TechSpot

Infected with Trojan:Win32/Sirefef.AH and Win32/Sirefef.AC

Resolved
By Ookpic
Apr 20, 2012
Topic Status:
Not open for further replies.
  1. Hello

    I've been struggling with trying to clean this laptop and on the verge of formatting but I thought I would give it one last shot here if anyone can help. I've read through the instructions and hopefully I've done everything correctly. I did disable MSE before scanning with MalwareBytes but as soon as I was finished with scans, I re-enabled MSE and did a scan and it found and quarantined 2 Sirefef.AH trojans. Anyway, below is the list of the initial scans as per the 5-step preliminary removal.

    Malwarebytes Anti-Malware (Trial) 1.61.0.1400
    www.malwarebytes.org

    Database version: v2012.04.20.02

    Windows 7 Service Pack 1 x86 NTFS
    Internet Explorer 9.0.8112.16421
    Arlene :: LAPTOP [administrator]

    Protection: Enabled

    4/20/2012 11:26:35 AM
    mbam-log-2012-04-20 (11-26-35).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 297364
    Time elapsed: 28 minute(s), 50 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 60
    C:\Windows\System32\midisyn.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\StickyMesger.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\ZTEusbser6k.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\emproxy.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\eectrl.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\epfw.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\ESDCR.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\lxbt_device.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\lxcd_device.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\AFGMp50.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\AIRPLUS.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\atapi.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\ATWPKT2.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\btserial.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\CDRPDACC.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\clcapsvc.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\dmisrv.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\DniVad.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\elnkupdateservice.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\flutilssvc.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\FA312.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\FGDSCSI.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\fsdfwd.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\ini910u.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\kbfiltr.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\mcvsrte.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\mrxsmb.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\MSSQL$AUTODESKVAULT.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\NETw3x32.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\nimcdlbk.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\nipsvc.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\olregcap.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\oracleorahomehttpserver.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\owstimer.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\pdlnecfg.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\R300.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\RioS30.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\s217nd5.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\s217obex.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\sentinelprotectionserver.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\sfng32.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\smwdm.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\ssm_mdfl.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\symantecantibotshim.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\SymIM.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\syntp.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\USB_RNDIS_XP.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\szkg.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\Tb2RCAssist.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\tbhsd.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\vaiomediaplatform-mobile-gateway.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\vmx86.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\webclient.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\WGX.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\xfilt.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\z525obex.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\z800mgmt.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\zpmysql.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\vds.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.
    C:\Windows\System32\rdsessmgr.dll (RootKit.0Access.H) -> Quarantined and deleted successfully.

    (end)
  2. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2012-04-20 12:09:31
    Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST932032 rev.0010
    Running: hpij4qqp.exe; Driver: C:\Users\Arlene\AppData\Local\Temp\kflcauod.sys
    ---- Devices - GMER 1.0.15 ----
    AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    ---- EOF - GMER 1.0.15 ----
  3. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_24
    Run by Arlene at 12:12:51 on 2012-04-20
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2999.2041 [GMT -4:00]
    .
    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe
    C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
    C:\Windows\System32\IgrsSvcs.exe
    C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
    C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe
    C:\Program Files\USB Camera\VM331_STI.EXE
    C:\Program Files\Elantech\ETDCtrl.exe
    C:\Program Files\Lenovo\Energy Management\utility.exe
    C:\Program Files\Lenovo\Energy Management\Energy Management.exe
    C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe
    C:\Program Files\Lenovo\VeriFace\PManage.exe
    C:\Program Files\Lenovo\YouCam\YouCamTray.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
    C:\Program Files\Conexant\SAII\SmartAudio.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Windows\system32\REGSVR32.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.ca/
    uDefault_Page_URL = hxxp://www.lenovo.com
    uInternet Settings,ProxyOverride = *.local
    mRun: [IAStorIcon] c:\program files\intel\intel(r) rapid storage technology\IAStorIcon.exe
    mRun: [SmartAudio] c:\program files\conexant\saii\SAIICpl.exe /t
    mRun: [cAudioFilterAgent] c:\program files\conexant\caudiofilteragent\cAudioFilterAgent.exe
    mRun: [331BigDog] c:\program files\usb camera\VM331_STI.EXE
    mRun: [ETDWare] c:\program files\elantech\ETDCtrl.exe
    mRun: [EnergyUtility] c:\program files\lenovo\energy management\utility.exe
    mRun: [Energy Management] c:\program files\lenovo\energy management\Energy Management.exe
    mRun: [OnekeyStudio] c:\program files\lenovo\onekey theater\OnekeyStudio.exe
    mRun: [VeriFaceManager] c:\program files\lenovo\veriface\PManage.exe
    mRun: [UCam_Menu] "c:\program files\lenovo\youcam\muitransfer\muistartmenu.exe" "c:\program files\lenovo\youcam" updatewithcreateonce "software\cyberlink\youcam\3.0"
    mRun: [YouCam Mirror Tray icon] "c:\program files\lenovo\youcam\YouCamTray.exe" /s
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe
    mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
    mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
    LSP: mswsock.dll
    TCP: DhcpNameServer = 64.71.255.198 10.0.1.1
    TCP: Interfaces\{9FA57896-6456-4AD1-8DF8-8A2FEE889636} : DhcpNameServer = 64.71.255.198 64.71.255.253
    TCP: Interfaces\{E1553729-F30A-4E09-B7BE-8AE08B19B1AD} : DhcpNameServer = 64.71.255.198 10.0.1.1
    TCP: Interfaces\{E1553729-F30A-4E09-B7BE-8AE08B19B1AD}\2454C4C4439323 : DhcpNameServer = 192.168.2.1
    TCP: Interfaces\{E1553729-F30A-4E09-B7BE-8AE08B19B1AD}\3486C6F6175756C6 : DhcpNameServer = 192.168.2.1 64.71.255.198
    TCP: Interfaces\{E1553729-F30A-4E09-B7BE-8AE08B19B1AD}\3547574656E647 : DhcpNameServer = 10.3.6.3
    TCP: Interfaces\{E1553729-F30A-4E09-B7BE-8AE08B19B1AD}\46C696E6B6 : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{E1553729-F30A-4E09-B7BE-8AE08B19B1AD}\75C414E4 : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{E1553729-F30A-4E09-B7BE-8AE08B19B1AD}\841627075627026416D696C69702E4564777F627B6 : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{E1553729-F30A-4E09-B7BE-8AE08B19B1AD}\E4F647C6F626 : DhcpNameServer = 192.168.0.1
    Notify: igfxcui - igfxdev.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
    R2 cvhsvc;Client Virtualization Handler;c:\program files\common files\microsoft shared\virtualization handler\CVHSVC.EXE [2012-1-4 822624]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\intel\intel(r) rapid storage technology\IAStorDataMgrSvc.exe [2011-2-9 13336]
    R2 IGRS;IGRS;c:\program files\lenovo\readycomm\common\IGRS.exe [2009-7-14 38152]
    R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-12-8 374152]
    R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2011-3-27 47640]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-4-18 654408]
    R2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\system32\igrssvcs.exe -k igrssvcs --> c:\windows\system32\IgrsSvcs.exe -k IgrsSvcs [?]
    R2 sftlist;Application Virtualization Client;c:\program files\microsoft application virtualization client\sftlist.exe [2011-10-1 508776]
    R3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\drivers\AcpiVpc.sys [2011-2-9 21256]
    R3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [2011-2-9 119296]
    R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-2-26 132480]
    R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\drivers\IntcDAud.sys [2011-2-9 209920]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-4-18 22344]
    R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfslh.sys [2011-10-1 579944]
    R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplaylh.sys [2011-10-1 194408]
    R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirlh.sys [2011-10-1 21864]
    R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvollh.sys [2011-10-1 19304]
    R3 sftvsa;Application Virtualization Service Agent;c:\program files\microsoft application virtualization client\sftvsa.exe [2011-10-1 219496]
    R3 vm331avs;Digital Camera 1;c:\windows\system32\drivers\vm331avs.sys [2011-2-9 179072]
    R3 wdmirror;wdmirror;c:\windows\system32\drivers\WDMirror.sys [2011-2-11 11792]
    S2 avgio;Tifsfilter;c:\windows\system32\svchost.exe -k netsvcs [2009-7-13 20992]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2010-9-17 12856]
    S2 mcproxy;Atalk;c:\windows\system32\svchost.exe -k netsvcs [2009-7-13 20992]
    S2 navap;Lmouflt2;c:\windows\system32\svchost.exe -k netsvcs [2009-7-13 20992]
    S2 nod32krn;Wlluc48;c:\windows\system32\svchost.exe -k netsvcs [2009-7-13 20992]
    S2 TeamViewer;Pavfnsvr;c:\windows\system32\svchost.exe -k netsvcs [2009-7-13 20992]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
    S3 bpenum;bpenum;c:\windows\system32\drivers\bpenum.sys [2009-9-15 56832]
    S3 Bridge0;Bridge0;c:\windows\system32\drivers\wdbridge.sys [2011-2-11 63240]
    S3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\lenovo\readycomm\AppSvc.exe [2011-2-11 509192]
    S3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\lenovo\readycomm\ConnSvc.exe [2011-2-11 579400]
    S3 libusb0;libusb-win32 - Kernel Driver, Version 1.2.4.0;c:\windows\system32\drivers\libusb0.sys [2010-6-24 21504]
    S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2010-4-19 18432]
    S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
    S3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\system32\igrssvcs.exe -k igrssvcs --> c:\windows\system32\IgrsSvcs.exe -k IgrsSvcs [?]
    S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2011-2-9 182304]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-2-9 189440]
    S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-3-10 52224]
    S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-3-6 1343400]
    S3 wsvd;wsvd;c:\windows\system32\drivers\wsvd.sys [2009-7-21 81704]
    .
    =============== Created Last 30 ================
    .
    2012-04-18 17:51:25388096----a-r-c:\users\arlene\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
    2012-04-18 17:51:24--------d-----w-c:\program files\Trend Micro
    2012-04-18 16:44:22--------d-----w-c:\users\arlene\appdata\roaming\Malwarebytes
    2012-04-18 16:28:35--------d-----w-c:\programdata\Malwarebytes
    2012-04-18 16:28:3322344----a-w-c:\windows\system32\drivers\mbam.sys
    2012-04-18 16:28:33--------d-----w-c:\program files\Malwarebytes' Anti-Malware
    2012-04-12 19:34:475120----a-w-c:\windows\system32\wmi.dll
    2012-04-12 19:34:4719824----a-w-c:\windows\system32\drivers\fs_rec.sys
    2012-04-12 19:34:47172544----a-w-c:\windows\system32\wintrust.dll
    2012-04-12 19:34:47159232----a-w-c:\windows\system32\imagehlp.dll
    2012-04-12 19:34:243968368----a-w-c:\windows\system32\ntkrnlpa.exe
    2012-04-12 19:34:243913072----a-w-c:\windows\system32\ntoskrnl.exe
    2012-04-11 02:38:250--sha-w-c:\windows\system32\dds_trash_log.cmd
    .
    ==================== Find3M ====================
    .
    2012-02-28 01:18:551799168----a-w-c:\windows\system32\jscript9.dll
    2012-02-28 01:11:211427456----a-w-c:\windows\system32\inetcpl.cpl
    2012-02-28 01:11:071127424----a-w-c:\windows\system32\wininet.dll
    2012-02-28 01:03:162382848----a-w-c:\windows\system32\mshtml.tlb
    2012-02-17 05:34:22826880----a-w-c:\windows\system32\rdpcore.dll
    2012-02-17 04:14:08183808----a-w-c:\windows\system32\drivers\rdpwd.sys
    2012-02-17 04:13:2224576----a-w-c:\windows\system32\drivers\tdtcp.sys
    2012-02-10 05:38:431077248----a-w-c:\windows\system32\DWrite.dll
    2012-02-07 16:39:5883360----a-w-c:\windows\system32\LMIRfsClientNP.dll
    2012-02-07 16:39:5852096----a-w-c:\windows\system32\spool\prtprocs\w32x86\LMIproc.dll
    2012-02-07 16:39:5687424----a-w-c:\windows\system32\LMIinit.dll
    2012-02-07 16:39:5630592----a-w-c:\windows\system32\LMIport.dll
    2012-02-03 03:54:272343424----a-w-c:\windows\system32\win32k.sys
    2012-01-31 12:44:05237072------w-c:\windows\system32\MpSigStub.exe
    2012-01-25 05:32:3558880----a-w-c:\windows\system32\rdpwsx.dll
    2012-01-25 05:32:34129536----a-w-c:\windows\system32\rdpcorekmts.dll
    2012-01-25 05:27:518192----a-w-c:\windows\system32\rdrmemptylst.exe
    .
    ============= FINISH: 12:13:19.29 ===============
  4. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 2/9/2011 5:07:01 PM
    System Uptime: 4/20/2012 12:03:01 PM (0 hours ago)
    .
    Motherboard: LENOVO | | Base Board Product Name
    Processor: Intel(R) Core(TM) i5 CPU M 450 @ 2.40GHz | CPU | 2400/1066mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 298 GiB total, 232.571 GiB free.
    D: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Broadcom 802.11n Network Adapter
    Device ID: PCI\VEN_14E4&DEV_4727&SUBSYS_051014E4&REV_01\4&C74C28E&0&00E1
    Manufacturer: Broadcom
    Name: Broadcom 802.11n Network Adapter
    PNP Device ID: PCI\VEN_14E4&DEV_4727&SUBSYS_051014E4&REV_01\4&C74C28E&0&00E1
    Service: BCM43XX
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: MpKsl5975f928
    Device ID: ROOT\LEGACY_MPKSL5975F928\0000
    Manufacturer:
    Name: MpKsl5975f928
    PNP Device ID: ROOT\LEGACY_MPKSL5975F928\0000
    Service: MpKsl5975f928
    .
    ==== System Restore Points ===================
    .
    RP172: 3/27/2012 3:08:30 PM - Windows Update
    RP173: 3/28/2012 8:55:31 PM - Windows Update
    RP174: 4/1/2012 8:57:45 AM - Windows Update
    RP175: 4/4/2012 1:31:39 PM - Windows Update
    RP176: 4/7/2012 8:29:49 PM - Windows Update
    RP177: 4/11/2012 3:23:31 PM - Windows Update
    RP178: 4/12/2012 3:34:07 PM - Windows Update
    RP179: 4/18/2012 12:24:12 PM - Windows Update
    RP180: 4/18/2012 1:51:03 PM - Installed HiJackThis
    RP181: 4/20/2012 11:23:38 AM - Windows Update
    .
    ==== Installed Programs ======================
    .
    Adobe Flash Player 10 Plugin
    Adobe Flash Player 11 ActiveX
    Adobe Shockwave Player 11.6
    AppGraffiti
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    BlackBerry Desktop Software 6.1
    Bonjour
    Cake Mania - To the Max
    Conexant HD Audio
    CyberLink YouCam
    Energy Management
    ETDWare PS/2-x86 7.0.4.13_WHQL
    Facebook Video Calling 1.2.0.159
    Free Studio version 5.0.10
    HiJackThis
    iCloud
    Intel(R) Control Center
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) Rapid Storage Technology
    Intel(R) TV Wizard
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 24
    Kobo
    Lenovo DirectShare
    Lenovo EasyCamera
    Lenovo OneKey Recovery
    Lenovo ReadyComm 5
    Lenovo ReadyComm 5.0 Service
    LogMeIn
    Malwarebytes Anti-Malware version 1.61.0.1400
    Microsoft .NET Framework 4 Client Profile
    Microsoft Office Click-to-Run 2010
    Microsoft Office Home and Student 2010 - English
    Microsoft Silverlight
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    MobileMe Control Panel
    Onekey Theater
    QuickTime
    Realtek Ethernet Controller Driver For Windows Vista and Later
    Realtek USB 2.0 Card Reader
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Skype Click to Call
    Skype™ 5.5
    swMSM
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
    VeriFace
    VLC media player 1.1.8
    Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000)
    Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405)
    Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    4/20/2012 12:06:36 PM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.
    4/20/2012 12:04:16 PM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Wstcodec service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Wlancig service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Vpcbus service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The USBModem service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Tosrfnds service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Symndis service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Sscdmdm service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Regsrvc service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Qmofiltr service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Ppa3 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Pavfnsvr service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Pav_service service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Nnsvc service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The NetTcpActivator service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Mbmiodrvr service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Ltmodem5 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Iksyssec service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Idebusdr service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Hibernation service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Emitray service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Delldmi service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Cfosspeed service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The Avg7rsw service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:31 PM, Error: Service Control Manager [7023] - The ATWPKT2 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Zunenetworksvc service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Wmp54gsvc service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Wlluc48 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Vmx86 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Tfsndrct service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Pwisvc service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Pdlnebas service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Pctavsvc service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The P17 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Oracleorahome92tnslistener service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Oracle_load_balancer_60_server-forms6i service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The NWSNS service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Mqdmserd service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Motoswitchservice service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Mcrdsvc service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Lmouflt2 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The IPassPeriodicUpdateApp service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The IntuitUpdateService service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The E1express service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Dvd-ram_service service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Dcevt32 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The CXAVXBAR service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The CTEAPSFX.DLL service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The BRCMDECO service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Bdrsdrv service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Battc service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Backupexecjobengine service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Autostore service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Atalk service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7023] - The Alpham2 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:29 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Winvnc service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The W700mdfl service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Vrmonsvc service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Vaiomediaplatform-videoserver-appserver service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Ultra66 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Tzontservice service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Tifsfilter service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The SeratoUsb service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The SE2Dmdm service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Se2Bunic service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Rt73 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Rdpdr service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Pdscheduler service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Pdlnsx25 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Nuvaud2 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Msloop service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Mcsysmon service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The MASPINT service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The MagicTune service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Ipodservice service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Ifxtcs service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Hap17v2k service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Fshttps service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Filemon701 service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Eaps2kbd service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The DVDRC service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The DKbFltr service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Db2licd service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Cpqvcagent service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The ASUSVRC service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Alcxwdm service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7023] - The Ageremodemaudio service terminated with the following error: The specified module could not be found.
    4/20/2012 12:03:28 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
    4/20/2012 11:51:30 AM, Error: Service Control Manager [7023] - The Battc service terminated with the following error: The specified procedure could not be found.
    4/20/2012 11:36:38 AM, Error: Service Control Manager [7023] - The Hibernation service terminated with the following error: The specified procedure could not be found.
    4/20/2012 11:18:05 AM, Error: Service Control Manager [7023] - The Ageremodemaudio service terminated with the following error: Access is denied.
    4/20/2012 11:17:02 AM, Error: Service Control Manager [7023] - The Winvnc service terminated with the following error: Access is denied.
    4/20/2012 11:16:50 AM, Error: Microsoft Antimalware [3002] -
    4/20/2012 11:16:26 AM, Error: Service Control Manager [7023] - The Vpcbus service terminated with the following error: Access is denied.
    4/20/2012 11:16:26 AM, Error: Service Control Manager [7023] - The Tzontservice service terminated with the following error: Access is denied.
    4/20/2012 11:16:26 AM, Error: Service Control Manager [7023] - The P17 service terminated with the following error: Access is denied.
    4/19/2012 9:47:23 AM, Error: Service Control Manager [7023] - The Radiosvr service terminated with the following error: Access is denied.
    4/19/2012 9:32:23 AM, Error: Service Control Manager [7023] - The MagicTune service terminated with the following error: Access is denied.
    4/19/2012 9:17:23 AM, Error: Service Control Manager [7023] - The Oracleorahome811cman service terminated with the following error: Access is denied.
    4/19/2012 9:02:23 AM, Error: Service Control Manager [7023] - The Fshttps service terminated with the following error: Access is denied.
    4/19/2012 8:47:24 AM, Error: Service Control Manager [7023] - The AsusACPI service terminated with the following error: Access is denied.
    4/19/2012 8:32:24 AM, Error: Service Control Manager [7023] - The Ipodservice service terminated with the following error: Access is denied.
    4/19/2012 8:17:23 AM, Error: Service Control Manager [7023] - The Nvcap service terminated with the following error: Access is denied.
    4/19/2012 8:02:23 AM, Error: Service Control Manager [7023] - The Avg7rsw service terminated with the following error: Access is denied.
    4/19/2012 7:47:23 AM, Error: Service Control Manager [7023] - The SbieDrv service terminated with the following error: Access is denied.
    4/19/2012 7:32:23 AM, Error: Service Control Manager [7023] - The Alpham2 service terminated with the following error: Access is denied.
    4/19/2012 7:17:23 AM, Error: Service Control Manager [7023] - The Axsnmsvc service terminated with the following error: Access is denied.
    4/19/2012 7:02:23 AM, Error: Service Control Manager [7023] - The CXAVXBAR service terminated with the following error: Access is denied.
    4/19/2012 6:47:23 AM, Error: Service Control Manager [7023] - The W810mgmt service terminated with the following error: Access is denied.
    4/19/2012 6:32:23 AM, Error: Service Control Manager [7023] - The IntuitUpdateService service terminated with the following error: Access is denied.
    4/19/2012 6:17:23 AM, Error: Service Control Manager [7023] - The Winsock service terminated with the following error: Access is denied.
    4/19/2012 6:02:23 AM, Error: Service Control Manager [7023] - The Db2licd service terminated with the following error: Access is denied.
    4/19/2012 5:47:23 AM, Error: Service Control Manager [7023] - The Ctprxy2k service terminated with the following error: Access is denied.
    4/19/2012 5:32:24 AM, Error: Service Control Manager [7023] - The Cpqvcagent service terminated with the following error: Access is denied.
    4/19/2012 5:17:23 AM, Error: Service Control Manager [7023] - The PGPsdkDriver service terminated with the following error: Access is denied.
    4/19/2012 5:02:23 AM, Error: Service Control Manager [7023] - The W700mdfl service terminated with the following error: Access is denied.
    4/19/2012 4:47:23 AM, Error: Service Control Manager [7023] - The Dbmang service terminated with the following error: Access is denied.
    4/19/2012 4:32:23 AM, Error: Service Control Manager [7023] - The Tifsfilter service terminated with the following error: Access is denied.
    4/19/2012 4:17:23 AM, Error: Service Control Manager [7023] - The ScsiPort service terminated with the following error: Access is denied.
    4/19/2012 4:02:23 AM, Error: Service Control Manager [7023] - The Nnsvc service terminated with the following error: Access is denied.
    4/19/2012 3:47:23 AM, Error: Service Control Manager [7023] - The OneCareMP service terminated with the following error: Access is denied.
    4/19/2012 3:32:23 AM, Error: Service Control Manager [7023] - The Mqdmserd service terminated with the following error: Access is denied.
    4/19/2012 3:17:23 AM, Error: Service Control Manager [7023] - The Lxcccustomerconnect service terminated with the following error: Access is denied.
    4/19/2012 3:02:23 AM, Error: Service Control Manager [7023] - The Mcrdsvc service terminated with the following error: Access is denied.
    4/19/2012 2:47:23 AM, Error: Service Control Manager [7023] - The VAIOMediaPlatform-VideoServer-HTTP service terminated with the following error: Access is denied.
    4/19/2012 2:32:23 AM, Error: Service Control Manager [7023] - The Pctavsvc service terminated with the following error: Access is denied.
    4/19/2012 2:17:23 AM, Error: Service Control Manager [7023] - The Aegisp service terminated with the following error: Access is denied.
    4/19/2012 2:02:24 AM, Error: Service Control Manager [7023] - The Lmouflt2 service terminated with the following error: Access is denied.
    4/19/2012 12:51:51 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    4/19/2012 12:47:47 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    4/19/2012 12:47:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    4/19/2012 12:47:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    4/19/2012 12:47:44 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    4/19/2012 12:47:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    4/19/2012 12:47:23 AM, Error: Service Control Manager [7023] - The Tnidriver service terminated with the following error: Access is denied.
    4/19/2012 12:40:06 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\bcmihvsrv.dll Error Code: 21
    4/19/2012 12:39:52 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache MpFilter spldr Wanarpv6
    4/19/2012 12:39:52 PM, Error: Service Control Manager [7001] - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: The dependency service or group failed to start.
    4/19/2012 12:39:47 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    4/19/2012 12:32:24 PM, Error: Service Control Manager [7023] - The Yukonwlh service terminated with the following error: Access is denied.
    4/19/2012 12:32:23 AM, Error: Service Control Manager [7023] - The Vaiomediaplatform-videoserver-appserver service terminated with the following error: Access is denied.
    4/19/2012 12:17:24 PM, Error: Service Control Manager [7023] - The Sdcplh service terminated with the following error: Access is denied.
    4/19/2012 12:17:23 AM, Error: Service Control Manager [7023] - The Vrfwsvc service terminated with the following error: Access is denied.
    4/19/2012 12:02:24 PM, Error: Service Control Manager [7023] - The USBModem service terminated with the following error: Access is denied.
    4/19/2012 12:02:23 AM, Error: Service Control Manager [7023] - The CTEAPSFX.DLL service terminated with the following error: Access is denied.
    4/19/2012 11:47:23 AM, Error: Service Control Manager [7023] - The Vsbus service terminated with the following error: Access is denied.
    4/19/2012 11:32:23 AM, Error: Service Control Manager [7023] - The ATWPKT2 service terminated with the following error: Access is denied.
    4/19/2012 11:17:23 AM, Error: Service Control Manager [7023] - The NWUSBPort service terminated with the following error: Access is denied.
    4/19/2012 11:02:23 AM, Error: Service Control Manager [7023] - The Wlluc48 service terminated with the following error: Access is denied.
    4/19/2012 10:47:23 AM, Error: Service Control Manager [7023] - The 3compxe service terminated with the following error: Access is denied.
    4/19/2012 10:32:23 AM, Error: Service Control Manager [7023] - The Ifxtcs service terminated with the following error: Access is denied.
    4/19/2012 10:17:23 AM, Error: Service Control Manager [7023] - The Ipahelper.exe service terminated with the following error: Access is denied.
    4/19/2012 10:02:23 AM, Error: Service Control Manager [7023] - The Dcevt32 service terminated with the following error: Access is denied.
    4/19/2012 1:47:23 AM, Error: Service Control Manager [7023] - The Elbycdfl service terminated with the following error: Access is denied.
    4/19/2012 1:32:23 AM, Error: Service Control Manager [7023] - The Vmx86 service terminated with the following error: Access is denied.
    4/19/2012 1:17:23 AM, Error: Service Control Manager [7023] - The CAM1210 service terminated with the following error: Access is denied.
    4/19/2012 1:02:23 AM, Error: Service Control Manager [7023] - The Mcsysmon service terminated with the following error: Access is denied.
    4/18/2012 9:47:24 PM, Error: Service Control Manager [7023] - The Tfsnudfa service terminated with the following error: Access is denied.
    4/18/2012 9:32:23 PM, Error: Service Control Manager [7023] - The Alcxwdm service terminated with the following error: Access is denied.
    4/18/2012 9:17:23 PM, Error: Service Control Manager [7023] - The Symantecantibotdriver service terminated with the following error: Access is denied.
    4/18/2012 9:02:23 PM, Error: Service Control Manager [7023] - The MASPINT service terminated with the following error: Access is denied.
    4/18/2012 8:47:23 PM, Error: Service Control Manager [7023] - The Epfwndis service terminated with the following error: Access is denied.
    4/18/2012 8:32:23 PM, Error: Service Control Manager [7023] - The Pdlnebas service terminated with the following error: Access is denied.
    4/18/2012 8:17:23 PM, Error: Service Control Manager [7023] - The DELTA service terminated with the following error: Access is denied.
    4/18/2012 8:02:23 PM, Error: Service Control Manager [7023] - The Pavfnsvr service terminated with the following error: Access is denied.
    4/18/2012 7:47:23 PM, Error: Service Control Manager [7023] - The Sysmonlog service terminated with the following error: Access is denied.
    4/18/2012 7:32:23 PM, Error: Service Control Manager [7023] - The Eaps2kbd service terminated with the following error: Access is denied.
    4/18/2012 7:17:23 PM, Error: Service Control Manager [7023] - The Epoxusdm service terminated with the following error: Access is denied.
    4/18/2012 7:02:23 PM, Error: Service Control Manager [7023] - The Wstcodec service terminated with the following error: Access is denied.
    4/18/2012 6:47:23 PM, Error: Service Control Manager [7023] - The Teefer service terminated with the following error: Access is denied.
    4/18/2012 6:32:23 PM, Error: Service Control Manager [7023] - The Ltmodem5 service terminated with the following error: Access is denied.
    4/18/2012 6:17:23 PM, Error: Service Control Manager [7023] - The Emupia service terminated with the following error: Access is denied.
    4/18/2012 6:02:23 PM, Error: Service Control Manager [7023] - The Oracle_load_balancer_60_server-forms6i service terminated with the following error: Access is denied.
    4/18/2012 5:47:23 PM, Error: Service Control Manager [7023] - The Caccprovsp service terminated with the following error: Access is denied.
    4/18/2012 5:32:23 PM, Error: Service Control Manager [7023] - The Motoswitchservice service terminated with the following error: Access is denied.
    4/18/2012 5:17:23 PM, Error: Service Control Manager [7023] - The SE2Emdm service terminated with the following error: Access is denied.
    4/18/2012 5:02:23 PM, Error: Service Control Manager [7023] - The Bdrsdrv service terminated with the following error: Access is denied.
    4/18/2012 4:47:24 PM, Error: Service Control Manager [7023] - The CVirtA service terminated with the following error: Access is denied.
    4/18/2012 4:32:23 PM, Error: Service Control Manager [7023] - The BRCMDECO service terminated with the following error: Access is denied.
    4/18/2012 4:17:23 PM, Error: Service Control Manager [7023] - The MTsensor service terminated with the following error: Access is denied.
    4/18/2012 4:02:23 PM, Error: Service Control Manager [7023] - The Se2Bunic service terminated with the following error: Access is denied.
    4/18/2012 3:47:23 PM, Error: Service Control Manager [7023] - The Hddsvc service terminated with the following error: Access is denied.
    4/18/2012 3:32:23 PM, Error: Service Control Manager [7023] - The Pdscheduler service terminated with the following error: Access is denied.
    4/18/2012 3:17:23 PM, Error: Service Control Manager [7023] - The Nimdbgk service terminated with the following error: Access is denied.
    4/18/2012 3:02:24 PM, Error: Service Control Manager [7023] - The Mbmiodrvr service terminated with the following error: Access is denied.
    4/18/2012 2:47:23 PM, Error: Service Control Manager [7023] - The Nimxdfk service terminated with the following error: Access is denied.
    4/18/2012 2:32:23 PM, Error: Service Control Manager [7023] - The E1express service terminated with the following error: Access is denied.
    4/18/2012 2:17:23 PM, Error: Service Control Manager [7023] - The Tfsndrct service terminated with the following error: Access is denied.
    4/18/2012 2:02:24 PM, Error: Service Control Manager [7023] - The Oracleorahome92tnslistener service terminated with the following error: Access is denied.
    4/18/2012 2:01:24 PM, Error: Service Control Manager [7023] - The SeratoUsb service terminated with the following error: Access is denied.
    4/18/2012 12:33:23 PM, Error: Service Control Manager [7023] - The IPassPeriodicUpdateApp service terminated with the following error: Access is denied.
    4/18/2012 12:27:23 PM, Error: Service Control Manager [7023] - The Iksyssec service terminated with the following error: Access is denied.
    4/18/2012 12:18:24 PM, Error: Service Control Manager [7023] - The Intcazaudaddservice service terminated with the following error: Access is denied.
    4/18/2012 12:14:35 PM, Error: Service Control Manager [7023] - The Backupexecjobengine service terminated with the following error: Access is denied.
    4/18/2012 11:47:23 PM, Error: Service Control Manager [7023] - The Btwavdt service terminated with the following error: Access is denied.
    4/18/2012 11:17:23 PM, Error: Service Control Manager [7023] - The Bt service terminated with the following error: Access is denied.
    4/18/2012 11:02:23 PM, Error: Service Control Manager [7023] - The Atalk service terminated with the following error: Access is denied.
    4/18/2012 10:47:23 PM, Error: Service Control Manager [7023] - The Belmonitorservice service terminated with the following error: Access is denied.
    4/18/2012 10:32:23 PM, Error: Service Control Manager [7023] - The Sscdmdm service terminated with the following error: Access is denied.
    4/18/2012 10:17:23 PM, Error: Service Control Manager [7023] - The Psdvdisk service terminated with the following error: Access is denied.
    4/18/2012 10:02:23 PM, Error: Service Control Manager [7023] - The Msloop service terminated with the following error: Access is denied.
    4/18/2012 1:46:55 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
    .
    ==== End Of File ===========================
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Okay then- judging by the number of infected files with Zero Access Rootkit and the abundance of errors in the Event Viewer, it appears that you have had the malware for a while. We will see what else in on the system and make the decision whether it's feasible to try and clean the system or go to the reformat/reinstall.

    This malware is usually accompanie with other malware, or conversely, other malware may bring this.
    ===========================================
    Please note: If you have previously run Combofix and it's still on the system, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    --------------------------------------
    Before you run the Combofix scan, please disable any security software you have running.

    Download Combofix from HERE or HERE and save to the desktop
    • Double click combofix.exe [​IMG]& follow the prompts.
    • If prompted for Recovery Console, please allow.
    • Once installed, you should see a blue screen prompt that says:
      • The Recovery Console was successfully installed.[/b]
      • Note: If Combofix was downloaded to a flash drive, the Recovery Console will not install- just bypass and go on.[/b]
      • Note: No query will be made if the Recovery Console is already on the system.
    • .Close/disable all anti virus and anti malware programs
      (If you need help with this, please see HERE)
    • .Close any open browsers.
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.
    Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    Note 2:If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart the computer.
    Note 3:CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    =================================================
    • Download the file TDSSKiller.zip and save to the desktop.
      (If you are unable to download the file for some reason, then TDSS may be blocking it. You would then need to download it first to a clean computer and then transfer it to the infected one using an external drive or USB flash drive.)
    • Right-click the tdsskiller.zip file> Select Extract All into a folder on the infected (or potentially infected) PC.
    • Double click on TDSSKiller.exe. to run the scan
    • When the scan is over, the utility outputs a list of detected objects with description.
      The utility automatically selects an action (Cure or Delete) for malicious objects.
      The utility prompts the user to select an action to apply to suspicious objects (Skip, by default).
    • Select the action Quarantine to quarantine detected objects.
      The default quarantine folder is in the system disk root folder, e.g.: C:\TDSSKiller_Quarantine\23.07.2010_15.31.43
    • After clicking Next, the utility applies selected actions and outputs the result.
    • A reboot is required after disinfection.
    =========================================
    To run the Eset Online Virus Scan:
    If you use Internet Explorer:
    1. Open the ESETOnlineScan
    2. Skip to #4 to "Continue with the directions"

      If you are using a browser other than Internet Explorer
    3. Open Eset Smart Installer
      [o] Click on the esetsmartinstaller_enu.exelink and save to the desktop.
      [o] Double click on the desktop icon to run.
      [o] After successful installation of the ESET Smart Installer, the ESET Online Scanner will be launched in a new Window
    4. Continue with the directions.
    5. Check 'Yes I accept terms of use.'
    6. Click Start button
    7. Accept any security warnings from your browser.
      [​IMG]
    8. Uncheck 'Remove found threats'
    9. Check 'Scan archives/
    10. Leave remaining settings as is.
    11. Press the Start button.
    12. ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    13. When the scan completes, press List of found threats
    14. Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    15. Push the Back button, then Finish
    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
    =====================================================
    If yoi have any problem running these programs- STOP-and let me know what they are.
    If anything noticobly improves-OR-is anything gets worse, please advise me.
    ======================================================
    Please leave the logs from Combofix, TDSSKiller and Eset scan in your next reply.
    ======================================================
    My Guidelines: please read and follow:
    • Be patient. Malware cleaning takes time. I am also working with other members while I am helping you.
    • Read my instructions carefully. If you don't understand or have a problem, ask me. Follow the order of the tasks I give you. Order is crucial in cleaning process.
    • If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
    • File sharing programs should be uninstalled or disabled during the cleaning process..
    • Observe these:
      [o] Don't follow directions given to someone else
      [o] Don't use any other cleaning programs or scans while I'm helping you.
      [o] Don't use a Registry cleaner or make any changes in the Registry.
      [o] Don't download and install new programs- except those I give you.
    Threads are closed after 5 days if there is no reply.
  6. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    Ok, First off, Thanks very very much!!

    When I ran ComboFix I got the following prompt:

    You are infected with Rootkit.ZeroAccess! It has inserted itself into the tcp/ip stack. This is a particularly difficult infection.

    If for any reason that your're unable to connect to the internet after running ComboFix, reboot once and see if that fixes it.

    If it's not fixed, run ComboFix one more time.

    When I click ok the machine seemed to lock up. I waited for an hour and nothing changed so I rebooted and tried again. I got the same prompt and clicked OK. This time it went all the way through all stages, rebooted, finished doing it's thing and spit out this result:

    ComboFix 12-04-19.01 - Arlene 04/21/2012 12:47:38.1.4 - x86
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2999.2398 [GMT -4:00]
    Running from: c:\users\Arlene\Desktop\ComboFix.exe
    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    C:\install.exe
    c:\users\Arlene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{76C2C7BA-4D9A-4B1E-9DB5-2CA65E5ACEC5}.xps
    c:\users\Arlene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{901F818A-2128-4826-94ED-9A548D450D22}.xps
    c:\users\Arlene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{95E1D93F-F7A5-4A9F-909F-FF5E56F82B09}.xps
    c:\users\Arlene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{977C3A03-9BA1-4466-A914-97AF2E54367C}.xps
    c:\users\Erika\AppData\Local\Microsoft\Windows\Temporary Internet Files\{1D8E5346-9119-4CFB-A39A-FA00E51D490A}.xps
    c:\users\Erika\AppData\Local\Microsoft\Windows\Temporary Internet Files\{43EE608B-18AD-480F-9E97-AC070F3107BE}.xps
    c:\users\Erika\AppData\Local\Microsoft\Windows\Temporary Internet Files\{47BDEF41-B3AC-48CC-9F58-6A9787D1E3A5}.xps
    c:\users\Erika\AppData\Local\Microsoft\Windows\Temporary Internet Files\{85C8A1F0-E7D8-4CE5-8B37-0BA928E419F3}.xps
    c:\users\Erika\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B41E36AE-E40A-47F8-BAB6-1942A92F2DC0}.xps
    c:\users\Erika\AppData\Local\Microsoft\Windows\Temporary Internet Files\{BD6D9916-E6B1-4808-9F64-DAE96EA6928F}.xps
    c:\users\Erika\AppData\Local\Microsoft\Windows\Temporary Internet Files\{C8A84F4E-F6B6-4437-AD55-C01C83167685}.xps
    c:\users\Erika\AppData\Local\Microsoft\Windows\Temporary Internet Files\{D3C1F474-6614-47DB-BD02-48D2A0AF9689}.xps
    c:\users\Erika\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E2396FD9-8734-421C-9042-52906B72B021}.xps
    c:\users\Erika\Documents\~WRL0003.tmp
    c:\users\Erika\Documents\~WRL0004.tmp
    c:\users\Erika\Documents\~WRL0005.tmp
    c:\users\Erika\Documents\~WRL1488.tmp
    c:\users\Erika\Documents\~WRL2075.tmp
    c:\windows\system32\bdss.dll
    c:\windows\system32\bwmservice.dll
    c:\windows\system32\dds_trash_log.cmd
    c:\windows\$NtUninstallKB25191$ . . . . Failed to delete
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Service_a8djavs
    -------\Service_Eplpdx02
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-03-21 to 2012-04-21 )))))))))))))))))))))))))))))))
    .
    .
    2012-04-21 16:57 . 2012-04-21 16:57--------d-----w-c:\users\LogMeInRemoteUser\AppData\Local\temp
    2012-04-21 16:57 . 2012-04-21 16:57--------d-----w-c:\users\Erika\AppData\Local\temp
    2012-04-21 16:57 . 2012-04-21 17:18--------d-----w-c:\users\Arlene\AppData\Local\temp
    2012-04-21 16:57 . 2012-04-21 16:57--------d-----w-c:\users\Laurie\AppData\Local\temp
    2012-04-21 16:57 . 2012-04-21 16:57--------d-----w-c:\users\Default\AppData\Local\temp
    2012-04-21 16:57 . 2012-04-21 16:57--------d-----w-c:\windows\system32\config\systemprofile\AppData\Local\temp
    2012-04-18 17:51 . 2012-04-18 17:51388096----a-r-c:\users\Arlene\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2012-04-18 17:51 . 2012-04-18 17:51--------d-----w-c:\program files\Trend Micro
    2012-04-18 16:44 . 2012-04-18 16:44--------d-----w-c:\users\Arlene\AppData\Roaming\Malwarebytes
    2012-04-18 16:28 . 2012-04-18 16:28--------d-----w-c:\users\Erika\AppData\Roaming\Malwarebytes
    2012-04-18 16:28 . 2012-04-18 16:28--------d-----w-c:\programdata\Malwarebytes
    2012-04-18 16:28 . 2012-04-18 16:28--------d-----w-c:\program files\Malwarebytes' Anti-Malware
    2012-04-18 16:28 . 2012-04-04 19:5622344----a-w-c:\windows\system32\drivers\mbam.sys
    2012-04-12 19:34 . 2012-03-01 05:4619824----a-w-c:\windows\system32\drivers\fs_rec.sys
    2012-04-12 19:34 . 2012-03-01 05:37172544----a-w-c:\windows\system32\wintrust.dll
    2012-04-12 19:34 . 2012-03-01 05:33159232----a-w-c:\windows\system32\imagehlp.dll
    2012-04-12 19:34 . 2012-03-01 05:295120----a-w-c:\windows\system32\wmi.dll
    2012-04-12 19:34 . 2012-03-06 05:593968368----a-w-c:\windows\system32\ntkrnlpa.exe
    2012-04-12 19:34 . 2012-03-06 05:593913072----a-w-c:\windows\system32\ntoskrnl.exe
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-02-17 05:34 . 2012-03-14 10:52826880----a-w-c:\windows\system32\rdpcore.dll
    2012-02-17 04:14 . 2012-03-14 10:52183808----a-w-c:\windows\system32\drivers\rdpwd.sys
    2012-02-17 04:13 . 2012-03-14 10:5224576----a-w-c:\windows\system32\drivers\tdtcp.sys
    2012-02-10 05:38 . 2012-03-14 10:531077248----a-w-c:\windows\system32\DWrite.dll
    2012-02-03 03:54 . 2012-03-14 10:532343424----a-w-c:\windows\system32\win32k.sys
    2012-01-31 12:44 . 2011-02-11 06:01237072------w-c:\windows\system32\MpSigStub.exe
    2012-01-25 05:32 . 2012-03-14 10:5258880----a-w-c:\windows\system32\rdpwsx.dll
    2012-01-25 05:32 . 2012-03-14 10:52129536----a-w-c:\windows\system32\rdpcorekmts.dll
    2012-01-25 05:27 . 2012-03-14 10:528192----a-w-c:\windows\system32\rdrmemptylst.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]
    @="{771C7324-DA80-49D3-8017-753B0AF60951}"
    [HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]
    2011-02-11 06:111410400----a-w-c:\windows\System32\IcnOvrly.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-11-20 284696]
    "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-12-20 307768]
    "cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe" [2009-12-20 487992]
    "331BigDog"="c:\program files\USB Camera\VM331_STI.EXE" [2009-12-20 536576]
    "ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-12-20 501640]
    "EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-12-17 4114368]
    "Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-12-17 6223808]
    "OnekeyStudio"="c:\program files\Lenovo\Onekey Theater\OnekeyStudio.exe" [2009-12-19 665504]
    "VeriFaceManager"="c:\program files\Lenovo\VeriFace\PManage.exe" [2011-02-11 3122528]
    "UCam_Menu"="c:\program files\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
    "YouCam Mirror Tray icon"="c:\program files\Lenovo\YouCam\YouCamTray.exe" [2009-11-11 167008]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 136216]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 171032]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 170520]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
    "RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-11-02 59240]
    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    IgrsSvcsREG_MULTI_SZ ReadyComm.DirectRouter PS_MDP
    .
    NETSVCS REQUIRES REPAIRS - current entries shown
    AeLookupSvc
    CertPropSvc
    SCPolicySvc
    lanmanserver
    gpsvc
    IKEEXT
    AudioSrv
    FastUserSwitchingCompatibility
    Ias
    Irmon
    Nla
    Ntmssvc
    NWCWorkstation
    Nwsapagent
    Rasauto
    Rasman
    Remoteaccess
    SENS
    Sharedaccess
    SRService
    Tapisrv
    Wmi
    WmdmPmSp
    vwlogger
    StkScan
    hpqwmi
    MSFWHLPR
    VAIOMediaPlatform-PhotoServer-UPnP
    VAIOMediaPlatform-PhotoServer-HTTP
    s3savagenb
    ATSWPDRV
    cd20xrnt
    SWNC8U51
    wanatw
    w550mdm
    cvintdrv
    flutilssvc
    vpn5000service
    tng-dts
    rtl8023
    ScFBPNT2
    lmouflt2
    PhilCam8116_XP
    s716unic
    alerter
    NsTrcNT
    LVBulk
    timounter
    cdvp
    PTproct
    DritekPortIO
    zenos1
    mxserver
    AMDPCI
    npkcusb
    pid_0928
    ntcharge
    avgio
    ashampoodefragservice
    pinger
    NITaggerService
    compaq_rba
    Cinemsup
    cnxtdiag
    thotkey
    ati2mtaa
    cpuidlep
    sscdmdfl
    sony_ssm.sys
    symantecantibotagent
    se2Bunic
    ss_mdm
    amdk77
    EpmShd
    XAudio
    vxsvc
    Rawwan
    vnxservice
    oraclewebassistant
    riomsc
    nalntservice
    VC6SecS
    FirePM
    omniusb
    HPSLPSVC
    CoolerXPDriver
    upsentry_smart
    dxdebug
    ehstart
    cdfsvc
    license
    ccpwdsvc
    se45mdfl
    sdbus
    Eplpdx02
    a8djavs
    websensepolicyserver
    pwisvc
    xusb21
    X4HSX32
    TdmService
    areschatserver
    ldlcserv
    WIBUKEY
    w300mdm
    SiRemFil
    roxliveshare
    s117unic
    WINIO
    DM9102
    inport
    HBtnKey
    lxcd_device
    sandboxu
    pae_avs
    AtlsAud
    lightscribeservice
    bdpredir
    ds1
    lxrjd31d
    moufiltr
    dlaudfam
    se26unic
    nhcDriverDevice
    pcidump
    Si3132r5
    nod32krn
    rnadiagnosticsservice
    cfosspeed
    snareiis
    portmapper
    citrixxteserver
    L8042Kbd
    tdrpman174
    netmnt
    navap
    BCMWLNPF
    oracledbconsoleorcl
    mcproxy
    adobeactivefilemonitor5.0
    Anydlc
    TeamViewer
    tvalz
    passthru
    LVVI500A
    aliadwdm
    USBCamera
    pnmsrv
    elosystemservice
    U81xmgmt
    bc_pat_f
    mqdmbus
    LPDSVC
    btwaudio
    ati2mtag
    pnarp
    snpstd
    quickbooksdb
    lusbaudio
    tpkmpsvc
    zebrmdmc
    L6POD
    DLARTL_M
    trioservice
    icm10blk
    iAimFP5
    entech
    NETw4v32
    TermService
    wuauserv
    BITS
    ShellHWDetection
    LogonHours
    PCAudit
    helpsvc
    uploadmgr
    iphlpsvc
    seclogon
    AppInfo
    msiscsi
    MMCSS
    wercplsupport
    EapHost
    ProfSvc
    schedule
    hkmsvc
    SessionEnv
    winmgmt
    browser
    Themes
    BDESVC
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-04-18 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2455382146-3077568640-2663614186-1003Core.job
    - c:\users\Laurie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-06 19:31]
    .
    2012-04-20 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2455382146-3077568640-2663614186-1003UA.job
    - c:\users\Laurie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-06 19:31]
    .
    2012-04-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2455382146-3077568640-2663614186-1004Core.job
    - c:\users\Erika\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-27 09:30]
    .
    2012-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2455382146-3077568640-2663614186-1004UA.job
    - c:\users\Erika\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-27 09:30]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.ca/
    uInternet Settings,ProxyOverride = *.local
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'Explorer.exe'(7836)
    c:\program files\Lenovo\Onekey Theater\ActiveDetect32.dll
    c:\program files\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
    c:\windows\system32\IcnOvrly.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\WLANExt.exe
    c:\windows\system32\conhost.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\System32\IgrsSvcs.exe
    c:\program files\Microsoft Application Virtualization Client\sftvsa.exe
    c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    c:\program files\Microsoft Application Virtualization Client\sftlist.exe
    c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
    c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
    c:\windows\system32\conhost.exe
    c:\program files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2012-04-21 13:22:23 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-04-21 17:22
    .
    Pre-Run: 249,738,764,288 bytes free
    Post-Run: 252,095,774,720 bytes free
    .
    - - End Of File - - A2439518983C0A8BE1837F9EFFF2E962
  7. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    I ran tdsskiller and got a fault:
    "Illegal operation attempted on a registry key that has been marked for deletion"

    As instructed I rebooted and ran again. It found one infection but there was no option to "Quarantine". The only 2 options were to "copy to quarantine" and "cure". I selected the "copy to quarantine". It reported that one infection remained. I re-read the instructions and noticed the last line said "reboot after disinfection" so I rescanned with tdsskiller and chose the "cure" option. It failed to cure and didn't prompt for a reboot.

    Here is a copy of the log from TDSSKILLER

    13:50:25.0721 7100TDSS rootkit removing tool 2.7.29.0 Apr 18 2012 16:44:20
    13:50:25.0737 7100============================================================
    13:50:25.0737 7100Current date / time: 2012/04/21 13:50:25.0737
    13:50:25.0737 7100SystemInfo:
    13:50:25.0737 7100
    13:50:25.0737 7100OS Version: 6.1.7601 ServicePack: 1.0
    13:50:25.0737 7100Product type: Workstation
    13:50:25.0737 7100ComputerName: LAPTOP
    13:50:25.0737 7100UserName: Arlene
    13:50:25.0737 7100Windows directory: C:\Windows
    13:50:25.0737 7100System windows directory: C:\Windows
    13:50:25.0737 7100Processor architecture: Intel x86
    13:50:25.0737 7100Number of processors: 4
    13:50:25.0737 7100Page size: 0x1000
    13:50:25.0737 7100Boot type: Normal boot
    13:50:25.0737 7100============================================================
    13:50:28.0155 7100Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
    13:50:28.0155 7100\Device\Harddisk0\DR0:
    13:50:28.0155 7100MBR partitions:
    13:50:28.0155 7100\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
    13:50:28.0155 7100\Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x253FB800
    13:50:28.0186 7100C: <-> \Device\Harddisk0\DR0\Partition1
    13:50:28.0186 7100Initialize success
    13:50:28.0186 7100============================================================
    13:50:35.0705 6576============================================================
    13:50:35.0705 6576Scan started
    13:50:35.0705 6576Mode: Manual;
    13:50:35.0705 6576============================================================
    13:50:38.0170 65761394ohci (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
    13:50:38.0186 65761394ohci - ok
    13:50:38.0264 6576ACPI (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
    13:50:38.0264 6576ACPI - ok
    13:50:38.0451 6576AcpiPmi (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
    13:50:38.0451 6576AcpiPmi - ok
    13:50:38.0529 6576ACPIVPC (e4d3dd5a1fc4aef696d34d4b97049343) C:\Windows\system32\DRIVERS\AcpiVpc.sys
    13:50:38.0529 6576ACPIVPC - ok
    13:50:38.0669 6576adobeactivefilemonitor5.0 - ok
    13:50:38.0763 6576adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
    13:50:38.0779 6576adp94xx - ok
    13:50:38.0950 6576adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
    13:50:38.0950 6576adpahci - ok
    13:50:39.0106 6576adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
    13:50:39.0106 6576adpu320 - ok
    13:50:39.0153 6576AeLookupSvc (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll
    13:50:39.0153 6576AeLookupSvc - ok
    13:50:39.0247 6576AFD (0dac8bf208bb132ebea0f0366ebd3e6d) C:\Windows\system32\drivers\afd.sys
    13:50:39.0262 6576AFD ( Virus.Win32.ZAccess.k ) - infected
    13:50:39.0262 6576AFD - detected Virus.Win32.ZAccess.k (0)
    13:50:39.0371 6576agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
    13:50:39.0387 6576agp440 - ok
    13:50:39.0481 6576aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
    13:50:39.0481 6576aic78xx - ok
    13:50:39.0512 6576alerter - ok
    13:50:39.0777 6576ALG (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe
    13:50:39.0777 6576ALG - ok
    13:50:39.0808 6576aliadwdm - ok
    13:50:39.0871 6576aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
    13:50:39.0871 6576aliide - ok
    13:50:39.0917 6576amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
    13:50:39.0917 6576amdagp - ok
    13:50:39.0933 6576amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys
    13:50:39.0933 6576amdide - ok
    13:50:40.0011 6576AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
    13:50:40.0011 6576AmdK8 - ok
    13:50:40.0105 6576AMDPCI - ok
    13:50:40.0120 6576AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
    13:50:40.0120 6576AmdPPM - ok
    13:50:40.0198 6576amdsata (d320bf87125326f996d4904fe24300fc) C:\Windows\system32\drivers\amdsata.sys
    13:50:40.0198 6576amdsata - ok
    13:50:40.0229 6576amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
    13:50:40.0245 6576amdsbs - ok
    13:50:40.0276 6576amdxata (46387fb17b086d16dea267d5be23a2f2) C:\Windows\system32\drivers\amdxata.sys
    13:50:40.0276 6576amdxata - ok
    13:50:40.0323 6576Anydlc - ok
    13:50:40.0401 6576AppID (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
    13:50:40.0417 6576AppID - ok
    13:50:40.0495 6576AppIDSvc (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll
    13:50:40.0495 6576AppIDSvc - ok
    13:50:40.0557 6576Appinfo (fb1959012294d6ad43e5304df65e3c26) C:\Windows\System32\appinfo.dll
    13:50:40.0573 6576Appinfo - ok
    13:50:40.0744 6576Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    13:50:40.0744 6576Apple Mobile Device - ok
    13:50:40.0931 6576arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
    13:50:40.0931 6576arc - ok
    13:50:40.0947 6576arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
    13:50:40.0947 6576arcsas - ok
    13:50:41.0009 6576ashampoodefragservice - ok
    13:50:41.0103 6576AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
    13:50:41.0119 6576AsyncMac - ok
    13:50:41.0212 6576atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
    13:50:41.0212 6576atapi - ok
    13:50:41.0306 6576ati2mtag - ok
    13:50:41.0415 6576ATSWPDRV - ok
    13:50:41.0477 6576AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
    13:50:41.0493 6576AudioEndpointBuilder - ok
    13:50:41.0493 6576Audiosrv (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
    13:50:41.0493 6576Audiosrv - ok
    13:50:41.0571 6576avgio - ok
    13:50:41.0789 6576AxInstSV (6e30d02aac9cac84f421622e3a2f6178) C:\Windows\System32\AxInstSV.dll
    13:50:41.0789 6576AxInstSV - ok
    13:50:41.0899 6576b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
    13:50:41.0914 6576b06bdrv - ok
    13:50:42.0055 6576b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
    13:50:42.0055 6576b57nd60x - ok
    13:50:42.0211 6576BCM43XX (61351a6aac26257f333d77ef738f3f3e) C:\Windows\system32\DRIVERS\bcmwl6.sys
    13:50:42.0289 6576BCM43XX - ok
    13:50:42.0351 6576BCMWLNPF - ok
    13:50:42.0429 6576BDESVC (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll
    13:50:42.0429 6576BDESVC - ok
    13:50:42.0507 6576Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
    13:50:42.0507 6576Beep - ok
    13:50:42.0757 6576BFE (1e2bac209d184bb851e1a187d8a29136) C:\Windows\System32\bfe.dll
    13:50:42.0757 6576BFE - ok
    13:50:42.0803 6576BITS (e585445d5021971fae10393f0f1c3961) C:\Windows\system32\qmgr.dll
    13:50:42.0819 6576BITS - ok
    13:50:42.0866 6576blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
    13:50:42.0866 6576blbdrive - ok
    13:50:42.0991 6576Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe
    13:50:42.0991 6576Bonjour Service - ok
    13:50:43.0100 6576bowser (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
    13:50:43.0100 6576bowser - ok
    13:50:43.0178 6576bpenum (2b21b3e9abf067ce0b0878e2517a8971) C:\Windows\system32\DRIVERS\bpenum.sys
    13:50:43.0178 6576bpenum - ok
    13:50:43.0225 6576BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
    13:50:43.0225 6576BrFiltLo - ok
    13:50:43.0240 6576BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
    13:50:43.0240 6576BrFiltUp - ok
    13:50:43.0303 6576Bridge0 (b35bb97b6dd9913093579f5c83962636) C:\Windows\system32\drivers\WDBridge.sys
    13:50:43.0318 6576Bridge0 - ok
    13:50:43.0459 6576BridgeMP (77361d72a04f18809d0efb6cceb74d4b) C:\Windows\system32\DRIVERS\bridge.sys
    13:50:43.0459 6576BridgeMP - ok
    13:50:43.0505 6576Browser (6e11f33d14d020f58d5e02e4d67dfa19) C:\Windows\System32\browser.dll
    13:50:43.0505 6576Browser - ok
    13:50:43.0708 6576Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
    13:50:43.0724 6576Brserid - ok
    13:50:43.0833 6576BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
    13:50:43.0849 6576BrSerWdm - ok
    13:50:43.0864 6576BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
    13:50:43.0864 6576BrUsbMdm - ok
    13:50:43.0880 6576BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
    13:50:43.0880 6576BrUsbSer - ok
    13:50:43.0895 6576BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
    13:50:43.0895 6576BTHMODEM - ok
    13:50:43.0958 6576bthserv (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll
    13:50:43.0958 6576bthserv - ok
    13:50:44.0036 6576btwaudio - ok
    13:50:44.0161 6576catchme - ok
    13:50:44.0285 6576ccpwdsvc - ok
    13:50:44.0363 6576cd20xrnt - ok
    13:50:44.0441 6576cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
    13:50:44.0457 6576cdfs - ok
    13:50:44.0535 6576cdrom (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\drivers\cdrom.sys
    13:50:44.0535 6576cdrom - ok
    13:50:44.0675 6576cdvp - ok
    13:50:44.0753 6576CertPropSvc (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
    13:50:44.0753 6576CertPropSvc - ok
    13:50:44.0816 6576cfosspeed - ok
    13:50:44.0894 6576Cinemsup - ok
    13:50:44.0956 6576circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
    13:50:44.0956 6576circlass - ok
    13:50:45.0065 6576citrixxteserver - ok
    13:50:45.0112 6576CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
    13:50:45.0128 6576CLFS - ok
    13:50:45.0237 6576clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    13:50:45.0253 6576clr_optimization_v2.0.50727_32 - ok
    13:50:45.0331 6576clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    13:50:45.0346 6576clr_optimization_v4.0.30319_32 - ok
    13:50:45.0393 6576CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
    13:50:45.0393 6576CmBatt - ok
    13:50:45.0440 6576cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
    13:50:45.0440 6576cmdide - ok
    13:50:45.0487 6576CNG (6427525d76f61d0c519b008d3680e8e7) C:\Windows\system32\Drivers\cng.sys
    13:50:45.0487 6576CNG - ok
    13:50:45.0518 6576cnxtdiag - ok
    13:50:45.0580 6576CnxtHdAudService (544e2926007f7b57fd5e4a76718e3c85) C:\Windows\system32\drivers\CHDRT32.sys
    13:50:45.0580 6576CnxtHdAudService - ok
    13:50:45.0721 6576compaq_rba - ok
    13:50:45.0799 6576Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
    13:50:45.0799 6576Compbatt - ok
    13:50:45.0955 6576CompositeBus (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys
    13:50:45.0955 6576CompositeBus - ok
    13:50:46.0033 6576COMSysApp - ok
    13:50:46.0064 6576crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
    13:50:46.0079 6576crcdisk - ok
    13:50:46.0220 6576CryptSvc (a585bebf7d054bd9618eda0922d5484a) C:\Windows\system32\cryptsvc.dll
    13:50:46.0220 6576CryptSvc - ok
    13:50:46.0329 6576cvhsvc (72794d112cbaff3bc0c29bf7350d4741) C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
    13:50:46.0345 6576cvhsvc - ok
    13:50:46.0454 6576cvintdrv - ok
    13:50:46.0516 6576DcomLaunch (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll
    13:50:46.0516 6576DcomLaunch - ok
    13:50:46.0750 6576defragsvc (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll
    13:50:46.0750 6576defragsvc - ok
    13:50:46.0906 6576DfsC (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
    13:50:46.0906 6576DfsC - ok
    13:50:47.0078 6576Dhcp (e9e01eb683c132f7fa27cd607b8a2b63) C:\Windows\system32\dhcpcore.dll
    13:50:47.0078 6576Dhcp - ok
    13:50:47.0125 6576discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
    13:50:47.0125 6576discache - ok
    13:50:47.0171 6576Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
    13:50:47.0171 6576Disk - ok
    13:50:47.0312 6576DLARTL_M - ok
    13:50:47.0359 6576Dnscache (33ef4861f19a0736b11314aad9ae28d0) C:\Windows\System32\dnsrslvr.dll
    13:50:47.0359 6576Dnscache - ok
    13:50:47.0405 6576dot3svc (366ba8fb4b7bb7435e3b9eacb3843f67) C:\Windows\System32\dot3svc.dll
    13:50:47.0405 6576dot3svc - ok
    13:50:47.0452 6576DPS (8ec04ca86f1d68da9e11952eb85973d6) C:\Windows\system32\dps.dll
    13:50:47.0452 6576DPS - ok
    13:50:47.0515 6576DritekPortIO - ok
    13:50:47.0639 6576drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
    13:50:47.0639 6576drmkaud - ok
    13:50:47.0780 6576DXGKrnl (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
    13:50:47.0795 6576DXGKrnl - ok
    13:50:47.0936 6576EapHost (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll
    13:50:47.0951 6576EapHost - ok
    13:50:48.0154 6576ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
    13:50:48.0232 6576ebdrv - ok
    13:50:48.0357 6576EFS (81951f51e318aecc2d68559e47485cc4) C:\Windows\System32\lsass.exe
    13:50:48.0373 6576EFS - ok
    13:50:48.0466 6576ehRecvr (a8c362018efc87beb013ee28f29c0863) C:\Windows\ehome\ehRecvr.exe
    13:50:48.0482 6576ehRecvr - ok
    13:50:48.0513 6576ehSched (d389bff34f80caede417bf9d1507996a) C:\Windows\ehome\ehsched.exe
    13:50:48.0513 6576ehSched - ok
    13:50:48.0685 6576elosystemservice - ok
    13:50:48.0809 6576elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
    13:50:48.0825 6576elxstor - ok
    13:50:48.0919 6576entech - ok
    13:50:48.0965 6576ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
    13:50:48.0965 6576ErrDev - ok
    13:50:49.0043 6576ETD (0daa932ae06b47e0f4b1c02f6575be05) C:\Windows\system32\DRIVERS\ETD.sys
    13:50:49.0043 6576ETD - ok
    13:50:49.0184 6576EventSystem (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll
    13:50:49.0184 6576EventSystem - ok
    13:50:49.0231 6576exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
    13:50:49.0231 6576exfat - ok
    13:50:49.0246 6576fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
    13:50:49.0262 6576fastfat - ok
    13:50:49.0293 6576Fax (967ea5b213e9984cbe270205df37755b) C:\Windows\system32\fxssvc.exe
    13:50:49.0309 6576Fax - ok
    13:50:49.0340 6576fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
    13:50:49.0340 6576fdc - ok
    13:50:49.0371 6576fdPHost (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll
    13:50:49.0371 6576fdPHost - ok
    13:50:49.0387 6576FDResPub (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll
    13:50:49.0402 6576FDResPub - ok
    13:50:49.0418 6576FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
    13:50:49.0418 6576FileInfo - ok
    13:50:49.0449 6576Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
    13:50:49.0449 6576Filetrace - ok
    13:50:49.0465 6576flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
    13:50:49.0465 6576flpydisk - ok
    13:50:49.0543 6576FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
    13:50:49.0543 6576FltMgr - ok
    13:50:49.0667 6576flutilssvc - ok
    13:50:49.0714 6576FontCache (b3a5ec6b6b6673db7e87c2bcdbddc074) C:\Windows\system32\FntCache.dll
    13:50:49.0730 6576FontCache - ok
    13:50:49.0901 6576FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    13:50:49.0901 6576FontCache3.0.0.0 - ok
    13:50:49.0948 6576FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
    13:50:49.0948 6576FsDepends - ok
    13:50:49.0995 6576Fs_Rec (7dae5ebcc80e45d3253f4923dc424d05) C:\Windows\system32\drivers\Fs_Rec.sys
    13:50:49.0995 6576Fs_Rec - ok
    13:50:50.0073 6576fvevol (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
    13:50:50.0073 6576fvevol - ok
    13:50:50.0229 6576gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
    13:50:50.0229 6576gagp30kx - ok
    13:50:50.0369 6576GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
    13:50:50.0369 6576GEARAspiWDM - ok
    13:50:50.0479 6576gpsvc (e897eaf5ed6ba41e081060c9b447a673) C:\Windows\System32\gpsvc.dll
    13:50:50.0479 6576gpsvc - ok
    13:50:50.0541 6576hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
    13:50:50.0541 6576hcw85cir - ok
    13:50:50.0744 6576HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys
    13:50:50.0759 6576HdAudAddService - ok
    13:50:50.0822 6576HDAudBus (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys
    13:50:50.0822 6576HDAudBus - ok
    13:50:50.0869 6576HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
    13:50:50.0869 6576HidBatt - ok
    13:50:50.0900 6576HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
    13:50:50.0900 6576HidBth - ok
    13:50:50.0931 6576HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
    13:50:50.0931 6576HidIr - ok
    13:50:50.0978 6576hidserv (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\System32\hidserv.dll
    13:50:50.0978 6576hidserv - ok
    13:50:51.0056 6576HidUsb (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\drivers\hidusb.sys
    13:50:51.0056 6576HidUsb - ok
    13:50:51.0087 6576hkmsvc (196b4e3f4cccc24af836ce58facbb699) C:\Windows\system32\kmsvc.dll
    13:50:51.0103 6576hkmsvc - ok
    13:50:51.0134 6576HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\Windows\system32\ListSvc.dll
    13:50:51.0149 6576HomeGroupListener - ok
  8. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    (cont)

    13:50:51.0212 6576HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\Windows\system32\provsvc.dll
    13:50:51.0212 6576HomeGroupProvider - ok
    13:50:51.0227 6576hpqwmi - ok
    13:50:51.0305 6576HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
    13:50:51.0305 6576HpSAMD - ok
    13:50:51.0446 6576HPSLPSVC - ok
    13:50:51.0508 6576HTTP (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
    13:50:51.0508 6576HTTP - ok
    13:50:51.0555 6576hwpolicy (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
    13:50:51.0555 6576hwpolicy - ok
    13:50:51.0695 6576i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys
    13:50:51.0695 6576i8042prt - ok
    13:50:51.0836 6576iAimFP5 - ok
    13:50:51.0914 6576iaStor (edf5ecc965faaa533d35e02f47b9132e) C:\Windows\system32\DRIVERS\iaStor.sys
    13:50:51.0914 6576iaStor - ok
    13:50:52.0007 6576IAStorDataMgrSvc (cc800d2d9fd467542bac7c186c4774ad) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    13:50:52.0007 6576IAStorDataMgrSvc - ok
    13:50:52.0163 6576iaStorV (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys
    13:50:52.0179 6576iaStorV - ok
    13:50:52.0179 6576icm10blk - ok
    13:50:52.0273 6576idsvc (c521d7eb6497bb1af6afa89e322fb43c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
    13:50:52.0319 6576idsvc - ok
    13:50:52.0553 6576igfx (8266ae06df974e5ba047b3e9e9e70b3f) C:\Windows\system32\DRIVERS\igdkmd32.sys
    13:50:52.0787 6576igfx - ok
    13:50:52.0897 6576IGRS (d951d20153e51928f9db2227d6ff5c7a) C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe
    13:50:52.0897 6576IGRS - ok
    13:50:53.0053 6576iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
    13:50:53.0053 6576iirsp - ok
    13:50:53.0099 6576IKEEXT (f95622f161474511b8d80d6b093aa610) C:\Windows\System32\ikeext.dll
    13:50:53.0131 6576IKEEXT - ok
    13:50:53.0224 6576Impcd (e3c36ac5ae87ec970ae8ea2a93d59ae1) C:\Windows\system32\DRIVERS\Impcd.sys
    13:50:53.0224 6576Impcd - ok
    13:50:53.0333 6576IntcDAud (29061f25abb6e60a5b49fbeed7a5698a) C:\Windows\system32\DRIVERS\IntcDAud.sys
    13:50:53.0333 6576IntcDAud - ok
    13:50:53.0380 6576intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
    13:50:53.0380 6576intelide - ok
    13:50:53.0458 6576intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
    13:50:53.0458 6576intelppm - ok
    13:50:53.0505 6576IPBusEnum (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll
    13:50:53.0505 6576IPBusEnum - ok
    13:50:53.0521 6576IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
    13:50:53.0521 6576IpFilterDriver - ok
    13:50:53.0708 6576iphlpsvc (4d65a07b795d6674312f879d09aa7663) C:\Windows\System32\iphlpsvc.dll
    13:50:53.0723 6576iphlpsvc - ok
    13:50:53.0833 6576IPMIDRV (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
    13:50:53.0848 6576IPMIDRV - ok
    13:50:53.0911 6576IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
    13:50:53.0911 6576IPNAT - ok
    13:50:54.0035 6576iPod Service (178fe38b7740f598391eb2f51ae4ccac) C:\Program Files\iPod\bin\iPodService.exe
    13:50:54.0067 6576iPod Service - ok
    13:50:54.0207 6576IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
    13:50:54.0207 6576IRENUM - ok
    13:50:54.0254 6576isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
    13:50:54.0254 6576isapnp - ok
    13:50:54.0285 6576iScsiPrt (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
    13:50:54.0285 6576iScsiPrt - ok
    13:50:54.0363 6576kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys
    13:50:54.0363 6576kbdclass - ok
    13:50:54.0441 6576kbdhid (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys
    13:50:54.0441 6576kbdhid - ok
    13:50:54.0472 6576KeyIso (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
    13:50:54.0472 6576KeyIso - ok
    13:50:54.0503 6576KSecDD (f4647bb23db9038a7536cf6b68f4207f) C:\Windows\system32\Drivers\ksecdd.sys
    13:50:54.0503 6576KSecDD - ok
    13:50:54.0535 6576KSecPkg (e73cae53bbb72ba26918492c6b4c229d) C:\Windows\system32\Drivers\ksecpkg.sys
    13:50:54.0535 6576KSecPkg - ok
    13:50:54.0581 6576KtmRm (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll
    13:50:54.0581 6576KtmRm - ok
    13:50:54.0722 6576L6POD - ok
    13:50:54.0737 6576L8042Kbd - ok
    13:50:54.0847 6576LanmanServer (d64af876d53eca3668bb97b51b4e70ab) C:\Windows\System32\srvsvc.dll
    13:50:54.0847 6576LanmanServer - ok
    13:50:54.0971 6576LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\Windows\System32\wkssvc.dll
    13:50:54.0971 6576LanmanWorkstation - ok
    13:50:55.0096 6576Lenovo ReadyComm AppSvc (7fcb3ec66361f157bcd5b5c33ce2ac16) C:\Program Files\Lenovo\ReadyComm\AppSvc.exe
    13:50:55.0112 6576Lenovo ReadyComm AppSvc - ok
    13:50:55.0127 6576Lenovo ReadyComm ConnSvc (5287074e79e4ba82510886f684dc5f72) C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe
    13:50:55.0143 6576Lenovo ReadyComm ConnSvc - ok
    13:50:55.0268 6576libusb0 (b280c4608ac389da9515a35ac4cab0fd) C:\Windows\system32\drivers\libusb0.sys
    13:50:55.0268 6576libusb0 - ok
    13:50:55.0330 6576license - ok
    13:50:55.0517 6576lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
    13:50:55.0517 6576lltdio - ok
    13:50:55.0549 6576lltdsvc (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll
    13:50:55.0564 6576lltdsvc - ok
    13:50:55.0580 6576lmhosts (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll
    13:50:55.0580 6576lmhosts - ok
    13:50:55.0611 6576lmimirr - ok
    13:50:55.0954 6576LPDSVC - ok
    13:50:56.0079 6576LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
    13:50:56.0079 6576LSI_FC - ok
    13:50:56.0110 6576LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
    13:50:56.0126 6576LSI_SAS - ok
    13:50:56.0219 6576LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
    13:50:56.0219 6576LSI_SAS2 - ok
    13:50:56.0266 6576LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
    13:50:56.0266 6576LSI_SCSI - ok
    13:50:56.0313 6576luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
    13:50:56.0313 6576luafv - ok
    13:50:56.0391 6576lusbaudio - ok
    13:50:56.0469 6576LVBulk - ok
    13:50:56.0485 6576LVVI500A - ok
    13:50:56.0578 6576MBAMProtector (fb097bbc1a18f044bd17bd2fccf97865) C:\Windows\system32\drivers\mbam.sys
    13:50:56.0594 6576MBAMProtector - ok
    13:50:56.0703 6576MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    13:50:56.0719 6576MBAMService - ok
    13:50:56.0875 6576mcproxy - ok
    13:50:57.0109 6576Mcx2Svc (bfb9ee8ee977efe85d1a3105abef6dd1) C:\Windows\system32\Mcx2Svc.dll
    13:50:57.0109 6576Mcx2Svc - ok
    13:50:57.0374 6576megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
    13:50:57.0374 6576megasas - ok
    13:50:57.0483 6576MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
    13:50:57.0483 6576MegaSR - ok
    13:50:57.0514 6576MMCSS (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
    13:50:57.0530 6576MMCSS - ok
    13:50:57.0561 6576Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
    13:50:57.0561 6576Modem - ok
    13:50:57.0686 6576monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
    13:50:57.0686 6576monitor - ok
    13:50:57.0904 6576mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\drivers\mouclass.sys
    13:50:57.0920 6576mouclass - ok
    13:50:58.0123 6576mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
    13:50:58.0123 6576mouhid - ok
    13:50:58.0169 6576mountmgr (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
    13:50:58.0185 6576mountmgr - ok
    13:50:58.0201 6576mpio (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
    13:50:58.0216 6576mpio - ok
    13:50:58.0247 6576MpKsl5975f928 - ok
    13:50:58.0403 6576mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
    13:50:58.0403 6576mpsdrv - ok
    13:50:58.0591 6576MpsSvc (9835584e999d25004e1ee8e5f3e3b881) C:\Windows\system32\mpssvc.dll
    13:50:58.0606 6576MpsSvc - ok
    13:50:58.0887 6576mqdmbus - ok
    13:50:59.0027 6576MRxDAV (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
    13:50:59.0027 6576MRxDAV - ok
    13:50:59.0277 6576mrxsmb (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
    13:50:59.0277 6576mrxsmb - ok
    13:50:59.0324 6576mrxsmb10 (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
    13:50:59.0339 6576mrxsmb10 - ok
    13:50:59.0355 6576mrxsmb20 (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
    13:50:59.0371 6576mrxsmb20 - ok
    13:50:59.0402 6576msahci (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
    13:50:59.0402 6576msahci - ok
    13:50:59.0449 6576msdsm (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
    13:50:59.0464 6576msdsm - ok
    13:50:59.0542 6576MSDTC (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe
    13:50:59.0558 6576MSDTC - ok
    13:50:59.0620 6576Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
    13:50:59.0620 6576Msfs - ok
    13:50:59.0620 6576MSFWHLPR - ok
    13:50:59.0667 6576mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
    13:50:59.0667 6576mshidkmdf - ok
    13:50:59.0698 6576msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
    13:50:59.0698 6576msisadrv - ok
    13:50:59.0808 6576MSiSCSI (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll
    13:50:59.0808 6576MSiSCSI - ok
    13:50:59.0823 6576msiserver - ok
    13:50:59.0917 6576MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
    13:50:59.0917 6576MSKSSRV - ok
    13:50:59.0979 6576MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
    13:50:59.0979 6576MSPCLOCK - ok
    13:50:59.0995 6576MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
    13:50:59.0995 6576MSPQM - ok
    13:51:00.0026 6576MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
    13:51:00.0026 6576MsRPC - ok
    13:51:00.0073 6576mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys
    13:51:00.0073 6576mssmbios - ok
    13:51:00.0135 6576MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
    13:51:00.0135 6576MSTEE - ok
    13:51:00.0151 6576MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
    13:51:00.0151 6576MTConfig - ok
    13:51:00.0182 6576Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
    13:51:00.0182 6576Mup - ok
    13:51:00.0198 6576mxserver - ok
    13:51:00.0244 6576napagent (61d57a5d7c6d9afe10e77dae6e1b445e) C:\Windows\system32\qagentRT.dll
    13:51:00.0260 6576napagent - ok
    13:51:00.0338 6576NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
    13:51:00.0338 6576NativeWifiP - ok
    13:51:00.0385 6576navap - ok
    13:51:00.0447 6576NDIS (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys
    13:51:00.0463 6576NDIS - ok
    13:51:00.0868 6576NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
    13:51:00.0868 6576NdisCap - ok
    13:51:00.0978 6576NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
    13:51:00.0978 6576NdisTapi - ok
    13:51:01.0071 6576Ndisuio (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
    13:51:01.0071 6576Ndisuio - ok
    13:51:01.0118 6576NdisWan (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
    13:51:01.0134 6576NdisWan - ok
    13:51:01.0165 6576NDProxy (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
    13:51:01.0165 6576NDProxy - ok
    13:51:01.0243 6576Netaapl (7afd0e39ab15cb355487b7cc19f4e2c5) C:\Windows\system32\DRIVERS\netaapl.sys
    13:51:01.0243 6576Netaapl - ok
    13:51:01.0290 6576NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
    13:51:01.0290 6576NetBIOS - ok
    13:51:01.0336 6576NetBT (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
    13:51:01.0336 6576NetBT - ok
    13:51:01.0383 6576Netlogon (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
    13:51:01.0383 6576Netlogon - ok
    13:51:01.0492 6576Netman (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll
    13:51:01.0492 6576Netman - ok
    13:51:01.0524 6576netmnt - ok
    13:51:01.0570 6576netprofm (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll
    13:51:01.0586 6576netprofm - ok
    13:51:01.0726 6576NetTcpPortSharing (f476ec40033cdb91efbe73eb99b8362d) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
    13:51:01.0773 6576NetTcpPortSharing - ok
    13:51:01.0820 6576NETw4v32 - ok
    13:51:01.0976 6576nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
    13:51:01.0976 6576nfrd960 - ok
    13:51:02.0007 6576NITaggerService - ok
    13:51:02.0148 6576NlaSvc (912084381d30d8b89ec4e293053f4710) C:\Windows\System32\nlasvc.dll
    13:51:02.0163 6576NlaSvc - ok
    13:51:02.0272 6576nod32krn - ok
    13:51:02.0428 6576Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
    13:51:02.0428 6576Npfs - ok
    13:51:02.0569 6576npkcusb - ok
    13:51:02.0616 6576nsi (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll
    13:51:02.0616 6576nsi - ok
    13:51:02.0803 6576nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
    13:51:02.0818 6576nsiproxy - ok
    13:51:03.0006 6576NsTrcNT - ok
    13:51:03.0224 6576ntcharge - ok
    13:51:03.0302 6576Ntfs (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys
    13:51:03.0333 6576Ntfs - ok
    13:51:03.0411 6576Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
    13:51:03.0411 6576Null - ok
    13:51:03.0489 6576nvraid (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys
    13:51:03.0505 6576nvraid - ok
    13:51:03.0583 6576nvstor (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys
    13:51:03.0598 6576nvstor - ok
    13:51:03.0848 6576nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
    13:51:03.0848 6576nv_agp - ok
    13:51:03.0957 6576ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
    13:51:03.0957 6576ohci1394 - ok
    13:51:04.0004 6576oracledbconsoleorcl - ok
    13:51:04.0129 6576ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    13:51:04.0129 6576ose - ok
    13:51:04.0597 6576osppsvc (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    13:51:04.0706 6576osppsvc - ok
    13:51:04.0846 6576p2pimsvc (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
    13:51:04.0862 6576p2pimsvc - ok
    13:51:04.0971 6576p2psvc (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll
    13:51:04.0971 6576p2psvc - ok
    13:51:05.0018 6576Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
    13:51:05.0034 6576Parport - ok
    13:51:05.0065 6576partmgr (bf8f6af06da75b336f07e23aef97d93b) C:\Windows\system32\drivers\partmgr.sys
    13:51:05.0065 6576partmgr - ok
    13:51:05.0096 6576Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
    13:51:05.0096 6576Parvdm - ok
    13:51:05.0143 6576passthru - ok
    13:51:05.0190 6576PcaSvc (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll
    13:51:05.0190 6576PcaSvc - ok
    13:51:05.0221 6576pci (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
    13:51:05.0221 6576pci - ok
    13:51:05.0268 6576pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
    13:51:05.0268 6576pciide - ok
    13:51:05.0314 6576pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
    13:51:05.0314 6576pcmcia - ok
    13:51:05.0346 6576pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
    13:51:05.0346 6576pcw - ok
    13:51:05.0392 6576PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
    13:51:05.0392 6576PEAUTH - ok
    13:51:05.0439 6576PhilCam8116_XP - ok
    13:51:05.0455 6576pid_0928 - ok
    13:51:05.0470 6576pinger - ok
    13:51:05.0564 6576pla (414bba67a3ded1d28437eb66aeb8a720) C:\Windows\system32\pla.dll
    13:51:05.0595 6576pla - ok
    13:51:05.0720 6576PlugPlay (ec7bc28d207da09e79b3e9faf8b232ca) C:\Windows\system32\umpnpmgr.dll
    13:51:05.0736 6576PlugPlay - ok
    13:51:05.0876 6576pnarp - ok
    13:51:05.0954 6576pnmsrv - ok
    13:51:06.0001 6576PNRPAutoReg (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll
    13:51:06.0001 6576PNRPAutoReg - ok
    13:51:06.0079 6576PNRPsvc (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
    13:51:06.0079 6576PNRPsvc - ok
    13:51:06.0204 6576PolicyAgent (53946b69ba0836bd95b03759530c81ec) C:\Windows\System32\ipsecsvc.dll
    13:51:06.0204 6576PolicyAgent - ok
    13:51:06.0219 6576portmapper - ok
    13:51:06.0266 6576Power (f87d30e72e03d579a5199ccb3831d6ea) C:\Windows\system32\umpo.dll
    13:51:06.0266 6576Power - ok
    13:51:06.0406 6576PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
    13:51:06.0406 6576PptpMiniport - ok
    13:51:06.0438 6576Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
    13:51:06.0453 6576Processor - ok
    13:51:06.0531 6576ProfSvc (43ca4ccc22d52fb58e8988f0198851d0) C:\Windows\system32\profsvc.dll
    13:51:06.0531 6576ProfSvc - ok
    13:51:06.0594 6576ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
    13:51:06.0594 6576ProtectedStorage - ok
    13:51:06.0672 6576Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
  9. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    (cont)

    13:51:06.0672 6576Psched - ok
    13:51:06.0781 6576PS_MDP - ok
    13:51:06.0859 6576PTproct - ok
    13:51:07.0046 6576pwisvc - ok
    13:51:07.0124 6576ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
    13:51:07.0171 6576ql2300 - ok
    13:51:07.0202 6576ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
    13:51:07.0202 6576ql40xx - ok
    13:51:07.0342 6576quickbooksdb - ok
    13:51:07.0436 6576QWAVE (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll
    13:51:07.0436 6576QWAVE - ok
    13:51:07.0561 6576QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
    13:51:07.0561 6576QWAVEdrv - ok
    13:51:07.0592 6576RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
    13:51:07.0592 6576RasAcd - ok
    13:51:07.0795 6576RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
    13:51:07.0810 6576RasAgileVpn - ok
    13:51:07.0826 6576RasAuto (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll
    13:51:07.0842 6576RasAuto - ok
    13:51:07.0904 6576Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
    13:51:07.0920 6576Rasl2tp - ok
    13:51:08.0076 6576RasMan (cb9e04dc05eacf5b9a36ca276d475006) C:\Windows\System32\rasmans.dll
    13:51:08.0076 6576RasMan - ok
    13:51:08.0232 6576RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
    13:51:08.0232 6576RasPppoe - ok
    13:51:08.0263 6576RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
    13:51:08.0263 6576RasSstp - ok
    13:51:08.0294 6576rdbss (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
    13:51:08.0310 6576rdbss - ok
    13:51:08.0341 6576rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
    13:51:08.0341 6576rdpbus - ok
    13:51:08.0372 6576RDPCDD (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
    13:51:08.0372 6576RDPCDD - ok
    13:51:08.0434 6576RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
    13:51:08.0434 6576RDPENCDD - ok
    13:51:08.0497 6576RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
    13:51:08.0497 6576RDPREFMP - ok
    13:51:08.0559 6576RDPWD (244c83332f44589ae98fc347f11b2693) C:\Windows\system32\drivers\RDPWD.sys
    13:51:08.0575 6576RDPWD - ok
    13:51:08.0715 6576rdyboost (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
    13:51:08.0731 6576rdyboost - ok
    13:51:08.0778 6576ReadyComm.DirectRouter - ok
    13:51:08.0809 6576RemoteAccess (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll
    13:51:08.0824 6576RemoteAccess - ok
    13:51:08.0856 6576RemoteRegistry (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll
    13:51:08.0856 6576RemoteRegistry - ok
    13:51:08.0949 6576RimUsb (616eac1b0e48b236a5a9b8ae07fdb81c) C:\Windows\system32\Drivers\RimUsb.sys
    13:51:08.0949 6576RimUsb - ok
    13:51:09.0121 6576RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys
    13:51:09.0121 6576RimVSerPort - ok
    13:51:09.0152 6576rnadiagnosticsservice - ok
    13:51:09.0277 6576ROOTMODEM (564297827d213f52c7a3a2ff749568ca) C:\Windows\system32\Drivers\RootMdm.sys
    13:51:09.0277 6576ROOTMODEM - ok
    13:51:09.0417 6576RpcEptMapper (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll
    13:51:09.0433 6576RpcEptMapper - ok
    13:51:09.0464 6576RpcLocator (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe
    13:51:09.0480 6576RpcLocator - ok
    13:51:09.0511 6576RpcSs (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll
    13:51:09.0526 6576RpcSs - ok
    13:51:09.0667 6576rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
    13:51:09.0667 6576rspndr - ok
    13:51:09.0807 6576RSUSBSTOR (9f66b1355a53ff3ff9d0e7dfdd2f3dc9) C:\Windows\system32\Drivers\RtsUStor.sys
    13:51:09.0807 6576RSUSBSTOR - ok
    13:51:09.0885 6576RTL8167 (05c2613f661584190c752f6184d1c8ef) C:\Windows\system32\DRIVERS\Rt86win7.sys
    13:51:09.0901 6576RTL8167 - ok
    13:51:10.0026 6576s3savagenb - ok
    13:51:10.0088 6576s716unic - ok
    13:51:10.0150 6576SamSs (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
    13:51:10.0150 6576SamSs - ok
    13:51:10.0244 6576sbp2port (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
    13:51:10.0244 6576sbp2port - ok
    13:51:10.0291 6576SCardSvr (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll
    13:51:10.0291 6576SCardSvr - ok
    13:51:10.0338 6576scfilter (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
    13:51:10.0338 6576scfilter - ok
    13:51:10.0384 6576Schedule (a04bb13f8a72f8b6e8b4071723e4e336) C:\Windows\system32\schedsvc.dll
    13:51:10.0400 6576Schedule - ok
    13:51:10.0447 6576SCPolicySvc (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
    13:51:10.0447 6576SCPolicySvc - ok
    13:51:10.0509 6576sdbus - ok
    13:51:10.0556 6576SDRSVC (08236c4bce5edd0a0318a438af28e0f7) C:\Windows\System32\SDRSVC.dll
    13:51:10.0634 6576SDRSVC - ok
    13:51:10.0790 6576se45mdfl - ok
    13:51:10.0868 6576secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
    13:51:10.0868 6576secdrv - ok
    13:51:10.0915 6576seclogon (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll
    13:51:10.0915 6576seclogon - ok
    13:51:10.0962 6576SENS (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\system32\sens.dll
    13:51:10.0977 6576SENS - ok
    13:51:11.0008 6576SensrSvc (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll
    13:51:11.0008 6576SensrSvc - ok
    13:51:11.0040 6576Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
    13:51:11.0055 6576Serenum - ok
    13:51:11.0071 6576Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
    13:51:11.0071 6576Serial - ok
    13:51:11.0118 6576sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
    13:51:11.0118 6576sermouse - ok
    13:51:11.0196 6576SessionEnv (4ae380f39a0032eab7dd953030b26d28) C:\Windows\system32\sessenv.dll
    13:51:11.0196 6576SessionEnv - ok
    13:51:11.0227 6576sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
    13:51:11.0227 6576sffdisk - ok
    13:51:11.0274 6576sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
    13:51:11.0274 6576sffp_mmc - ok
    13:51:11.0289 6576sffp_sd (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
    13:51:11.0289 6576sffp_sd - ok
    13:51:11.0352 6576sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
    13:51:11.0367 6576sfloppy - ok
    13:51:11.0445 6576Sftfs (d9b734638dd8dba9d59aad3189cd0fad) C:\Windows\system32\DRIVERS\Sftfslh.sys
    13:51:11.0445 6576Sftfs - ok
    13:51:11.0539 6576sftlist (cb73bc422c07fb611f194da18d1e7f36) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
    13:51:11.0554 6576sftlist - ok
    13:51:11.0695 6576Sftplay (2f61bd46c0bff4eb36e1e359ca17bfc5) C:\Windows\system32\DRIVERS\Sftplaylh.sys
    13:51:11.0695 6576Sftplay - ok
    13:51:11.0851 6576Sftredir (518bac0179f94304f422696b47c0ec12) C:\Windows\system32\DRIVERS\Sftredirlh.sys
    13:51:11.0851 6576Sftredir - ok
    13:51:11.0976 6576Sftvol (747325236d88b3f05ffd27ff9ec711c5) C:\Windows\system32\DRIVERS\Sftvollh.sys
    13:51:11.0976 6576Sftvol - ok
    13:51:12.0069 6576sftvsa (a5812f0281ca5081bf696626f9bf324d) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
    13:51:12.0085 6576sftvsa - ok
    13:51:12.0194 6576SharedAccess (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll
    13:51:12.0210 6576SharedAccess - ok
    13:51:12.0334 6576ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\Windows\System32\shsvcs.dll
    13:51:12.0334 6576ShellHWDetection - ok
    13:51:12.0428 6576Si3132r5 - ok
    13:51:12.0615 6576sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
    13:51:12.0615 6576sisagp - ok
    13:51:12.0771 6576SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
    13:51:12.0771 6576SiSRaid2 - ok
    13:51:12.0787 6576SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
    13:51:12.0802 6576SiSRaid4 - ok
    13:51:12.0849 6576Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
    13:51:12.0849 6576Smb - ok
    13:51:12.0943 6576snareiis - ok
    13:51:13.0021 6576SNMPTRAP (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe
    13:51:13.0021 6576SNMPTRAP - ok
    13:51:13.0083 6576snpstd - ok
    13:51:13.0208 6576spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
    13:51:13.0208 6576spldr - ok
    13:51:13.0255 6576Spooler (866a43013535dc8587c258e43579c764) C:\Windows\System32\spoolsv.exe
    13:51:13.0270 6576Spooler - ok
    13:51:13.0395 6576sppsvc (cf87a1de791347e75b98885214ced2b8) C:\Windows\system32\sppsvc.exe
    13:51:13.0489 6576sppsvc - ok
    13:51:13.0598 6576sppuinotify (b0180b20b065d89232a78a40fe56eaa6) C:\Windows\system32\sppuinotify.dll
    13:51:13.0614 6576sppuinotify - ok
    13:51:13.0660 6576srv (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
    13:51:13.0660 6576srv - ok
    13:51:13.0692 6576srv2 (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
    13:51:13.0707 6576srv2 - ok
    13:51:13.0785 6576srvnet (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
    13:51:13.0801 6576srvnet - ok
    13:51:13.0848 6576SSDPSRV (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll
    13:51:13.0863 6576SSDPSRV - ok
    13:51:13.0879 6576SstpSvc (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll
    13:51:13.0879 6576SstpSvc - ok
    13:51:13.0972 6576stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
    13:51:13.0972 6576stexstor - ok
    13:51:14.0066 6576StiSvc (e1fb3706030fb4578a0d72c2fc3689e4) C:\Windows\System32\wiaservc.dll
    13:51:14.0082 6576StiSvc - ok
    13:51:14.0097 6576StkScan - ok
    13:51:14.0191 6576swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys
    13:51:14.0191 6576swenum - ok
    13:51:14.0222 6576SWNC8U51 - ok
    13:51:14.0269 6576swprv (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll
    13:51:14.0284 6576swprv - ok
    13:51:14.0362 6576SysMain (36650d618ca34c9d357dfd3d89b2c56f) C:\Windows\system32\sysmain.dll
    13:51:14.0425 6576SysMain - ok
    13:51:14.0472 6576TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\Windows\System32\TabSvc.dll
    13:51:14.0472 6576TabletInputService - ok
    13:51:14.0550 6576TapiSrv (613bf4820361543956909043a265c6ac) C:\Windows\System32\tapisrv.dll
    13:51:14.0565 6576TapiSrv - ok
    13:51:14.0721 6576TBS (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll
    13:51:14.0721 6576TBS - ok
    13:51:14.0815 6576Tcpip (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\drivers\tcpip.sys
    13:51:14.0846 6576Tcpip - ok
    13:51:15.0033 6576TCPIP6 (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\DRIVERS\tcpip.sys
    13:51:15.0033 6576TCPIP6 - ok
    13:51:15.0127 6576tcpipreg (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
    13:51:15.0127 6576tcpipreg - ok
    13:51:15.0252 6576TDPIPE (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
    13:51:15.0252 6576TDPIPE - ok
    13:51:15.0267 6576tdrpman174 - ok
    13:51:15.0314 6576TDTCP (2c2c5afe7ee4f620d69c23c0617651a8) C:\Windows\system32\drivers\tdtcp.sys
    13:51:15.0314 6576TDTCP - ok
    13:51:15.0376 6576tdx (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
    13:51:15.0392 6576tdx - ok
    13:51:15.0501 6576TeamViewer - ok
    13:51:15.0564 6576TermDD (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys
    13:51:15.0564 6576TermDD - ok
    13:51:15.0688 6576TermService (382c804c92811be57829d8e550a900e2) C:\Windows\System32\termsrv.dll
    13:51:15.0704 6576TermService - ok
    13:51:15.0782 6576Themes (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll
    13:51:15.0782 6576Themes - ok
    13:51:15.0813 6576thotkey - ok
    13:51:15.0860 6576THREADORDER (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
    13:51:15.0876 6576THREADORDER - ok
    13:51:15.0876 6576timounter - ok
    13:51:15.0922 6576tng-dts - ok
    13:51:15.0954 6576tpkmpsvc - ok
    13:51:15.0969 6576trioservice - ok
    13:51:16.0032 6576TrkWks (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll
    13:51:16.0032 6576TrkWks - ok
    13:51:16.0078 6576TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\Windows\servicing\TrustedInstaller.exe
    13:51:16.0078 6576TrustedInstaller - ok
    13:51:16.0141 6576tssecsrv (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
    13:51:16.0141 6576tssecsrv - ok
    13:51:16.0234 6576TsUsbFlt (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
    13:51:16.0234 6576TsUsbFlt - ok
    13:51:16.0375 6576tunnel (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
    13:51:16.0375 6576tunnel - ok
    13:51:16.0406 6576tvalz - ok
    13:51:16.0453 6576uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
    13:51:16.0468 6576uagp35 - ok
    13:51:16.0531 6576udfs (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
    13:51:16.0531 6576udfs - ok
    13:51:16.0593 6576UI0Detect (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe
    13:51:16.0593 6576UI0Detect - ok
    13:51:16.0718 6576uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
    13:51:16.0718 6576uliagpkx - ok
    13:51:16.0843 6576umbus (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys
    13:51:16.0858 6576umbus - ok
    13:51:16.0905 6576UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
    13:51:16.0905 6576UmPass - ok
    13:51:16.0968 6576upnphost (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll
    13:51:16.0968 6576upnphost - ok
    13:51:16.0999 6576USBAAPL (83cafcb53201bbac04d822f32438e244) C:\Windows\system32\Drivers\usbaapl.sys
    13:51:17.0014 6576USBAAPL - ok
    13:51:17.0092 6576usbaudio (1d9f2bd026e8e2d45033a4df3f16b78c) C:\Windows\system32\drivers\usbaudio.sys
    13:51:17.0092 6576usbaudio - ok
    13:51:17.0124 6576USBCamera - ok
    13:51:17.0170 6576usbccgp (bd9c55d7023c5de374507acc7a14e2ac) C:\Windows\system32\DRIVERS\usbccgp.sys
    13:51:17.0170 6576usbccgp - ok
    13:51:17.0233 6576usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
    13:51:17.0233 6576usbcir - ok
    13:51:17.0264 6576usbehci (f92de757e4b7ce9c07c5e65423f3ae3b) C:\Windows\system32\drivers\usbehci.sys
    13:51:17.0264 6576usbehci - ok
    13:51:17.0326 6576usbhub (8dc94aec6a7e644a06135ae7506dc2e9) C:\Windows\system32\DRIVERS\usbhub.sys
    13:51:17.0342 6576usbhub - ok
    13:51:17.0373 6576usbohci (e185d44fac515a18d9deddc23c2cdf44) C:\Windows\system32\drivers\usbohci.sys
    13:51:17.0373 6576usbohci - ok
    13:51:17.0436 6576usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
    13:51:17.0436 6576usbprint - ok
    13:51:17.0545 6576usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys
    13:51:17.0545 6576usbscan - ok
    13:51:17.0638 6576USBSTOR (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS
    13:51:17.0638 6576USBSTOR - ok
    13:51:17.0685 6576usbuhci (68df884cf41cdada664beb01daf67e3d) C:\Windows\system32\drivers\usbuhci.sys
    13:51:17.0685 6576usbuhci - ok
    13:51:17.0748 6576usbvideo (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\Windows\system32\Drivers\usbvideo.sys
    13:51:17.0763 6576usbvideo - ok
    13:51:17.0779 6576UxSms (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll
    13:51:17.0794 6576UxSms - ok
    13:51:17.0826 6576VAIOMediaPlatform-PhotoServer-HTTP - ok
    13:51:17.0841 6576VAIOMediaPlatform-PhotoServer-UPnP - ok
    13:51:17.0888 6576VaultSvc (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
    13:51:17.0888 6576VaultSvc - ok
    13:51:17.0966 6576vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
    13:51:17.0966 6576vdrvroot - ok
    13:51:18.0013 6576vds (c3cd30495687c2a2f66a65ca6fd89be9) C:\Windows\System32\vds.exe
    13:51:18.0013 6576vds - ok
    13:51:18.0122 6576vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
    13:51:18.0122 6576vga - ok
    13:51:18.0200 6576VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
    13:51:18.0216 6576VgaSave - ok
    13:51:18.0309 6576vhdmp (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
    13:51:18.0309 6576vhdmp - ok
    13:51:18.0512 6576viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
    13:51:18.0512 6576viaagp - ok
    13:51:18.0559 6576ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
    13:51:18.0574 6576ViaC7 - ok
    13:51:18.0606 6576viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
    13:51:18.0606 6576viaide - ok
    13:51:18.0684 6576vm331avs (e37e2dc65ae295cc0c27f31d566045c6) C:\Windows\system32\Drivers\vm331avs.sys
    13:51:18.0684 6576vm331avs - ok
    13:51:18.0715 6576volmgr (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
    13:51:18.0715 6576volmgr - ok
    13:51:18.0746 6576volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
    13:51:18.0762 6576volmgrx - ok
    13:51:18.0808 6576volsnap (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
    13:51:18.0808 6576volsnap - ok
    13:51:18.0886 6576vpn5000service - ok
    13:51:18.0980 6576vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
    13:51:18.0996 6576vsmraid - ok
    13:51:19.0058 6576VSS (209a3b1901b83aeb8527ed211cce9e4c) C:\Windows\system32\vssvc.exe
    13:51:19.0089 6576VSS - ok
    13:51:19.0183 6576vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys
    13:51:19.0183 6576vwifibus - ok
    13:51:19.0276 6576vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys
    13:51:19.0276 6576vwififlt - ok
    13:51:19.0292 6576vwlogger - ok
    13:51:19.0339 6576W32Time (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll
    13:51:19.0339 6576W32Time - ok
    13:51:19.0526 6576w550mdm - ok
    13:51:19.0588 6576WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
    13:51:19.0588 6576WacomPen - ok
    13:51:19.0713 6576WANARP (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
    13:51:19.0713 6576WANARP - ok
    13:51:19.0729 6576Wanarpv6 (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
    13:51:19.0729 6576Wanarpv6 - ok
    13:51:19.0885 6576wanatw - ok
    13:51:20.0072 6576WatAdminSvc (353a04c273ec58475d8633e75ccd5604) C:\Windows\system32\Wat\WatAdminSvc.exe
    13:51:20.0103 6576WatAdminSvc - ok
    13:51:20.0197 6576wbengine (691e3285e53dca558e1a84667f13e15a) C:\Windows\system32\wbengine.exe
    13:51:20.0228 6576wbengine - ok
    13:51:20.0368 6576WbioSrvc (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll
    13:51:20.0384 6576WbioSrvc - ok
    13:51:20.0415 6576wcncsvc (34eee0dfaadb4f691d6d5308a51315dc) C:\Windows\System32\wcncsvc.dll
    13:51:20.0431 6576wcncsvc - ok
    13:51:20.0446 6576WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll
    13:51:20.0462 6576WcsPlugInService - ok
    13:51:20.0493 6576Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
    13:51:20.0509 6576Wd - ok
    13:51:20.0540 6576Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
    13:51:20.0556 6576Wdf01000 - ok
    13:51:20.0571 6576WdiServiceHost (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
    13:51:20.0587 6576WdiServiceHost - ok
    13:51:20.0587 6576WdiSystemHost (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
    13:51:20.0587 6576WdiSystemHost - ok
    13:51:20.0680 6576wdmirror (ea4e9dd00e69b35f9bd3d39acb113e3f) C:\Windows\system32\DRIVERS\WDMirror.sys
    13:51:20.0680 6576wdmirror - ok
    13:51:20.0790 6576WebClient (a9d880f97530d5b8fee278923349929d) C:\Windows\System32\webclnt.dll
    13:51:20.0805 6576WebClient - ok
    13:51:20.0868 6576websensepolicyserver - ok
    13:51:20.0914 6576Wecsvc (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll
    13:51:20.0930 6576Wecsvc - ok
    13:51:20.0946 6576wercplsupport (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll
    13:51:20.0946 6576wercplsupport - ok
    13:51:21.0024 6576WerSvc (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll
    13:51:21.0024 6576WerSvc - ok
    13:51:21.0102 6576WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
    13:51:21.0102 6576WfpLwf - ok
    13:51:21.0195 6576WimFltr (f9ad3a5e3fd7e0bdb18b8202b0fdd4e4) C:\Windows\system32\DRIVERS\wimfltr.sys
    13:51:21.0195 6576WimFltr - ok
    13:51:21.0242 6576WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
    13:51:21.0242 6576WIMMount - ok
    13:51:21.0336 6576WinDefend (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll
    13:51:21.0351 6576WinDefend - ok
    13:51:21.0367 6576WinHttpAutoProxySvc - ok
    13:51:21.0507 6576Winmgmt (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll
    13:51:21.0507 6576Winmgmt - ok
    13:51:21.0570 6576WinRM (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\Windows\system32\WsmSvc.dll
    13:51:21.0601 6576WinRM - ok
    13:51:21.0772 6576WinUsb (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\DRIVERS\WinUsb.sys
    13:51:21.0772 6576WinUsb - ok
    13:51:21.0835 6576Wlansvc (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll
    13:51:21.0850 6576Wlansvc - ok
    13:51:22.0038 6576WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
    13:51:22.0038 6576WmiAcpi - ok
    13:51:22.0131 6576wmiApSrv (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe
    13:51:22.0131 6576wmiApSrv - ok
    13:51:22.0240 6576WMPNetworkSvc (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe
    13:51:22.0272 6576WMPNetworkSvc - ok
    13:51:22.0381 6576WPCSvc (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll
    13:51:22.0396 6576WPCSvc - ok
    13:51:22.0443 6576WPDBusEnum (aa53356d60af47eacc85bc617a4f3f66) C:\Windows\system32\wpdbusenum.dll
    13:51:22.0443 6576WPDBusEnum - ok
    13:51:22.0490 6576ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
    13:51:22.0490 6576ws2ifsl - ok
    13:51:22.0521 6576wscsvc (6f5d49efe0e7164e03ae773a3fe25340) C:\Windows\system32\wscsvc.dll
    13:51:22.0521 6576wscsvc - ok
    13:51:22.0537 6576WSearch - ok
    13:51:22.0615 6576wsvd (baedc491374defd5e76336901d6d397d) C:\Windows\system32\DRIVERS\wsvd.sys
    13:51:22.0630 6576wsvd - ok
    13:51:22.0771 6576wuauserv (3026418a50c5b4761befa632cedb7406) C:\Windows\system32\wuaueng.dll
    13:51:22.0833 6576wuauserv - ok
    13:51:22.0958 6576WudfPf (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
    13:51:22.0958 6576WudfPf - ok
    13:51:23.0130 6576WUDFRd (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys
    13:51:23.0130 6576WUDFRd - ok
    13:51:23.0208 6576wudfsvc (8d1e1e529a2c9e9b6a85b55a345f7629) C:\Windows\System32\WUDFSvc.dll
    13:51:23.0223 6576wudfsvc - ok
    13:51:23.0270 6576WwanSvc (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll
    13:51:23.0286 6576WwanSvc - ok
    13:51:23.0301 6576X4HSX32 - ok
    13:51:23.0379 6576xusb21 - ok
    13:51:23.0504 6576zebrmdmc - ok
    13:51:23.0520 6576zenos1 - ok
    13:51:23.0582 6576MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
    13:51:23.0722 6576\Device\Harddisk0\DR0 - ok
    13:51:23.0722 6576Boot (0x1200) (6508ee5510674296c7e617f7846c96ef) \Device\Harddisk0\DR0\Partition0
    13:51:23.0722 6576\Device\Harddisk0\DR0\Partition0 - ok
    13:51:23.0754 6576Boot (0x1200) (65959a05f6ba93b801abe5af1b881eea) \Device\Harddisk0\DR0\Partition1
    13:51:23.0754 6576\Device\Harddisk0\DR0\Partition1 - ok
    13:51:23.0754 6576============================================================
    13:51:23.0754 6576Scan finished
    13:51:23.0754 6576============================================================
    13:51:23.0769 7416Detected object count: 1
    13:51:23.0769 7416Actual detected object count: 1
    13:51:38.0043 7416C:\Windows\system32\drivers\afd.sys - copied to quarantine
    13:51:38.0059 7416VerifyFileNameVersionInfo: GetFileVersionInfoSizeW(C:\Windows\system32\drivers\afd.sys) error 1813
    13:51:40.0992 7416Backup copy not found, trying to cure infected file..
    13:51:40.0992 7416C:\Windows\system32\drivers\afd.sys - Cure failed (FFFFFFFF)
    13:51:40.0992 7416C:\Windows\system32\drivers\afd.sys - processing error
    13:51:43.0753 7416AFD ( Virus.Win32.ZAccess.k ) - User select action: Cure
  10. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    I could not run ESET online scan because I no longer have internet access on either WiFi or hardwired LAN. Connection is present but it has the yellow exclamation triangle. I tried rebooting several times but no internet.
  11. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    t
    Regarding this:
    ========================================
    When you have finished the above, Please uninstall Combofix as follows:

    Uninstall ComboFix and all Backups of the files it deleted
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
      [​IMG]
    =========================================
    The run this:
    Please download and extract the following file: XPSP3 netsvcs
    Then double click on it to merge it into the Registry.
    ============================================
    Now download and run Combofiix again.
    =========================================
    I see multiple users on the system: Laurie, Arelene, Erika. I also see a Remote User> log me in. Are you doing a remote help for this system? There is also a 'default user.'
    =======================================
    Please leave logs in next reply
     
  12. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    Hello

    I removed Combofix as instructed.

    The link for the file XPSP3 netsvcs appears to be dead. Please forward and alternative link if you have one.

    Yes there are 3 user accounts on the laptop. There is also a Guest account but it is disabled. I did have logmein installed on this laptop but uninstalled it while we are trying to salvage it.

    I'm not sure what you mean when you ask if I'm doing a "remove help"? If you meant remote help then the answer is no the laptop is sitting on my desk here. I'm downloading files to USB stick from my main computer and transferring them to laptop. I am scanning the stick everytime I reinsert it to my main computer.

    Thanks again!
  13. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    I found the xpsp3_netsvcs file it was located HERE.

    I've merged it into registry and re-downloaded Combofix. Currently running combofix. Will post the log results when complete.
  14. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    I ran the freshly downloaded Combofix. It prompted me again that computer has a rootkit and combofix needed to reboot machine. I selected ok and the laptop rebooted. I still have no internet access on this machine and it says connected to "unidentified network" in the connection icon in tray along with the yellow exclamation point. Here is the log from the newest combofix run.

    ComboFix 12-04-22.02 - SYSTEM 04/23/2012 11:18:08.3.4 - x86
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2999.725 [GMT -4:00]
    Running from: c:\windows\system32\config\systemprofile\Desktop\ComboFix.exe
    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-03-23 to 2012-04-23 )))))))))))))))))))))))))))))))
    .
    .
    2012-04-23 15:26 . 2012-04-23 15:27--------d-----w-c:\windows\system32\config\systemprofile\AppData\Local\temp
    2012-04-23 15:26 . 2012-04-23 15:26--------d-----w-c:\users\LogMeInRemoteUser\AppData\Local\temp
    2012-04-23 15:26 . 2012-04-23 15:26--------d-----w-c:\users\Laurie\AppData\Local\temp
    2012-04-23 15:26 . 2012-04-23 15:26--------d-----w-c:\users\Erika\AppData\Local\temp
    2012-04-23 15:26 . 2012-04-23 15:26--------d-----w-c:\users\Default\AppData\Local\temp
    2012-04-23 15:26 . 2012-04-23 15:26--------d-----w-c:\users\Arlene\AppData\Local\temp
    2012-04-23 15:04 . 2012-04-23 15:04--------d-----w-c:\windows\system32\%LocalAppData%
    2012-04-21 17:30 . 2012-04-21 17:51--------d-----w-C:\TDSSKiller_Quarantine
    2012-04-18 17:51 . 2012-04-18 17:51388096----a-r-c:\users\Arlene\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2012-04-18 17:51 . 2012-04-18 17:51--------d-----w-c:\program files\Trend Micro
    2012-04-18 16:44 . 2012-04-18 16:44--------d-----w-c:\users\Arlene\AppData\Roaming\Malwarebytes
    2012-04-18 16:28 . 2012-04-18 16:28--------d-----w-c:\users\Erika\AppData\Roaming\Malwarebytes
    2012-04-18 16:28 . 2012-04-18 16:28--------d-----w-c:\programdata\Malwarebytes
    2012-04-18 16:28 . 2012-04-18 16:28--------d-----w-c:\program files\Malwarebytes' Anti-Malware
    2012-04-18 16:28 . 2012-04-04 19:5622344----a-w-c:\windows\system32\drivers\mbam.sys
    2012-04-12 19:34 . 2012-03-01 05:4619824----a-w-c:\windows\system32\drivers\fs_rec.sys
    2012-04-12 19:34 . 2012-03-01 05:37172544----a-w-c:\windows\system32\wintrust.dll
    2012-04-12 19:34 . 2012-03-01 05:33159232----a-w-c:\windows\system32\imagehlp.dll
    2012-04-12 19:34 . 2012-03-01 05:295120----a-w-c:\windows\system32\wmi.dll
    2012-04-12 19:34 . 2012-03-06 05:593968368----a-w-c:\windows\system32\ntkrnlpa.exe
    2012-04-12 19:34 . 2012-03-06 05:593913072----a-w-c:\windows\system32\ntoskrnl.exe
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-02-17 05:34 . 2012-03-14 10:52826880----a-w-c:\windows\system32\rdpcore.dll
    2012-02-17 04:14 . 2012-03-14 10:52183808----a-w-c:\windows\system32\drivers\rdpwd.sys
    2012-02-17 04:13 . 2012-03-14 10:5224576----a-w-c:\windows\system32\drivers\tdtcp.sys
    2012-02-10 05:38 . 2012-03-14 10:531077248----a-w-c:\windows\system32\DWrite.dll
    2012-02-03 03:54 . 2012-03-14 10:532343424----a-w-c:\windows\system32\win32k.sys
    2012-01-31 12:44 . 2011-02-11 06:01237072------w-c:\windows\system32\MpSigStub.exe
    2012-01-25 05:32 . 2012-03-14 10:5258880----a-w-c:\windows\system32\rdpwsx.dll
    2012-01-25 05:32 . 2012-03-14 10:52129536----a-w-c:\windows\system32\rdpcorekmts.dll
    2012-01-25 05:27 . 2012-03-14 10:528192----a-w-c:\windows\system32\rdrmemptylst.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]
    @="{771C7324-DA80-49D3-8017-753B0AF60951}"
    [HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]
    2011-02-11 06:111410400----a-w-c:\windows\System32\IcnOvrly.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-11-20 284696]
    "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-12-20 307768]
    "cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe" [2009-12-20 487992]
    "331BigDog"="c:\program files\USB Camera\VM331_STI.EXE" [2009-12-20 536576]
    "ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-12-20 501640]
    "EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-12-17 4114368]
    "Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-12-17 6223808]
    "OnekeyStudio"="c:\program files\Lenovo\Onekey Theater\OnekeyStudio.exe" [2009-12-19 665504]
    "VeriFaceManager"="c:\program files\Lenovo\VeriFace\PManage.exe" [2011-02-11 3122528]
    "UCam_Menu"="c:\program files\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
    "YouCam Mirror Tray icon"="c:\program files\Lenovo\YouCam\YouCamTray.exe" [2009-11-11 167008]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 136216]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 171032]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 170520]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
    "RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-11-02 59240]
    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    R1 MpKsl5975f928;MpKsl5975f928;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B19D7BAE-6EA6-4768-9B9F-430BA3B53678}\MpKsl5975f928.sys [x]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 IGRS;IGRS;c:\program files\Lenovo\ReadyComm\common\IGRS.exe [2009-07-14 38152]
    R3 bpenum;bpenum;c:\windows\system32\DRIVERS\bpenum.sys [2009-09-16 56832]
    R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys [2009-07-29 63240]
    R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe [2009-08-14 509192]
    R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [2009-09-22 579400]
    R3 libusb0;libusb-win32 - Kernel Driver, Version 1.2.4.0;c:\windows\system32\drivers\libusb0.sys [2010-06-24 21504]
    R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2010-04-20 18432]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4640000]
    R3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-12-20 182304]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-06 1343400]
    R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-22 81704]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
    S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
    S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-11-20 13336]
    S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
    S2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
    S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
    S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2009-09-03 21256]
    S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2009-12-20 119296]
    S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 132480]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-12-20 209920]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 22344]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-12-20 189440]
    S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 579944]
    S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 194408]
    S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 21864]
    S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 19304]
    S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
    S3 vm331avs;Digital Camera 1;c:\windows\system32\Drivers\vm331avs.sys [2009-12-20 179072]
    S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys [2009-07-16 11792]
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    IgrsSvcsREG_MULTI_SZ ReadyComm.DirectRouter PS_MDP
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    CryptSvc
    DMServer
    DHCP
    ERSvc
    EventSystem
    HidServ
    Iprip
    LanmanWorkstation
    Messenger
    Netman
    TrkWks
    W32Time
    WZCSVC
    wscsvc
    xmlprov
    napagent
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-04-18 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2455382146-3077568640-2663614186-1003Core.job
    - c:\users\Laurie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-06 19:31]
    .
    2012-04-20 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2455382146-3077568640-2663614186-1003UA.job
    - c:\users\Laurie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-06 19:31]
    .
    2012-04-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2455382146-3077568640-2663614186-1004Core.job
    - c:\users\Erika\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-27 09:30]
    .
    2012-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2455382146-3077568640-2663614186-1004UA.job
    - c:\users\Erika\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-27 09:30]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.ca/
    uInternet Settings,ProxyOverride = *.local
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2012-04-23 11:29:31
    ComboFix-quarantined-files.txt 2012-04-23 15:29
    .
    Pre-Run: 262,901,125,120 bytes free
    Post-Run: 262,837,653,504 bytes free
    .
    - - End Of File - - 3F167C8B7FC79B60C95257CA7C931FD8
  15. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    Any more ideas??
  16. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Then we need to replace file if we can find a clean on:

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2

    For 64bit: http://jpshortstuff.247fixes.com/SystemLook_x64.exe
    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      Code:
      
      :filefind
      afd.*
      
      
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt

    I am puzzled by the multitude of drivers/Services crashing and/or being deleted. I' like to check the system:

    Please run the MGA Diagnostics tool
    • You will be prompted to either “Run” or “Save” the tool. Choose to “Run” the tool and follow the on-screen prompts.
    • You will receive an Internet Explorer-Security Warning dialog box for the Windows Genuine Advantage Diagnostic Tool>
    • You must choose to Run this tool when prompted.
    • Once you are presented with the Diagnostics tool choose Continue to run the diagnostic report.
    • If the RESOLVE button is available after running the diagnostics, please click RESOLVE to allow the diagnostic tool to attempt a repair.
    • After running the MGA Diagnostic tool, click on the Windows tab and then click on Copy
    • Please return to this thread and Paste the results here for review.
    ------------------------------------------
    This tool will is to look on the computer itself, in the documentation you received with the computer or with your retail purchase of Windows to see if you have a Certificate of Authenticity (COA). If you have one, tell us about the COA. Tell us:

    1. What edition of Windows is it for?
    2. Does it read "OEM Software" or "OEM Product" in black lettering?
    3. Or, does it have the computer manufacturer's name in black lettering?
    4. DO NOT post the Product Key.

    NOTE: The data collected with the Genuine Diagnostics Tool does NOT contain any information that can personally identify you and can be fully reviewed, by you, before being posted.
  17. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    Thanks for sticking with me! Ok, so a couple of weird things I've noticed. All the desktop icons that I copy to the desktop now show a little padlock beside them. Also, my sound icon in the tray now shows a little red "x" beside it. Just letting you know.

    Also this laptop only came with 2 DVD's that I had to order after the fact. 1 is a product recovery DVD and the other is a driver DVD. There is a COA sticker on the bottom of the Laptop that is virtually unreadable for the product key which is a little alarming but it says "Windows 7 Home Prem. OA" along the top.

    Ok, on to the info you requested.

    SystemLook log:

    SystemLook 30.07.11 by jpshortstuff
    Log created at 11:09 on 26/04/2012 by SYSTEM
    Administrator - Elevation successful

    ========== filefind ==========

    Searching for "afd.*"
    C:\Windows\System32\drivers\afd.sys--a---- 338944 bytes[22:27 15/06/2011][02:18 25/04/2011] 0DAC8BF208BB132EBEA0F0366EBD3E6D
    C:\Windows\System32\drivers\en-US\afd.sys.mui--a---- 14848 bytes[04:55 14/07/2009][02:08 14/07/2009] 2F1E1E5CE5927E156F0B30163119960D
    C:\Windows\winsxs\x86_microsoft-windows-winsock-core.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4bbf167edfba3058\afd.sys.mui--a---- 14848 bytes[04:55 14/07/2009][02:08 14/07/2009] 2F1E1E5CE5927E156F0B30163119960D
    C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_d7be98b5bfc0b4c1\afd.sys--a---- 338944 bytes[23:12 13/07/2009][23:12 13/07/2009] DDC040FDB01EF1712A6B13E52AFB104C
    C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16802_none_d81220b5bf827af7\afd.sys--a---- 338944 bytes[22:27 15/06/2011][02:35 25/04/2011] 0DB7A48388D54D154EBEC120461A0FCD
    C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.20951_none_d864ad9ad8c98d1f\afd.sys--a---- 338944 bytes[22:27 15/06/2011][02:27 25/04/2011] C114AB7A1550D42EA1700FFD4179CF5A
    C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_d9efac7dbcaf385b\afd.sys--a---- 338944 bytes[05:09 10/03/2011][08:40 20/11/2010] 1151FD4FB0216CFED887BFDE29EBD516
    C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_d9f97e05bca8003a\afd.sys--a---- 338944 bytes[22:27 15/06/2011][02:18 25/04/2011] 0DAC8BF208BB132EBEA0F0366EBD3E6D
    C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_da774a9ad5cea29e\afd.sys--a---- 338944 bytes[22:27 15/06/2011][03:24 25/04/2011] C427F91A748CD342A2B3F9278D9FD6A5

    -= EOF =-

    MGA Diagnostics Log:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-JKHXW-D9W83-FJQKD
    Windows Product Key Hash: AYaBykmfTHUVW5whGaYMeVJn0/U=
    Windows Product ID: 00359-OEM-8992687-00249
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {2EC5CF4C-3B3A-4BE7-9327-DCEB5807F272}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000000
    Build lab: 7601.win7sp1_gdr.120305-1505
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{2EC5CF4C-3B3A-4BE7-9327-DCEB5807F272}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-FJQKD</PKey><PID>00359-OEM-8992687-00249</PID><PIDType>2</PIDType><SID>S-1-5-21-2455382146-3077568640-2663614186</SID><SYSTEM><Manufacturer>LENOVO</Manufacturer><Model>0679 </Model></SYSTEM><BIOS><Manufacturer>LENOVO</Manufacturer><Version>29CN29WW(V2.06)</Version><SMBIOSVersion major="2" minor="6"/><Date>20100708000000.000000+000</Date></BIOS><HWID>D38D3E07018400FC</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>LENOVO</OEMID><OEMTableID>CB-01 </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
    Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00178-926-800249-02-1033-7600.0000-0402011
    Installation ID: 013155057073610574604485876070964602683581547101042095
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: FJQKD
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 4/26/2012 11:13:26 AM

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x00000000
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 3:28:2012 20:43
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: KgAAAAEAAQABAAEAAAABAAAAAQABAAEAeqgeVDaGmEEyl6wizMpSylxd

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
    ACPI Table NameOEMID ValueOEMTableID Value
    APICINTELCalpella
    FACPLENOVOCB-01
    HPETLENOVOCB-01
    BOOTINTELCalpella
    MCFGLENOVOCB-01
    WDRTINTELCalpella
    ASF!INTELCalpella
    SLICLENOVOCB-01
    ASPTINTELCalpella
    SSDTPmRefCpuPm
    SSDTPmRefCpuPm
    SSDTPmRefCpuPm
  18. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    For the blocked icons:

    Do a right click anywhere on an empty space on the desktop> Arrange icons by......................> Uncheck 'lock web items on desktop.'

    I notice this on the MGA DX scan:
    "Remaining Windows rearm count: 4" A Rearm is the ability for a user to extend the Activation grace period and all version of Vista and Windows 7 get three 3 rearms, not 4.And it appears that either the OS is damaged, or you did not Activate it.

    Go to http://microsoft.com/genuine and click the Validate Windows button. If it validates as Genuine, that should cause the Non-Genuine messaging to go away. If it validates as Non-Genuine, it should give an indication of the cause.
  19. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    Hello again.

    I don't have the option to uncheck "lock web items" I've included a screen capture. In fact I don't even have the "Arrange icons by" option. The option also doesn't show in either "view" or "sort by".

    I still can not connect to internet on this computer so I can't go to the above link. I tried downloading the genuine advantage prog onto a stick and running it but the first thing it wants to do is update which it can't do so it just quits.

    Thanks
  20. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    I'm sorry but this is taking too long. I have to give this computer back to her. I'm going to format it and reinstall everything. I tried uninstalling and reinstalling LAN drivers for both hardwired and wireless. I also tried using my iPhone to tether and nothing is working. This problem started with the ComboFix execution. It still finds a rootkit every single time I run it so obviously it is not eliminating it. I'm frustrated and upset that we can't get this working and now I have to spend another 4 hours starting from scratch. I really appreciate you sticking with me on this and trying your best. It's much further than I would have got on my own. Thanks again for all the help!
  21. Ookpic

    Ookpic TS Rookie Topic Starter Posts: 17

    Formatted and reinstalled. All is well with the computer. Again thanks so much for the help!
  22. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Maybe what we did didn't work because Windows isn't set up correctly.

    You're welcome for the help. Less impatience will allow one to learn.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.