSTOR (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2010/12/27 13:01:10.0756 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys

2010/12/27 13:01:10.0793 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\system32\Drivers\usbvideo.sys

2010/12/27 13:01:10.0828 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys

2010/12/27 13:01:10.0842 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

2010/12/27 13:01:10.0859 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

2010/12/27 13:01:10.0871 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys

2010/12/27 13:01:10.0883 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys

2010/12/27 13:01:10.0898 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys

2010/12/27 13:01:10.0920 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys

2010/12/27 13:01:10.0943 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys

2010/12/27 13:01:10.0958 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

2010/12/27 13:01:10.0980 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

2010/12/27 13:01:10.0994 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

2010/12/27 13:01:11.0016 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

2010/12/27 13:01:11.0046 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

2010/12/27 13:01:11.0055 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

2010/12/27 13:01:11.0085 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

2010/12/27 13:01:11.0100 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

2010/12/27 13:01:11.0136 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

2010/12/27 13:01:11.0148 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

2010/12/27 13:01:11.0194 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys

2010/12/27 13:01:11.0224 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

2010/12/27 13:01:11.0252 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys

2010/12/27 13:01:11.0270 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys

2010/12/27 13:01:11.0399 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054} (74983addca2d9618512c088d856d6615) C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl

2010/12/27 13:01:11.0441 ================================================================================

2010/12/27 13:01:11.0441 Scan finished

2010/12/27 13:01:11.0441 ================================================================================

Link to post
Share on other sites

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  • Double click on ComboFix.exe & follow the prompts.
    Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
    Note: If you have SP3, use the SP2 package.
    If Vista or Windows 7, skip the Recovery Console part
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RC1.png

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC2-1.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

Link to post
Share on other sites

Here is the result of ComboFix =). My system runs smoothly, like it did before, but I can't get to see the redirecting behavior anymore.

ComboFix 10-12-26.01 - Antoine 2010-12-27 13:52:15.1.6 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.4095.2075 [GMT -5:00]

Lanc

Link to post
Share on other sites

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

DDS::
uInternet Settings,ProxyServer = 174.74.84.50:27977

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

CFScriptB-4.gif

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

Link to post
Share on other sites

Thanks again for your help!

My system behavior is unchanged from last post, but it has rebooted during the ComboFix routine. Here is the log:

ComboFix 10-12-26.01 - Antoine 2010-12-27 14:35:49.2.6 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.4095.2005 [GMT -5:00]

Lanc

Link to post
Share on other sites

Good job thumbup.gif

The following will implement some cleanup procedures as well as reset System Restore points:

For XP:

  • Click START run
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

For Vista / Windows 7

  • Click START Search
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

If you used DeFogger

To re-enable your Emulation drivers, double click DeFogger to run the tool.

  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Here's my usual all clean post

To be on the safe side, I would also change all my passwords.

This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.

Log looks good :lol:

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    1. From within Internet Explorer click on the Tools menu and then click on Options.
    2. Click once on the Security tab
    3. Click once on the Internet icon so it becomes highlighted.
    4. Click once on the Custom Level button.
    5. Change the Download signed ActiveX controls to Prompt
    6. Change the Download unsigned ActiveX controls to Disable
    7. Change the Initialize and script ActiveX controls not marked as safe to Disable
    8. Change the Installation of desktop items to Prompt
    9. Change the Launching programs and files in an IFRAME to Prompt
    10. Change the Navigate sub-frames across different domains to Prompt
    11. When all these settings have been made, click on the OK button.
    12. If it prompts you as to whether or not you want to save the settings, press the Yes button.
    13. Next press the Apply button and then the OK to exit the Internet Properties page.

    [*]Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week

    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    [*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.

    Without a firewall your computer is succeptible to being hacked and taken over.

    I am very serious about this and see it happen almost every day with my clients.

    Simply using a Firewall in its default configuration can lower your risk greatly.

    [*] WOT , Web of Trust, As 'Googling' is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

    Green to go

    Yellow for caution

    Red to stop

    WOT has an addon available for both Firefox and IE.

    [*]Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.

    This will ensure your computer has always the latest security updates available installed on your computer.

    If there are new updates to install, install them immediately, reboot your computer, and revisit the site

    until there are no more critical updates.

Only run one Anti-Virus and Firewall program.

I would suggest you read:

PC Safety and Security--What Do I Need?.

How to Prevent Malware:

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.