TechSpot

[A] Windows Command Processor popup; 5 step viruses/spyware/malware preliminary removal done

Inactive
By Domh1
Jun 12, 2012
  1. Hello,

    A few days ago on my HP Pavillion Notebook with Windows 7 an alert appeared telling my McAfee firewall was turned off and that I was vulnerable to attacks; whenever I turned it back on it immediately turned itself off again.

    Whilst searching for a solution another alert appeared -

    Do you want to allow the following program to make changes to this computer?
    Program Name: Windows Command Processor
    Verified Publisher: Microsoft Windows
    Program Location: "C:/Windows/Sys/WOW64/cmd.exe" / "C:/Users/Dominic/AppData/Local/Temp'admin

    Clicking exit or no has no effect - it reappears within seconds. My Internet usage has become greatly impaired - access to most anti-virus websites is blocked and it often crashes entirely. I've used another laptop to download the software specified in the the 5-step viruses/spyware/malware preliminary removal instructions and managed to transfer it to mine. Below are the logs -


    Note - Unable to open my McAffee anti-virus software at all to scan to was unable to complete Step One. Also unable to disable it as instructed for following steps, hope it hasn't conflicted with any of the programs....

    Many thanks in advance for any help you can offer!

    Malwarebytes log -


    Malwarebytes Anti-Malware 1.61.0.1400
    www.malwarebytes.org

    Database version: v2012.04.04.08

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 9.0.8112.16421
    Dominic :: DOMINIC-HP [administrator]

    10/06/2012 21:18:18
    mbam-log-2012-06-10 (21-18-18).txt

    Scan type: Full scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 453290
    Time elapsed: 2 hour(s), 38 minute(s), 10 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 2
    C:\Users\Dominic\AppData\LocalLow\Retrogamer_2zEI\Installr\Cache\0598EAB9.exe (PUP.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Users\Dominic\0.039833092536455283.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

    (end)


    Note - despite deleting the program's findings and restarting as instructed, the problem persisted so I continued -

    GMER log -


    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit scan 2012-06-12 18:44:55
    Windows 6.1.7601 Service Pack 1
    Running: 0c29vynp.exe


    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713d5c64e
    Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e02a827dae15
    Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713d5c64e (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e02a827dae15 (not active ControlSet)

    ---- EOF - GMER 1.0.15 ----




    DDS log (1st) -


    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 9.0.8112.16421
    Run by Dominic at 18:46:00 on 2012-06-12
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3894.2220 [GMT 1:00]
    .
    AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Program Files\Tablet\Pen\Pen_TouchService.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\SYSTEM32\WISPTIS.EXE
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\SysWOW64\ezSharedSvcHost.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
    C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
    C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    C:\Windows\system32\mfevtps.exe
    C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Windows\system32\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Tablet\Pen\Pen_Tablet.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\svchost.exe -k HPService
    C:\Windows\system32\svchost.exe -k bthsvcs
    C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe
    C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
    C:\Program Files\Realtek\RtVOsd\RtVOsd.exe
    C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\system32\taskhost.exe
    C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\SYSTEM32\WISPTIS.EXE
    C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Tablet\Pen\Pen_Tablet.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
    C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Users\Dominic\AppData\Roaming\Dropbox\bin\Dropbox.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\mswinext.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Windows\system32\svchost.exe
    C:\Users\Dominic\AppData\Local\Temp\ollwuhipsriqxcpl.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
    C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
    C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
    C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe
    C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
    C:\Windows\system32\consent.exe
    F:\0c29vynp.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uInternet Settings,ProxyOverride = *.local
    mWinlogon: Userinit=userinit.exe,
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120510133950.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
    BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    TB: @C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll
    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    uRun: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
    uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
    uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
    uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    uRun: [WdnCsfjj] C:\Users\Dominic\AppData\Local\oavpicas\wdncsfjj.exe
    mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun: [Bing Bar] "C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\mswinext.exe"
    mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
    mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
    mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
    mRun: [Wondershare Helper Compact.exe] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
    mRun: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    StartupFolder: C:\Users\Dominic\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Dominic\AppData\Roaming\Dropbox\bin\Dropbox.exe
    StartupFolder: C:\Users\Dominic\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wdncsfjj.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-explorer: EnableShellExecuteHooks = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
    DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://oas.support.microsoft.com/ActiveX/MSDcode.cab
    DPF: {4F29DE54-5EB7-4D76-B610-A86B5CD2A234} - hxxp://archives.gametap.com/static/cab_headless/GameTapWebPlayer.cab
    DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
    TCP: Interfaces\{E213C5F9-C673-4EFD-9F6F-05BE4470EF7E} : DhcpNameServer = 194.168.4.100 194.168.8.100
    TCP: Interfaces\{E213C5F9-C673-4EFD-9F6F-05BE4470EF7E}\244584572633D273158405 : DhcpNameServer = 192.168.1.254
    TCP: Interfaces\{E213C5F9-C673-4EFD-9F6F-05BE4470EF7E}\244584F6D656845726D223634353 : DhcpNameServer = 192.168.1.254
    TCP: Interfaces\{E213C5F9-C673-4EFD-9F6F-05BE4470EF7E}\E64757D26796379647F627 : DhcpNameServer = 152.71.2.3 152.71.148.1
    TCP: Interfaces\{E213C5F9-C673-4EFD-9F6F-05BE4470EF7E}\E64757D277962756C65637378456C607 : DhcpNameServer = 152.71.2.3 152.71.148.1
    Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\MSC\McSnIePl.dll
    Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
    SEH: EasyBits ShellExecute Hook: {e54729e8-bb3d-4270-9d49-7389ea579090} - C:\Windows\SysWow64\EZUPBH~1.DLL
    mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
    BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO-X64: Search Helper - No File
    BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120510133950.dll
    BHO-X64: scriptproxy - No File
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO-X64: SkypeIEPluginBHO - No File
    BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
    BHO-X64: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    TB-X64: @C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll
    TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
    TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun-x64: [Bing Bar] "C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\mswinext.exe"
    mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun-x64: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
    mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun-x64: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
    mRun-x64: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
    mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    mRun-x64: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
    mRun-x64: [Wondershare Helper Compact.exe] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
    mRun-x64: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    SEH-X64: EasyBits ShellExecute Hook: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]
    R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]
    R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]
    R1 MOBKFilter;MOBKFilter;C:\Windows\system32\DRIVERS\MOBK.sys --> C:\Windows\system32\DRIVERS\MOBK.sys [?]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
    R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2011-1-12 98208]
    R2 ezSharedSvc;Easybits Services for Windows;C:\Windows\System32\ezSharedSvcHost.exe [2010-7-16 514232]
    R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-9-9 86072]
    R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-6-19 103992]
    R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-9-1 227896]
    R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-2-15 34872]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-1-12 13336]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-11-4 249936]
    R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-11-4 249936]
    R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-11-4 249936]
    R2 McShield;McAfee McShield;C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe [2011-11-4 199272]
    R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [2011-11-4 210584]
    R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]
    R2 MOBKbackup;McAfee Online Backup;C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe [2010-4-13 231224]
    R2 RtVOsdService;RtVOsdService Installer;C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [2010-6-24 315392]
    R2 TabletServicePen;TabletServicePen;C:\Program Files\Tablet\Pen\Pen_Tablet.exe [2012-1-13 6583160]
    R2 TouchServicePen;Wacom Consumer Touch Service;C:\Program Files\Tablet\Pen\Pen_TouchService.exe [2012-1-13 528760]
    R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-1-12 2320920]
    R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
    R3 IntcDAud;Intel(R) Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
    R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]
    R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]
    R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2011-1-12 225280]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-8-19 136176]
    S2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-11-4 249936]
    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]
    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-5 257696]
    S3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]
    S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2012-6-2 1038088]
    S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-8-19 136176]
    S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]
    S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
    S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
    S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
    S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
    .
    =============== Created Last 30 ================
    .
    2012-06-10 20:14:01 -------- d-----w- C:\Users\Dominic\AppData\Roaming\Malwarebytes
    2012-06-10 20:13:55 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2012-06-10 20:13:55 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2012-06-10 19:55:08 -------- d-----w- C:\ProgramData\Malwarebytes
    2012-06-10 19:00:35 -------- d-----w- C:\Users\Dominic\AppData\Local\oavpicas
    2012-06-09 02:00:18 -------- d-sh--w- C:\Windows\System32\%APPDATA%
    2012-06-07 12:54:07 -------- d-----w- C:\ProgramData\Windows
    2012-06-02 16:40:30 -------- d-----w- C:\Users\Dominic\Adobe Photoshop CS4 (64 Bit)
    2012-06-02 16:34:54 -------- d-----w- C:\Users\Dominic\Adobe Photoshop CS4
    2012-06-02 16:31:34 -------- d-----w- C:\Users\Dominic\Adobe Bridge CS4
    2012-06-02 16:29:16 -------- d-----w- C:\Users\Dominic\Adobe Device Central CS4
    2012-06-02 16:26:44 -------- d-----w- C:\Users\Dominic\Adobe Extension Manager CS4
    2012-06-02 16:26:11 -------- d-----w- C:\Program Files\Common Files\Macrovision Shared
    2012-06-02 16:26:04 -------- d-----w- C:\Program Files (x86)\Common Files\Macrovision Shared
    2012-05-23 20:34:28 81408 ----a-w- C:\Windows\emMON.exe
    2012-05-23 20:34:28 649472 ----a-w- C:\Windows\System32\drivers\emBDA64.sys
    2012-05-23 20:34:28 617216 ----a-w- C:\Windows\System32\drivers\emOEM64.sys
    2012-05-23 20:34:28 118784 ----a-w- C:\Windows\System32\emPRP64.ax
    2012-05-23 20:34:27 113664 ----a-w- C:\Windows\SysWow64\emPRP.ax
    2012-05-23 20:34:26 -------- d-----w- C:\Program Files (x86)\USB_video_device
    2012-05-23 07:26:30 -------- d-----w- C:\ProgramData\xml_param
    2012-05-23 07:14:16 -------- d-----w- C:\Users\Dominic\AppData\Roaming\Wondershare Video Converter Ultimate
    2012-05-23 07:14:05 -------- d-----w- C:\Users\Dominic\AppData\Local\Wondershare
    2012-05-23 07:14:03 -------- d-----w- C:\Program Files (x86)\Common Files\Wondershare
    2012-05-23 07:13:48 892928 ----a-w- C:\Windows\SysWow64\iconv.dll
    2012-05-23 07:13:48 675840 ----a-w- C:\Windows\SysWow64\ac3filter.ax
    2012-05-23 07:13:48 496640 ----a-w- C:\Windows\SysWow64\xvid.ax
    2012-05-23 07:13:42 -------- d-----w- C:\Program Files (x86)\Wondershare
    .
    ==================== Find3M ====================
    .
    2012-05-05 12:09:30 70304 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-05-05 12:09:30 419488 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
    2012-05-05 12:09:17 8769696 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe
    2012-03-31 06:05:57 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe
    2012-03-31 04:39:37 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2012-03-31 04:39:37 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2012-03-31 03:10:03 3146240 ----a-w- C:\Windows\System32\win32k.sys
    2012-03-30 11:35:47 1918320 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2012-03-20 12:11:30 162192 ----a-w- C:\Windows\System32\mfevtps.exe
    2012-03-17 07:58:57 75120 ----a-w- C:\Windows\System32\drivers\partmgr.sys
    .
    ============= FINISH: 18:48:13.50 ===============



    DDS log (2nd) -



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 19/08/2011 17:00:39
    System Uptime: 11/06/2012 00:42:35 (42 hours ago)
    .
    Motherboard: Hewlett-Packard | | 1439
    Processor: Intel(R) Core(TM) i3 CPU M 350 @ 2.27GHz | CPU | 2266/1066mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 449 GiB total, 334.465 GiB free.
    D: is FIXED (NTFS) - 16 GiB total, 2.36 GiB free.
    E: is CDROM ()
    F: is Removable
    G: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP97: 01/06/2012 23:50:38 - Installed HP Product Detection
    RP98: 05/06/2012 03:00:16 - Windows Update
    .
    ==== Installed Programs ======================
    .
    Acrobat.com
    Adobe AIR
    Adobe Anchor Service CS4
    Adobe Bridge CS4
    Adobe CMaps CS4
    Adobe Color - Photoshop Specific CS4
    Adobe Color EU Recommended Settings CS4
    Adobe Color JA Extra Settings CS4
    Adobe Color NA Extra Settings CS4
    Adobe Community Help
    Adobe CSI CS4
    Adobe Default Language CS4
    Adobe Device Central CS4
    Adobe Download Assistant
    Adobe Drive CS4
    Adobe ExtendScript Toolkit CS4
    Adobe Extension Manager CS4
    Adobe Fonts All
    Adobe Illustrator CS5.1
    Adobe Linguistics CS4
    Adobe Media Player
    Adobe Output Module
    Adobe PDF Library Files CS4
    Adobe Photoshop CS4
    Adobe Photoshop CS4 Support
    Adobe Reader 9.5.1 MUI
    Adobe Search for Help
    Adobe Service Manager Extension
    Adobe Setup
    Adobe Shockwave Player 11.5
    Adobe Type Support CS4
    Adobe Update Manager CS4
    Adobe WinSoft Linguistics Plugin
    Adobe XMP Panels CS4
    AdobeColorCommonSetCMYK
    Agatha Christie - Death on the Nile
    Apple Application Support
    Apple Software Update
    Audacity 1.3.13 (Unicode)
    B110
    Bamboo Dock
    Bejeweled 2 Deluxe
    Bing Bar
    Bing Bar Platform
    Blackhawk Striker 2
    BufferChm
    Chuzzle Deluxe
    Connect
    CyberLink DVD Suite
    CyberLink PowerDVD 9
    CyberLink YouCam
    Destinations
    DeviceDiscovery
    Dora's Carnival Adventure
    Dropbox
    Energy Star Digital Logo
    Escape Rosecliff Island
    ESU for Microsoft Windows 7
    FATE
    Final Drive Nitro
    FreeTorrentViewer
    GameTap Web Player
    Google Toolbar for Internet Explorer
    Google Update Helper
    GPBaseService2
    Hewlett-Packard ACLM.NET v1.1.2.0
    HP Advisor
    HP Customer Experience Enhancements
    HP Documentation
    HP Game Console
    HP Games
    HP Photo Creations
    HP Power Manager
    HP Product Detection
    HP Quick Launch
    HP Setup
    HP Software Framework
    HP Support Assistant
    HPAppStudio
    HPPhotoGadget
    HPProductAssistant
    Intel(R) Control Center
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) Management Engine Components
    Intel(R) Rapid Storage Technology
    IrfanView (remove only)
    Java Auto Updater
    Java(TM) 6 Update 20
    Jewel Quest - Heritage
    Junk Mail filter update
    kuler
    LabelPrint
    LightScribe System Software
    Magic Desktop
    Malwarebytes Anti-Malware version 1.61.0.1400
    MarketResearch
    McAfee Internet Security
    McAfee Online Backup
    Microsoft Choice Guard
    Microsoft Default Manager
    Microsoft Office 2010
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Home and Student 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Save as PDF Add-in for 2007 Microsoft Office programs
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft_VC80_ATL_x86
    Microsoft_VC80_CRT_x86
    Microsoft_VC80_MFC_x86
    Microsoft_VC80_MFCLOC_x86
    Microsoft_VC90_ATL_x86
    Microsoft_VC90_CRT_x86
    Microsoft_VC90_MFC_x86
    Microsoft_VC90_MFCLOC_x86
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    PDF Settings CS4
    PDF Settings CS5
    Penguins!
    PhotoNow!
    Photoshop Camera Raw
    Plants vs. Zombies
    Poker Superstars III
    Polar Bowler
    Polar Golfer
    Power2Go
    PowerDirector
    PS_AIO_07_B110_SW_Min
    QuickTime
    QuickTransfer
    Ralink RT3090 802.11b/g/n WiFi Adapter
    RealNetworks - Microsoft Visual C++ 2008 Runtime
    RealPlayer
    Realtek Ethernet Controller Driver For Windows 7
    Realtek High Definition Audio Driver
    Realtek USB 2.0 Card Reader
    RealUpgrade 1.1
    Recovery Manager
    Scan
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Skype Click to Call
    Skype™ 5.8
    SolutionCenter
    Status
    Suite Shared Configuration CS4
    Toolbox
    TrayApp
    Tunatic
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
    USB Video/Audio Device Driver
    Virtual Villagers - The Secret City
    WebReg
    WebTablet FB Plugin
    WebTablet IE Plugin
    WebTablet Netscape Plugin
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Mail
    Windows Live Messenger
    Windows Live Movie Maker
    Windows Live Photo Gallery
    Windows Live Sync
    Windows Live Upload Tool
    Windows Live Writer
    Windows Media Encoder 9 Series
    Windows Media Encoder 9 Series SDK
    Wondershare Video Converter Ultimate(Build 5.7.6.7)
    Zuma Deluxe
    .
    ==== Event Viewer Messages From Past Week ========
    .
    12/06/2012 18:01:13, Error: Service Control Manager [7003] - The McAfee Personal Firewall Service service depends the following service: MpsSvc. This service might not be installed.
    12/06/2012 12:43:18, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TouchServicePen service.
    11/06/2012 15:42:27, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR4.
    11/06/2012 00:43:08, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
    11/06/2012 00:43:05, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147024891
    11/06/2012 00:43:05, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
    11/06/2012 00:43:05, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
    10/06/2012 21:13:06, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HPWMISVC service.
    10/06/2012 17:05:35, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the EFS service.
    09/06/2012 02:55:13, Error: Service Control Manager [7034] - The McAfee Scanner service terminated unexpectedly. It has done this 1 time(s).
    09/06/2012 00:09:08, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the RtVOsdService service.
    06/06/2012 22:52:03, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{E213C5F9-C673-4EFD-9F6F-05BE4470EF7E} because another computer on the network has the same name. The server could not start.
    06/06/2012 08:20:02, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Apple Mobile Device service to connect.
    06/06/2012 08:20:02, Error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    .
    ==== End Of File ===========================
     
  2. Broni

    Broni Malware Annihilator Posts: 47,066   +256

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ============================================

    Your MBAM database is very outdated.
    Update MBAM, run it and post new log.

    Next....

    Download Bootkit Remover to your desktop.

    • Unzip downloaded file to your Desktop.
    • Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on boot_cleaner.exe and click Run As Administrator).
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.

    ==============================================

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan.
    On completion of the scan click "Save log", save it to your desktop and post in your next reply.

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.
     
  3. Domh1

    Domh1 TS Rookie Topic Starter

    Hi Broni,

    Thanks for getting back to me, really appreciate your help. Please find below the updated Malwarebytes log -

    Malwarebytes Anti-Malware 1.61.0.1400
    www.malwarebytes.org
    Database version: v2012.06.13.01
    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 9.0.8112.16421
    Dominic :: DOMINIC-HP [administrator]
    13/06/2012 09:17:45
    mbam-log-2012-06-13 (09-17-45).txt
    Scan type: Full scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 459055
    Time elapsed: 2 hour(s), 31 minute(s), 29 second(s)
    Memory Processes Detected: 0
    (No malicious items detected)
    Memory Modules Detected: 0
    (No malicious items detected)
    Registry Keys Detected: 0
    (No malicious items detected)
    Registry Values Detected: 0
    (No malicious items detected)
    Registry Data Items Detected: 0
    (No malicious items detected)
    Folders Detected: 0
    (No malicious items detected)
    Files Detected: 0
    (No malicious items detected)
    (end)


    Bootkit Remover log -


    .\debug.cpp(238) : Debug log started at 12.06.2012 - 19:37:49

    .\boot_cleaner.cpp(527) : Bootkit Remover

    .\boot_cleaner.cpp(528) : (c) 2009 Esage Lab

    .\boot_cleaner.cpp(529) : www.esagelab.com

    .\boot_cleaner.cpp(533) : Program version: 1.2.0.1

    .\boot_cleaner.cpp(540) : OS Version: Microsoft Windows 7 Home Premium Edition Service Pack 1 (build 7601), 64-bit

    .\debug.cpp(248) : **********************************************

    .\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] ***********

    .\debug.cpp(250) : **********************************************

    .\debug.cpp(256) : 0x0340d000 0x005e8000 "\SystemRoot\system32\ntoskrnl.exe"

    .\debug.cpp(256) : 0x039f5000 0x00049000 "\SystemRoot\system32\hal.dll"

    .\debug.cpp(256) : 0x00bb0000 0x0000a000 "\SystemRoot\system32\kdcom.dll"

    .\debug.cpp(256) : 0x00c38000 0x0004f000 "\SystemRoot\system32\mcupdate_GenuineIntel.dll"

    .\debug.cpp(256) : 0x00c87000 0x00014000 "\SystemRoot\system32\PSHED.dll"

    .\debug.cpp(256) : 0x00c9b000 0x0005e000 "\SystemRoot\system32\CLFS.SYS"

    .\debug.cpp(256) : 0x00cf9000 0x000c0000 "\SystemRoot\system32\CI.dll"

    .\debug.cpp(256) : 0x00ee4000 0x000a4000 "\SystemRoot\system32\drivers\Wdf01000.sys"

    .\debug.cpp(256) : 0x00f88000 0x0000f000 "\SystemRoot\system32\drivers\WDFLDR.SYS"

    .\debug.cpp(256) : 0x00f97000 0x00057000 "\SystemRoot\system32\drivers\ACPI.sys"

    .\debug.cpp(256) : 0x00fee000 0x00009000 "\SystemRoot\system32\drivers\WMILIB.SYS"

    .\debug.cpp(256) : 0x00e00000 0x0000a000 "\SystemRoot\system32\drivers\msisadrv.sys"

    .\debug.cpp(256) : 0x00e0a000 0x00033000 "\SystemRoot\system32\drivers\pci.sys"

    .\debug.cpp(256) : 0x00e3d000 0x0000d000 "\SystemRoot\system32\drivers\vdrvroot.sys"

    .\debug.cpp(256) : 0x00e4a000 0x00015000 "\SystemRoot\System32\drivers\partmgr.sys"

    .\debug.cpp(256) : 0x00e5f000 0x00009000 "\SystemRoot\system32\DRIVERS\compbatt.sys"

    .\debug.cpp(256) : 0x00e68000 0x0000c000 "\SystemRoot\system32\DRIVERS\BATTC.SYS"

    .\debug.cpp(256) : 0x00e74000 0x00015000 "\SystemRoot\system32\drivers\volmgr.sys"

    .\debug.cpp(256) : 0x010d4000 0x0005c000 "\SystemRoot\System32\drivers\volmgrx.sys"

    .\debug.cpp(256) : 0x01130000 0x0001a000 "\SystemRoot\System32\drivers\mountmgr.sys"

    .\debug.cpp(256) : 0x012ab000 0x0020a000 "\SystemRoot\system32\DRIVERS\iaStor.sys"

    .\debug.cpp(256) : 0x014b5000 0x00009000 "\SystemRoot\system32\drivers\atapi.sys"

    .\debug.cpp(256) : 0x014be000 0x0002a000 "\SystemRoot\system32\drivers\ataport.SYS"

    .\debug.cpp(256) : 0x014e8000 0x0000b000 "\SystemRoot\system32\drivers\msahci.sys"

    .\debug.cpp(256) : 0x014f3000 0x00010000 "\SystemRoot\system32\drivers\PCIIDEX.SYS"

    .\debug.cpp(256) : 0x01503000 0x0000b000 "\SystemRoot\system32\drivers\amdxata.sys"

    .\debug.cpp(256) : 0x0150e000 0x0004c000 "\SystemRoot\system32\drivers\fltmgr.sys"

    .\debug.cpp(256) : 0x0155a000 0x00014000 "\SystemRoot\system32\drivers\fileinfo.sys"

    .\debug.cpp(256) : 0x01200000 0x0009c000 "\SystemRoot\system32\drivers\mfehidk.sys"

    .\debug.cpp(256) : 0x0165a000 0x001a3000 "\SystemRoot\System32\Drivers\Ntfs.sys"

    .\debug.cpp(256) : 0x0156e000 0x0005e000 "\SystemRoot\System32\Drivers\msrpc.sys"

    .\debug.cpp(256) : 0x01600000 0x0001b000 "\SystemRoot\System32\Drivers\ksecdd.sys"

    .\debug.cpp(256) : 0x0114a000 0x00072000 "\SystemRoot\System32\Drivers\cng.sys"

    .\debug.cpp(256) : 0x0161b000 0x00011000 "\SystemRoot\System32\drivers\pcw.sys"

    .\debug.cpp(256) : 0x0162c000 0x0000a000 "\SystemRoot\System32\Drivers\Fs_Rec.sys"

    .\debug.cpp(256) : 0x01819000 0x000f3000 "\SystemRoot\system32\drivers\ndis.sys"

    .\debug.cpp(256) : 0x0190c000 0x00060000 "\SystemRoot\system32\drivers\NETIO.SYS"

    .\debug.cpp(256) : 0x0196c000 0x0002b000 "\SystemRoot\System32\Drivers\ksecpkg.sys"

    .\debug.cpp(256) : 0x01a1a000 0x00203000 "\SystemRoot\System32\drivers\tcpip.sys"

    .\debug.cpp(256) : 0x01c1d000 0x0004a000 "\SystemRoot\System32\drivers\fwpkclnt.sys"

    .\debug.cpp(256) : 0x01c67000 0x00045000 "\SystemRoot\system32\drivers\mfewfpk.sys"

    .\debug.cpp(256) : 0x01cac000 0x00008000 "\SystemRoot\system32\DRIVERS\wd.sys"

    .\debug.cpp(256) : 0x01cb4000 0x0004c000 "\SystemRoot\system32\drivers\volsnap.sys"

    .\debug.cpp(256) : 0x01d00000 0x00008000 "\SystemRoot\System32\Drivers\spldr.sys"

    .\debug.cpp(256) : 0x01d08000 0x0003a000 "\SystemRoot\System32\drivers\rdyboost.sys"

    .\debug.cpp(256) : 0x01d42000 0x00012000 "\SystemRoot\System32\Drivers\mup.sys"

    .\debug.cpp(256) : 0x01d54000 0x00009000 "\SystemRoot\System32\drivers\hwpolicy.sys"

    .\debug.cpp(256) : 0x01d5d000 0x0003a000 "\SystemRoot\System32\DRIVERS\fvevol.sys"

    .\debug.cpp(256) : 0x01d97000 0x00016000 "\SystemRoot\system32\DRIVERS\disk.sys"

    .\debug.cpp(256) : 0x01dad000 0x00030000 "\SystemRoot\system32\DRIVERS\CLASSPNP.SYS"

    .\debug.cpp(256) : 0x04453000 0x0002a000 "\SystemRoot\system32\DRIVERS\cdrom.sys"

    .\debug.cpp(256) : 0x0447d000 0x00016000 "\SystemRoot\system32\DRIVERS\MOBK.sys"

    .\debug.cpp(256) : 0x04493000 0x00009000 "\SystemRoot\System32\Drivers\Null.SYS"

    .\debug.cpp(256) : 0x0449c000 0x00007000 "\SystemRoot\System32\Drivers\Beep.SYS"

    .\debug.cpp(256) : 0x044a3000 0x0000e000 "\SystemRoot\System32\drivers\vga.sys"

    .\debug.cpp(256) : 0x044b1000 0x00025000 "\SystemRoot\System32\drivers\VIDEOPRT.SYS"

    .\debug.cpp(256) : 0x044d6000 0x00010000 "\SystemRoot\System32\drivers\watchdog.sys"

    .\debug.cpp(256) : 0x044e6000 0x00009000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys"

    .\debug.cpp(256) : 0x044ef000 0x00009000 "\SystemRoot\system32\drivers\rdpencdd.sys"

    .\debug.cpp(256) : 0x044f8000 0x00009000 "\SystemRoot\system32\drivers\rdprefmp.sys"

    .\debug.cpp(256) : 0x04501000 0x0000b000 "\SystemRoot\System32\Drivers\Msfs.SYS"

    .\debug.cpp(256) : 0x0450c000 0x00011000 "\SystemRoot\System32\Drivers\Npfs.SYS"

    .\debug.cpp(256) : 0x0451d000 0x00022000 "\SystemRoot\system32\DRIVERS\tdx.sys"

    .\debug.cpp(256) : 0x0453f000 0x0000d000 "\SystemRoot\system32\DRIVERS\TDI.SYS"

    .\debug.cpp(256) : 0x0454c000 0x00045000 "\SystemRoot\System32\DRIVERS\netbt.sys"

    .\debug.cpp(256) : 0x01000000 0x00089000 "\SystemRoot\system32\drivers\afd.sys"

    .\debug.cpp(256) : 0x04591000 0x00009000 "\SystemRoot\system32\DRIVERS\wfplwf.sys"

    .\debug.cpp(256) : 0x0459a000 0x00026000 "\SystemRoot\system32\DRIVERS\pacer.sys"

    .\debug.cpp(256) : 0x045c0000 0x00016000 "\SystemRoot\system32\DRIVERS\vwififlt.sys"

    .\debug.cpp(256) : 0x045d6000 0x00011000 "\SystemRoot\system32\DRIVERS\mfenlfk.sys"

    .\debug.cpp(256) : 0x045e7000 0x0000f000 "\SystemRoot\system32\DRIVERS\netbios.sys"

    .\debug.cpp(256) : 0x04200000 0x0001b000 "\SystemRoot\system32\DRIVERS\wanarp.sys"

    .\debug.cpp(256) : 0x0421b000 0x00014000 "\SystemRoot\system32\drivers\termdd.sys"

    .\debug.cpp(256) : 0x01997000 0x00051000 "\SystemRoot\system32\DRIVERS\rdbss.sys"

    .\debug.cpp(256) : 0x01deb000 0x0000c000 "\SystemRoot\system32\drivers\nsiproxy.sys"

    .\debug.cpp(256) : 0x01a00000 0x0000b000 "\SystemRoot\system32\drivers\mssmbios.sys"

    .\debug.cpp(256) : 0x01a0b000 0x0000f000 "\SystemRoot\System32\drivers\discache.sys"

    .\debug.cpp(256) : 0x01636000 0x0001e000 "\SystemRoot\System32\Drivers\dfsc.sys"

    .\debug.cpp(256) : 0x019e8000 0x00011000 "\SystemRoot\system32\DRIVERS\blbdrive.sys"

    .\debug.cpp(256) : 0x015cc000 0x00026000 "\SystemRoot\system32\DRIVERS\tunnel.sys"

    .\debug.cpp(256) : 0x04c92000 0x00a1f000 "\SystemRoot\system32\DRIVERS\igdkmd64.sys"

    .\debug.cpp(256) : 0x056b1000 0x000f4000 "\SystemRoot\System32\drivers\dxgkrnl.sys"

    .\debug.cpp(256) : 0x057a5000 0x00046000 "\SystemRoot\System32\drivers\dxgmms1.sys"

    .\debug.cpp(256) : 0x057eb000 0x00011000 "\SystemRoot\system32\DRIVERS\HECIx64.sys"

    .\debug.cpp(256) : 0x04c00000 0x00011000 "\SystemRoot\system32\drivers\usbehci.sys"

    .\debug.cpp(256) : 0x04c11000 0x00056000 "\SystemRoot\system32\drivers\USBPORT.SYS"

    .\debug.cpp(256) : 0x04c67000 0x00024000 "\SystemRoot\system32\drivers\HDAudBus.sys"

    .\debug.cpp(256) : 0x04817000 0x001c0000 "\SystemRoot\system32\DRIVERS\netr28x.sys"

    .\debug.cpp(256) : 0x049d7000 0x0000d000 "\SystemRoot\system32\DRIVERS\vwifibus.sys"

    .\debug.cpp(256) : 0x01089000 0x0001e000 "\SystemRoot\system32\drivers\i8042prt.sys"

    .\debug.cpp(256) : 0x049e4000 0x0000f000 "\SystemRoot\system32\drivers\kbdclass.sys"

    .\debug.cpp(256) : 0x0302a000 0x0015b000 "\SystemRoot\system32\DRIVERS\SynTP.sys"

    .\debug.cpp(256) : 0x03185000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS"

    .\debug.cpp(256) : 0x03187000 0x0000f000 "\SystemRoot\system32\DRIVERS\mouclass.sys"

    .\debug.cpp(256) : 0x03196000 0x0000d000 "\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys"

    .\debug.cpp(256) : 0x031a3000 0x00036000 "\SystemRoot\System32\Drivers\fastfat.SYS"

    .\debug.cpp(256) : 0x031d9000 0x00005000 "\SystemRoot\system32\DRIVERS\CmBatt.sys"

    .\debug.cpp(256) : 0x031de000 0x00009000 "\SystemRoot\system32\drivers\wmiacpi.sys"

    .\debug.cpp(256) : 0x031e7000 0x00016000 "\SystemRoot\system32\DRIVERS\intelppm.sys"

    .\debug.cpp(256) : 0x03000000 0x00010000 "\SystemRoot\system32\drivers\CompositeBus.sys"

    .\debug.cpp(256) : 0x03010000 0x00003000 "\SystemRoot\system32\DRIVERS\wacomvhid.sys"

    .\debug.cpp(256) : 0x01800000 0x00019000 "\SystemRoot\system32\DRIVERS\HIDCLASS.SYS"

    .\debug.cpp(256) : 0x03013000 0x00009000 "\SystemRoot\system32\DRIVERS\HIDPARSE.SYS"

    .\debug.cpp(256) : 0x04800000 0x00016000 "\SystemRoot\system32\DRIVERS\AgileVpn.sys"

    .\debug.cpp(256) : 0x010a7000 0x00024000 "\SystemRoot\system32\DRIVERS\rasl2tp.sys"

    .\debug.cpp(256) : 0x0301c000 0x0000c000 "\SystemRoot\system32\DRIVERS\ndistapi.sys"

    .\debug.cpp(256) : 0x011bc000 0x0002f000 "\SystemRoot\system32\DRIVERS\ndiswan.sys"

    .\debug.cpp(256) : 0x00db9000 0x0001b000 "\SystemRoot\system32\DRIVERS\raspppoe.sys"

    .\debug.cpp(256) : 0x00dd4000 0x00021000 "\SystemRoot\system32\DRIVERS\raspptp.sys"

    .\debug.cpp(256) : 0x00c00000 0x0001a000 "\SystemRoot\system32\DRIVERS\rassstp.sys"

    .\debug.cpp(256) : 0x03028000 0x00002000 "\SystemRoot\system32\drivers\swenum.sys"

    .\debug.cpp(256) : 0x05a21000 0x00043000 "\SystemRoot\system32\drivers\ks.sys"

    .\debug.cpp(256) : 0x05a64000 0x00012000 "\SystemRoot\system32\drivers\umbus.sys"

    .\debug.cpp(256) : 0x05a76000 0x0005a000 "\SystemRoot\system32\DRIVERS\usbhub.sys"

    .\debug.cpp(256) : 0x05ad0000 0x0000d000 "\SystemRoot\system32\DRIVERS\mouhid.sys"

    .\debug.cpp(256) : 0x05add000 0x00008000 "\SystemRoot\system32\DRIVERS\wacommousefilter.sys"

    .\debug.cpp(256) : 0x05ae5000 0x00015000 "\SystemRoot\System32\Drivers\NDProxy.SYS"

    .\debug.cpp(256) : 0x06a7a000 0x0025d000 "\SystemRoot\system32\drivers\RTKVHD64.sys"

    .\debug.cpp(256) : 0x06cd7000 0x0003d000 "\SystemRoot\system32\drivers\portcls.sys"

    .\debug.cpp(256) : 0x06d14000 0x00022000 "\SystemRoot\system32\drivers\drmk.sys"

    .\debug.cpp(256) : 0x06d36000 0x00006000 "\SystemRoot\system32\drivers\ksthunk.sys"

    .\debug.cpp(256) : 0x06d3c000 0x00047000 "\SystemRoot\system32\DRIVERS\IntcDAud.sys"

    .\debug.cpp(256) : 0x06d83000 0x00036000 "\SystemRoot\system32\drivers\mfeavfk.sys"

    .\debug.cpp(256) : 0x06a00000 0x00075000 "\SystemRoot\system32\drivers\mfefirek.sys"

    .\debug.cpp(256) : 0x000b0000 0x00315000 "\SystemRoot\System32\win32k.sys"

    .\debug.cpp(256) : 0x06db9000 0x0000c000 "\SystemRoot\System32\drivers\Dxapi.sys"

    .\debug.cpp(256) : 0x06dc5000 0x0000e000 "\SystemRoot\System32\Drivers\crashdmp.sys"

    .\debug.cpp(256) : 0x0422f000 0x0020a000 "\SystemRoot\System32\Drivers\dump_iaStor.sys"

    .\debug.cpp(256) : 0x06dd3000 0x00013000 "\SystemRoot\System32\Drivers\dump_dumpfve.sys"

    .\debug.cpp(256) : 0x004b0000 0x0000a000 "\SystemRoot\System32\TSDDD.dll"

    .\debug.cpp(256) : 0x00670000 0x00027000 "\SystemRoot\System32\cdd.dll"

    .\debug.cpp(256) : 0x05afa000 0x0001d000 "\SystemRoot\system32\DRIVERS\usbccgp.sys"

    .\debug.cpp(256) : 0x05b17000 0x0002e000 "\SystemRoot\System32\Drivers\usbvideo.sys"

    .\debug.cpp(256) : 0x05b45000 0x00018000 "\SystemRoot\System32\Drivers\BTHUSB.sys"

    .\debug.cpp(256) : 0x05b5d000 0x0008c000 "\SystemRoot\System32\Drivers\bthport.sys"

    .\debug.cpp(256) : 0x008d0000 0x00061000 "\SystemRoot\System32\ATMFD.DLL"

    .\debug.cpp(256) : 0x02522000 0x00023000 "\SystemRoot\system32\drivers\luafv.sys"

    .\debug.cpp(256) : 0x02545000 0x00021000 "\SystemRoot\system32\drivers\WudfPf.sys"

    .\debug.cpp(256) : 0x02566000 0x0002c000 "\SystemRoot\system32\DRIVERS\rfcomm.sys"

    .\debug.cpp(256) : 0x02592000 0x00010000 "\SystemRoot\system32\DRIVERS\BthEnum.sys"

    .\debug.cpp(256) : 0x025a2000 0x00020000 "\SystemRoot\system32\DRIVERS\bthpan.sys"

    .\debug.cpp(256) : 0x025c2000 0x00015000 "\SystemRoot\system32\DRIVERS\lltdio.sys"

    .\debug.cpp(256) : 0x02400000 0x00053000 "\SystemRoot\system32\DRIVERS\nwifi.sys"

    .\debug.cpp(256) : 0x02453000 0x00013000 "\SystemRoot\system32\DRIVERS\ndisuio.sys"

    .\debug.cpp(256) : 0x02466000 0x00018000 "\SystemRoot\system32\DRIVERS\rspndr.sys"

    .\debug.cpp(256) : 0x02cf6000 0x000c9000 "\SystemRoot\system32\drivers\HTTP.sys"

    .\debug.cpp(256) : 0x02dbf000 0x00031000 "\SystemRoot\System32\DRIVERS\srvnet.sys"

    .\debug.cpp(256) : 0x02c00000 0x0001e000 "\SystemRoot\system32\DRIVERS\bowser.sys"

    .\debug.cpp(256) : 0x02c1e000 0x0002d000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys"

    .\debug.cpp(256) : 0x02c4b000 0x0004e000 "\SystemRoot\system32\DRIVERS\mrxsmb10.sys"

    .\debug.cpp(256) : 0x02c99000 0x00024000 "\SystemRoot\system32\DRIVERS\mrxsmb20.sys"

    .\debug.cpp(256) : 0x03cac000 0x00069000 "\SystemRoot\System32\DRIVERS\srv2.sys"

    .\debug.cpp(256) : 0x03d15000 0x00098000 "\SystemRoot\System32\DRIVERS\srv.sys"

    .\debug.cpp(256) : 0x03dad000 0x00018000 "\SystemRoot\System32\Drivers\adfs.SYS"

    .\debug.cpp(256) : 0x03c00000 0x000a6000 "\SystemRoot\system32\drivers\peauth.sys"

    .\debug.cpp(256) : 0x03dc5000 0x0000b000 "\SystemRoot\System32\Drivers\secdrv.SYS"

    .\debug.cpp(256) : 0x03dd0000 0x00012000 "\SystemRoot\System32\drivers\tcpipreg.sys"

    .\debug.cpp(256) : 0x024ba000 0x00031000 "\SystemRoot\system32\DRIVERS\WUDFRd.sys"

    .\debug.cpp(256) : 0x0247e000 0x0003c000 "\SystemRoot\System32\Drivers\RtsUStor.sys"

    .\debug.cpp(256) : 0x00e89000 0x00055000 "\SystemRoot\system32\DRIVERS\udfs.sys"

    .\debug.cpp(256) : 0x03dee000 0x0000e000 "\SystemRoot\system32\DRIVERS\monitor.sys"

    .\debug.cpp(256) : 0x02cbd000 0x00026000 "\SystemRoot\system32\drivers\mfeapfk.sys"

    .\debug.cpp(256) : 0x03de2000 0x0000b000 "\SystemRoot\system32\DRIVERS\asyncmac.sys"

    .\debug.cpp(256) : 0x02506000 0x0001b000 "\SystemRoot\system32\DRIVERS\USBSTOR.SYS"

    .\debug.cpp(256) : 0x02ce3000 0x0000f000 "\??\C:\Users\Dominic\AppData\Local\Temp\aswMBR.sys"

    .\debug.cpp(256) : 0x77110000 0x001a9000 "\Windows\System32\ntdll.dll"

    .\debug.cpp(256) : 0x47780000 0x00020000 "\Windows\System32\smss.exe"

    .\debug.cpp(256) : 0xff430000 0x00050000 "\Windows\System32\apisetschema.dll"

    .\debug.cpp(256) : 0xff950000 0x000c1000 "\Windows\System32\autochk.exe"

    .\debug.cpp(256) : 0xff380000 0x00099000 "\Windows\System32\clbcatq.dll"

    .\debug.cpp(256) : 0xff300000 0x00080000 "\Windows\System32\difxapi.dll"

    .\debug.cpp(256) : 0xff2b0000 0x0004d000 "\Windows\System32\ws2_32.dll"

    .\debug.cpp(256) : 0xff2a0000 0x00008000 "\Windows\System32\nsi.dll"

    .\debug.cpp(256) : 0xff280000 0x0001f000 "\Windows\System32\sechost.dll"

    .\debug.cpp(256) : 0xff260000 0x00019000 "\Windows\System32\imagehlp.dll"

    .\debug.cpp(256) : 0x77010000 0x000fa000 "\Windows\System32\user32.dll"

    .\debug.cpp(256) : 0x76eb0000 0x0015a000 "\Windows\System32\wininet.dll"

    .\debug.cpp(256) : 0xff150000 0x00109000 "\Windows\System32\msctf.dll"

    .\debug.cpp(256) : 0xff080000 0x000c9000 "\Windows\System32\usp10.dll"

    .\debug.cpp(256) : 0xfefe0000 0x0009f000 "\Windows\System32\msvcrt.dll"

    .\debug.cpp(256) : 0xfef60000 0x00071000 "\Windows\System32\shlwapi.dll"

    .\debug.cpp(256) : 0x76d90000 0x0011f000 "\Windows\System32\kernel32.dll"

    .\debug.cpp(256) : 0x76b80000 0x0020f000 "\Windows\System32\iertutil.dll"

    .\debug.cpp(256) : 0xfef50000 0x0000e000 "\Windows\System32\lpk.dll"

    .\debug.cpp(256) : 0xfeee0000 0x00067000 "\Windows\System32\gdi32.dll"

    .\debug.cpp(256) : 0x772e0000 0x00007000 "\Windows\System32\psapi.dll"

    .\debug.cpp(256) : 0x76a30000 0x0014d000 "\Windows\System32\urlmon.dll"

    .\debug.cpp(256) : 0xfecd0000 0x00203000 "\Windows\System32\ole32.dll"

    .\debug.cpp(256) : 0x772d0000 0x00003000 "\Windows\System32\normaliz.dll"

    .\debug.cpp(256) : 0xfeba0000 0x0012d000 "\Windows\System32\rpcrt4.dll"

    .\debug.cpp(256) : 0xfe9c0000 0x001d7000 "\Windows\System32\setupapi.dll"

    .\debug.cpp(256) : 0xfe990000 0x0002e000 "\Windows\System32\imm32.dll"

    .\debug.cpp(256) : 0xfe930000 0x00052000 "\Windows\System32\Wldap32.dll"

    .\debug.cpp(256) : 0xfe890000 0x00097000 "\Windows\System32\comdlg32.dll"

    .\debug.cpp(256) : 0xfe7b0000 0x000d7000 "\Windows\System32\oleaut32.dll"

    .\debug.cpp(256) : 0xfe6d0000 0x000db000 "\Windows\System32\advapi32.dll"

    .\debug.cpp(256) : 0xfd940000 0x00d88000 "\Windows\System32\shell32.dll"

    .\debug.cpp(256) : 0xfd900000 0x00036000 "\Windows\System32\cfgmgr32.dll"

    .\debug.cpp(256) : 0xfd8e0000 0x0001a000 "\Windows\System32\devobj.dll"

    .\debug.cpp(256) : 0xfd840000 0x000a0000 "\Windows\System32\comctl32.dll"

    .\debug.cpp(256) : 0xfd800000 0x0003a000 "\Windows\System32\wintrust.dll"

    .\debug.cpp(256) : 0xfd790000 0x0006c000 "\Windows\System32\KernelBase.dll"

    .\debug.cpp(256) : 0xfd620000 0x00167000 "\Windows\System32\crypt32.dll"

    .\debug.cpp(256) : 0xfd610000 0x0000f000 "\Windows\System32\msasn1.dll"

    .\debug.cpp(256) : 0x74c30000 0x00003000 "\Windows\SysWOW64\normaliz.dll"

    .\debug.cpp(263) : **********************************************

    .\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] ***********

    .\debug.cpp(308) : **********************************************

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\D:"

    .\debug.cpp(400) : Destination "\Device\HarddiskVolume3"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0"

    .\debug.cpp(400) : Destination "\Device\Harddisk0\DR0"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{091171A3-B0E8-40FE-96B5-1F05B891E26A}"

    .\debug.cpp(400) : Destination "\Device\NDMP5"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0A#0#{72631e54-78a4-11d0-bcf7-00aa00b7b32a}"

    .\debug.cpp(400) : Destination "\Device\00000053"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#WACOMVIRTUALHID&Col03#1&2d595ca7&0&0002#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"

    .\debug.cpp(400) : Destination "\Device\00000070"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY5"

    .\debug.cpp(400) : Destination "\Device\Video4"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) : Destination "\Device\00000043"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VDRVROOT"

    .\debug.cpp(400) : Destination "\Device\0000004e"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_0046&SUBSYS_1439103C&REV_02#3&11583659&0&10#{1ca05180-a699-450a-9a0c-de4fbe3ddd89}"

    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0001"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive1"

    .\debug.cpp(400) : Destination "\Device\Harddisk1\DR8"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{eeab7790-c514-11d1-b42b-00805fc1270e}#asyncmac#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) : Destination "\Device\KSENUM#00000002"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HostProcess-2956c227-3d27-48a7-af35-dcd22fd1a3b4"

    .\debug.cpp(400) : Destination "\Device\HostProcess-2956c227-3d27-48a7-af35-dcd22fd1a3b4"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196}"

    .\debug.cpp(400) : Destination "\Device\0000004c"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#SYN1E2C#4&3637fedb&0#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"

    .\debug.cpp(400) : Destination "\Device\0000006a"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\GEARAspiWDMDevice"

    .\debug.cpp(400) : Destination "\Device\GEARAspiWDMDevice"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1"

    .\debug.cpp(400) : Destination "\Device\Video0"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0270&SUBSYS_103C1439&REV_1001#4&37536f62&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}"

    .\debug.cpp(400) : Destination "\Device\00000072"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive2"

    .\debug.cpp(400) : Destination "\Device\Harddisk2\DR10"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_SSTPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) : Destination "\Device\00000049"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*TEREDO#0000#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) : Destination "\Device\00000005"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WUDFLpcDevice"

    .\debug.cpp(400) : Destination "\Device\WUDFLpcDevice"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\E:"

    .\debug.cpp(400) : Destination "\Device\CdRom0"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_Generic-&Prod_Multi-Card&Rev_1.00#00000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) : Destination "\Device\000000a7"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"

    .\debug.cpp(400) : Destination "\Device\0000004b"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Psched"

    .\debug.cpp(400) : Destination "\Device\Psched"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#{156413f6-1e2e-11e0-badf-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) : Destination "\Device\HarddiskVolume1"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#DiskST9500325AS_____________________________0005HPM1#4&24833bee&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) : Destination "\Device\Ide\IAAStorageDevice-1"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIPV6#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) : Destination "\Device\00000046"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_0BDA&PID_0159#20071114173400000#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"

    .\debug.cpp(400) : Destination "\Device\USBPDO-6"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AscKmd"

    .\debug.cpp(400) : Destination "\Device\AscKmd"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ndisuio"

    .\debug.cpp(400) : Destination "\Device\Ndisuio"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{cf1dda2c-9743-11d0-a3ee-00a0c9223196}"

    .\debug.cpp(400) : Destination "\Device\0000004c"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_3B64&SUBSYS_1439103C&REV_06#3&11583659&0&B0#{e2d1ff34-3458-49a9-88da-8e6915ce9be5}"

    .\debug.cpp(400) : Destination "\Device\NTPNP_PCI0002"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0001#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) : Destination "\Device\00000002"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0"

    .\debug.cpp(400) : Destination "\Device\CdRom0"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0A#0#{e849804e-c719-43d8-ac88-96b894c191e2}"

    .\debug.cpp(400) : Destination "\Device\00000053"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#ThermalZone#TSZ0#{4afa3d51-74a7-11d0-be5e-00a0c9062857}"

    .\debug.cpp(400) : Destination "\Device\0000005c"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{69f4d067-a3f5-11e1-9830-e02a827dae15}"

    .\debug.cpp(400) : Destination "\Device\HarddiskVolume14"

    .\debug.cpp(409) : --
     
  4. Domh1

    Domh1 TS Rookie Topic Starter

    CONTINUED -

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{4053f7b6-ccda-11e0-a451-a7a422a43cbf}"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume12"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{E43D242B-9EAB-4626-A952-46649FBB939A}"

    .\debug.cpp(400) :Destination "\Device\NDMP9"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SYNTP"

    .\debug.cpp(400) :Destination "\Device\SynTP"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMB#UMB#1&841921d&0&PrinterBusEnumerator#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}"

    .\debug.cpp(400) :Destination "\Device\00000088"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0303#4&3637fedb&0#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"

    .\debug.cpp(400) :Destination "\Device\00000069"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0D#2&daba3ff&2#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"

    .\debug.cpp(400) :Destination "\Device\00000055"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\F:"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume14"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000045"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_8086&DEV_2804&SUBSYS_80860101&REV_1000#4&37536f62&0&0301#{9ff3b516-cd99-4eaf-8373-f2caf87ed26b}"

    .\debug.cpp(400) :Destination "\Device\00000073"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AgileVPN"

    .\debug.cpp(400) :Destination "\Device\AgileVPN"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0:"

    .\debug.cpp(400) :Destination "\Device\Ide\iaStor0"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{EC133235-0FB6-4073-BCBD-5F167EEFCAA4}"

    .\debug.cpp(400) :Destination "\Device\NDMP1"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HostProcess-f025e0a5-195a-4e58-9623-debc27ba2eed"

    .\debug.cpp(400) :Destination "\Device\HostProcess-f025e0a5-195a-4e58-9623-debc27ba2eed"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice"

    .\debug.cpp(400) :Destination "\Device\WMIDataDevice"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PEAuth"

    .\debug.cpp(400) :Destination "\Device\PEAuth"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1"

    .\debug.cpp(400) :Destination "\Device\USBFDO-1"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPSECDOSPDevice"

    .\debug.cpp(400) :Destination "\Device\IPSECDOSP"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0270&SUBSYS_103C1439&REV_1001#4&37536f62&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"

    .\debug.cpp(400) :Destination "\Device\00000072"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{bef800ba-cabe-11e0-909c-806e6f6e6963}"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume1"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Harddisk2Partition1"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume14"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY6"

    .\debug.cpp(400) :Destination "\Device\Video5"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_8087&PID_0020#5&375c6185&0&1#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

    .\debug.cpp(400) :Destination "\Device\USBPDO-2"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{bef800bb-cabe-11e0-909c-806e6f6e6963}"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume2"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC"

    .\debug.cpp(400) :Destination "\Device\Mup"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\G:"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume12"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_KINGSTON&PROD_DATATRAVELER_G3&REV_PMAP#001CC0EC3504BBA0970D0228&0##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}"

    .\debug.cpp(400) :Destination "\Device\000000af"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-f4c71055-b355-11e1-8903-e02a827dae15"

    .\debug.cpp(400) :Destination "\Device\UMDFCtrlDev-f4c71055-b355-11e1-8903-e02a827dae15"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\vwififlt"

    .\debug.cpp(400) :Destination "\Device\vwififlt"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP"

    .\debug.cpp(400) :Destination "\Device\NDMP11"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2"

    .\debug.cpp(400) :Destination "\Device\Video1"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{bef800bc-cabe-11e0-909c-806e6f6e6963}"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume3"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ASYNCMAC"

    .\debug.cpp(400) :Destination "\Device\ASYNCMAC"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-f4c71065-b355-11e1-8903-e02a827dae15"

    .\debug.cpp(400) :Destination "\Device\UMDFCtrlDev-f4c71065-b355-11e1-8903-e02a827dae15"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SPDevice"

    .\debug.cpp(400) :Destination "\Device\SPDevice"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp"

    .\debug.cpp(400) :Destination "\Device\Tcp"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Harddisk0Partition1"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume1"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{bef800bd-cabe-11e0-909c-806e6f6e6963}"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume4"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\LCD"

    .\debug.cpp(400) :Destination "\Device\000000a9"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0270&SUBSYS_103C1439&REV_1001#4&37536f62&0&0001#{9ff3b516-cd99-4eaf-8373-f2caf87ed26b}"

    .\debug.cpp(400) :Destination "\Device\00000072"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}"

    .\debug.cpp(400) :Destination "\Device\0000004c"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\RT2860"

    .\debug.cpp(400) :Destination "\Device\RT2860"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Harddisk0Partition2"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume2"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&2#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"

    .\debug.cpp(400) :Destination "\Device\0000005e"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Generic-&Prod_Multi-Card&Rev_1.00#00000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume12"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolume14"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume14"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_AGILEVPNMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000042"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) :Destination "\Device\00000048"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_5986&PID_0149#6&14db8e8&0&3#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"

    .\debug.cpp(400) :Destination "\Device\USBPDO-4"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN"

    .\debug.cpp(400) :Destination "\DosDevices\LPT1"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp"

    .\debug.cpp(400) :Destination "\Device\WANARP"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Harddisk0Partition3"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume3"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-f4c71095-b355-11e1-8903-e02a827dae15"

    .\debug.cpp(400) :Destination "\Device\UMDFCtrlDev-f4c71095-b355-11e1-8903-e02a827dae15"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{6596689C-C4B5-4A2A-ACBA-7D4830E42AF5}"

    .\debug.cpp(400) :Destination "\Device\NDMP3"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{eeab7790-c514-11d1-b42b-00805fc1270e}#asyncmac#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\KSENUM#00000002"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_8087&PID_0020#5&1cd94fb&0&1#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

    .\debug.cpp(400) :Destination "\Device\USBPDO-3"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}"

    .\debug.cpp(400) :Destination "\Device\0000004c"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Harddisk0Partition4"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume4"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\CompositeBattery"

    .\debug.cpp(400) :Destination "\Device\CompositeBattery"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_KINGSTON&PROD_DATATRAVELER_G3&REV_PMAP#001CC0EC3504BBA0970D0228&0##{6ac27878-a6fa-4155-ba85-f98f491d4f33}"

    .\debug.cpp(400) :Destination "\Device\000000af"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{9939AD4B-16C2-49C5-8063-59083F310EF8}"

    .\debug.cpp(400) :Destination "\Device\NDMP2"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"

    .\debug.cpp(400) :Destination "\Device\0000004a"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196}"

    .\debug.cpp(400) :Destination "\Device\0000004c"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager"

    .\debug.cpp(400) :Destination "\Device\MountPointManager"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{8E301A52-AFFA-4F49-B9CA-C79096A1A056}"

    .\debug.cpp(400) :Destination "\Device\NDMP13"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0002#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) : Destination "\Device\00000003"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&3a1d518a&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

    .\debug.cpp(400) :Destination "\Device\USBPDO-1"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#{156413f6-1e2e-11e0-badf-806e6f6e6963}#000000000C800000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume2"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000043"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000001"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) :Destination "\Device\00000047"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#LGD027A#4&2567af4e&0&UID67568640#{e6f07b5f-ee97-4a90-b076-33f57bf4eaa7}"

    .\debug.cpp(400) :Destination "\Device\000000a9"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_148F&PID_1000#6&14db8e8&0&4#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"

    .\debug.cpp(400) :Destination "\Device\USBPDO-5"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&2b909e96&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"

    .\debug.cpp(400) :Destination "\Device\USBPDO-0"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIAdminDevice"

    .\debug.cpp(400) :Destination "\Device\WMIAdminDevice"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{27EA6B1E-CA51-4A04-B9B3-95A3AF50A5F5}"

    .\debug.cpp(400) :Destination "\Device\NDMP4"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*TEREDO#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000005"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\mfehidk"

    .\debug.cpp(400) :Destination "\Device\mfehidk"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#WACOMVIRTUALHID&Col02#1&2d595ca7&0&0001#{4d1e55b2-f16f-11cf-88cb-001111000030}"

    .\debug.cpp(400) :Destination "\Device\0000006f"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) :Destination "\Device\00000045"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANBH#0000#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) :Destination "\Device\00000044"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMB#UMB#1&841921d&0&WpdBusEnumRoot#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}"

    .\debug.cpp(400) :Destination "\Device\0000009a"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global"

    .\debug.cpp(400) :Destination "\GLOBAL??"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MOBKfilter"

    .\debug.cpp(400) :Destination "\FileSystem\Filters\MOBKfilter"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_G3&Rev_PMAP#001CC0EC3504BBA0970D0228&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) :Destination "\Device\000000ae"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_0951&PID_1643#001CC0EC3504BBA0970D0228#{a5dcbf10-6530-11d2-901f-00c04fb951ed}"

    .\debug.cpp(400) :Destination "\Device\USBPDO-7"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0002#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) :Destination "\Device\00000003"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\LOG:"

    .\debug.cpp(400) :Destination "\clfs"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\nativewifip"

    .\debug.cpp(400) :Destination "\Device\nativewifip"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1814&DEV_3090&SUBSYS_1453103C&REV_00#4&18e4f928&0&00E2#{435b6226-1dcc-43b3-887e-217dbaa27ba3}"

    .\debug.cpp(400) :Destination "\Device\NTPNP_PCI0019"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3"

    .\debug.cpp(400) :Destination "\Device\Video2"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg"

    .\debug.cpp(400) :Destination "\FileSystem\Filters\FltMgrMsg"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\aswMBR"

    .\debug.cpp(400) :Destination "\Device\aswMBR"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#WACOMVIRTUALHID&Col04#1&2d595ca7&0&0003#{4d1e55b2-f16f-11cf-88cb-001111000030}"

    .\debug.cpp(400) :Destination "\Device\00000071"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0270&SUBSYS_103C1439&REV_1001#4&37536f62&0&0001#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"

    .\debug.cpp(400) :Destination "\Device\00000072"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#GenuineIntel_-_Intel64_Family_6_Model_37_-_Intel(R)_Core(TM)_i3_CPU_______M_350__@_2.27GHz#_2#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"

    .\debug.cpp(400) :Destination "\Device\00000059"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr"

    .\debug.cpp(400) :Destination "\FileSystem\Filters\FltMgr"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#vdrvroot#0000#{2e34d650-5819-42ca-84ae-d30803bae505}"

    .\debug.cpp(400) :Destination "\Device\0000004e"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT"

    .\debug.cpp(400) :Destination "\Device\MailSlot"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{78032B7E-4968-42D3-9F37-287EA86C0AAA}"

    .\debug.cpp(400) :Destination "\Device\NDMP21"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{E213C5F9-C673-4EFD-9F6F-05BE4470EF7E}"

    .\debug.cpp(400) :Destination "\Device\NDMP7"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#LGD027A#4&2567af4e&0&UID67568640#{866519b5-3f07-4c97-b7df-24c5d8a8ccb8}"

    .\debug.cpp(400) :Destination "\Device\000000a9"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Harddisk1Partition1"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume12"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WwanProt"

    .\debug.cpp(400) :Destination "\Device\WwanProt"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANBH"

    .\debug.cpp(400) :Destination "\Device\NDMP10"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_3B3C&SUBSYS_1439103C&REV_05#3&11583659&0&D0#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"

    .\debug.cpp(400) :Destination "\Device\NTPNP_PCI0003"
     
  5. Domh1

    Domh1 TS Rookie Topic Starter

    CONTINUED -
    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolume1"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume1"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl"

    .\debug.cpp(400) :Destination "\Device\VolMgrControl"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#{156413f6-1e2e-11e0-badf-806e6f6e6963}#000000746A400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume4"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\BthPan"

    .\debug.cpp(400) :Destination "\Device\BthPan"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000047"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_5986&PID_0149&MI_00#7&25898363&0&0000#{6994ad05-93ef-11d0-a3cc-00a0c9223196}"

    .\debug.cpp(400) :Destination "\Device\0000007d"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0270&SUBSYS_103C1439&REV_1001#4&37536f62&0&0001#{dda54a40-1e4c-11d1-a050-405705c10000}"

    .\debug.cpp(400) :Destination "\Device\00000072"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArpV6"

    .\debug.cpp(400) :Destination "\Device\WANARPV6"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy1"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolumeShadowCopy1"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolume2"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume2"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#volmgr#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) :Destination "\Device\0000004f"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VolMgrControl"

    .\debug.cpp(400) :Destination "\Device\VolMgrControl"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Nsi"

    .\debug.cpp(400) :Destination "\Device\Nsi"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MULTI-CARD&REV_1.00#00000##{6bdd1fc6-810f-11d0-bec7-08002be2092f}"

    .\debug.cpp(400) :Destination "\Device\000000a8"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0000#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) :Destination "\Device\00000001"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\BTH#MS_BTHPAN#7&2df67b9b&1&2#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) :Destination "\Device\00000085"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap"

    .\debug.cpp(400) :Destination "\Device\FsWrap"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy2"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolumeShadowCopy2"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolume3"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume3"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomhp_DVDRAM_GT30L_________________________mP04____#4&24833bee&0&0.1.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) :Destination "\Device\Ide\IAAStorageDevice-0"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0001#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000002"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#WACOMVIRTUALHID&Col01#1&2d595ca7&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}"

    .\debug.cpp(400) :Destination "\Device\0000006e"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#GenuineIntel_-_Intel64_Family_6_Model_37_-_Intel(R)_Core(TM)_i3_CPU_______M_350__@_2.27GHz#_1#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"

    .\debug.cpp(400) :Destination "\Device\00000058"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000}"

    .\debug.cpp(400) :Destination "\Device\0000004c"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000}"

    .\debug.cpp(400) :Destination "\Device\0000004c"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolume4"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume4"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C32#2#{629758ee-986e-4d9e-8e47-de27f8ab054d}"

    .\debug.cpp(400) :Destination "\Device\0000006b"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#UMBUS#0000#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}"

    .\debug.cpp(400) :Destination "\Device\0000004d"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Secdrv"

    .\debug.cpp(400) :Destination "\Device\Secdrv"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{bef800ca-cabe-11e0-909c-806e6f6e6963}"

    .\debug.cpp(400) :Destination "\Device\CdRom0"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#{156413f6-1e2e-11e0-badf-806e6f6e6963}#0000007053B00000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume3"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_0046&SUBSYS_1439103C&REV_02#3&11583659&0&10#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}"

    .\debug.cpp(400) :Destination "\Device\NTPNP_PCI0001"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NXTIPSECDevice"

    .\debug.cpp(400) :Destination "\Device\NXTIPSEC"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_3B29&SUBSYS_1439103C&REV_05#3&11583659&0&FA#{2accfe60-c130-11d2-b082-00a0c91efb8b}"

    .\debug.cpp(400) :Destination "\Device\NTPNP_PCI0010"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{DF4A9D2C-8742-4EB1-8703-D395C4183F33}"

    .\debug.cpp(400) :Destination "\Device\NDMP14"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#WACOMVIRTUALHID&Col03#1&2d595ca7&0&0002#{4d1e55b2-f16f-11cf-88cb-001111000030}"

    .\debug.cpp(400) :Destination "\Device\00000070"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1814&DEV_3090&SUBSYS_1453103C&REV_00#4&18e4f928&0&00E2#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) :Destination "\Device\NTPNP_PCI0019"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_0BDA&PID_0159#20071114173400000#{53440e77-835c-4768-bd70-e6e87ac8ae69}"

    .\debug.cpp(400) :Destination "\Device\USBPDO-6"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4"

    .\debug.cpp(400) :Destination "\Device\Video3"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\TeredoTun"

    .\debug.cpp(400) :Destination "\Device\TeredoTun"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SstpDrv"

    .\debug.cpp(400) :Destination "\Device\SstpDrv"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{71F897D7-EB7C-4D8D-89DB-AC80D9DD2270}"

    .\debug.cpp(400) :Destination "\Device\NDMP15"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0003#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) :Destination "\Device\00000004"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HostProcess-39dee3ba-9759-4e2d-83f9-fece3f0b0ee7"

    .\debug.cpp(400) :Destination "\Device\HostProcess-39dee3ba-9759-4e2d-83f9-fece3f0b0ee7"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WFPDev"

    .\debug.cpp(400) :Destination "\Device\WFP"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS"

    .\debug.cpp(400) :Destination "\Device\Ndis"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{14A1D349-B0F6-43F9-A7F1-D7AB5F91224B}"

    .\debug.cpp(400) :Destination "\Device\NDMP16"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000048"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIPV6#0000#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) :Destination "\Device\00000046"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ProcessManagement"

    .\debug.cpp(400) :Destination "\Device\ProcessManagement"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0270&SUBSYS_103C1439&REV_1001#4&37536f62&0&0001#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"

    .\debug.cpp(400) :Destination "\Device\00000072"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0270&SUBSYS_103C1439&REV_1001#4&37536f62&0&0001#{86841137-ed8e-4d97-9975-f2ed56b4430e}"

    .\debug.cpp(400) :Destination "\Device\00000072"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_8086&DEV_2804&SUBSYS_80860101&REV_1000#4&37536f62&0&0301#{86841137-ed8e-4d97-9975-f2ed56b4430e}"

    .\debug.cpp(400) :Destination "\Device\00000073"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WfpAle"

    .\debug.cpp(400) :Destination "\Device\WfpAle"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_148F&PID_1000#6&14db8e8&0&4#{0850302a-b344-4fda-9be9-90576b8d46f0}"

    .\debug.cpp(400) :Destination "\Device\USBPDO-5"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANBH#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000044"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HostProcess-09c42559-2d3c-4bab-a449-c4f879c4ecd0"

    .\debug.cpp(400) :Destination "\Device\HostProcess-09c42559-2d3c-4bab-a449-c4f879c4ecd0"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#GenuineIntel_-_Intel64_Family_6_Model_37_-_Intel(R)_Core(TM)_i3_CPU_______M_350__@_2.27GHz#_4#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"

    .\debug.cpp(400) :Destination "\Device\0000005b"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PartmgrControl"

    .\debug.cpp(400) :Destination "\Device\PartmgrControl"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE"

    .\debug.cpp(400) :Destination "\Device\NamedPipe"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT"

    .\debug.cpp(400) :Destination ""

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_AGILEVPNMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}"

    .\debug.cpp(400) :Destination "\Device\00000042"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MULTI-CARD&REV_1.00#00000##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}"

    .\debug.cpp(400) :Destination "\Device\000000a8"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolume12"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume12"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\C:"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume2"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\0000004c"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_1814&DEV_3090&SUBSYS_1453103C&REV_00#4&18e4f928&0&00E2#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\NTPNP_PCI0019"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\BTH#MS_BTHPAN#7&2df67b9b&1&2#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000085"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_5986&PID_0149&MI_00#7&25898363&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"

    .\debug.cpp(400) :Destination "\Device\0000007d"

    .\debug.cpp(409) : --

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ADVirtualDiskDevice"

    .\debug.cpp(400) :Destination "\Device\ADVirtualDisk\Control"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIPV6"

    .\debug.cpp(400) :Destination "\Device\NDMP12"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX"

    .\debug.cpp(400) :Destination "\DosDevices\COM1"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_G3&Rev_PMAP#001CC0EC3504BBA0970D0228&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) :Destination "\Device\HarddiskVolume14"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WGUARDNT"

    .\debug.cpp(400) :Destination "\Device\mfehidk"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0003#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000004"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL"

    .\debug.cpp(400) :Destination "\Device\Null"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomhp_DVDRAM_GT30L_________________________mP04____#4&24833bee&0&0.1.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"

    .\debug.cpp(400) :Destination "\Device\Ide\IAAStorageDevice-0"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MULTI-CARD&REV_1.00#00000##{6ac27878-a6fa-4155-ba85-f98f491d4f33}"

    .\debug.cpp(400) :Destination "\Device\000000a8"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{75D562C6-D20E-4690-94AD-EFDA289941B4}"

    .\debug.cpp(400) :Destination "\Device\NDMP8"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_3B34&SUBSYS_1439103C&REV_05#3&11583659&0&E8#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"

    .\debug.cpp(400) :Destination "\Device\NTPNP_PCI0007"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&2#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"

    .\debug.cpp(400) :Destination "\Device\00000056"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0"

    .\debug.cpp(400) :Destination "\Device\USBFDO-0"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_SSTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"

    .\debug.cpp(400) :Destination "\Device\00000049"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#GenuineIntel_-_Intel64_Family_6_Model_37_-_Intel(R)_Core(TM)_i3_CPU_______M_350__@_2.27GHz#_3#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"

    .\debug.cpp(400) :Destination "\Device\0000005a"

    .\debug.cpp(409) :--

    .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan"

    .\debug.cpp(400) :Destination "\Device\NdisWan"

    .\debug.cpp(409) :--

    .\debug.cpp(453) : **********************************************

    .\boot_cleaner.cpp(565) : System volume is \\.\C:

    .\boot_cleaner.cpp(600) : \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`0c800000

    .\boot_cleaner.cpp(276) : Boot sector MD5 is: 15b5efcf5647670fbe8bb5771b74ba8e

    .\boot_cleaner.cpp(1061) :

    .\boot_cleaner.cpp(1062) :SizeDevice NameMBR Status

    .\boot_cleaner.cpp(1063) :--------------------------------------------

    .\boot_cleaner.cpp(1107) :465 GB\\.\PhysicalDrive0Unknown boot code

    .\boot_cleaner.cpp(1113) :

    .\boot_cleaner.cpp(1119) : Unknown boot code has been found on some of your physical disks.

    .\boot_cleaner.cpp(1121) : To inspect the boot code manually, dump the master boot sector:

    .\boot_cleaner.cpp(1122) : remover.exe dump< device_name> [output_file]

    .\boot_cleaner.cpp(1126) : To disinfect the master boot sector, use the following command:

    .\boot_cleaner.cpp(1127) : remover.exe fix< device_name>

    .\boot_cleaner.cpp(1130) :

    .\boot_cleaner.cpp(1152) : Done;



    aswMBR log -


    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

    Run date: 2012-06-12 19:42:48

    -----------------------------

    19:42:48.731OS Version: Windows x64 6.1.7601 Service Pack 1

    19:42:48.731Number of processors: 4 586 0x2505

    19:42:48.746ComputerName: DOMINIC-HPUserName: Dominic

    19:42:51.118Initialize success

    19:43:37.432AVAST engine defs: 12061200

    19:43:57.244Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

    19:43:57.244Disk 0 Vendor: ST950032 0005 Size: 476940MB BusType: 3

    19:43:57.416Disk 0 MBR read successfully

    19:43:57.416Disk 0 MBR scan

    19:43:57.431Disk 0 unknown MBR code

    19:43:57.447Disk 0 Partition 1 80 (A) 07HPFS/NTFS NTFS199 MB offset 2048

    19:43:57.463Disk 0 Partition 2 0007HPFS/NTFS NTFS459891 MB offset 409600

    19:43:57.509Disk 0 Partition 3 0007HPFS/NTFS NTFS16745 MB offset 942266368

    19:43:57.541Disk 0 Partition 4 000CFAT32 LBA MSDOS5.0103 MB offset 976560128

    19:43:57.603Disk 0 scanning C:\Windows\system32\drivers

    19:44:15.060Service scanning

    19:44:45.029Modules scanning

    19:44:45.045Disk 0 trace - called modules:

    19:44:45.606ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll

    19:44:45.6221 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800522d790]

    19:44:45.6383 CLASSPNP.SYS[fffff88001dae43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004f53050]

    19:44:47.634AVAST engine scan C:\Windows

    19:44:51.036AVAST engine scan C:\Windows\system32

    19:50:59.003AVAST engine scan C:\Windows\system32\drivers

    19:51:32.715AVAST engine scan C:\Users\Dominic

    20:11:52.546File: C:\Users\Dominic\AppData\Local\oavpicas\wdncsfjj.exe**INFECTED** Win32:Malware-gen

    20:13:08.488File: C:\Users\Dominic\AppData\Local\Temp\ollwuhipsriqxcpl.exe**INFECTED** Win32:Malware-gen

    20:15:51.017File: C:\Users\Dominic\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wdncsfjj.exe**INFECTED** Win32:Malware-gen

    20:23:39.558AVAST engine scan C:\ProgramData

    20:35:33.666Scan finished successfully

    20:37:15.433Disk 0 MBR has been saved successfully to "C:\Users\Dominic\Documents\MBR.dat"

    20:37:15.443The log file has been saved successfully to "C:\Users\Dominic\Documents\aswMBR4.txt"
     
  6. Broni

    Broni Malware Annihilator Posts: 47,066   +256

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
    There are 4 different versions. If one of them won't run then download and try to run the other one.
    Vista and Win7 users need to right click Rkill and choose Run as Administrator
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    * Rkill.com
    * Rkill.scr
    * Rkill.exe
    • Double-click on the Rkill icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.
    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  7. Domh1

    Domh1 TS Rookie Topic Starter

    Hi, I've tried installing Combofix and the installer seems to work, but when the loading bar reaches the end the window disappears and nothing more happens, so I'm assuming the program hasn't installed as I can't find it anywhere. I've tried installing it in Safe Mode with Networking but the same thing happens. Are there any other methods I should try of installing it or should I go straight to trying Rkill? Thanks.
     
  8. Broni

    Broni Malware Annihilator Posts: 47,066   +256

    For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
    For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Enter System Recovery Options.

    To enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.

    To enter System Recovery Options by using Windows installation disc:
    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.

    On the System Recovery Options menu you will get the following options:

      • Startup Repair
        System Restore
        Windows Complete PC Restore
        Windows Memory Diagnostic Tool
        Command Prompt
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
     
  9. Domh1

    Domh1 TS Rookie Topic Starter

    Hi again,

    I've got as far as opening the flash drive in the Notepad window, but I just wanted to check if I should click on the FRST file within it as it won't let me just select the flash drive and click Open? I have tried this, upon which a long section of what looks to me like meaningless text appeared in Notebook, so just thought I'd double check what to do before proceeding.

    Thanks!

    (Also, another popup has appeared which reads Microsoft Windows Malicious Software Removal Tool, which disappears for a while when I click exit but also reappears in minutes.)
     
  10. Broni

    Broni Malware Annihilator Posts: 47,066   +256

    I can't comment without seeing what's there.

    Are you back in Windows?
     
  11. Domh1

    Domh1 TS Rookie Topic Starter

    Hi, I'll try again and can post what comes up - I came back onto Normal Windows Mode to reply on here as I couldn't find an option to access the Internet in Repair Mode. I'll be back!
     
     
  12. Domh1

    Domh1 TS Rookie Topic Starter

    I've tried repeatedly to paste the text that appears, but even after dividing it into 7 separate messages I'm told it's still too long to post. Should I attach it as a file or keep on shortening the messages? Also, my flash drive appears as G: in normal mode but as H: in repair mode, might this be affecting anything? Thanks
     
  13. Broni

    Broni Malware Annihilator Posts: 47,066   +256

    No.

    Go ahead and attach the file.
     
  14. Domh1

    Domh1 TS Rookie Topic Starter

    Now I'm given the message - there was a problem uploading your file/ your file doen't have valid extension (I've tried Text and Word documents). I can try sending it from an uninfected laptop in an hour or so?
     
  15. Broni

    Broni Malware Annihilator Posts: 47,066   +256

    Upload the file(s) here: http://uploadmb.com/
    Copy the link inside the Direct Link box and post it in your next reply.
     
  16. Domh1

    Domh1 TS Rookie Topic Starter

  17. Broni

    Broni Malware Annihilator Posts: 47,066   +256

    You did something wrong.
    It's all gibberish.

    Re-read my instructions and redo.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.