also @ TechSpot: Exploit allows command prompt to launch at Windows 7 login screen

TechSpot
Register now for a live online demo to see how the Office 365 suite of tools
- professional email, calendars, video conferencing, and file sharing -

[Solved] Infected with Guard Online and Google Redirect

Discussion in 'Virus and Malware Removal' started by dshoff115, Oct 11, 2011.

Page 1 of 6

  1. dshoff115 Newcomer, in training

    Hi,

    I have tried to follow steps I have read online regarding removal of the AV Guard Online Malware. I have google redirect issues sending me to SPAM websites. The LAN settings did not have the proxy setting clicked and I tried running TDSS and nothing malicious is found. Once I run Malwarebytes the scan stops after 30 seconds and closes the program. My anti virus program keeps turning off and asking me to fix the status. Once I change the status it will require me to restart my computer. Please help! See below for the DDS log and the attach.txt log. I cannot run GMER because I have 64 bit windows vista so I did not attach the file from GMER as this froze my computer.

    .
    DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK
    Internet Explorer: 8.0.6001.19120
    Run by Home at 20:52:29 on 2011-10-10
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3066.2373 [GMT -4:00]
    .
    AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}
    SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\3951070527:3228729108.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    C:\Windows\winsett.exe
    C:\Windows\system32\winsett.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\Windows\explorer.exe
    C:\Users\Home\AppData\Local\Temp\winsett.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uSearch Page = hxxp://www.google.com
    uStart Page = about:blank
    uSearch Bar = Preserve
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uWindow Title = Internet Explorer provided by Dell
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
    uURLSearchHooks: H - No File
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO: c:\windows\system32\a0xzg.dll: {d3a152c1-a201-90bd-b821-04b53a2c8952} - c:\windows\system32\a0xzg.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    uRun: [Aim6]
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
    uRun: [Windows Auto Config] c:\users\home\appdata\local\temp\winsett.exe
    uRun: [Windows Defragment] c:\windows\winsett.exe
    uRun: [System Cleanup] c:\windows\system32\winsett.exe
    uRun: [Spyware Doctor with AntiVirus] c:\users\home\desktop\sdasetup_revwire207.exe -min
    mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    mRun: [Apoint] c:\program files\delltpad\Apoint.exe
    mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
    mRun: [Dell DataSafe Online] "c:\program files\dell datasafe online\DataSafeOnline.exe" /m
    mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
    mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
    mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
    mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    mRun: [ConnectionCenter] "c:\program files\citrix\ica client\concentr.exe" /startup
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [volmgr] c:\windows\system32\config\systemprofile\appdata\local\volmgr.exe
    mRun: [cftmon] c:\windows\system32\fbjx.exe
    mRun: [MqmPdb] c:\windows\temp\he7qc.exe
    mRun: [MqmPvB] c:\windows\temp\yoof40t.exe
    mRun: [MqmPcc] c:\windows\temp\f0koqen.exe
    mRun: [Windows Auto Config] c:\users\home\appdata\local\temp\winsett.exe
    mRun: [Windows Defragment] c:\windows\winsett.exe
    mRun: [System Cleanup] c:\windows\system32\winsett.exe
    mRun: [ISTray] "c:\program files\pc tools security\pctsGui.exe" /hideGUI
    mRunOnce: [GrpConv] grpconv -o
    mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
    dRun: [MqmPdb] c:\windows\temp\he7qc.exe
    dRun: [MqmPvB] c:\windows\temp\yoof40t.exe
    dRun: [MqmPcc] c:\windows\temp\f0koqen.exe
    StartupFolder: c:\users\home\appdata\roaming\microsoft\windows\start menu\programs\startup\crss.exe
    StartupFolder: c:\users\home\appdata\roaming\micros~1\windows\startm~1\programs\startup\delldo~1.lnk - c:\program files\dell\delldock\DellDock.exe
    uPolicies-explorer: NoFolderOptions = 1 (0x1)
    uPolicies-system: DisableRegistryTools = 1 (0x1)
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
    IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
    LSP: mswsock.dll
    Trusted Zone: microsoft.com\office
    DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk/6u12-b04/jinstall-6u12-windows-i586-jc.cab?e=1235666869495&h=7f0741001e661d1bc55d92bc619b51e0/&filename=jinstall-6u12-windows-i586-jc.cab
    DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://www.cvsphoto.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
    DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: DhcpNameServer = 68.87.74.166 68.87.68.166
    TCP: Interfaces\{74DEFE3F-39CD-4C3C-BA38-21F4073BE24A} : DhcpNameServer = 68.87.74.166 68.87.68.166
    TCP: Interfaces\{AFFA35B4-D23B-40D8-B629-64AA5A8B21DF} : DhcpNameServer = 68.87.74.166 68.87.68.166
    Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\McSnIePl.dll
    Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll
    AppInit_DLLs: c:\progra~1\google\google~3\GOEC62~1.DLL
    STS: c:\windows\system32\a0xzg.dll: {d3a152c1-a201-90bd-b821-04b53a2c8952} - c:\windows\system32\a0xzg.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
    Hosts: 74.55.76.230 www.google-analytics.com.
    Hosts: 74.55.76.230 ad-emea.doubleclick.net.
    Hosts: 74.55.76.230 www.statcounter.com.
    Hosts: 178.250.45.15 www.google-analytics.com.
    Hosts: 178.250.45.15 ad-emea.doubleclick.net.
    .
    Note: multiple HOSTS entries found. Please refer to Attach.txt
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-26 64288]
    R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-12-24 461864]
    R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2011-10-9 239168]
    R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2011-10-9 338880]
    R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2010-8-31 64712]
    R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-8-31 164776]
    R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-8-31 214904]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-8-31 160344]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\common files\mcafee\systemcore\mfevtps.exe [2010-8-31 148520]
    R3 itecir;ITECIR Infrared Receiver;c:\windows\system32\drivers\itecir.sys [2008-12-24 54784]
    R3 k57nd60x;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\k57nd60x.sys [2008-12-24 203264]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-8-31 338040]
    R3 NETw5v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\system32\drivers\NETw5v32.sys [2008-12-24 3663360]
    S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [2010-7-14 65584]
    S2 5016;5016;c:\users\home\appdata\local\temp\5016.sys [2011-10-9 133120]
    S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_f091b975\AEstSrv.exe [2008-12-24 73728]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 DockLoginService;Dock Login Service;c:\program files\dell\delldock\DockLogin.exe [2008-9-24 155648]
    S2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
    S2 gupdate1ca932fbab02360;Google Update Service (gupdate1ca932fbab02360);c:\program files\google\update\GoogleUpdate.exe [2010-1-11 133104]
    S2 inewnetwork;Network Location Awarenes(NLA);c:\windows\system32\svchost.exe -k inetswork [2008-1-20 21504]
    S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
    S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-8-31 214904]
    S2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-8-31 214904]
    S2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-8-31 166024]
    S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\pc tools security\pctsAuxs.exe [2011-10-9 366840]
    S2 sdCoreService;PC Tools Security Service;c:\program files\pc tools security\pctsSvc.exe [2011-10-9 1150936]
    S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-8-31 57432]
    S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-12-24 30192]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-11 133104]
    S3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-12-24 180072]
    S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-12-24 59288]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-8-31 87808]
    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-12-24 34248]
    S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-12-24 40552]
    S3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\drivers\OA001Ufd.sys [2008-12-24 144672]
    S3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\drivers\OA001Vid.sys [2008-12-24 277440]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    .
    =============== Created Last 30 ================
    .
    2011-10-11 00:19:50 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{76beb441-b54f-419c-9377-f1f280ac7587}\offreg.dll
    2011-10-10 03:32:51 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys
    2011-10-10 03:32:51 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys
    2011-10-10 03:32:51 251560 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
    2011-10-10 03:32:51 103232 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys
    2011-10-10 03:32:49 239168 ----a-w- c:\windows\system32\drivers\PCTCore.sys
    2011-10-10 03:32:49 160448 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
    2011-10-10 03:32:47 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys
    2011-10-10 03:32:43 -------- d-----w- c:\users\home\appdata\roaming\PC Tools
    2011-10-10 03:32:43 -------- d-----w- c:\program files\PC Tools Security
    2011-10-10 03:32:43 -------- d-----w- c:\program files\common files\PC Tools
    2011-10-10 03:31:39 -------- d-----w- c:\programdata\PC Tools
    2011-10-10 02:59:46 -------- d-----w- C:\TDSSKiller_Quarantine
    2011-10-10 02:51:50 18944 ---h--w- c:\windows\winsett.exe
    2011-10-10 02:51:50 18944 ---h--w- c:\windows\system32\winsett.exe
    2011-10-09 22:13:17 7680 ----a-w- c:\windows\system\svchost.exe
    2011-10-09 22:12:36 53248 ----a-w- c:\windows\system32\Irmonv32.dll
    2011-10-09 22:11:10 50000 ----a-w- c:\windows\system32\a0xzg.dll
    2011-10-09 22:10:30 440320 ----a-w- c:\windows\system32\fbjx.exe
    2011-10-09 22:10:29 440320 ----a-w- c:\windows\system32\loff.exe
    2011-10-09 22:10:28 440320 ----a-w- c:\windows\system32\bwdzm.exe
    2011-10-09 22:10:26 440320 ----a-w- c:\windows\system32\zvotb.exe
    2011-10-09 22:10:26 440320 ----a-w- c:\windows\system32\xwqfl.exe
    2011-10-09 22:10:24 440320 ----a-w- c:\windows\system32\ocos.exe
    2011-10-09 22:10:04 53248 ----a-w- c:\windows\system32\Iasv32.dll
    2011-10-09 22:10:02 53248 ----a-w- c:\windows\system32\FastUv32.dll
    2011-10-09 22:09:58 220160 ----a-w- c:\windows\system32\inetsw32.dll
    2011-10-09 22:09:55 50000 ----a-w- c:\windows\system32\swudgior.dll
    2011-10-09 22:09:54 50000 ----a-w- c:\windows\system32\y2s015mz.dll
    2011-10-09 19:15:52 -------- d-----w- c:\users\home\appdata\roaming\VkIIVVrlO
    2011-10-09 19:15:51 -------- d-----w- c:\users\home\appdata\roaming\GyyxAAdWjYekVzN
    2011-10-09 19:15:49 -------- d-----w- c:\users\home\appdata\roaming\Y5Q6KTjCeBz2FQ6
    2011-10-09 19:15:47 -------- d-----w- c:\users\home\appdata\roaming\OfffRL99hX
    2011-10-09 18:59:04 -------- d-----w- c:\users\home\appdata\roaming\hmGG55sQJ6dE89X
    2011-10-09 18:58:59 -------- d-----w- c:\users\home\appdata\roaming\eXXXwjjUVelBtPN
    2011-10-09 18:58:59 -------- d-----w- c:\users\home\appdata\roaming\bsQJ7dEEK8RZ9Yj
    2011-10-09 18:58:58 -------- d-----w- c:\users\home\appdata\roaming\b55ssQJ77EK8gZh
    2011-10-09 18:54:27 3042304 ----a-w- c:\windows\system32\ONt0ucS2iDp4Q6W.exe
    2011-10-09 18:51:30 -------- d-----w- c:\programdata\WSTB
    2011-10-09 18:51:14 3042304 ----a-w- c:\windows\system32\FELL88gTZ.exe
    2011-10-09 18:32:16 -------- d-----w- c:\users\home\appdata\roaming\tGGG4aaQH6sK7EL
    2011-10-09 18:32:15 -------- d-----w- c:\users\home\appdata\roaming\A000uccS2ib3
    2011-10-09 18:32:07 69120 ----a-w- c:\users\home\appdata\roaming\microsoft\windows\start menu\programs\startup\crss.exe
    2011-10-09 18:32:06 -------- d-----w- c:\users\home\appdata\roaming\d777fEEL8gTqhCw
    2011-10-09 18:32:06 -------- d-----w- c:\users\home\appdata\roaming\BPP00yccS1iD3nF
    2011-10-07 11:49:42 7269712 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{76beb441-b54f-419c-9377-f1f280ac7587}\mpengine.dll
    2011-09-15 23:55:55 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
    .
    ==================== Find3M ====================
    .
    2011-10-11 00:35:43 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-08-31 21:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-08-15 14:00:06 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
    2011-08-15 14:00:06 87808 ----a-w- c:\windows\system32\drivers\mferkdet.sys
    2011-08-15 14:00:06 64712 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
    2011-08-15 14:00:06 59288 ----a-w- c:\windows\system32\drivers\mfebopk.sys
    2011-08-15 14:00:06 57432 ----a-w- c:\windows\system32\drivers\cfwids.sys
    2011-08-15 14:00:06 461864 ----a-w- c:\windows\system32\drivers\mfehidk.sys
    2011-08-15 14:00:06 338040 ----a-w- c:\windows\system32\drivers\mfefirek.sys
    2011-08-15 14:00:06 180072 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
    2011-08-15 14:00:06 164776 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
    2011-08-15 14:00:06 119808 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
    2011-07-23 11:04:29 916480 ----a-w- c:\windows\system32\wininet.dll
    2011-07-23 11:00:05 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-07-23 10:59:52 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-07-23 10:59:34 71680 ----a-w- c:\windows\system32\iesetup.dll
    2011-07-23 10:59:34 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2011-07-23 10:03:47 385024 ----a-w- c:\windows\system32\html.iec
    2011-07-23 09:27:04 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2011-07-23 09:25:38 1638912 ----a-w- c:\windows\system32\mshtml.tlb
    2011-07-23 00:05:28 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    .
    ============= FINISH: 20:54:36.08 ===============
    dshoff115, Oct 11, 2011
    #1

  2. dshoff115 Newcomer, in training

    Attach file

    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft® Windows Vista™ Home Premium
    Boot Device: \Device\HarddiskVolume3
    Install Date: 12/24/2008 9:23:13 AM
    System Uptime: 10/10/2011 8:18:12 PM (0 hours ago)
    .
    Motherboard: Dell Inc. | | 0P132H
    Processor: Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz | U2E1 | 2261/1066mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 288 GiB total, 190.558 GiB free.
    D: is FIXED (NTFS) - 10 GiB total, 4.456 GiB free.
    E: is CDROM ()
    F: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4d36e97d-e325-11ce-bfc1-08002be10318}
    Description: Consumer IR Devices
    Device ID: ROOT\SYSTEM\0001
    Manufacturer: Microsoft
    Name: Consumer IR Devices
    PNP Device ID: ROOT\SYSTEM\0001
    Service: circlass
    .
    ==== System Restore Points ===================
    .
    .
    ==== Hosts File Hijack ======================
    .
    Hosts: 74.55.76.230 www.google-analytics.com.
    Hosts: 74.55.76.230 ad-emea.doubleclick.net.
    Hosts: 74.55.76.230 www.statcounter.com.
    Hosts: 178.250.45.15 www.google-analytics.com.
    Hosts: 178.250.45.15 ad-emea.doubleclick.net.
    Hosts: 178.250.45.15 www.statcounter.com.
    .
    ==== Installed Programs ======================
    .
    Update for Microsoft Office 2007 (KB2508958)
    AAC Decoder
    Acrobat.com
    Ad-Aware
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Reader 9.4.6
    Advanced Audio FX Engine
    AIM 6
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ATI Catalyst Control Center
    AutoUpdate
    AVS Update Manager 1.0
    AVS Video Converter 6
    AVS4YOU Software Navigator 1.3
    Bonjour
    Browser Address Error Redirector
    Canon Camera Window DC_DV 6 for ZoomBrowser EX
    Canon Camera Window MC 6 for ZoomBrowser EX
    Canon G.726 WMP-Decoder
    Canon MovieEdit Task for ZoomBrowser EX
    Canon RAW Image Task for ZoomBrowser EX
    Canon RemoteCapture Task for ZoomBrowser EX
    Canon Utilities PhotoStitch
    Canon Utilities ZoomBrowser EX
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization Chinese Standard
    Catalyst Control Center Localization Chinese Traditional
    Catalyst Control Center Localization Danish
    Catalyst Control Center Localization Dutch
    Catalyst Control Center Localization Finnish
    Catalyst Control Center Localization French
    Catalyst Control Center Localization German
    Catalyst Control Center Localization Italian
    Catalyst Control Center Localization Japanese
    Catalyst Control Center Localization Korean
    Catalyst Control Center Localization Norwegian
    Catalyst Control Center Localization Portuguese
    Catalyst Control Center Localization Russian
    Catalyst Control Center Localization Spanish
    Catalyst Control Center Localization Swedish
    ccc-core-static
    ccc-utility
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCScore
    Citrix online plug-in - web
    Citrix online plug-in (DV)
    Citrix online plug-in (HDX)
    Citrix online plug-in (USB)
    Citrix online plug-in (Web)
    Compatibility Pack for the 2007 Office system
    Dell-eBay
    Dell DataSafe Online
    Dell Dock
    Dell Getting Started Guide
    Dell Support Center (Support Software)
    Dell Touchpad
    Dell Video Chat (remove only)
    Dell Webcam Central
    DerivaGem 1.53
    DivX Codec
    DivX Converter
    DivX Player
    DivX Plus DirectShow Filters
    DivX Version Checker
    DivX Web Player
    EDocs
    EPSON Logiciel imprimante
    ESSCDBK
    ESScore
    ESSgui
    ESSini
    ESSPCD
    ESSSONIC
    ESSTOOLS
    essvatgt
    getPlus(R) for Adobe
    Google Chrome
    Google Desktop
    Google Toolbar for Internet Explorer
    Google Update Helper
    GoToAssist 8.0.0.514
    H.264 Decoder
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Integrated Webcam Driver (1.03.02.0919)
    ITECIR Driver
    iTunes
    Java(TM) 6 Update 12
    Java(TM) 6 Update 7
    K-Lite Codec Pack 4.9.5 (Basic)
    kgcbaby
    kgcbase
    kgchday
    kgchlwn
    kgcinvt
    kgckids
    kgcmove
    kgcvday
    Kodak EasyShare software
    KSU
    Live! Cam Avatar Creator
    Malwarebytes' Anti-Malware version 1.51.2.1300
    McAfee SecurityCenter
    MediaDirect
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Office Word Viewer 2003
    Microsoft Silverlight
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works
    MKV Splitter
    MobileMe Control Panel
    Move Media Player
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    netbrdg
    Notifier
    OfotoXMI
    OGA Notifier 2.0.0048.0
    PCDADDIN
    PCDHELP
    QualXServ Service Agreement
    QuickSet
    QuickTime
    RealPlayer
    RealProducer Basic 10
    RealProducer Basic 11
    Roxio Creator Audio
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator DE
    Roxio Creator Tools
    Roxio Express Labeler 3
    Roxio Update Manager
    SecondLife (remove only)
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2288931)
    Security Update for 2007 Microsoft Office System (KB2345043)
    Security Update for 2007 Microsoft Office System (KB2553074)
    Security Update for 2007 Microsoft Office System (KB2553089)
    Security Update for 2007 Microsoft Office System (KB2553090)
    Security Update for 2007 Microsoft Office System (KB2584063)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft Office Access 2007 (KB979440)
    Security Update for Microsoft Office Excel 2007 (KB2553073)
    Security Update for Microsoft Office Groove 2007 (KB2552997)
    Security Update for Microsoft Office InfoPath 2007 (KB2510061)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
    Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
    Security Update for Microsoft Office Publisher 2007 (KB2284697)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    SFR
    SHASTA
    SKIN0001
    Skins
    SKINXSDK
    Skype web features
    Skype™ 4.1
    Spelling Dictionaries Support For Adobe Reader 9
    Spyware Doctor with AntiVirus 8.0
    staticcr
    tooltips
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office 2007 System (KB2539530)
    Update for Microsoft Office Access 2007 Help (KB963663)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office Infopath 2007 Help (KB963662)
    Update for Microsoft Office OneNote 2007 (KB980729)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Outlook 2007 (KB2583910)
    Update for Microsoft Office Outlook 2007 Help (KB963677)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Publisher 2007 Help (KB963667)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    Update for Outlook 2007 Junk Email Filter (KB2553110)
    VC80CRTRedist - 8.0.50727.762
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    VPRINTOL
    Windows Essentials Media Codec Pack 2.3d
    WinRAR archiver
    WIRELESS
    Yahoo! Messenger
    .
    ==== End Of File ===========================
    dshoff115, Oct 11, 2011
    #2

  3. Broni Malware Annihilator

    Welcome aboard [IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =====================================================================

    Please download DummyCreator.zip and unzip it.

    • Run the tool.
    • Copy and paste the following into the edit box:
    C:\Windows\3951070527
    • Press Create button and post the content of the Result.txt.
    Important: Restart the computer.

    ==================================================================

    Download TDSSKiller and save it to your desktop.
    • Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
    Broni, Oct 11, 2011
    #3

  4. dshoff115 Newcomer, in training

    Hi Broni!

    Thanks for your help. Here are the results. Let me know if I did this right.

    DummyCreator by Farbar
    Ran by Home (administrator) on 11-10-2011 at 22:51:38
    **************************************************************

    C:\Windows\3951070527 [11-10-2011 22:51:06]

    == End of log ==
    dshoff115, Oct 11, 2011
    #4

  5. dshoff115 Newcomer, in training

    TDSS Killer

    Here is the log for the TDSS Killer. Nothing was cured and no reboot was required.

    22:58:26.0552 1428 TDSS rootkit removing tool 2.6.7.0 Oct 10 2011 09:40:06
    22:58:27.0270 1428 ============================================================
    22:58:27.0270 1428 Current date / time: 2011/10/11 22:58:27.0270
    22:58:27.0270 1428 SystemInfo:
    22:58:27.0270 1428
    22:58:27.0270 1428 OS Version: 6.0.6002 ServicePack: 2.0
    22:58:27.0270 1428 Product type: Workstation
    22:58:27.0270 1428 ComputerName: HOME-PC
    22:58:27.0270 1428 UserName: Home
    22:58:27.0270 1428 Windows directory: C:\Windows
    22:58:27.0270 1428 System windows directory: C:\Windows
    22:58:27.0270 1428 Processor architecture: Intel x86
    22:58:27.0270 1428 Number of processors: 2
    22:58:27.0270 1428 Page size: 0x1000
    22:58:27.0270 1428 Boot type: Safe boot with network
    22:58:27.0270 1428 ============================================================
    22:58:28.0440 1428 Initialize success
    22:58:30.0717 0932 ============================================================
    22:58:30.0717 0932 Scan started
    22:58:30.0717 0932 Mode: Manual;
    22:58:30.0717 0932 ============================================================
    22:58:31.0841 0932 3f8d80eb - ok
    22:58:31.0997 0932 5016 (cf236c71c0106a9dc6ff9f51b0151307) C:\Users\Home\AppData\Local\Temp\5016.sys
    22:58:31.0997 0932 5016 - ok
    22:58:32.0137 0932 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
    22:58:32.0137 0932 ACPI - ok
    22:58:32.0231 0932 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
    22:58:32.0246 0932 adp94xx - ok
    22:58:32.0324 0932 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
    22:58:32.0324 0932 adpahci - ok
    22:58:32.0449 0932 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
    22:58:32.0449 0932 adpu160m - ok
    22:58:32.0480 0932 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
    22:58:32.0480 0932 adpu320 - ok
    22:58:32.0667 0932 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
    22:58:32.0667 0932 AFD - ok
    22:58:32.0777 0932 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
    22:58:32.0777 0932 agp440 - ok
    22:58:32.0839 0932 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
    22:58:32.0855 0932 aic78xx - ok
    22:58:32.0964 0932 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
    22:58:32.0964 0932 aliide - ok
    22:58:32.0979 0932 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
    22:58:32.0995 0932 amdagp - ok
    22:58:33.0011 0932 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
    22:58:33.0011 0932 amdide - ok
    22:58:33.0135 0932 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
    22:58:33.0135 0932 AmdK7 - ok
    22:58:33.0167 0932 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
    22:58:33.0167 0932 AmdK8 - ok
    22:58:33.0198 0932 ApfiltrService (1de27858a431a5749e0f3df54ba935b9) C:\Windows\system32\DRIVERS\Apfiltr.sys
    22:58:33.0198 0932 ApfiltrService - ok
    22:58:33.0338 0932 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
    22:58:33.0338 0932 arc - ok
    22:58:33.0401 0932 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
    22:58:33.0401 0932 arcsas - ok
    22:58:33.0525 0932 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
    22:58:33.0525 0932 AsyncMac - ok
    22:58:33.0588 0932 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
    22:58:33.0588 0932 atapi - ok
    22:58:33.0791 0932 atikmdag (47dcf5d78c395159d72c65c25129fc44) C:\Windows\system32\DRIVERS\atikmdag.sys
    22:58:33.0915 0932 atikmdag - ok
    22:58:34.0040 0932 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
    22:58:34.0040 0932 Beep - ok
    22:58:34.0071 0932 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
    22:58:34.0071 0932 blbdrive - ok
    22:58:34.0212 0932 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
    22:58:34.0227 0932 bowser - ok
    22:58:34.0274 0932 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
    22:58:34.0274 0932 BrFiltLo - ok
    22:58:34.0383 0932 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
    22:58:34.0383 0932 BrFiltUp - ok
    22:58:34.0446 0932 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
    22:58:34.0446 0932 Brserid - ok
    22:58:34.0477 0932 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
    22:58:34.0477 0932 BrSerWdm - ok
    22:58:34.0586 0932 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
    22:58:34.0586 0932 BrUsbMdm - ok
    22:58:34.0602 0932 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
    22:58:34.0602 0932 BrUsbSer - ok
    22:58:34.0649 0932 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
    22:58:34.0649 0932 BTHMODEM - ok
    22:58:34.0758 0932 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
    22:58:34.0758 0932 cdfs - ok
    22:58:34.0820 0932 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
    22:58:34.0820 0932 cdrom - ok
    22:58:34.0976 0932 cfwids (142e4e00ad91600a2d20692ed52fafc8) C:\Windows\system32\drivers\cfwids.sys
    22:58:34.0976 0932 cfwids - ok
    22:58:35.0054 0932 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys
    22:58:35.0054 0932 circlass - ok
    22:58:35.0101 0932 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
    22:58:35.0101 0932 CLFS - ok
    22:58:35.0241 0932 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
    22:58:35.0241 0932 CmBatt - ok
    22:58:35.0273 0932 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
    22:58:35.0273 0932 cmdide - ok
    22:58:35.0304 0932 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
    22:58:35.0304 0932 Compbatt - ok
    22:58:35.0413 0932 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
    22:58:35.0413 0932 crcdisk - ok
    22:58:35.0460 0932 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
    22:58:35.0460 0932 Crusoe - ok
    22:58:35.0553 0932 ctxusbm (cb6ff7012bb5d59d7c12350db795ce1f) C:\Windows\system32\DRIVERS\ctxusbm.sys
    22:58:35.0553 0932 ctxusbm - ok
    22:58:35.0663 0932 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
    22:58:35.0678 0932 DfsC - ok
    22:58:35.0850 0932 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
    22:58:35.0850 0932 disk - ok
    22:58:35.0912 0932 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
    22:58:35.0912 0932 drmkaud - ok
    22:58:35.0990 0932 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
    22:58:35.0990 0932 DXGKrnl - ok
    22:58:36.0131 0932 e1express (908ed85b7806e8af3af5e9b74f7809d4) C:\Windows\system32\DRIVERS\e1e6032.sys
    22:58:36.0146 0932 e1express - ok
    22:58:36.0193 0932 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
    22:58:36.0193 0932 E1G60 - ok
    22:58:36.0349 0932 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
    22:58:36.0349 0932 Ecache - ok
    22:58:36.0427 0932 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
    22:58:36.0443 0932 elxstor - ok
    22:58:36.0552 0932 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
    22:58:36.0552 0932 ErrDev - ok
    22:58:36.0661 0932 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
    22:58:36.0661 0932 exfat - ok
    22:58:36.0801 0932 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
    22:58:36.0801 0932 fastfat - ok
    22:58:36.0864 0932 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
    22:58:36.0879 0932 fdc - ok
    22:58:37.0004 0932 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
    22:58:37.0004 0932 FileInfo - ok
    22:58:37.0035 0932 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
    22:58:37.0035 0932 Filetrace - ok
    22:58:37.0051 0932 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
    22:58:37.0067 0932 flpydisk - ok
    22:58:37.0176 0932 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
    22:58:37.0176 0932 FltMgr - ok
    22:58:37.0269 0932 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
    22:58:37.0285 0932 Fs_Rec - ok
    22:58:37.0332 0932 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
    22:58:37.0332 0932 gagp30kx - ok
    22:58:37.0394 0932 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
    22:58:37.0394 0932 GEARAspiWDM - ok
    22:58:37.0613 0932 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys
    22:58:37.0628 0932 HdAudAddService - ok
    22:58:37.0706 0932 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
    22:58:37.0706 0932 HDAudBus - ok
    22:58:37.0831 0932 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
    22:58:37.0831 0932 HidBth - ok
    22:58:37.0878 0932 HidIr (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys
    22:58:37.0878 0932 HidIr - ok
    22:58:38.0018 0932 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
    22:58:38.0018 0932 HidUsb - ok
    22:58:38.0065 0932 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
    22:58:38.0065 0932 HpCISSs - ok
    22:58:38.0143 0932 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
    22:58:38.0143 0932 HTTP - ok
    22:58:38.0252 0932 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
    22:58:38.0252 0932 i2omp - ok
    22:58:38.0299 0932 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
    22:58:38.0299 0932 i8042prt - ok
    22:58:38.0424 0932 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
    22:58:38.0424 0932 iaStorV - ok
    22:58:38.0455 0932 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
    22:58:38.0455 0932 iirsp - ok
    22:58:38.0595 0932 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
    22:58:38.0595 0932 intelide - ok
    22:58:38.0642 0932 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
    22:58:38.0642 0932 intelppm - ok
    22:58:38.0767 0932 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
    22:58:38.0767 0932 IpFilterDriver - ok
    22:58:38.0783 0932 IpInIp - ok
    22:58:38.0814 0932 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
    22:58:38.0829 0932 IPMIDRV - ok
    22:58:38.0861 0932 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
    22:58:38.0861 0932 IPNAT - ok
    22:58:38.0970 0932 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
    22:58:38.0970 0932 IRENUM - ok
    22:58:39.0001 0932 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
    22:58:39.0001 0932 isapnp - ok
    22:58:39.0063 0932 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
    22:58:39.0063 0932 iScsiPrt - ok
    22:58:39.0173 0932 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
    22:58:39.0173 0932 iteatapi - ok
    22:58:39.0219 0932 itecir (8bcd857c7932ad005d5f9c89329da2e1) C:\Windows\system32\DRIVERS\itecir.sys
    22:58:39.0219 0932 itecir - ok
    22:58:39.0251 0932 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
    22:58:39.0251 0932 iteraid - ok
    22:58:39.0391 0932 k57nd60x (a67e8cfcad7d4f8b35643d6c79ba64c3) C:\Windows\system32\DRIVERS\k57nd60x.sys
    22:58:39.0391 0932 k57nd60x - ok
    22:58:39.0438 0932 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
    22:58:39.0438 0932 kbdclass - ok
    22:58:39.0516 0932 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
    22:58:39.0516 0932 kbdhid - ok
    22:58:39.0656 0932 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
    22:58:39.0672 0932 KSecDD - ok
    22:58:39.0812 0932 Lbd (713cd5267abfb86fe90a72e384e82a38) C:\Windows\system32\DRIVERS\Lbd.sys
    22:58:39.0812 0932 Lbd - ok
    22:58:39.0875 0932 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
    22:58:39.0875 0932 lltdio - ok
    22:58:39.0906 0932 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
    22:58:39.0906 0932 LSI_FC - ok
    22:58:40.0031 0932 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
    22:58:40.0031 0932 LSI_SAS - ok
    22:58:40.0062 0932 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
    22:58:40.0062 0932 LSI_SCSI - ok
    22:58:40.0093 0932 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
    22:58:40.0093 0932 luafv - ok
    22:58:40.0265 0932 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
    22:58:40.0265 0932 megasas - ok
    22:58:40.0311 0932 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
    22:58:40.0311 0932 MegaSR - ok
    22:58:40.0452 0932 mfeapfk (c373a719d704d12f5a4503f6f10239ff) C:\Windows\system32\drivers\mfeapfk.sys
    22:58:40.0452 0932 mfeapfk - ok
    22:58:40.0499 0932 mfeavfk (851ad52871b62457152a8acaff0c632d) C:\Windows\system32\drivers\mfeavfk.sys
    22:58:40.0499 0932 mfeavfk - ok
    22:58:40.0561 0932 mfebopk (5b9ffb027669a8ac30aac0b4996bc603) C:\Windows\system32\drivers\mfebopk.sys
    22:58:40.0561 0932 mfebopk - ok
    22:58:40.0670 0932 mfefirek (2cabe72e53365834cb9969dde47bd690) C:\Windows\system32\drivers\mfefirek.sys
    22:58:40.0686 0932 mfefirek - ok
    22:58:40.0779 0932 mfehidk (46db8f041e928bdc17b8daba249a2148) C:\Windows\system32\drivers\mfehidk.sys
    22:58:40.0795 0932 mfehidk - ok
    22:58:40.0904 0932 mfenlfk (3f9c3147c904fb4377ede0d9df06c789) C:\Windows\system32\DRIVERS\mfenlfk.sys
    22:58:40.0904 0932 mfenlfk - ok
    22:58:40.0967 0932 mferkdet (316fd7c31cd57ca793fb10912aeeb2d2) C:\Windows\system32\drivers\mferkdet.sys
    22:58:40.0967 0932 mferkdet - ok
    22:58:41.0013 0932 mferkdk (41fe2f288e05a6c8ab85dd56770ffbad) C:\Windows\system32\drivers\mferkdk.sys
    22:58:41.0013 0932 mferkdk - ok
    22:58:41.0138 0932 mfesmfk (096b52ea918aa909ba5903d79e129005) C:\Windows\system32\drivers\mfesmfk.sys
    22:58:41.0138 0932 mfesmfk - ok
    22:58:41.0216 0932 mfewfpk (991069f1e220842c5f9742f6ec4b40a8) C:\Windows\system32\drivers\mfewfpk.sys
    22:58:41.0216 0932 mfewfpk - ok
    22:58:41.0310 0932 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
    22:58:41.0310 0932 Modem - ok
    22:58:41.0372 0932 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
    22:58:41.0372 0932 monitor - ok
    22:58:41.0403 0932 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
    22:58:41.0403 0932 mouclass - ok
    22:58:41.0450 0932 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
    22:58:41.0450 0932 mouhid - ok
    22:58:41.0544 0932 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
    22:58:41.0544 0932 MountMgr - ok
    22:58:41.0575 0932 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
    22:58:41.0591 0932 mpio - ok
    22:58:41.0606 0932 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
    22:58:41.0606 0932 mpsdrv - ok
    22:58:41.0700 0932 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
    22:58:41.0700 0932 Mraid35x - ok
    22:58:41.0778 0932 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
    22:58:41.0778 0932 MRxDAV - ok
    22:58:41.0825 0932 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
    22:58:41.0825 0932 mrxsmb - ok
    22:58:41.0918 0932 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
    22:58:41.0918 0932 mrxsmb10 - ok
    22:58:41.0965 0932 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
    22:58:41.0965 0932 mrxsmb20 - ok
    22:58:42.0074 0932 msahci (5457dcfa7c0da43522f4d9d4049c1472) C:\Windows\system32\drivers\msahci.sys
    22:58:42.0074 0932 msahci - ok
    22:58:42.0121 0932 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
    22:58:42.0121 0932 msdsm - ok
    22:58:42.0137 0932 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
    22:58:42.0152 0932 Msfs - ok
    22:58:42.0183 0932 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
    22:58:42.0183 0932 msisadrv - ok
    22:58:42.0277 0932 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
    22:58:42.0277 0932 MSKSSRV - ok
    22:58:42.0324 0932 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
    22:58:42.0324 0932 MSPCLOCK - ok
    22:58:42.0339 0932 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
    22:58:42.0339 0932 MSPQM - ok
    22:58:42.0417 0932 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
    22:58:42.0417 0932 MsRPC - ok
    22:58:42.0511 0932 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
    22:58:42.0511 0932 mssmbios - ok
    22:58:42.0589 0932 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
    22:58:42.0589 0932 MSTEE - ok
    22:58:42.0667 0932 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
    22:58:42.0667 0932 Mup - ok
    22:58:42.0792 0932 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
    22:58:42.0792 0932 NativeWifiP - ok
    22:58:42.0870 0932 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
    22:58:42.0885 0932 NDIS - ok
    22:58:42.0963 0932 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
    22:58:42.0963 0932 NdisTapi - ok
    22:58:43.0026 0932 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
    22:58:43.0026 0932 Ndisuio - ok
    22:58:43.0104 0932 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
    22:58:43.0104 0932 NdisWan - ok
    22:58:43.0197 0932 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
    22:58:43.0197 0932 NDProxy - ok
    22:58:43.0213 0932 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
    22:58:43.0213 0932 NetBIOS - ok
    22:58:43.0275 0932 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
    22:58:43.0275 0932 netbt - ok
    22:58:43.0463 0932 NETw5v32 (0b214c6a4728f085fb64a29ed9c4de94) C:\Windows\system32\DRIVERS\NETw5v32.sys
    22:58:43.0541 0932 NETw5v32 - ok
    22:58:43.0650 0932 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
    22:58:43.0650 0932 nfrd960 - ok
    22:58:43.0728 0932 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
    22:58:43.0728 0932 Npfs - ok
    22:58:43.0775 0932 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
    22:58:43.0775 0932 nsiproxy - ok
    22:58:43.0868 0932 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
    22:58:43.0884 0932 Ntfs - ok
    22:58:44.0009 0932 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
    22:58:44.0009 0932 ntrigdigi - ok
    22:58:44.0087 0932 NuidFltr (cf7e041663119e09d2e118521ada9300) C:\Windows\system32\DRIVERS\NuidFltr.sys
    22:58:44.0087 0932 NuidFltr - ok
    22:58:44.0118 0932 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
    22:58:44.0118 0932 Null - ok
    22:58:44.0243 0932 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
    22:58:44.0243 0932 nvraid - ok
    22:58:44.0274 0932 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
    22:58:44.0274 0932 nvstor - ok
    22:58:44.0305 0932 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
    22:58:44.0305 0932 nv_agp - ok
    22:58:44.0399 0932 NwlnkFlt - ok
    22:58:44.0399 0932 NwlnkFwd - ok
    22:58:44.0477 0932 OA001Ufd (a015dd2ba6009c8bdd00a6c431302d06) C:\Windows\system32\DRIVERS\OA001Ufd.sys
    22:58:44.0477 0932 OA001Ufd - ok
    22:58:44.0523 0932 OA001Vid (438ffcb55b8ce39b0bc71afc0a059835) C:\Windows\system32\DRIVERS\OA001Vid.sys
    22:58:44.0523 0932 OA001Vid - ok
    22:58:44.0664 0932 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
    22:58:44.0664 0932 ohci1394 - ok
    22:58:44.0726 0932 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
    22:58:44.0726 0932 Parport - ok
    22:58:44.0789 0932 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
    22:58:44.0789 0932 partmgr - ok
    22:58:44.0898 0932 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
    22:58:44.0898 0932 Parvdm - ok
    22:58:44.0960 0932 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
    22:58:44.0960 0932 pci - ok
    22:58:44.0991 0932 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
    22:58:44.0991 0932 pciide - ok
    22:58:45.0101 0932 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
    22:58:45.0116 0932 pcmcia - ok
    22:58:45.0179 0932 PCTCore (995e6bc3bb92bb4a9eb49a663c43b6cb) C:\Windows\system32\drivers\PCTCore.sys
    22:58:45.0179 0932 PCTCore - ok
    22:58:45.0319 0932 pctDS (f820b4c61d1e591325b679d479d4eea4) C:\Windows\system32\drivers\pctDS.sys
    22:58:45.0319 0932 pctDS - ok
    22:58:45.0444 0932 pctEFA (acc8c15f3d59f17c5d903ff1de3b43d3) C:\Windows\system32\drivers\pctEFA.sys
    22:58:45.0475 0932 pctEFA - ok
    22:58:45.0600 0932 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
    22:58:45.0615 0932 PEAUTH - ok
    22:58:45.0740 0932 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
    22:58:45.0740 0932 PptpMiniport - ok
    22:58:45.0771 0932 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
    22:58:45.0771 0932 Processor - ok
    22:58:45.0849 0932 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
    22:58:45.0849 0932 PSched - ok
    22:58:45.0974 0932 PxHelp20 (03e0fe281823ba64b3782f5b38950e73) C:\Windows\system32\Drivers\PxHelp20.sys
    22:58:45.0974 0932 PxHelp20 - ok
    22:58:46.0068 0932 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
    22:58:46.0083 0932 ql2300 - ok
    22:58:46.0208 0932 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
    22:58:46.0224 0932 ql40xx - ok
    22:58:46.0239 0932 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
    22:58:46.0239 0932 QWAVEdrv - ok
    22:58:46.0411 0932 R300 (47dcf5d78c395159d72c65c25129fc44) C:\Windows\system32\DRIVERS\atikmdag.sys
    22:58:46.0427 0932 R300 - ok
    22:58:46.0551 0932 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
    22:58:46.0551 0932 RasAcd - ok
    22:58:46.0583 0932 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
    22:58:46.0583 0932 Rasl2tp - ok
    22:58:46.0645 0932 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
    22:58:46.0645 0932 RasPppoe - ok
    22:58:46.0770 0932 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
    22:58:46.0770 0932 RasSstp - ok
    22:58:46.0832 0932 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
    22:58:46.0832 0932 rdbss - ok
    22:58:46.0863 0932 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
    22:58:46.0863 0932 RDPCDD - ok
    22:58:46.0988 0932 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
    22:58:47.0004 0932 rdpdr - ok
    22:58:47.0019 0932 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
    22:58:47.0019 0932 RDPENCDD - ok
    22:58:47.0160 0932 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
    22:58:47.0175 0932 RDPWD - ok
    22:58:47.0222 0932 rimmptsk (c2ef513bbe069f0d4ee0938a76f975d3) C:\Windows\system32\DRIVERS\rimmptsk.sys
    22:58:47.0222 0932 rimmptsk - ok
    22:58:47.0253 0932 rimsptsk (c398bca91216755b098679a8da8a2300) C:\Windows\system32\DRIVERS\rimsptsk.sys
    22:58:47.0253 0932 rimsptsk - ok
    22:58:47.0378 0932 rismxdp (2a2554cb24506e0a0508fc395c4a1b42) C:\Windows\system32\DRIVERS\rixdptsk.sys
    22:58:47.0378 0932 rismxdp - ok
    22:58:47.0425 0932 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
    22:58:47.0425 0932 rspndr - ok
    22:58:47.0456 0932 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
    22:58:47.0456 0932 sbp2port - ok
    22:58:47.0612 0932 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys
    22:58:47.0612 0932 sdbus - ok
    22:58:47.0659 0932 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
    22:58:47.0659 0932 secdrv - ok
    22:58:47.0690 0932 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
    22:58:47.0690 0932 Serenum - ok
    22:58:47.0721 0932 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
    22:58:47.0721 0932 Serial - ok
    22:58:47.0815 0932 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
    22:58:47.0815 0932 sermouse - ok
    22:58:47.0846 0932 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
    22:58:47.0862 0932 sffdisk - ok
    22:58:47.0893 0932 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
    22:58:47.0893 0932 sffp_mmc - ok
    22:58:47.0924 0932 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
    22:58:47.0924 0932 sffp_sd - ok
    22:58:48.0033 0932 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
    22:58:48.0033 0932 sfloppy - ok
    22:58:48.0080 0932 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
    22:58:48.0080 0932 sisagp - ok
    22:58:48.0111 0932 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
    22:58:48.0111 0932 SiSRaid2 - ok
    22:58:48.0221 0932 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
    22:58:48.0236 0932 SiSRaid4 - ok
    22:58:48.0299 0932 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
    22:58:48.0299 0932 Smb - ok
    22:58:48.0330 0932 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
    22:58:48.0330 0932 spldr - ok
    22:58:48.0423 0932 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
    22:58:48.0439 0932 srv - ok
    22:58:48.0548 0932 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
    22:58:48.0548 0932 srv2 - ok
    22:58:48.0579 0932 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
    22:58:48.0579 0932 srvnet - ok
    22:58:48.0642 0932 STHDA (5af1feec6945f4fa5efd00e0c6d8f9b9) C:\Windows\system32\DRIVERS\stwrt.sys
    22:58:48.0642 0932 STHDA - ok
    22:58:48.0782 0932 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
    22:58:48.0782 0932 swenum - ok
    22:58:48.0813 0932 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
    22:58:48.0813 0932 Symc8xx - ok
    22:58:48.0845 0932 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
    22:58:48.0845 0932 Sym_hi - ok
    22:58:48.0969 0932 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
    22:58:48.0969 0932 Sym_u3 - ok
    22:58:49.0047 0932 Tcpip (2756186e287139310997090797e0182b) C:\Windows\system32\drivers\tcpip.sys
    22:58:49.0047 0932 Tcpip - ok
    22:58:49.0172 0932 Tcpip6 (2756186e287139310997090797e0182b) C:\Windows\system32\DRIVERS\tcpip.sys
    22:58:49.0188 0932 Tcpip6 - ok
    22:58:49.0328 0932 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
    22:58:49.0328 0932 tcpipreg - ok
    22:58:49.0375 0932 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
    22:58:49.0375 0932 TDPIPE - ok
    22:58:49.0406 0932 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
    22:58:49.0406 0932 TDTCP - ok
    22:58:49.0531 0932 tdx (31396184b0e2d25a1f5fb38d88b89353) C:\Windows\system32\DRIVERS\tdx.sys
    22:58:49.0531 0932 Suspicious file (Forged): C:\Windows\system32\DRIVERS\tdx.sys. Real md5: 31396184b0e2d25a1f5fb38d88b89353, Fake md5: 76b06eb8a01fc8624d699e7045303e54
    22:58:49.0531 0932 tdx ( ForgedFile.Multi.Generic ) - warning
    22:58:49.0531 0932 tdx - detected ForgedFile.Multi.Generic (1)
    22:58:49.0609 0932 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
    22:58:49.0609 0932 TermDD - ok
    22:58:49.0671 0932 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
    22:58:49.0671 0932 tssecsrv - ok
    22:58:49.0812 0932 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
    22:58:49.0812 0932 tunmp - ok
    22:58:49.0905 0932 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
    22:58:49.0905 0932 tunnel - ok
    22:58:50.0015 0932 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
    22:58:50.0015 0932 uagp35 - ok
    22:58:50.0077 0932 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
    22:58:50.0077 0932 udfs - ok
    22:58:50.0108 0932 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
    22:58:50.0108 0932 uliagpkx - ok
    22:58:50.0233 0932 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
    22:58:50.0233 0932 uliahci - ok
    22:58:50.0358 0932 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
    22:58:50.0358 0932 UlSata - ok
    22:58:50.0389 0932 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
    22:58:50.0389 0932 ulsata2 - ok
    22:58:50.0420 0932 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
    22:58:50.0420 0932 umbus - ok
    22:58:50.0545 0932 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\Windows\system32\Drivers\usbaapl.sys
    22:58:50.0545 0932 USBAAPL - ok
    22:58:50.0623 0932 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
    22:58:50.0623 0932 usbccgp - ok
    22:58:50.0670 0932 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
    22:58:50.0670 0932 usbcir - ok
    22:58:50.0810 0932 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
    22:58:50.0810 0932 usbehci - ok
    22:58:50.0888 0932 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
    22:58:50.0888 0932 usbhub - ok
    22:58:50.0919 0932 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
    22:58:50.0919 0932 usbohci - ok
    22:58:51.0029 0932 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
    22:58:51.0029 0932 usbprint - ok
    22:58:51.0091 0932 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
    22:58:51.0091 0932 usbscan - ok
    22:58:51.0216 0932 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
    22:58:51.0216 0932 USBSTOR - ok
    22:58:51.0247 0932 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
    22:58:51.0247 0932 usbuhci - ok
    22:58:51.0294 0932 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
    22:58:51.0294 0932 vga - ok
    22:58:51.0325 0932 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
    22:58:51.0325 0932 VgaSave - ok
    22:58:51.0434 0932 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
    22:58:51.0434 0932 viaagp - ok
    22:58:51.0465 0932 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
    22:58:51.0465 0932 ViaC7 - ok
    22:58:51.0497 0932 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
    22:58:51.0497 0932 viaide - ok
    22:58:51.0528 0932 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
    22:58:51.0543 0932 volmgr - ok
    22:58:51.0653 0932 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
    22:58:51.0653 0932 volmgrx - ok
    22:58:51.0746 0932 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
    22:58:51.0746 0932 volsnap - ok
    22:58:51.0793 0932 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
    22:58:51.0793 0932 vsmraid - ok
    22:58:51.0902 0932 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
    22:58:51.0902 0932 WacomPen - ok
    22:58:51.0933 0932 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
    22:58:51.0949 0932 Wanarp - ok
    22:58:51.0949 0932 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
    22:58:51.0949 0932 Wanarpv6 - ok
    22:58:51.0980 0932 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
    22:58:51.0980 0932 Wd - ok
    22:58:52.0089 0932 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
    22:58:52.0089 0932 Wdf01000 - ok
    22:58:52.0261 0932 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
    22:58:52.0261 0932 WmiAcpi - ok
    22:58:52.0323 0932 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
    22:58:52.0323 0932 WpdUsb - ok
    22:58:52.0339 0932 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
    22:58:52.0355 0932 ws2ifsl - ok
    22:58:52.0495 0932 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
    22:58:52.0495 0932 WUDFRd - ok
    22:58:52.0542 0932 MBR (0x1B8) (cdb4de4bbd714f152979da2dcbef57eb) \Device\Harddisk0\DR0
    22:58:52.0573 0932 \Device\Harddisk0\DR0 - ok
    22:58:52.0573 0932 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1
    22:58:52.0573 0932 \Device\Harddisk1\DR1 - ok
    22:58:52.0604 0932 Boot (0x1200) (2916a7f978645cb49e545a582f0f5cf7) \Device\Harddisk0\DR0\Partition0
    22:58:52.0604 0932 \Device\Harddisk0\DR0\Partition0 - ok
    22:58:52.0604 0932 Boot (0x1200) (0ebddef2f9bb39e8bda2fb7f4a0be38f) \Device\Harddisk0\DR0\Partition1
    22:58:52.0604 0932 \Device\Harddisk0\DR0\Partition1 - ok
    22:58:52.0620 0932 Boot (0x1200) (55a864c1a7556216617446d1980232f0) \Device\Harddisk1\DR1\Partition0
    22:58:52.0620 0932 \Device\Harddisk1\DR1\Partition0 - ok
    22:58:52.0620 0932 ============================================================
    22:58:52.0620 0932 Scan finished
    22:58:52.0620 0932 ============================================================
    22:58:52.0620 1996 Detected object count: 1
    22:58:52.0620 1996 Actual detected object count: 1
    22:58:58.0064 1996 tdx ( ForgedFile.Multi.Generic ) - skipped by user
    22:58:58.0064 1996 tdx ( ForgedFile.Multi.Generic ) - User select action: Skip
    dshoff115, Oct 11, 2011
    #5

  6. Broni Malware Annihilator

    Very well :)

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan:
    [IMG]

    On completion of the scan click "Save log", save it to your desktop and post in your next reply:
    [IMG]

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    ==================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode (How to...)

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
    Broni, Oct 11, 2011
    #6

  7. dshoff115 Newcomer, in training

    I was able to download aswMBR however it was shut down similar to other malware programs. It said it found a trojan, however the scan was not able to finish. Should I try this again in Safe Mode?

    I have been running Combofix for an hour and I had to go to work. Once I am home tonight I will post the results. Thanks again.
    dshoff115, Oct 12, 2011
    #7

  8. Broni Malware Annihilator

    OK................................
    Broni, Oct 12, 2011
    #8

  9. dshoff115 Newcomer, in training

    Hi,

    Sorry I just got home. Combofix didn't run and I just tried to restart it. It says recyclebin on C:\ is corrupted and asks if i want to empty it before running combo fix again? I wanted to make sure I should say yes.
    dshoff115, Oct 12, 2011
    #9

  10. Broni Malware Annihilator

    Go ahead....
    Broni, Oct 12, 2011
    #10

  11. dshoff115 Newcomer, in training

    Thanks. It says it's scanning for infected files with a blank cursor. Should anything else be happening while this runs? This is how I left it this morning and I want to make sure if it's working properly. I figured the files it was scanning would start scrolling across the program. If not I can try running in Safe Mode.
    dshoff115, Oct 12, 2011
    #11

  12. Broni Malware Annihilator

    It won't display any scanned files.
    It'll display:
    Stage 1
    Stage 2 etc.

    If nothing else happens in next 15-20 minutes try safe mode.
    Broni, Oct 12, 2011
    #12

  13. dshoff115 Newcomer, in training

    Sorry for the delay. It's still doing the same thing in Safe Mode. how long does this usually take to run?
    dshoff115, Oct 12, 2011
    #13

  14. Broni Malware Annihilator

    Lets run the following tool. This will help determine which files need permissions restored.

    Please download and save Junction.zip

    Unzip it and place Junction.exe in the Windows directory (C:\Windows).
    Go to Start>Run (Vista and Windows 7 users use "Start search" box).
    Copy and paste the following command in the Run box and click OK (Vista and Windows 7 users press "Enter"):

    cmd /c junction -s c:\ >log.txt&log.txt& del log.txt

    A command window opens starting to scan the system.
    Wait until a log file opens.
    Copy and paste the log in your next reply.
    Broni, Oct 12, 2011
    #14

  15. dshoff115 Newcomer, in training

    It's just a black box with a blinking cursor for the last 15 minutes. Is that right? I am still in safe mode too.
    dshoff115, Oct 12, 2011
    #15

  16. Broni Malware Annihilator

    Stop the process and read my previous reply.
    Broni, Oct 12, 2011
    #16

  17. dshoff115 Newcomer, in training

    Sorry I wasn't clear. I downloaded Junction and followed those instructions. Now I have a black box searching C:\window\system32folder\cmd.exe. There is a blinking cursor and that's all.
    dshoff115, Oct 12, 2011
    #17

  18. Broni Malware Annihilator

    Restart computer and try again.
    Broni, Oct 12, 2011
    #18

  19. dshoff115 Newcomer, in training

    I ran this in normal mode

    Junction v1.06 - Windows junction creator and reparse point viewer
    Copyright (C) 2000-2010 Mark Russinovich
    Sysinternals - www.sysinternals.com

    \\?\c:\\Documents and Settings: JUNCTION
    Print Name : C:\Users
    Substitute Name: C:\Users


    Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process.



    Failed to open \\?\c:\\System Volume Information: Access is denied.


    .\\?\c:\\Documents and Settings\All Users: SYMBOLIC LINK
    Print Name : C:\ProgramData
    Substitute Name: \??\C:\ProgramData

    \\?\c:\\Documents and Settings\Default User: JUNCTION
    Print Name : C:\Users\Default
    Substitute Name: C:\Users\Default

    \\?\c:\\Documents and Settings\All Users\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates



    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu



    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData
    dshoff115, Oct 12, 2011
    #19

  20. dshoff115 Newcomer, in training

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates



    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates



    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites



    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates

    .\\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Templates: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Templates
    Substitute Name: C:\ProgramData\Microsoft\Windows\Templates



    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data: JUNCTION
    Print Name : C:\ProgramData
    Substitute Name: C:\ProgramData

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop: JUNCTION
    Print Name : C:\Users\Public\Desktop
    Substitute Name: C:\Users\Public\Desktop

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents: JUNCTION
    Print Name : C:\Users\Public\Documents
    Substitute Name: C:\Users\Public\Documents

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Favorites: JUNCTION
    Print Name : C:\Users\Public\Favorites
    Substitute Name: C:\Users\Public\Favorites

    \\?\c:\\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu: JUNCTION
    Print Name : C:\ProgramData\Microsoft\Windows\Start Menu
    Substitute Name: C:\ProgramData\Microsoft\Windows\Start Menu
    dshoff115, Oct 12, 2011
    #20
Page 1 of 6