Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 7 BSOD


  • This topic is locked This topic is locked
14 replies to this topic

#1 madmanjim

madmanjim

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:07 AM

Posted 04 March 2011 - 09:28 PM

Hi there,

I recently (stupidly) ran a shady looking .exe file, as soon as I did my computer restarted and booted into a BSOD.

At first my computer only just got to the Windows 7 loading screen before dumping me to a 0x7E bsod, saying something about a kdcom.dll file.

So I ran a KasperSky, AVG and F-Secure rescue cd and did some virus scans. This found a few viruses as well as the culprit .exe file I opened.

The Windows 7 loading screen now gets a bit further (the animation of windows logo actually loads now) before dumping me to a BSOD with a 0x7B BSOD.

The full error code is:

Stop: 0x0000007B (0xFFFFF990009A9928, 0xFFFFFFFFC000000D, 0x0000000000000000, 0x0000000000000000)

There is no other error or file listed, just some info saying to do virus scans and run a chkdsk which I already have.

I cannot boot into Safe Mode, the best I can do is boot from USB/CD or enter the Repair Console. Repair Consoles repair utility has also failed, saying it doesn't know how to fix the problem and gives me an option to send an error report to microsoft.

I have been reading this topic: http://www.bleepingcomputer.com/forums/topic359093.html/page__st__30

It looks like this user also had the same problem as me, and I have followed elise025's advice and downloaded xpud and run a driver.sh scan. I will post the report.txt in the next post.

Any help is appreciated as I am pulling my hair out!

Also this is a 64bit machine.

Thanks!

driver.sh report.txt file

Sat Mar 5 11:54:17 UTC 2011
Driver report for /mnt/sda2/Windows/System32/drivers

64edd3f59db321947969fdf1dd747323 1394bus.sys
Microsoft Corporation

1b00662092f9f9568b995902f0cc40d5 1394ohci.sys
Microsoft Corporation

63b05a0420ce4bf0e4af6dcc7cada254 acpipmi.sys
Microsoft Corporation

6f11e88748cdefd2f76aa215f97ddfe5 acpi.sys
Microsoft Corporation

2f6b34b83843f0c5118b63ac634f5bf4 adp94xx.sys
Adaptec

597f78224ee9224ea1a13d6350ced962 adpahci.sys
Adaptec

e109549c90f62fb570b9540c4b148e54 adpu320.sys
Adaptec

b9384e03479d2506bc924c16a3db87bc afd.sys
Microsoft Corporation

7ecff9b22276b73f43a99a15a6094e90 agilevpn.sys
Microsoft Corporation

608c14dba7299d8cb6ed035a68a15799 AGP440.sys
Microsoft Corporation

5812713a477a3ad7363c7438ca2ee038 aliide.sys
Acer Laboratories

1ff8b4431c353ce385c875f194924c0c amdide.sys
Microsoft Corporation

7024f087cff1833a806193ef9d22cda9 amdk8.sys
Microsoft Corporation

1e56388b3fe0d031c44144eb8c4d6217 amdppm.sys
Microsoft Corporation

7a4b413614c055935567cf88a9734d38 amdsata.sys
Advanced Micro Devices

f67f933e79241ed32ff46a4f29b5120b amdsbs.sys
AMD Technologies

b4ad0cacbab298671dd6f6ef7e20679d amdxata.sys
Advanced Micro Devices

42fd751b27fa0e9c69bb39f39e409594 appid.sys
Microsoft Corporation

019af6924aefe7839f61c830227fe79c arcsas.sys
Adaptec

c484f8ceb1717c540242531db7845c4e arc.sys
Adaptec

03b7145c889603537e9ffeabb1ad1089 ASACPI.sys
tH`p((VS_VERSION_INFO%?(aStringFileInfodbCommentsCompanyNameRFileDescriptionATKACPIUtility@FileVersion,,,bInternalNameATK$LegalCopyright(LegalTrademarksbOriginalFilenameATKPrivateBuildJProductNameATKACPIUtility@ProductVersion,,,SpecialBuildDVarFileInfo$Translationt*

769765ce2cc62867468cea93969b2242 asyncmac.sys
Microsoft Corporation

02062c0b390b7729edc9e69c680a6f3c atapi.sys
Microsoft Corporation

aa2186f7944104a16d6ed176ed462cec ataport.sys
Microsoft Corporation

39c2e2870fc0c2ae0595b883cbe716b4 avgntflt.sys
Avira Gmb

c98fa6e5ad0e857d22716bd2b8b1f399 avipbb.sys
Avira Gmb

b5ace6968304a3900eeb1ebfd9622df2 b57nd60a.sys
Broadcom Corporation

f4de2ae7a9e1badac70bc71ea2c17612 battc.sys
Microsoft Corporation

16a47ce2decc9b099349a5f840654746 beep.sys
Microsoft Corporation

61583ee3c3a17003c4acd0475646b4d3 blbdrive.sys
Microsoft Corporation

91ce0d3dc57dd377e690a2d324022b08 bowser.sys
Microsoft Corporation

f09eee9edc320b5e1501f749fde686c8 BrFiltLo.sys
Brother Industries

b114d3098e9bdb8bea8b053685831be6 BrFiltUp.sys
Brother Industries

5c2f352a4e961d72518261257aae204b bridge.sys
Microsoft Corporation

43bea8d483bf1870f018e2d02e06a5bd BrSerId.sys
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries

a6eca2151b08a09caceca35c07f05b42 BrSerWdm.sys
Brother Industries

b79968002c277e869cf38bd22cd61524 BrUsbMdm.sys
Brother Industries

a87528880231c54e75ea7a44943b38bf BrUsbSer.sys
Brother Industries

9da669f11d1f894ab4eb69bf546a42e8 bthmodem.sys
Microsoft Corporation

3e5b191307609f7514148c6832bb0842 bxvbda.sys
Broadcom Corporation

b8bd2bb284668c84865658c77574381a cdfs.sys
Microsoft Corporation

83d2d75e1efb81b3450c18131443f7db cdrom.sys
Microsoft Corporation

d7cd5c4e1b71fa62050515314cfb52cf circlass.sys
Microsoft Corporation

62f1ed63f0cb0b5a2f65d15a6490c2fd Classpnp.sys
Microsoft Corporation

0840155d0bddf1190f84a663c284bd33 CmBatt.sys
Microsoft Corporation

e19d3f095812725d88f9001985b94edd cmdide.sys
CMD Technology

f95fd4cb7da00ba2a63ce9f6b5c053e1 cng.sys
Microsoft Corporation

102de219c3f61415f964c88e9085ad14 compbatt.sys
Microsoft Corporation

f26b3a86f6fa87ca360b879581ab4123 CompositeBus.sys
Microsoft Corporation

3e588b60ec061686ba05d33574a344c6 crashdmp.sys
Microsoft Corporation

1c827878a998c18847245fe1f34ee597 crcdisk.sys
Microsoft Corporation

4a6173c2279b498cd8f57cae504564cb csc.sys
Microsoft Corporation

3f1dc527070acb87e40afe46ef6da749 dfsc.sys
Microsoft Corporation

13096b05847ec78f0977f2c0f79e9ab3 discache.sys
Microsoft Corporation

b8b501f03486d8dc76d1bf304436c692 Diskdump.sys
Microsoft Corporation

9819eee8b5ea3784ec4af3b137a5244c disk.sys
Microsoft Corporation

9b19f34400d24df84c858a421c205754 drmkaud.sys
Microsoft Corporation

21d26064aedb4988f785bb4a3a2c051e drmk.sys
Microsoft Corporation

839b5fe3d48e9f35b22c21a3d5103f6c Dumpata.sys
Microsoft Corporation

814db88f2641691575a455cf25354098 dumpfve.sys
Microsoft Corporation

bf24d6f2ed97fe830bfd52b246f98e67 dxapi.sys
Microsoft Corporation

ebce0b0924835f635f620d19f0529dce dxgkrnl.sys
Microsoft Corporation

ddb7ad1ba01005521010db3e30adc972 dxgmms1.sys
Microsoft Corporation

fede0629ecb23650d48989517d4914da dxg.sys
Microsoft Corporation

0e5da5369a0fcaea12456dd852545184 elxstor.sys
Emulex

34a3c54752046e79a126e15c51db409b errdev.sys
Microsoft Corporation

dc5d737f51be844d8c82c695eb17372f evbda.sys
Broadcom Corporation

a510c654ec00c1e9bdd91eeb3a59823b exfat.sys
Microsoft Corporation

0adc83218b66a6db380c330836f3e36d fastfat.sys
Microsoft Corporation

d765d19cd8ef61f650c384f62fac00ab fdc.sys
Microsoft Corporation

655661be46b5f5f3fd454e2c3095b930 fileinfo.sys
Microsoft Corporation

5f671ab5bc87eea04ec38a6cd5962a47 filetrace.sys
Microsoft Corporation

c172a0f53008eaeb8ea33fe10e177af5 flpydisk.sys
Microsoft Corporation

f7866af72abbaf84b1fa5aa195378c59 fltMgr.sys
Microsoft Corporation

d43703496149971890703b4b1b723eac fsdepends.sys
Microsoft Corporation

e95ef8547de20cf0603557c0cf7a9462 fs_rec.sys
Microsoft Corporation

ae87ba80d0ec3b57126ed2cdc15b24ed fvevol.sys
Microsoft Corporation

50555005e22a56aef10be607472d0bdc FWPKCLNT.SYS
Microsoft Corporation

8c778d335c9d272cfd3298ab02abe3b6 GAGP30KX.SYS
Microsoft Corporation

e403aacf8c7bb11375122d2464560311 GEARAspiWDM.sys
GEAR Software

f2523ef6460fc42405b12248338ab2f0 hcw85cir.sys
Hauppauge Computer Works

0a49913402747a0b67de940fb42cbdbb hdaudbus.sys
Microsoft Corporation

78e86380454a7b10a5eb255dc44a355f hidbatt.sys
Microsoft Corporation

7fd2a313f7afe5c4dab14798c48dd104 hidbth.sys
Microsoft Corporation

685fec2407fc121eb937cb658b3c0f35 hidclass.sys
Microsoft Corporation

0a77d29f311b88cfae3b13f9c1a73825 hidir.sys
Microsoft Corporation

49ee2e52e6cd03947dad72f65367be06 hidparse.sys
Microsoft Corporation

b3bf6b5b50006def50b66306d99fcf6f hidusb.sys
Microsoft Corporation

0886d440058f203eba0e1825e4355914 HpSAMD.sys
Hewlett-Packard

cee049cac4efa7f4e1e4ad014414a5d4 http.sys
Microsoft Corporation

f17766a19145f111856378df337a5d79 hwpolicy.sys
Microsoft Corporation

fa55c73d4affa7ee23ac4be53b4592d3 i8042prt.sys
Microsoft Corporation

d83efb6fd45df9d55e9a1afc63640d50 iaStorV.sys
Intel Corporation

5c18831c61933628f5bb0ea2675b9d21 iirsp.sys
Intel Corp

f00f20e70c6ec3aa366910083a0518aa intelide.sys
Microsoft Corporation

ada036632c664caa754079041cf1f8c1 intelppm.sys
Microsoft Corporation

722dd294df62483cecaae6e094b4d695 ipfltdrv.sys
Microsoft Corporation

e2b4a4494db7cb9b89b55ca268c337c5 IPMIDrv.sys
Microsoft Corporation

af9b39a7e7b6caa203b3862582e9f2d0 ipnat.sys
Microsoft Corporation

05360b1ea5a2abf620d1d96ebd8bd8f1 irda.sys
Microsoft Corporation

3abf5e7213eb28966d55d58b515d5ce9 irenum.sys
Microsoft Corporation

2f7b28dc3e1183e5eb418df55c204f38 isapnp.sys
Microsoft Corporation

bc02336f1cba7dcc7d1213bb588a68a5 kbdclass.sys
Microsoft Corporation

6def98f8541e1b5dceb2c822a11f7323 kbdhid.sys
Microsoft Corporation

e8b6fcc9c83535c67f835d407620bd27 ksecdd.sys
Microsoft Corporation

a8c63880ef6f4d3fec7b616b9c060215 ksecpkg.sys
Microsoft Corporation

5c7af4a20f5bf67042b2e613d123d111 ks.sys
Microsoft Corporation

6869281e78cb31a43e969f06b57347c4 ksthunk.sys
Microsoft Corporation

1538831cf8ad2979a04c423779465827 lltdio.sys
Microsoft Corporation

1a93e54eb0ece102495a51266dcdb6a6 lsi_fc.sys
LSI Corporation

30f5c0de1ee8b5bc9306c1f0e4a75f93 lsi_sas2.sys
LSI Corporation

1047184a9fdc8bdbff857175875ee810 lsi_sas.sys
LSI Corporation

0504eacaff0d3c8aed161c4b0d369d4a lsi_scsi.sys
LSI Corporation

43d0f98e1d56ccddb0d5254cff7b356e luafv.sys
Microsoft Corporation

de5d0dd632ee6977979799de64ce0951 mbam.sys
Malwarebytes Corporation

3c9f072f9dca856b9fb7a20cbd4281ac mcd.sys
Microsoft Corporation

a55805f747c6edb6a9080d7c633bd0f4 megasas.sys
LSI Corporation

baf74ce0072480c3b6b7c13b2a94d6b3 MegaSR.sys
LSI Corporation

800ba92f7010378b09f9ed9270f07137 modem.sys
Microsoft Corporation

b03d591dc7da45ece20b3b467e6aadaa monitor.sys
Microsoft Corporation

7d27ea49f3c1f687d357e77a470aea99 mouclass.sys
Microsoft Corporation

d3bf052c40b0c4166d9fd86a4288c1e6 mouhid.sys
Microsoft Corporation

791af66c4d0e7c90a3646066386fb571 mountmgr.sys
Microsoft Corporation

609d1d87649ecc19796f4d76d4c15cea mpio.sys
Microsoft Corporation

6c38c9e45ae0ea2fa5e551f2ed5e978f mpsdrv.sys
Microsoft Corporation

30524261bb51d96d6fcbac20c810183c mrxdav.sys
Microsoft Corporation

920ee0ff995fcfdeb08c41605a959e1c mrxsmb10.sys
Microsoft Corporation

740d7ea9d72c981510a5292cf6adc941 mrxsmb20.sys
Microsoft Corporation

767a4c3bcf9410c286ced15a2db17108 mrxsmb.sys
Microsoft Corporation

5c37497276e3b3a5488b23a326a754b7 msahci.sys
Microsoft Corporation

8d27b597229aed79430fb9db3bcbfbd0 msdsm.sys
Microsoft Corporation

aa3fb40e17ce1388fa1bedab50ea8f96 msfs.sys
Microsoft Corporation

f9d215a46a8b9753f61767fa72a20326 mshidkmdf.sys
Microsoft Corporation

d916874bbd4f8b07bfb7fa9b3ccae29d msisadrv.sys
Microsoft Corporation

fa4d2557de56d45b0a346f93564be6e1 msiscsi.sys
Microsoft Corporation

49ccf2c4fea34ffad8b1b59d49439366 mskssrv.sys
Microsoft Corporation

bdd71ace35a232104ddd349ee70e1ab3 mspclock.sys
Microsoft Corporation

4ed981241db27c3383d72092b618a1d0 mspqm.sys
Microsoft Corporation

89cb141aa8616d8c6a4610fa26c60964 msrpc.sys
Microsoft Corporation

0eed230e37515a0eaee3c2e1bc97b288 mssmbios.sys
Microsoft Corporation

2e66f9ecb30b4221a318c92ac2250779 mstee.sys
Microsoft Corporation

7ea404308934e675bffde8edf0757bcd MTConfig.sys
Microsoft Corporation

f9a18612fd3526fe473c1bda678d61c8 mup.sys
Microsoft Corporation

9f9a1f53aad7da4d6fef5bb73ab811ac ndiscap.sys
Microsoft Corporation

cad515dbd07d082bb317d9928ce8962c ndis.sys
Microsoft Corporation

30639c932d9fef22b31268fe25a1b6e5 ndistapi.sys
Microsoft Corporation

f105ba1e22bf1f2ee8f005d4305e4bec ndisuio.sys
Microsoft Corporation

557dfab9ca1fcb036ac77564c010dad3 ndiswan.sys
Microsoft Corporation

659b74fb74b86228d6338d643cd3e3cf ndproxy.sys
Microsoft Corporation

307bc83250fc8e3b2878d81e7d760299 netaapl64.sys
Apple

86743d9f5d2b1048062b14b1d84501c4 netbios.sys
Microsoft Corporation

9162b273a44ab9dce5b44362731d062a netbt.sys
Microsoft Corporation

7b8403912673a87ea6622f5cb867a670 netio.sys
Microsoft Corporation

77889813be4d166cdab78ddba990da92 nfrd960.sys
IBM Corp

1e4c4ab5c9b8dd13179bbdc75a2a01f7 npfs.sys
Microsoft Corporation

e7f5ae18af4168178a642a9247c63001 nsiproxy.sys
Microsoft Corporation

356698a13c4630d5b31c37378d469196 ntfs.sys
Microsoft Corporation

9899284589f75fa8724ff3d16aed75c1 null.sys
Microsoft Corporation

270d7cd42d6e3979f6dd0146650f0e05 NV_AGP.SYS
Microsoft Corporation

dd81fbc57ab9134cddc5ce90880bfd80 nvlddmkm.sys
NVIDIA Corporation

a85b4f2ef3a7304a5399ef0526423040 nvm62x64.sys
NVIDIA Corporation

3e38712941e9bb4ddbee00affe3fed3d nvraid.sys
NVIDIA Corporation

477dc4d6deb99be37084c9ac6d013da1 nvstor.sys
NVIDIA Corporation

1ea3749c4114db3e3161156ffffa6b33 nwifi.sys
Microsoft Corporation

3589478e4b22ce21b41fa1bfc0b8b8a0 ohci1394.sys
Microsoft Corporation

ee992183bd8eaefd9973f352e587a299 pacer.sys
Microsoft Corporation

0086431c29c35be1dbc43f52cc273887 parport.sys
Microsoft Corporation

7daa117143316c4a1537e074a5a9eaf0 partmgr.sys
Microsoft Corporation

b5b8b5ef2e5cb34df8dcf8831e3534fa pciide.sys
Microsoft Corporation

144497daa145ba0f7be896064146c058 pciidex.sys
Microsoft Corporation

f36f6504009f2fb0dfd1b17a116ad74b pci.sys
Microsoft Corporation

b2e81d4e87ce48589f98cb8c05b01f2f pcmcia.sys
Microsoft Corporation

d6b9c2e1a11a3a4b26a182ffef18f603 pcw.sys
Microsoft Corporation

68769c3356b3be5d1c732c97b9a80d6e PEAuth.sys
Microsoft Corporation

32e11315b5126921ffd9074840ef13d3 portcls.sys
Microsoft Corporation

0d922e23c041efb1c3fac2a6f943c9bf processr.sys
Microsoft Corporation

a53a15a11ebfd21077463ee2c7afeef0 ql2300.sys
QLogic Corporation

4f6d12b51de1aaeff7dc58c4d75423c8 ql40xx.sys
QLogic Corporation

76707bb36430888d9ce9d705398adb6c qwavedrv.sys
Microsoft Corporation

5a0da8ad5762fa2d91678a8a01311704 rasacd.sys
Microsoft Corporation

87a6e852a22991580d6d39adc4790463 rasl2tp.sys
Microsoft Corporation

855c9b1cd4756c5e9a2aa58a15f58c25 raspppoe.sys
Microsoft Corporation

27cc19e81ba5e3403c48302127bda717 raspptp.sys
Microsoft Corporation

e8b1e447b008d07ff47d016c2b0eeecb rassstp.sys
Microsoft Corporation

3bac8142102c15d59a87757c1d41dce5 rdbss.sys
Microsoft Corporation

302da2a0539f2cf54d7c6cc30c1f2d8d rdpbus.sys
Microsoft Corporation

cea6cc257fc9b7715f1c2b4849286d24 RDPCDD.sys
Microsoft Corporation

9706b84dbabfc4b4ca46c5a82b14dfa3 rdpdr.sys
Microsoft Corporation

bb5971a4f00659529a5c44831af22365 RDPENCDD.sys
Microsoft Corporation

216f3fa57533d98e1f74ded70113177a RDPREFMP.sys
Microsoft Corporation

8a3e6bea1c53ea6177fe2b6eba2c80d7 rdpwd.sys
Microsoft Corporation

634b9a2181d98f15941236886164ec8b rdyboost.sys
Microsoft Corporation

77b3b747eb2413072b8e4306018d0c9b rmcast.sys
Microsoft Corporation

fc6d5c50d846b795335deb3fce8b33f3 RNDISMP.sys
Microsoft Corporation

3b2ac7ab44eda3cc05c806091c231c8c rndismpx.sys
Microsoft Corporation

388d3dd1a6457280f3badba9f3acd6b1 rootmdm.sys
Microsoft Corporation

ddc86e4f8e7456261e637e3552e804ff rspndr.sys
Microsoft Corporation

853ad8bd8ca940d0f5ac2679a6ed439b RTKVAC64.SYS
Realtek Semiconductor

e3bbb89983daf5622c1d50cf49f28227 sbp2port.sys
Microsoft Corporation

c94da20c7e3ba1dca269bc8460d98387 scfilter.sys
Microsoft Corporation

ad3a6838a059d65fb55d2f61cf0a6c1f scsiport.sys
Microsoft Corporation

3ea8a16169c26afbeb544e0e48421186 secdrv.sys
Macrovision Corporation

cb624c0035412af0debec78c41f5ca1b serenum.sys
Microsoft Corporation

c1d8e28b2c2adfaec4ba89e9fda69bd6 serial.sys
Microsoft Corporation

1c545a7d0691cc4a027396535691c3e3 sermouse.sys
Microsoft Corporation

a554811bcd09279536440c964ae35bbf sffdisk.sys
Microsoft Corporation

ff414f0baefeba59bc6c04b3db0b87bf sffp_mmc.sys
Microsoft Corporation

5588b8c6193eb1522490c122eb94dffa sffp_sd.sys
Microsoft Corporation

a9d601643a1647211a1ee2ec4e433ff4 sfloppy.sys
Microsoft Corporation

843caf1e5fde1ffd5ff768f23a51e2e1 sisraid2.sys
Silicon Integrated Systems

6a6c106d42e9ffff8b9fcb4f754f6da4 sisraid4.sys
Silicon Integrated Systems

548260a7b8654e024dc30bf8a7c5baa4 smb.sys
Microsoft Corporation

a80348ba03e96c70852959655ca3e084 smclib.sys
Microsoft Corporation

b9e31e5cacdfe584f34f730a677803f9 spldr.sys
Microsoft Corporation

fff95479c7ab1550f0750a5d01744211 spsys.sys
Microsoft Corporation

4d33d59c0b930c523d29f9bd40cda9d2 srv2.sys
Microsoft Corporation

5a663fd67049267bc5c3f3279e631ffb srvnet.sys
Microsoft Corporation

de6f5658da951c4bc8e498570b5b0d5f srv.sys
Microsoft Corporation

f3817967ed533d08327dc73bc4d5542a stexstor.sys
Promise Technology

141e6f0b54da421b8de146f5ad947760 storport.sys
Microsoft Corporation

8fccbefc5c440b3c23454656e551b09a storvsc.sys
Microsoft Corporation

001cc10fa5e71ae1119115e126c8750d stream.sys
Microsoft Corporation

d01ec09b6711a5f8e7e6564a4d0fbc90 swenum.sys
Microsoft Corporation

6e316c01cba8b785fe495f5cc4f48c6f tape.sys
Microsoft Corporation

76d078af6f587b162d50210f761eb9ed tcpipreg.sys
Microsoft Corporation

90a2d722cf64d911879d6c4a4f802a4d tcpip.sys
Microsoft Corporation

0ca6fe26acc7ffee1bd0463f40835f32 tdi.sys
Microsoft Corporation

3371d21011695b16333a3934340c4e7c tdpipe.sys
Microsoft Corporation

e4245bda3190a582d55ed09e137401a9 tdtcp.sys
Microsoft Corporation

079125c4b17b01fcaeebce0bcb290c0f tdx.sys
Microsoft Corporation

c448651339196c0e869a355171875522 termdd.sys
Microsoft Corporation

61b96c26131e37b24e93327a0bd1fb95 tssecsrv.sys
Microsoft Corporation

3836171a2cdf3af8ef10856db9835a70 tunnel.sys
Microsoft Corporation

b4dd609bd7e282bfc683cec7eaaaad67 UAGP35.SYS
Microsoft Corporation

d47baead86c65d4f4069d7ce0a4edceb udfs.sys
Microsoft Corporation

4bfe1bc28391222894cbf1e7d0e42320 ULIAGPKX.SYS
Microsoft Corporation

eab6c35e62b1b0db0d1b48b671d3a117 umbus.sys
Microsoft Corporation

b2e8e8cb557b156da5493bbddcc1474d umpass.sys
Microsoft Corporation

d0fe8cb5f84303e73ff0754437fad3d1 usb8023.sys
Microsoft Corporation

70d05ee263568a742d14e1876df80532 usb8023x.sys
Microsoft Corporation

f724b03c3dfaacf08d17d38bf3333583 usbaapl64.sys
Apple

faec06c1d24e2770ecc4f7c37659824d USBCAMD2.sys
Microsoft Corporation

b26afb54a534d634523c4fb66765b026 usbccgp.sys
Microsoft Corporation

af0892a803fdda7492f595368e3b68e7 usbcir.sys
Microsoft Corporation

63c8d74bed9f80f4dd0aa7a3101eb639 usbd.sys
Microsoft Corporation

df9f9afc9aaabd8ed47975d44e38169a usbehci.sys
Microsoft Corporation

372a91bc3c6603080a793880b0873785 usbhub.sys
Microsoft Corporation

58e546bbaf87664fc57e0f6081e4f609 usbohci.sys
Microsoft Corporation

a91291136d1e70966645252f6b828711 usbport.sys
Microsoft Corporation

73188f58fb384e75c4063d29413cee3d usbprint.sys
Microsoft Corporation

8f0d9d2ea6cfed2730b5bafb9b5b11c2 usbrpm.sys
Microsoft Corporation

080d3820da6c046be82fc8b45a893e83 USBSTOR.SYS
Microsoft Corporation

81fb2216d3a60d1284455d511797db3d usbuhci.sys
Microsoft Corporation

c5c876ccfc083ff3b128f933823e87bd vdrvroot.sys
Microsoft Corporation

da4da3f5e02943c2dc8c6ed875de68dd vgapnp.sys
Microsoft Corporation

53e92a310193cb3c03bea963de7d9cfc vga.sys
Microsoft Corporation

c82e748660f62a242b2dfac1442f22a4 vhdmp.sys
Microsoft Corporation

e5689d93ffe4e5d66c0178761240dd54 viaide.sys
VIA Technologies

e7353d59c9842bc7299faeb7e7e09340 videoprt.sys
Microsoft Corporation

ae10c35761889e65a6f7176937c5592c VMBusHID.sys
Microsoft Corporation

1501699d7eda984abc4155a7da5738d1 vmbus.sys
Microsoft Corporation

88af6e02ab19df7fd07ecdf9c91e9af6 vms3cap.sys
Microsoft Corporation

ffd7a6f15b14234b5b0e5d49e7961895 vmstorfl.sys
Microsoft Corporation

2b1a3dae2b4e70dbba822b7a03fbd4a3 volmgr.sys
Microsoft Corporation

99b0cbb569ca79acaed8c91461d765fb volmgrx.sys
Microsoft Corporation

58f82eed8ca24b461441f9c3e4f0bf5c volsnap.sys
Microsoft Corporation

5e2016ea6ebaca03c04feac5f330d997 vsmraid.sys
VIA Technologies

36d4720b72b5c5d9cb2b9c29e9df67a1 vwifibus.sys
Microsoft Corporation

6a3d66263414ff0d6fa754c646612f3f vwififlt.sys
Microsoft Corporation

6a638fc4bfddc4d9b186c28c91bd1a01 vwifimp.sys
Microsoft Corporation

4e9440f4f152a7b944cb1663d3935a3e wacompen.sys
Microsoft Corporation

47ca49400643effd3f1c9a27e1d69324 wanarp.sys
Microsoft Corporation

fc438d1430b28618e2d0c7c332a710ad watchdog.sys
Microsoft Corporation

441bd2d7b4f98134c3a4f9fa570fd250 Wdf01000.sys
Microsoft Corporation

1b409454d7a00110fdb06f7e0f155a88 WdfLdr.sys
Microsoft Corporation

72889e16ff12ba0f235467d6091b17dc wd.sys
Microsoft Corporation

611b23304bf067451a9fdee01fbdd725 wfplwf.sys
Microsoft Corporation

05ecaec3e4529a7153b3136ceb49f0ec wimmount.sys
Microsoft Corporation

aaefb9193b31d7eb2425dd3fb6766640 winhv.sys
Microsoft Corporation

817eaff5d38674edd7713b9dfb8e9791 winusb.sys
Microsoft Corporation

f6ff8944478594d0e414d3f048f0d778 wmiacpi.sys
Microsoft Corporation

fc146f46872d4c5b529b89a5131fd1e6 wmilib.sys
Microsoft Corporation

6bcc1d7d2fd2453957c5479a32364e52 ws2ifsl.sys
Microsoft Corporation

7cadc74271dd6461c452c271b30bd378 WUDFPf.sys
Microsoft Corporation

3b197af0fff08aa66b6b2241ca538d64 WUDFRd.sys
Microsoft Corporation

b3eeacf62445e24fbb2cd4b0fb4db026 yk62x64.sys
Marvell

BC AdBot (Login to Remove)

 


#2 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:12:07 AM

Posted 04 March 2011 - 09:51 PM

We need to know more about your BSODs...

Download BlueScreenView (in Zip file)

No installation required.

Unzip downloaded file and double click on BlueScreenView.exe file to run the program and When scanning is done, go to Edit > Select All.

Then go to File > Save Selected Items, and save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

Compliments of Broni

#3 madmanjim

madmanjim
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:07 AM

Posted 04 March 2011 - 09:57 PM

We need to know more about your BSODs...

Download BlueScreenView (in Zip file)

No installation required.

Unzip downloaded file and double click on BlueScreenView.exe file to run the program and When scanning is done, go to Edit > Select All.

Then go to File > Save Selected Items, and save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

Compliments of Broni


I cannot boot into Windows normally nor SafeMode, can this be run from the Repair Console command line?

#4 Zuhl3156

Zuhl3156

  • Members
  • 309 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bensalem, Pa.
  • Local time:08:07 PM

Posted 04 March 2011 - 10:12 PM

Boot into your Repair console by tapping F8 during bootup and try the 'Use Last Known Good configuration' and see if it will work. http://windows.microsoft.com/en-US/windows7/Using-Last-Known-Good-Configuration#

  • Do one of the following:

    • If your computer has a single operating system installed, press and hold the F8 key as your computer restarts. You need to press F8 before the Windowslogo appears. If the Windows logo appears, you'll need to try again by shutting down and restarting your computer.
    • If your computer has more than one operating system, use the arrow keys to highlight the operating system you want to start, and then press F8.
  • On the Advanced Boot Options screen, use the arrow keys to highlight Last Known Good Configuration (advanced), and then press Enter.

Edited by Zuhl3156, 04 March 2011 - 10:14 PM.


#5 madmanjim

madmanjim
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:07 AM

Posted 04 March 2011 - 10:19 PM

Boot into your Repair console by tapping F8 during bootup and try the 'Use Last Known Good configuration' and see if it will work. http://windows.microsoft.com/en-US/windows7/Using-Last-Known-Good-Configuration#

  • Do one of the following:

    • If your computer has a single operating system installed, press and hold the F8 key as your computer restarts. You need to press F8 before the Windowslogo appears. If the Windows logo appears, you'll need to try again by shutting down and restarting your computer.
    • If your computer has more than one operating system, use the arrow keys to highlight the operating system you want to start, and then press F8.
  • On the Advanced Boot Options screen, use the arrow keys to highlight Last Known Good Configuration (advanced), and then press Enter.


Already done this as well as System Resores, Repair Consoles along time ago. I have been struggling with this system for days now.

#6 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:01:07 AM

Posted 05 March 2011 - 08:26 AM

Hi madmanjim,

I'm going to assist you with your problem. Please avoid making any changes to the system from now on.

Download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Scan your computer's memory for errors.
Command Prompt
[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst64 and press Enter.
Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.
[*]When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.[/list]

Edited by elise025, 05 March 2011 - 09:21 AM.
Topic moved as requested ~Elise


#7 madmanjim

madmanjim
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:07 AM

Posted 05 March 2011 - 11:14 PM

Hi farbar,

Thanks for the response, it's much appreciated.

Attached is the log file as requested.

Thanks!

Scan result of Farbars's Recovery Tool (FRST written by farbar) Version 2.0.6
Ran by SYSTEM at 2011-03-06 14:00:16
Running from F:\
Windows 7 Professional (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry ==========================

HKLM\...\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
HKLM\...\Run: [SoundMan] SOUNDMAN.EXE
HKU\Default\...\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (Microsoft Corporation)[1475072 2009-07-13]
HKU\Default User\...\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (Microsoft Corporation)[1475072 2009-07-13]
HKU\LocalAdmin\...\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (Microsoft Corporation)[1475072 2009-07-13]
HKU\rob\...\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (Microsoft Corporation)[1475072 2009-07-13]
HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE (Microsoft Corporation)[296960 2009-07-13]
Tcpip\Parameters: [DhcpNameServer] 10.17.17.254


==================== Drivers and Services ====================

3 1394ohci; C:\Windows\System32\DRIVERS\1394ohci.sys [227840 2009-07-13] (Microsoft Corporation)
0 ACPI; C:\Windows\System32\DRIVERS\ACPI.sys [334416 2009-07-13] (Microsoft Corporation)
3 AcpiPmi; C:\Windows\System32\DRIVERS\acpipmi.sys [12288 2009-07-13] (Microsoft Corporation)
3 adp94xx; C:\Windows\System32\DRIVERS\adp94xx.sys [491088 2009-07-13] (Adaptec, Inc.)
3 adpahci; C:\Windows\System32\DRIVERS\adpahci.sys [339536 2009-07-13] (Adaptec, Inc.)
3 adpu320; C:\Windows\System32\DRIVERS\adpu320.sys [182864 2009-07-13] (Adaptec, Inc.)
3 AeLookupSvc; C:\Windows\System32\aelupsvc.dll [72192 2009-07-13] (Microsoft Corporation)
1 AFD; C:\Windows\System32\drivers\afd.sys [500224 2009-07-13] (Microsoft Corporation)
3 agp440; C:\Windows\System32\DRIVERS\agp440.sys [61008 2009-07-13] (Microsoft Corporation)
3 ALCXWDM; C:\Windows\System32\drivers\RTKVAC64.SYS [3491616 2009-06-18] (Realtek Semiconductor Corp.)
3 ALG; C:\Windows\System32\alg.exe [79360 2009-07-13] (Microsoft Corporation)
3 aliide; C:\Windows\System32\DRIVERS\aliide.sys [15440 2009-07-13] (Acer Laboratories Inc.)
3 amdide; C:\Windows\System32\DRIVERS\amdide.sys [15440 2009-07-13] (Microsoft Corporation)
3 AmdK8; C:\Windows\System32\DRIVERS\amdk8.sys [64512 2009-07-13] (Microsoft Corporation)
3 AmdPPM; C:\Windows\System32\DRIVERS\amdppm.sys [60928 2009-07-13] (Microsoft Corporation)
3 amdsata; C:\Windows\System32\DRIVERS\amdsata.sys [106576 2009-07-13] (Advanced Micro Devices)
3 amdsbs; C:\Windows\System32\DRIVERS\amdsbs.sys [194128 2009-07-13] (AMD Technologies Inc.)
0 amdxata; C:\Windows\System32\DRIVERS\amdxata.sys [28752 2009-07-13] (Advanced Micro Devices)
2 AntiVirSchedulerService; "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" [135336 2010-08-01] (Avira GmbH)
2 AntiVirService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" [267944 2010-12-13] (Avira GmbH)
3 AppID; C:\Windows\System32\drivers\appid.sys [61440 2009-07-13] (Microsoft Corporation)
3 AppIDSvc; C:\Windows\System32\appidsvc.dll [32256 2009-07-13] (Microsoft Corporation)
3 Appinfo; C:\Windows\System32\appinfo.dll [70144 2009-07-13] (Microsoft Corporation)
2 Apple Mobile Device; "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" [37664 2010-10-15] (Apple Inc.)
3 AppMgmt; C:\Windows\System32\appmgmts.dll [193536 2009-07-13] (Microsoft Corporation)
3 arc; C:\Windows\System32\DRIVERS\arc.sys [87632 2009-07-13] (Adaptec, Inc.)
3 arcsas; C:\Windows\System32\DRIVERS\arcsas.sys [97856 2009-07-13] (Adaptec, Inc.)
3 AsyncMac; C:\Windows\System32\DRIVERS\asyncmac.sys [23040 2009-07-13] (Microsoft Corporation)
0 atapi; C:\Windows\System32\DRIVERS\atapi.sys [24128 2009-07-13] (Microsoft Corporation)
2 AudioEndpointBuilder; C:\Windows\System32\Audiosrv.dll [676864 2009-07-13] (Microsoft Corporation)
2 AudioSrv; C:\Windows\System32\Audiosrv.dll [676864 2009-07-13] (Microsoft Corporation)
2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83120 2010-12-13] (Avira GmbH)
1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [116568 2010-08-01] (Avira GmbH)
3 AxInstSV; C:\Windows\System32\AxInstSV.dll [114688 2009-07-13] (Microsoft Corporation)
3 b06bdrv; C:\Windows\System32\DRIVERS\bxvbda.sys [468480 2009-06-10] (Broadcom Corporation)
3 b57nd60a; C:\Windows\System32\DRIVERS\b57nd60a.sys [270848 2009-06-10] (Broadcom Corporation)
3 BDESVC; C:\Windows\System32\bdesvc.dll [100864 2009-07-13] (Microsoft Corporation)
1 Beep; C:\Windows\System32\Drivers\Beep.sys [6656 2009-07-13] (Microsoft Corporation)
2 BFE; C:\Windows\System32\bfe.dll [703488 2009-07-13] (Microsoft Corporation)
3 BITS; C:\Windows\System32\qmgr.dll [848384 2009-07-13] (Microsoft Corporation)
1 blbdrive; C:\Windows\System32\DRIVERS\blbdrive.sys [45056 2009-07-13] (Microsoft Corporation)
2 Bonjour Service; "C:\Program Files (x86)\Bonjour\mDNSResponder.exe" [345376 2010-10-06] (Apple Inc.)
3 bowser; C:\Windows\System32\DRIVERS\bowser.sys [90624 2009-07-13] (Microsoft Corporation)
3 BrFiltLo; C:\Windows\System32\DRIVERS\BrFiltLo.sys [18432 2009-06-10] (Brother Industries, Ltd.)
3 BrFiltUp; C:\Windows\System32\DRIVERS\BrFiltUp.sys [8704 2009-06-10] (Brother Industries, Ltd.)
3 Browser; C:\Windows\System32\browser.dll [136192 2009-07-13] (Microsoft Corporation)
3 Brserid; C:\Windows\System32\Drivers\Brserid.sys [286720 2009-07-13] (Brother Industries Ltd.)
3 BrSerWdm; C:\Windows\System32\Drivers\BrSerWdm.sys [47104 2009-06-10] (Brother Industries Ltd.)
3 BrUsbMdm; C:\Windows\System32\Drivers\BrUsbMdm.sys [14976 2009-06-10] (Brother Industries Ltd.)
3 BrUsbSer; C:\Windows\System32\Drivers\BrUsbSer.sys [14720 2009-06-10] (Brother Industries Ltd.)
3 BTHMODEM; C:\Windows\System32\DRIVERS\bthmodem.sys [72192 2009-07-13] (Microsoft Corporation)
3 bthserv; C:\Windows\System32\bthserv.dll [83968 2009-07-13] (Microsoft Corporation)
4 cdfs; C:\Windows\System32\DRIVERS\cdfs.sys [92160 2009-07-13] (Microsoft Corporation)
1 cdrom; C:\Windows\System32\DRIVERS\cdrom.sys [147456 2009-07-13] (Microsoft Corporation)
3 CertPropSvc; C:\Windows\System32\certprop.dll [80384 2009-07-13] (Microsoft Corporation)
3 circlass; C:\Windows\System32\DRIVERS\circlass.sys [45568 2009-07-13] (Microsoft Corporation)
0 CLFS; C:\Windows\System32\CLFS.sys [367696 2009-07-13] (Microsoft Corporation)
3 clr_optimization_v2.0.50727_32; C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [66384 2009-06-10] (Microsoft Corporation)
3 clr_optimization_v2.0.50727_64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [89920 2009-06-10] (Microsoft Corporation)
3 CmBatt; C:\Windows\System32\DRIVERS\CmBatt.sys [17664 2009-07-13] (Microsoft Corporation)
3 cmdide; C:\Windows\System32\DRIVERS\cmdide.sys [17488 2009-07-13] (CMD Technology, Inc.)
0 CNG; C:\Windows\System32\Drivers\cng.sys [460504 2009-07-13] (Microsoft Corporation)
3 Compbatt; C:\Windows\System32\DRIVERS\compbatt.sys [21584 2009-07-13] (Microsoft Corporation)
3 CompositeBus; C:\Windows\System32\DRIVERS\CompositeBus.sys [38912 2009-07-13] (Microsoft Corporation)
3 COMSysApp; C:\Windows\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} [9728 2009-07-13] (Microsoft Corporation)
4 crcdisk; C:\Windows\System32\DRIVERS\crcdisk.sys [24144 2009-07-13] (Microsoft Corporation)
2 CryptSvc; C:\Windows\System32\cryptsvc.dll [175104 2009-07-13] (Microsoft Corporation)
1 CSC; C:\Windows\System32\drivers\csc.sys [514048 2009-07-13] (Microsoft Corporation)
2 CscService; C:\Windows\System32\cscsvc.dll [689152 2009-07-13] (Microsoft Corporation)
2 DcomLaunch; C:\Windows\System32\rpcss.dll [509440 2009-07-13] (Microsoft Corporation)
3 defragsvc; C:\Windows\System32\defragsvc.dll [291328 2009-07-13] (Microsoft Corporation)
1 DfsC; C:\Windows\System32\Drivers\dfsc.sys [102400 2009-07-13] (Microsoft Corporation)
2 Dhcp; C:\Windows\System32\dhcpcore.dll [314368 2009-07-13] (Microsoft Corporation)
1 discache; C:\Windows\System32\drivers\discache.sys [40448 2009-07-13] (Microsoft Corporation)
0 Disk; C:\Windows\System32\DRIVERS\disk.sys [73280 2009-07-13] (Microsoft Corporation)
2 Dnscache; C:\Windows\System32\dnsrslvr.dll [182272 2009-07-13] (Microsoft Corporation)
3 dot3svc; C:\Windows\System32\dot3svc.dll [252416 2009-07-13] (Microsoft Corporation)
2 DPS; C:\Windows\System32\dps.dll [162816 2009-07-13] (Microsoft Corporation)
3 drmkaud; C:\Windows\System32\drivers\drmkaud.sys [5632 2009-07-13] (Microsoft Corporation)
3 DXGKrnl; C:\Windows\System32\drivers\dxgkrnl.sys [982600 2009-10-01] (Microsoft Corporation)
3 EapHost; C:\Windows\System32\eapsvc.dll [111104 2009-07-13] (Microsoft Corporation)
3 ebdrv; C:\Windows\System32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
3 EFS; C:\Windows\System32\lsass.exe [31232 2009-07-13] (Microsoft Corporation)
3 ehRecvr; C:\Windows\ehome\ehRecvr.exe [696320 2010-08-03] (Microsoft Corporation)
3 ehSched; C:\Windows\ehome\ehsched.exe [127488 2009-07-13] (Microsoft Corporation)
3 elxstor; C:\Windows\System32\DRIVERS\elxstor.sys [530496 2009-07-13] (Emulex)
3 ErrDev; C:\Windows\System32\DRIVERS\errdev.sys [9728 2009-07-13] (Microsoft Corporation)
2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [27136 2009-07-13] (Microsoft Corporation)
2 EventSystem; C:\Windows\System32\es.dll [402944 2009-07-13] (Microsoft Corporation)
3 exfat; C:\Windows\System32\Drivers\exfat.sys [195072 2009-07-13] (Microsoft Corporation)
3 fastfat; C:\Windows\System32\Drivers\fastfat.sys [204800 2009-07-13] (Microsoft Corporation)
3 Fax; C:\Windows\System32\fxssvc.exe [689152 2009-07-13] (Microsoft Corporation)
3 fdc; C:\Windows\System32\DRIVERS\fdc.sys [29696 2009-07-13] (Microsoft Corporation)
3 fdPHost; C:\Windows\System32\fdPHost.dll [16384 2009-07-13] (Microsoft Corporation)
2 FDResPub; C:\Windows\System32\fdrespub.dll [34816 2009-07-13] (Microsoft Corporation)
0 FileInfo; C:\Windows\System32\drivers\fileinfo.sys [70224 2009-07-13] (Microsoft Corporation)
3 Filetrace; C:\Windows\System32\drivers\filetrace.sys [34304 2009-07-13] (Microsoft Corporation)
3 flpydisk; C:\Windows\System32\DRIVERS\flpydisk.sys [24576 2009-07-13] (Microsoft Corporation)
0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [290368 2009-07-13] (Microsoft Corporation)
3 FontCache; C:\Windows\System32\FntCache.dll [1127936 2009-07-13] (Microsoft Corporation)
3 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42840 2009-06-10] (Microsoft Corporation)
3 FsDepends; C:\Windows\System32\drivers\FsDepends.sys [55376 2009-07-13] (Microsoft Corporation)
0 Fs_Rec; C:\Windows\System32\Drivers\Fs_Rec.sys [23104 2009-07-13] (Microsoft Corporation)
0 fvevol; C:\Windows\System32\DRIVERS\fvevol.sys [223448 2009-09-25] (Microsoft Corporation)
3 gagp30kx; C:\Windows\System32\DRIVERS\gagp30kx.sys [65088 2009-07-13] (Microsoft Corporation)
3 GEARAspiWDM; C:\Windows\System32\DRIVERS\GEARAspiWDM.sys [34152 2009-05-17] (GEAR Software Inc.)
2 gpsvc; C:\Windows\System32\gpsvc.dll [776192 2009-07-13] (Microsoft Corporation)
3 hcw85cir; C:\Windows\System32\drivers\hcw85cir.sys [31232 2009-06-10] (Hauppauge Computer Works, Inc.)
3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [122368 2009-07-13] (Microsoft Corporation)
3 HidBatt; C:\Windows\System32\DRIVERS\HidBatt.sys [26624 2009-07-13] (Microsoft Corporation)
3 HidBth; C:\Windows\System32\DRIVERS\hidbth.sys [100864 2009-07-13] (Microsoft Corporation)
3 HidIr; C:\Windows\System32\DRIVERS\hidir.sys [46592 2009-07-13] (Microsoft Corporation)
3 hidserv; C:\Windows\System32\hidserv.dll [38912 2009-07-13] (Microsoft Corporation)
3 HidUsb; C:\Windows\System32\DRIVERS\hidusb.sys [30208 2009-07-13] (Microsoft Corporation)
3 hkmsvc; C:\Windows\System32\kmsvc.dll [90624 2009-07-13] (Microsoft Corporation)
3 HomeGroupListener; C:\Windows\System32\ListSvc.dll [231936 2009-07-13] (Microsoft Corporation)
3 HomeGroupProvider; C:\Windows\System32\provsvc.dll [187904 2009-07-13] (Microsoft Corporation)
3 HpSAMD; C:\Windows\System32\DRIVERS\HpSAMD.sys [77888 2009-07-13] (Hewlett-Packard Company)
3 HTTP; C:\Windows\System32\drivers\HTTP.sys [751616 2009-07-13] (Microsoft Corporation)
0 hwpolicy; C:\Windows\System32\drivers\hwpolicy.sys [14416 2009-07-13] (Microsoft Corporation)
3 i8042prt; C:\Windows\System32\DRIVERS\i8042prt.sys [105472 2009-07-13] (Microsoft Corporation)
3 iaStorV; C:\Windows\System32\DRIVERS\iaStorV.sys [410688 2009-07-13] (Intel Corporation)
3 idsvc; "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe" [856384 2009-06-10] (Microsoft Corporation)
3 iirsp; C:\Windows\System32\DRIVERS\iirsp.sys [44112 2009-07-13] (Intel Corp./ICP vortex GmbH)
2 IKEEXT; C:\Windows\System32\ikeext.dll [845824 2009-07-13] (Microsoft Corporation)
3 intelide; C:\Windows\System32\DRIVERS\intelide.sys [16960 2009-07-13] (Microsoft Corporation)
3 intelppm; C:\Windows\System32\DRIVERS\intelppm.sys [62464 2009-07-13] (Microsoft Corporation)
3 IPBusEnum; C:\Windows\System32\ipbusenum.dll [101888 2009-07-13] (Microsoft Corporation)
3 IpFilterDriver; C:\Windows\System32\DRIVERS\ipfltdrv.sys [82944 2009-07-13] (Microsoft Corporation)
2 iphlpsvc; C:\Windows\System32\iphlpsvc.dll [565760 2009-07-13] (Microsoft Corporation)
3 IPMIDRV; C:\Windows\System32\DRIVERS\IPMIDrv.sys [78848 2009-07-13] (Microsoft Corporation)
3 IPNAT; C:\Windows\System32\drivers\ipnat.sys [116224 2009-07-13] (Microsoft Corporation)
3 iPod Service; "C:\Program Files\iPod\bin\iPodService.exe" [932640 2010-12-12] (Apple Inc.)
3 IRENUM; C:\Windows\System32\drivers\irenum.sys [17920 2009-07-13] (Microsoft Corporation)
3 isapnp; C:\Windows\System32\DRIVERS\isapnp.sys [20544 2009-07-13] (Microsoft Corporation)
3 iScsiPrt; C:\Windows\System32\DRIVERS\msiscsi.sys [224832 2009-07-13] (Microsoft Corporation)
3 kbdclass; C:\Windows\System32\DRIVERS\kbdclass.sys [50768 2009-07-13] (Microsoft Corporation)
3 kbdhid; C:\Windows\System32\DRIVERS\kbdhid.sys [33280 2009-07-13] (Microsoft Corporation)
3 KeyIso; C:\Windows\System32\lsass.exe [31232 2009-07-13] (Microsoft Corporation)
0 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [95312 2009-07-13] (Microsoft Corporation)
0 KSecPkg; C:\Windows\System32\Drivers\ksecpkg.sys [153160 2009-12-11] (Microsoft Corporation)
3 ksthunk; C:\Windows\System32\drivers\ksthunk.sys [20992 2009-07-13] (Microsoft Corporation)
3 KtmRm; C:\Windows\System32\msdtckrm.dll [368640 2009-07-13] (Microsoft Corporation)
2 LanmanServer; C:\Windows\System32\srvsvc.dll [236032 2010-08-26] (Microsoft Corporation)
2 LanmanWorkstation; C:\Windows\System32\wkssvc.dll [118784 2009-07-13] (Microsoft Corporation)
2 lltdio; C:\Windows\System32\DRIVERS\lltdio.sys [60928 2009-07-13] (Microsoft Corporation)
3 lltdsvc; C:\Windows\System32\lltdsvc.dll [300032 2009-07-13] (Microsoft Corporation)
2 lmhosts; C:\Windows\System32\lmhsvc.dll [23552 2009-07-13] (Microsoft Corporation)
3 LSI_FC; C:\Windows\System32\DRIVERS\lsi_fc.sys [114752 2009-07-13] (LSI Corporation)
3 LSI_SAS; C:\Windows\System32\DRIVERS\lsi_sas.sys [106560 2009-07-13] (LSI Corporation)
3 LSI_SAS2; C:\Windows\System32\DRIVERS\lsi_sas2.sys [65600 2009-07-13] (LSI Corporation)
3 LSI_SCSI; C:\Windows\System32\DRIVERS\lsi_scsi.sys [115776 2009-07-13] (LSI Corporation)
2 luafv; C:\Windows\System32\drivers\luafv.sys [113152 2009-07-13] (Microsoft Corporation)
4 Mcx2Svc; C:\Windows\System32\Mcx2Svc.dll [84480 2009-07-13] (Microsoft Corporation)
2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [322120 2003-06-19] (Microsoft Corporation)
3 megasas; C:\Windows\System32\DRIVERS\megasas.sys [35392 2009-07-13] (LSI Corporation)
3 MegaSR; C:\Windows\System32\DRIVERS\MegaSR.sys [284736 2009-07-13] (LSI Corporation, Inc.)
2 MMCSS; C:\Windows\System32\mmcss.dll [67584 2009-07-13] (Microsoft Corporation)
3 Modem; C:\Windows\System32\drivers\modem.sys [40448 2009-07-13] (Microsoft Corporation)
3 monitor; C:\Windows\System32\DRIVERS\monitor.sys [30208 2009-07-13] (Microsoft Corporation)
3 mouclass; C:\Windows\System32\DRIVERS\mouclass.sys [49216 2009-07-13] (Microsoft Corporation)
3 mouhid; C:\Windows\System32\DRIVERS\mouhid.sys [31232 2009-07-13] (Microsoft Corporation)
0 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [94784 2009-07-13] (Microsoft Corporation)
3 mpio; C:\Windows\System32\DRIVERS\mpio.sys [155216 2009-07-13] (Microsoft Corporation)
3 mpsdrv; C:\Windows\System32\drivers\mpsdrv.sys [77312 2009-07-13] (Microsoft Corporation)
2 MpsSvc; C:\Windows\System32\mpssvc.dll [824832 2009-07-13] (Microsoft Corporation)
3 MRxDAV; C:\Windows\System32\drivers\mrxdav.sys [140800 2009-07-13] (Microsoft Corporation)
3 mrxsmb; C:\Windows\System32\DRIVERS\mrxsmb.sys [157696 2010-02-26] (Microsoft Corporation)
3 mrxsmb10; C:\Windows\System32\DRIVERS\mrxsmb10.sys [286720 2010-02-26] (Microsoft Corporation)
3 mrxsmb20; C:\Windows\System32\DRIVERS\mrxsmb20.sys [125952 2010-02-26] (Microsoft Corporation)
3 msahci; C:\Windows\System32\DRIVERS\msahci.sys [30272 2009-07-13] (Microsoft Corporation)
3 msdsm; C:\Windows\System32\DRIVERS\msdsm.sys [140352 2009-07-13] (Microsoft Corporation)
3 MSDTC; C:\Windows\System32\msdtc.exe [141824 2009-07-13] (Microsoft Corporation)
1 Msfs; C:\Windows\System32\Drivers\Msfs.sys [26112 2009-07-13] (Microsoft Corporation)
3 mshidkmdf; C:\Windows\System32\drivers\mshidkmdf.sys [8192 2009-07-13] (Microsoft Corporation)
0 msisadrv; C:\Windows\System32\DRIVERS\msisadrv.sys [15424 2009-07-13] (Microsoft Corporation)
3 MSiSCSI; C:\Windows\System32\iscsiexe.dll [156672 2009-07-13] (Microsoft Corporation)
3 msiserver; C:\Windows\System32\msiexec.exe /V [127488 2009-07-13] (Microsoft Corporation)
3 MSKSSRV; C:\Windows\System32\drivers\MSKSSRV.sys [11136 2009-07-13] (Microsoft Corporation)
3 MSPCLOCK; C:\Windows\System32\drivers\MSPCLOCK.sys [7168 2009-07-13] (Microsoft Corporation)
3 MSPQM; C:\Windows\System32\drivers\MSPQM.sys [6784 2009-07-13] (Microsoft Corporation)
3 MsRPC; C:\Windows\System32\Drivers\MsRPC.sys [367168 2009-07-13] (Microsoft Corporation)
1 mssmbios; C:\Windows\System32\DRIVERS\mssmbios.sys [32320 2009-07-13] (Microsoft Corporation)
3 MSTEE; C:\Windows\System32\drivers\MSTEE.sys [8064 2009-07-13] (Microsoft Corporation)
3 MTConfig; C:\Windows\System32\DRIVERS\MTConfig.sys [15360 2009-07-13] (Microsoft Corporation)
3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-28] ()
0 Mup; C:\Windows\System32\Drivers\mup.sys [60496 2009-07-13] (Microsoft Corporation)
3 napagent; C:\Windows\System32\qagentRT.dll [475648 2009-07-13] (Microsoft Corporation)
3 NativeWifiP; C:\Windows\System32\DRIVERS\nwifi.sys [318976 2009-07-13] (Microsoft Corporation)
0 NDIS; C:\Windows\System32\drivers\ndis.sys [947776 2009-07-13] (Microsoft Corporation)
3 NdisCap; C:\Windows\System32\DRIVERS\ndiscap.sys [35328 2009-07-13] (Microsoft Corporation)
3 NdisTapi; C:\Windows\System32\DRIVERS\ndistapi.sys [24064 2009-07-13] (Microsoft Corporation)
3 Ndisuio; C:\Windows\System32\DRIVERS\ndisuio.sys [56320 2009-07-13] (Microsoft Corporation)
3 NdisWan; C:\Windows\System32\DRIVERS\ndiswan.sys [164352 2009-07-13] (Microsoft Corporation)
3 NDProxy; C:\Windows\System32\Drivers\NDProxy.sys [57856 2009-07-13] (Microsoft Corporation)
3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2010-04-19] (Apple Inc.)
1 NetBIOS; C:\Windows\System32\DRIVERS\netbios.sys [44544 2009-07-13] (Microsoft Corporation)
1 NetBT; C:\Windows\System32\DRIVERS\netbt.sys [259072 2009-07-13] (Microsoft Corporation)
2 Netlogon; C:\Windows\System32\lsass.exe [31232 2009-07-13] (Microsoft Corporation)
3 Netman; C:\Windows\System32\netman.dll [360448 2009-07-13] (Microsoft Corporation)
3 netprofm; C:\Windows\System32\netprofm.dll [459776 2009-07-13] (Microsoft Corporation)
4 NetTcpPortSharing; "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe" [116560 2009-06-10] (Microsoft Corporation)
3 nfrd960; C:\Windows\System32\DRIVERS\nfrd960.sys [51264 2009-07-13] (IBM Corporation)
2 NlaSvc; C:\Windows\System32\nlasvc.dll [302080 2009-07-13] (Microsoft Corporation)
1 Npfs; C:\Windows\System32\Drivers\Npfs.sys [44032 2009-07-13] (Microsoft Corporation)
2 nsi; C:\Windows\System32\nsisvc.dll [25600 2009-07-13] (Microsoft Corporation)
1 nsiproxy; C:\Windows\System32\drivers\nsiproxy.sys [24576 2009-07-13] (Microsoft Corporation)
3 Ntfs; C:\Windows\System32\Drivers\Ntfs.sys [1659984 2009-07-13] (Microsoft Corporation)
1 Null; C:\Windows\System32\Drivers\Null.sys [6144 2009-07-13] (Microsoft Corporation)
3 NVENETFD; C:\Windows\System32\DRIVERS\nvm62x64.sys [408960 2009-06-10] (NVIDIA Corporation)
3 nvlddmkm; C:\Windows\System32\DRIVERS\nvlddmkm.sys [11572512 2009-06-10] (NVIDIA Corporation)
3 nvraid; C:\Windows\System32\DRIVERS\nvraid.sys [149056 2009-07-13] (NVIDIA Corporation)
3 nvstor; C:\Windows\System32\DRIVERS\nvstor.sys [167488 2009-07-13] (NVIDIA Corporation)
3 nv_agp; C:\Windows\System32\DRIVERS\nv_agp.sys [122960 2009-07-13] (Microsoft Corporation)
3 ohci1394; C:\Windows\System32\DRIVERS\ohci1394.sys [72832 2009-07-13] (Microsoft Corporation)
3 ose; "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE" [89136 2003-07-27] (Microsoft Corporation)
3 p2pimsvc; C:\Windows\System32\pnrpsvc.dll [327168 2009-07-13] (Microsoft Corporation)
3 p2psvc; C:\Windows\System32\p2psvc.dll [438784 2009-07-13] (Microsoft Corporation)
3 Parport; C:\Windows\System32\DRIVERS\parport.sys [97280 2009-07-13] (Microsoft Corporation)
0 partmgr; C:\Windows\System32\drivers\partmgr.sys [75840 2009-07-13] (Microsoft Corporation)
2 PcaSvc; C:\Windows\System32\pcasvc.dll [186368 2009-07-13] (Microsoft Corporation)
0 pci; C:\Windows\System32\DRIVERS\pci.sys [183872 2009-07-13] (Microsoft Corporation)
0 pciide; C:\Windows\System32\DRIVERS\pciide.sys [12352 2009-07-13] (Microsoft Corporation)
3 pcmcia; C:\Windows\System32\DRIVERS\pcmcia.sys [220752 2009-07-13] (Microsoft Corporation)
0 pcw; C:\Windows\System32\drivers\pcw.sys [50768 2009-07-13] (Microsoft Corporation)
2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [651264 2009-07-13] (Microsoft Corporation)
3 PeerDistSvc; C:\Windows\System32\peerdistsvc.dll [1361920 2009-07-13] (Microsoft Corporation)
3 PerfHost; C:\Windows\SysWow64\perfhost.exe [20992 2009-07-13] (Microsoft Corporation)
3 pla; C:\Windows\System32\pla.dll [1390080 2009-07-13] (Microsoft Corporation)
2 PlugPlay; C:\Windows\System32\umpnpmgr.dll [404480 2009-07-13] (Microsoft Corporation)
3 PNRPAutoReg; C:\Windows\System32\pnrpauto.dll [25088 2009-07-13] (Microsoft Corporation)
3 PNRPsvc; C:\Windows\System32\pnrpsvc.dll [327168 2009-07-13] (Microsoft Corporation)
3 PolicyAgent; C:\Windows\System32\ipsecsvc.dll [500224 2009-07-13] (Microsoft Corporation)
2 Power; C:\Windows\System32\umpo.dll [163840 2009-07-13] (Microsoft Corporation)
3 PptpMiniport; C:\Windows\System32\DRIVERS\raspptp.sys [111616 2009-07-13] (Microsoft Corporation)
3 Processor; C:\Windows\System32\DRIVERS\processr.sys [60416 2009-07-13] (Microsoft Corporation)
2 ProfSvc; C:\Windows\System32\profsvc.dll [208384 2009-07-13] (Microsoft Corporation)
3 ProtectedStorage; C:\Windows\System32\lsass.exe [31232 2009-07-13] (Microsoft Corporation)
1 Psched; C:\Windows\System32\DRIVERS\pacer.sys [131584 2009-07-13] (Microsoft Corporation)
3 ql2300; C:\Windows\System32\DRIVERS\ql2300.sys [1524816 2009-07-13] (QLogic Corporation)
3 ql40xx; C:\Windows\System32\DRIVERS\ql40xx.sys [128592 2009-07-13] (QLogic Corporation)
3 QWAVE; C:\Windows\system32\qwave.dll [242688 2009-07-13] (Microsoft Corporation)
3 QWAVEdrv; C:\Windows\System32\drivers\qwavedrv.sys [46592 2009-07-13] (Microsoft Corporation)
2 RapiMgr; C:\Windows\WindowsMobile\rapimgr.dll [225672 2007-05-30] (Microsoft Corporation)
3 RasAcd; C:\Windows\System32\DRIVERS\rasacd.sys [14848 2009-07-13] (Microsoft Corporation)
3 RasAgileVpn; C:\Windows\System32\DRIVERS\AgileVpn.sys [60416 2009-07-13] (Microsoft Corporation)
3 RasAuto; C:\Windows\System32\rasauto.dll [99328 2009-07-13] (Microsoft Corporation)
3 Rasl2tp; C:\Windows\System32\DRIVERS\rasl2tp.sys [130048 2009-07-13] (Microsoft Corporation)
3 RasMan; C:\Windows\System32\rasmans.dll [343552 2009-07-13] (Microsoft Corporation)
3 RasPppoe; C:\Windows\System32\DRIVERS\raspppoe.sys [92672 2009-07-13] (Microsoft Corporation)
3 RasSstp; C:\Windows\System32\DRIVERS\rassstp.sys [83968 2009-07-13] (Microsoft Corporation)
1 rdbss; C:\Windows\System32\DRIVERS\rdbss.sys [309248 2009-07-13] (Microsoft Corporation)
3 rdpbus; C:\Windows\System32\DRIVERS\rdpbus.sys [24064 2009-07-13] (Microsoft Corporation)
1 RDPCDD; C:\Windows\System32\DRIVERS\RDPCDD.sys [7680 2009-07-13] (Microsoft Corporation)
3 RDPDR; C:\Windows\System32\drivers\rdpdr.sys [165376 2009-07-13] (Microsoft Corporation)
1 RDPENCDD; C:\Windows\System32\drivers\rdpencdd.sys [7680 2009-07-13] (Microsoft Corporation)
1 RDPREFMP; C:\Windows\System32\drivers\rdprefmp.sys [8192 2009-07-13] (Microsoft Corporation)
3 RDPWD; C:\Windows\System32\Drivers\RDPWD.sys [204800 2009-07-13] (Microsoft Corporation)
0 rdyboost; C:\Windows\System32\drivers\rdyboost.sys [214096 2009-07-13] (Microsoft Corporation)
4 RemoteAccess; C:\Windows\System32\mprdim.dll [97792 2009-07-13] (Microsoft Corporation)
3 RemoteRegistry; C:\Windows\System32\regsvc.dll [159232 2009-07-13] (Microsoft Corporation)
2 RpcEptMapper; C:\Windows\System32\RpcEpMap.dll [67072 2009-07-13] (Microsoft Corporation)
3 RpcLocator; C:\Windows\System32\locator.exe [10240 2009-07-13] (Microsoft Corporation)
2 RpcSs; C:\Windows\System32\rpcss.dll [509440 2009-07-13] (Microsoft Corporation)
2 rspndr; C:\Windows\System32\DRIVERS\rspndr.sys [76800 2009-07-13] (Microsoft Corporation)
3 s3cap; C:\Windows\System32\DRIVERS\vms3cap.sys [6656 2009-07-13] (Microsoft Corporation)
2 SamSs; C:\Windows\System32\lsass.exe [31232 2009-07-13] (Microsoft Corporation)
3 sbp2port; C:\Windows\System32\DRIVERS\sbp2port.sys [104016 2009-07-13] (Microsoft Corporation)
3 SCardSvr; C:\Windows\System32\SCardSvr.dll [190976 2009-07-13] (Microsoft Corporation)
3 scfilter; C:\Windows\System32\DRIVERS\scfilter.sys [29696 2009-07-13] (Microsoft Corporation)
2 Schedule; C:\Windows\System32\schedsvc.dll [1104384 2009-07-13] (Microsoft Corporation)
3 SCPolicySvc; C:\Windows\System32\certprop.dll [80384 2009-07-13] (Microsoft Corporation)
3 SDRSVC; C:\Windows\System32\SDRSVC.dll [170496 2009-07-13] (Microsoft Corporation)
2 secdrv; C:\Windows\System32\Drivers\secdrv.sys [23040 2009-06-10] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
3 seclogon; C:\Windows\system32\seclogon.dll [30720 2009-07-13] (Microsoft Corporation)
2 SENS; C:\Windows\System32\sens.dll [64512 2009-07-13] (Microsoft Corporation)
3 SensrSvc; C:\Windows\System32\sensrsvc.dll [29184 2009-07-13] (Microsoft Corporation)
3 Serenum; C:\Windows\System32\DRIVERS\serenum.sys [23552 2009-07-13] (Microsoft Corporation)
1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-13] (Microsoft Corporation)
3 sermouse; C:\Windows\System32\DRIVERS\sermouse.sys [26624 2009-07-13] (Microsoft Corporation)
3 SessionEnv; C:\Windows\System32\sessenv.dll [104960 2009-07-13] (Microsoft Corporation)
3 sffdisk; C:\Windows\System32\DRIVERS\sffdisk.sys [14336 2009-07-13] (Microsoft Corporation)
3 sffp_mmc; C:\Windows\System32\DRIVERS\sffp_mmc.sys [13824 2009-07-13] (Microsoft Corporation)
3 sffp_sd; C:\Windows\System32\DRIVERS\sffp_sd.sys [14336 2009-07-13] (Microsoft Corporation)
3 sfloppy; C:\Windows\System32\DRIVERS\sfloppy.sys [16896 2009-07-13] (Microsoft Corporation)
4 SharedAccess; C:\Windows\System32\ipnathlp.dll [359424 2009-07-13] (Microsoft Corporation)
2 ShellHWDetection; C:\Windows\System32\shsvcs.dll [369664 2009-07-13] (Microsoft Corporation)
3 SiSRaid2; C:\Windows\System32\DRIVERS\SiSRaid2.sys [43584 2009-07-13] (Silicon Integrated Systems Corp.)
3 SiSRaid4; C:\Windows\System32\DRIVERS\sisraid4.sys [80464 2009-07-13] (Silicon Integrated Systems)
3 Smb; C:\Windows\System32\DRIVERS\smb.sys [93184 2009-07-13] (Microsoft Corporation)
3 SNMPTRAP; C:\Windows\System32\snmptrap.exe [14336 2009-07-13] (Microsoft Corporation)
0 spldr; C:\Windows\System32\Drivers\spldr.sys [19008 2009-07-13] (Microsoft Corporation)
2 Spooler; C:\Windows\System32\spoolsv.exe [558592 2010-08-20] (Microsoft Corporation)
2 sppsvc; C:\Windows\System32\sppsvc.exe [3524608 2009-07-13] (Microsoft Corporation)
3 sppuinotify; C:\Windows\System32\sppuinotify.dll [65536 2009-07-13] (Microsoft Corporation)
3 srv; C:\Windows\System32\DRIVERS\srv.sys [463360 2010-08-26] (Microsoft Corporation)
3 srv2; C:\Windows\System32\DRIVERS\srv2.sys [402944 2010-08-26] (Microsoft Corporation)
3 srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [161792 2010-08-26] (Microsoft Corporation)
3 SSDPSRV; C:\Windows\System32\ssdpsrv.dll [193024 2009-07-13] (Microsoft Corporation)
3 SstpSvc; C:\Windows\System32\sstpsvc.dll [75264 2009-07-13] (Microsoft Corporation)
3 stexstor; C:\Windows\System32\DRIVERS\stexstor.sys [24656 2009-07-13] (Promise Technology)
2 stisvc; C:\Windows\System32\wiaservc.dll [578560 2009-07-13] (Microsoft Corporation)
0 storflt; C:\Windows\System32\DRIVERS\vmstorfl.sys [46672 2009-07-13] (Microsoft Corporation)
3 StorSvc; C:\Windows\System32\storsvc.dll [17920 2009-07-13] (Microsoft Corporation)
3 storvsc; C:\Windows\System32\DRIVERS\storvsc.sys [34896 2009-07-13] (Microsoft Corporation)
3 swenum; C:\Windows\System32\DRIVERS\swenum.sys [12496 2009-07-13] (Microsoft Corporation)
3 swprv; C:\Windows\System32\swprv.dll [524288 2009-07-13] (Microsoft Corporation)
2 SysMain; C:\Windows\System32\sysmain.dll [1780736 2009-07-13] (Microsoft Corporation)
3 TabletInputService; C:\Windows\System32\TabSvc.dll [93184 2009-07-13] (Microsoft Corporation)
3 TapiSrv; C:\Windows\System32\tapisrv.dll [316416 2009-07-13] (Microsoft Corporation)
3 TBS; C:\Windows\System32\tbssvc.dll [65536 2009-07-13] (Microsoft Corporation)
0 Tcpip; C:\Windows\System32\drivers\tcpip.sys [1896832 2010-06-13] (Microsoft Corporation)
3 TCPIP6; C:\Windows\System32\DRIVERS\tcpip.sys [1896832 2010-06-13] (Microsoft Corporation)
2 tcpipreg; C:\Windows\System32\drivers\tcpipreg.sys [44544 2009-07-13] (Microsoft Corporation)
3 TDPIPE; C:\Windows\System32\drivers\tdpipe.sys [15872 2009-07-13] (Microsoft Corporation)
3 TDTCP; C:\Windows\System32\drivers\tdtcp.sys [23552 2009-07-13] (Microsoft Corporation)
1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [99840 2009-07-13] (Microsoft Corporation)
2 TeamViewer6; C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2222376 2010-11-30] (TeamViewer GmbH)
1 TermDD; C:\Windows\System32\DRIVERS\termdd.sys [62544 2009-07-13] (Microsoft Corporation)
3 TermService; C:\Windows\System32\termsrv.dll [706560 2009-07-13] (Microsoft Corporation)
2 Themes; C:\Windows\System32\themeservice.dll [44544 2009-07-13] (Microsoft Corporation)
3 THREADORDER; C:\Windows\System32\mmcss.dll [67584 2009-07-13] (Microsoft Corporation)
2 TrkWks; C:\Windows\System32\trkwks.dll [119808 2009-07-13] (Microsoft Corporation)
3 TrustedInstaller; C:\Windows\servicing\TrustedInstaller.exe [194048 2009-07-13] (Microsoft Corporation)
3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [38400 2009-07-13] (Microsoft Corporation)
3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [125440 2009-07-13] (Microsoft Corporation)
3 uagp35; C:\Windows\System32\DRIVERS\uagp35.sys [64080 2009-07-13] (Microsoft Corporation)
4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [327168 2009-07-13] (Microsoft Corporation)
3 UI0Detect; C:\Windows\System32\UI0Detect.exe [40960 2009-07-13] (Microsoft Corporation)
3 uliagpkx; C:\Windows\System32\DRIVERS\uliagpkx.sys [64592 2009-07-13] (Microsoft Corporation)
3 umbus; C:\Windows\System32\DRIVERS\umbus.sys [48640 2009-07-13] (Microsoft Corporation)
3 UmPass; C:\Windows\System32\DRIVERS\umpass.sys [9728 2009-07-13] (Microsoft Corporation)
3 UmRdpService; C:\Windows\System32\umrdp.dll [195072 2009-07-13] (Microsoft Corporation)
3 upnphost; C:\Windows\System32\upnphost.dll [353792 2009-07-13] (Microsoft Corporation)
3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [51712 2010-09-27] (Apple, Inc.)
3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [98816 2009-07-13] (Microsoft Corporation)
3 usbcir; C:\Windows\System32\DRIVERS\usbcir.sys [100352 2009-07-13] (Microsoft Corporation)
3 usbehci; C:\Windows\System32\DRIVERS\usbehci.sys [51712 2009-10-23] (Microsoft Corporation)
3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [343040 2009-10-23] (Microsoft Corporation)
3 usbohci; C:\Windows\System32\DRIVERS\usbohci.sys [25600 2009-07-13] (Microsoft Corporation)
3 usbprint; C:\Windows\System32\DRIVERS\usbprint.sys [25088 2009-07-13] (Microsoft Corporation)
3 USBSTOR; C:\Windows\System32\DRIVERS\USBSTOR.SYS [89600 2009-07-13] (Microsoft Corporation)
3 usbuhci; C:\Windows\System32\DRIVERS\usbuhci.sys [30720 2009-07-13] (Microsoft Corporation)
3 usb_rndisx; C:\Windows\System32\DRIVERS\usb8023x.sys [19968 2009-07-13] (Microsoft Corporation)
2 UxSms; C:\Windows\System32\uxsms.dll [38912 2009-07-13] (Microsoft Corporation)
3 VaultSvc; C:\Windows\System32\lsass.exe [31232 2009-07-13] (Microsoft Corporation)
0 vdrvroot; C:\Windows\System32\DRIVERS\vdrvroot.sys [36432 2009-07-13] (Microsoft Corporation)
3 vds; C:\Windows\System32\vds.exe [532480 2009-07-13] (Microsoft Corporation)
3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [29184 2009-07-13] (Microsoft Corporation)
1 VgaSave; C:\Windows\System32\drivers\vga.sys [29184 2009-07-13] (Microsoft Corporation)
3 vhdmp; C:\Windows\System32\DRIVERS\vhdmp.sys [217680 2009-07-13] (Microsoft Corporation)
3 viaide; C:\Windows\System32\DRIVERS\viaide.sys [17488 2009-07-13] (VIA Technologies, Inc.)
3 vmbus; C:\Windows\System32\DRIVERS\vmbus.sys [200272 2009-07-13] (Microsoft Corporation)
3 VMBusHID; C:\Windows\System32\DRIVERS\VMBusHID.sys [21760 2009-07-13] (Microsoft Corporation)
0 volmgr; C:\Windows\System32\DRIVERS\volmgr.sys [71760 2009-07-13] (Microsoft Corporation)
0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [363584 2009-07-13] (Microsoft Corporation)
0 volsnap; C:\Windows\System32\DRIVERS\volsnap.sys [294992 2009-07-13] (Microsoft Corporation)
0 vsmraid; C:\Windows\System32\DRIVERS\vsmraid.sys [161872 2009-07-13] (VIA Technologies Inc.,Ltd)
3 VSS; C:\Windows\System32\vssvc.exe [1598976 2009-07-13] (Microsoft Corporation)
3 vwifibus; C:\Windows\System32\drivers\vwifibus.sys [24576 2009-07-13] (Microsoft Corporation)
3 W32Time; C:\Windows\System32\w32time.dll [381952 2009-07-13] (Microsoft Corporation)
3 WacomPen; C:\Windows\System32\DRIVERS\wacompen.sys [27776 2009-07-13] (Microsoft Corporation)
3 WANARP; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2009-07-13] (Microsoft Corporation)
1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2009-07-13] (Microsoft Corporation)
3 WatAdminSvc; C:\Windows\System32\Wat\WatAdminSvc.exe [1255736 2010-12-04] (Microsoft Corporation)
3 wbengine; "C:\Windows\system32\wbengine.exe" [1503744 2009-07-13] (Microsoft Corporation)
3 WbioSrvc; C:\Windows\System32\wbiosrvc.dll [202240 2009-07-13] (Microsoft Corporation)
2 WcesComm; C:\Windows\WindowsMobile\wcescomm.dll [443784 2007-05-30] (Microsoft Corporation)
3 wcncsvc; C:\Windows\System32\wcncsvc.dll [366592 2009-07-13] (Microsoft Corporation)
3 WcsPlugInService; C:\Windows\System32\WcsPlugInService.dll [40960 2009-07-13] (Microsoft Corporation)
3 Wd; C:\Windows\System32\DRIVERS\wd.sys [21056 2009-07-13] (Microsoft Corporation)
0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [654928 2009-07-13] (Microsoft Corporation)
3 WdiServiceHost; C:\Windows\System32\wdi.dll [90624 2009-07-13] (Microsoft Corporation)
3 WdiSystemHost; C:\Windows\System32\wdi.dll [90624 2009-07-13] (Microsoft Corporation)
3 WebClient; C:\Windows\System32\webclnt.dll [254464 2009-07-13] (Microsoft Corporation)
3 Wecsvc; C:\Windows\System32\wecsvc.dll [237568 2009-07-13] (Microsoft Corporation)
3 wercplsupport; C:\Windows\System32\wercplsupport.dll [84480 2009-07-13] (Microsoft Corporation)
3 WerSvc; C:\Windows\System32\WerSvc.dll [76800 2009-07-13] (Microsoft Corporation)
1 WfpLwf; C:\Windows\System32\DRIVERS\wfplwf.sys [12800 2009-07-13] (Microsoft Corporation)
3 WIMMount; C:\Windows\System32\drivers\wimmount.sys [22096 2009-07-13] (Microsoft Corporation)
3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
3 WinHttpAutoProxySvc; C:\Windows\System32\winhttp.dll [438784 2009-07-13] (Microsoft Corporation)
2 Winmgmt; C:\Windows\System32\wbem\WMIsvc.dll [242688 2009-07-13] (Microsoft Corporation)
3 WinRM; C:\Windows\System32\WsmSvc.dll [2018816 2009-07-13] (Microsoft Corporation)
3 WinUsb; C:\Windows\System32\DRIVERS\WinUsb.sys [40448 2009-07-13] (Microsoft Corporation)
3 Wlansvc; C:\Windows\System32\wlansvc.dll [886784 2009-07-13] (Microsoft Corporation)
2 wlidsvc; "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE" [2286976 2010-09-20] (Microsoft Corp.)
3 WmiAcpi; C:\Windows\System32\DRIVERS\wmiacpi.sys [14336 2009-07-13] (Microsoft Corporation)
3 wmiApSrv; C:\Windows\System32\wbem\WmiApSrv.exe [203264 2009-07-13] (Microsoft Corporation)
2 WMPNetworkSvc; "C:\Program Files\Windows Media Player\wmpnetwk.exe" [1525248 2009-07-13] (Microsoft Corporation)
3 WPCSvc; C:\Windows\System32\wpcsvc.dll [12288 2009-07-13] (Microsoft Corporation)
3 WPDBusEnum; C:\Windows\System32\wpdbusenum.dll [116736 2009-07-13] (Microsoft Corporation)
4 ws2ifsl; C:\Windows\System32\drivers\ws2ifsl.sys [21504 2009-07-13] (Microsoft Corporation)
2 wscsvc; C:\Windows\System32\wscsvc.dll [97280 2009-07-13] (Microsoft Corporation)
2 WSearch; C:\Windows\System32\SearchIndexer.exe /Embedding [593408 2009-07-13] (Microsoft Corporation)
2 wuauserv; C:\Windows\System32\wuaueng.dll [2418176 2009-07-13] (Microsoft Corporation)
3 WudfPf; C:\Windows\System32\drivers\WudfPf.sys [112128 2009-07-13] (Microsoft Corporation)
3 WUDFRd; C:\Windows\System32\DRIVERS\WUDFRd.sys [172544 2009-07-13] (Microsoft Corporation)
2 wudfsvc; C:\Windows\System32\WUDFSvc.dll [75264 2009-07-13] (Microsoft Corporation)
3 WwanSvc; C:\Windows\System32\wwansvc.dll [229888 2009-07-13] (Microsoft Corporation)
3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [389120 2009-06-10] (Marvell)

========================= NetSvcs ============================

============ One Month Created Files and folders ============

2011-03-06 13:56 - 2011-03-06 14:00 - 0000000 ____D C:\FRST
2011-03-06 13:56 - 2011-03-06 13:56 - 0089354 ____A C:\tmpfrst.txt
2011-03-05 08:05 - 2011-03-05 08:04 - 0000000 ____D C:\BackupThis
2011-03-03 13:26 - 2011-03-03 13:29 - 0000000 ___AD C:\Kaspersky Rescue Disk 10.0
2011-03-02 01:35 - 2011-03-02 21:06 - 0000000 ____D C:\WinSetupFromUSB
2011-03-01 05:49 - 2011-03-01 05:49 - 0495440 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\flash drive prep.zip
2011-03-01 05:49 - 2011-03-01 05:49 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Desktop\flash drive prep
2011-03-01 05:15 - 2011-03-02 21:06 - 0000000 ____D C:\Program Files (x86)\QuickPar
2011-03-01 05:15 - 2011-03-01 05:17 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\QuickPar
2011-02-27 05:00 - 2011-02-27 05:13 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\DiskAid
2011-02-27 05:00 - 2011-02-27 05:00 - 0000000 ____D C:\Program Files (x86)\DigiDNA
2011-02-27 04:59 - 2011-02-27 04:59 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\Cranium
2011-02-27 04:54 - 2011-02-27 04:54 - 2232199 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\frost_ls_by_technouse-d33ound.zip
2011-02-27 03:21 - 2011-02-27 03:21 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Downloads\kegel
2011-02-25 16:40 - 2011-02-25 17:18 - 300214115 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\TomTom Australia (v1.6 os30)-Nathan1233.ipa
2011-02-25 16:21 - 2011-03-02 21:06 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\Cranium_Consulting_and_Cu
2011-02-25 16:21 - 2011-03-02 21:06 - 0000000 ____D C:\Program Files (x86)\iPhoneBrowser
2011-02-22 05:53 - 2011-02-22 05:53 - 0000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2011-02-22 05:36 - 2011-03-02 23:14 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Desktop\gp_win_rc6_final
2011-02-20 05:18 - 2011-02-20 05:18 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{AC562A3B-CD56-4A63-933D-542CF98805CE}
2011-02-17 04:43 - 2011-02-17 04:43 - 0083577 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\GoVia.pdf
2011-02-12 22:12 - 2011-02-12 22:15 - 0000183 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\Features.txt
2011-02-12 22:09 - 2011-02-12 22:11 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Desktop\YZ250 Sale
2011-02-09 02:56 - 2011-02-09 02:56 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{366E5ECB-0CE3-4F66-922C-548EB78720D3}
2011-02-06 06:27 - 2011-02-06 06:27 - 0000000 ____D C:\Users\All Users\vsosdk
2011-02-06 06:27 - 2011-02-06 06:27 - 0000000 ____D C:\ProgramData\vsosdk
2011-02-06 03:20 - 2011-02-24 13:50 - 0001057 ____A C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\vso_ts_preview.xml
2011-02-06 03:20 - 2011-02-24 13:50 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\Vso
2011-02-06 03:20 - 2011-02-24 04:33 - 0000000 ____D C:\ConvertXtoDVD
2011-02-06 03:19 - 2011-02-06 03:19 - 0001234 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\ConvertXtoDVD 4.lnk
2011-02-06 03:19 - 2011-02-06 03:19 - 0000000 ____D C:\Program Files (x86)\VSO
2011-02-06 03:19 - 2009-09-01 18:44 - 1184984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wvc1dmod.dll
2011-02-06 03:19 - 2009-09-01 18:44 - 0626688 ____A (On2.com) C:\Windows\SysWOW64\vp7vfw.dll
2011-02-06 03:19 - 2009-09-01 18:44 - 0273408 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\Pncrt.dll
2011-02-06 03:19 - 2009-09-01 18:44 - 0217127 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\drv43260.dll
2011-02-06 03:19 - 2009-09-01 18:44 - 0208935 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\drv33260.dll
2011-02-06 03:19 - 2009-09-01 18:44 - 0176165 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\drv23260.dll
2011-02-06 03:19 - 2009-09-01 18:44 - 0102439 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\sipr3260.dll
2011-02-06 03:19 - 2009-09-01 18:44 - 0065602 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\cook3260.dll
2011-02-06 02:55 - 2011-02-06 02:55 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{A8A07732-A6B0-4766-9AF1-2110B93A180E}

============ 3 Months Modified Files and folders =============

2011-03-06 14:00 - 2011-03-06 13:56 - 0000000 ____D C:\FRST
2 Drive c: (SYSTEM) (Fixed) (Total:297.99 GB) (Free:219.6 GB) NTFS
2011-03-06 13:56 - 2011-03-06 13:56 - 0089354 ____A C:\tmpfrst.txt
2011-03-05 08:04 - 2011-03-05 08:05 - 0000000 ____D C:\BackupThis
4 Drive f: (SCAN) (Removable) (Total:0.97 GB) (Free:0.97 GB) FAT32
2011-03-04 13:00 - 2011-03-02 02:58 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Downloads\alt.binaries.x
5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
2011-03-03 13:29 - 2011-03-03 13:26 - 0000000 ___AD C:\Kaspersky Rescue Disk 10.0
6 Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS
2011-03-02 23:14 - 2011-02-22 05:36 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Desktop\gp_win_rc6_final
2011-03-02 23:14 - 2011-01-27 04:40 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\FrostWire
2011-03-02 23:14 - 2011-01-21 03:20 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\dvdcss
2011-03-02 23:14 - 2010-12-24 07:31 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\vlc
2011-03-02 23:14 - 2010-12-05 06:29 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Documents\LimeWire
2011-03-02 23:14 - 2010-12-05 04:54 - 0000000 ____D C:\users\Jamie.JIMWIN7P01
2011-03-02 23:14 - 2010-12-05 04:48 - 0000000 ____D C:\Program Files (x86)\Mozilla Firefox
2011-03-02 23:14 - 2010-12-05 04:38 - 0000000 ____D C:\users\Jamie
2011-03-02 23:14 - 2010-12-05 00:12 - 0000000 ____D C:\users\rob
2011-03-02 23:14 - 2010-12-05 00:02 - 0000000 ____D C:\users\LocalAdmin
2011-03-02 23:14 - 2009-07-13 19:20 - 0000000 ___RD C:\Program Files (x86)
2011-03-02 23:14 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\wfp
2011-03-02 23:14 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\wbem
2011-03-02 23:14 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\DriverStore
2011-03-02 23:14 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\registration
2011-03-02 23:14 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\AppCompat
2011-03-02 21:06 - 2011-03-02 01:35 - 0000000 ____D C:\WinSetupFromUSB
2011-03-02 21:06 - 2011-03-01 05:15 - 0000000 ____D C:\Program Files (x86)\QuickPar
2011-03-02 21:06 - 2011-02-25 16:21 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\Cranium_Consulting_and_Cu
2011-03-02 21:06 - 2011-02-25 16:21 - 0000000 ____D C:\Program Files (x86)\iPhoneBrowser
2011-03-02 21:04 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\LogFiles
2011-03-02 00:28 - 2010-12-03 17:15 - 3220664320 __ASH C:\hiberfil.sys
2011-03-01 06:14 - 2010-12-27 16:00 - 3011982 ___AH C:\Users\Jamie.JIMWIN7P01\AppData\Local\IconCache.db
2011-03-01 05:49 - 2011-03-01 05:49 - 0495440 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\flash drive prep.zip
2011-03-01 05:49 - 2011-03-01 05:49 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Desktop\flash drive prep
2011-03-01 05:17 - 2011-03-01 05:15 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\QuickPar
2011-02-27 05:13 - 2011-02-27 05:00 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\DiskAid
2011-02-27 05:00 - 2011-02-27 05:00 - 0000000 ____D C:\Program Files (x86)\DigiDNA
2011-02-27 04:59 - 2011-02-27 04:59 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\Cranium
2011-02-24 13:50 - 2011-02-06 03:20 - 0001057 ____A C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\vso_ts_preview.xml
2011-02-24 13:50 - 2011-02-06 03:20 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\Vso
2011-02-24 04:33 - 2011-02-06 03:20 - 0000000 ____D C:\ConvertXtoDVD
2011-02-24 04:27 - 2010-12-11 01:58 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\FileZilla
2011-02-22 06:22 - 2010-12-03 17:18 - 1979278 ____A C:\Windows\WindowsUpdate.log
2011-02-22 05:53 - 2011-02-22 05:53 - 0000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2011-02-22 05:53 - 2009-07-13 20:51 - 0027042 ____A C:\Windows\setupact.log
2011-02-22 05:42 - 2009-07-13 20:45 - 0020528 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2011-02-22 05:42 - 2009-07-13 20:45 - 0020528 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2011-02-22 03:09 - 2009-07-13 21:13 - 0717892 ____A C:\Windows\System32\PerfStringBackup.INI
2011-02-22 03:09 - 2009-07-13 18:36 - 0622110 ____A C:\Windows\System32\perfh009.dat
2011-02-22 03:09 - 2009-07-13 18:36 - 0108232 ____A C:\Windows\System32\perfc009.dat
2011-02-22 03:04 - 2009-07-13 21:08 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2011-02-20 05:18 - 2011-02-20 05:18 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{AC562A3B-CD56-4A63-933D-542CF98805CE}
2011-02-17 04:43 - 2011-02-17 04:43 - 0083577 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\GoVia.pdf
2011-02-12 22:15 - 2011-02-12 22:12 - 0000183 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\Features.txt
2011-02-12 22:11 - 2011-02-12 22:09 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Desktop\YZ250 Sale
2011-02-09 02:56 - 2011-02-09 02:56 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{366E5ECB-0CE3-4F66-922C-548EB78720D3}
2011-02-06 06:27 - 2011-02-06 06:27 - 0000000 ____D C:\Users\All Users\vsosdk
2011-02-06 06:27 - 2011-02-06 06:27 - 0000000 ____D C:\ProgramData\vsosdk
2011-02-06 03:19 - 2011-02-06 03:19 - 0001234 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\ConvertXtoDVD 4.lnk
2011-02-06 03:19 - 2011-02-06 03:19 - 0000000 ____D C:\Program Files (x86)\VSO
2011-02-06 02:55 - 2011-02-06 02:55 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{A8A07732-A6B0-4766-9AF1-2110B93A180E}
2011-02-04 05:03 - 2010-12-24 07:12 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\NewsLeecher
2011-02-04 01:20 - 2011-02-04 01:20 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{C9B5B2F6-E86D-4B4C-99B1-3541ADD3E8FA}
2011-02-02 03:25 - 2011-02-02 03:17 - 0014848 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\Hours.xls
2011-02-01 02:40 - 2011-02-01 02:40 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{D1015EC5-CC6B-41A2-A932-0074A32D1164}
2011-01-30 05:15 - 2010-12-19 05:52 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\mIRC
2011-01-30 04:59 - 2010-12-19 05:52 - 0000000 ____D C:\Program Files (x86)\mIRC
2011-01-30 04:44 - 2011-01-30 04:44 - 0001072 ____A C:\Users\Public\Desktop\VLC media player.lnk
2011-01-30 02:29 - 2011-01-30 02:29 - 0084238 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\TransLink - my go card3.pdf
2011-01-30 00:22 - 2011-01-30 00:00 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\ImgBurn
2011-01-30 00:01 - 2011-01-30 00:01 - 0001871 ____A C:\Users\Public\Desktop\ImgBurn.lnk
2011-01-29 20:03 - 2011-01-29 20:03 - 0178800 ____A (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt_x64.dll
2011-01-29 20:03 - 2011-01-29 20:03 - 0000000 ____D C:\Users\Public\Documents\EA Games
2011-01-29 19:53 - 2011-01-29 19:53 - 0002403 ____A C:\Users\Public\Desktop\The Sims™ 2 Double Deluxe.lnk
2011-01-29 19:53 - 2011-01-29 19:53 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Documents\EA Games
2011-01-29 19:36- 2011-01-29 19:36 - 0000000 ____D C:\Program Files (x86)\EA GAMES
2011-01-29 05:35 - 2011-01-25 19:41 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Desktop\Jamie's Graduation
2011-01-29 05:29 - 2011-01-08 20:38 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\uTorrent
2011-01-27 04:42 - 2011-01-27 04:37 - 0000000 ____D C:\Program Files (x86)\FrostWire
2011-01-27 04:37 - 2011-01-27 04:37 - 0001231 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\FrostWire 4.21.3.lnk
2011-01-27 01:59 - 2011-01-27 01:59 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{CC609B97-D155-49EF-B29E-EF82FF0D7BF7}
2011-01-26 02:42 - 2011-01-26 02:42 - 0066301 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\Amazon Candyshell Cutout.pdf
2011-01-23 02:07 - 2011-01-23 02:07 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{3DDDB0A1-0807-4EFD-B205-26A8302E2E29}
2011-01-22 07:56 - 2010-12-19 05:54 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\ElevatedDiagnostics
2011-01-22 02:31 - 2011-01-22 02:30 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{630E9552-80FF-4DF9-9AF5-63D56621B9C0}
2011-01-21 04:19 - 2011-01-21 04:19 - 0409539 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\Library.xml
2011-01-21 04:19 - 2011-01-21 04:19 - 0152092 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\Music.txt
2011-01-21 04:01 - 2011-01-21 04:01 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Documents\OldMusic
2011-01-21 03:04 - 2011-01-18 05:15 - 0000000 ____D C:\BTGUARD
2011-01-21 03:02 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\security
2011-01-21 01:27 - 2011-01-21 01:27 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{283AA388-A8BE-4A16-B1F6-58E3DBE66855}
2011-01-18 01:11 - 2011-01-18 01:11 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{05B42A0E-0C9F-4DE0-ADBE-92EBBCBEB402}
2011-01-15 16:44 - 2011-01-15 16:44 - 0086689 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\167505_180800291951665_100000650878227_448742_883669_n.jpg
2011-01-15 00:44 - 2011-01-15 00:43 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{8B9FF98B-A928-4824-9CF6-9B793CDA9005}
2011-01-13 04:29 - 2011-01-13 04:29 - 0001789 ____A C:\Users\Public\Desktop\iTunes.lnk
2011-01-13 04:29 - 2011-01-13 04:28 - 0000000 ____D C:\Program Files\iTunes
2011-01-13 04:29 - 2010-12-05 06:12 - 0000000 ____D C:\Program Files (x86)\iTunes
2011-01-13 04:28 - 2011-01-13 04:28 - 0000000 ____D C:\Program Files\iPod
2011-01-13 04:26 - 2011-01-13 04:26 - 0001851 ____A C:\Users\Public\Desktop\QuickTime Player.lnk
2011-01-13 04:26 - 2011-01-13 04:26 - 0000000 ____D C:\Program Files (x86)\QuickTime
2011-01-13 04:05 - 2011-01-12 04:10 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\Documents\ipodpics
2011-01-10 03:37 - 2011-01-10 03:37 - 0041818 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\Shopping Completed! _ HopShopGo.pdf
2011-01-09 01:33 - 2011-01-09 01:33 - 0084235 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\TransLink - my go card2.pdf
2011-01-08 21:18 - 2011-01-08 21:18 - 0319488 ____A (Realtek Semiconductor Corp.) C:\Windows\HideWin.exe
2011-01-08 21:18 - 2011-01-08 21:18 - 0000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2011-01-08 21:18 - 2011-01-08 21:18 - 0000000 ____D C:\Program Files (x86)\Realtek AC97
2011-01-08 21:05 - 2011-01-08 21:04 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{47AC9B13-429C-4977-9B72-97A9D05180EF}
2011-01-08 20:38 - 2011-01-08 20:38 - 0000949 ____A C:\Users\Public\Desktop\µTorrent.lnk
2011-01-08 20:38 - 2011-01-08 20:38 - 0000000 ____D C:\Program Files (x86)\uTorrent
2011-01-08 19:42 - 2011-01-08 19:09 - 0002002 ___AH C:\Users\Jamie.JIMWIN7P01\Documents\Default.rdp
2011-01-07 02:10 - 2011-01-07 02:10 - 290044907 ____A C:\Windows\MEMORY.DMP
2011-01-07 02:10 - 2011-01-07 02:10 - 0369008 ____A C:\Windows\Minidump\010711-19687-01.dmp
2011-01-07 02:10 - 2011-01-07 02:10 - 0000000 ____D C:\Windows\Minidump
2011-01-04 23:33 - 2011-01-04 23:33 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{A4087824-6836-4B0C-A31D-8E7FC7354898}
2011-01-02 06:59 - 2010-12-05 06:13 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\Apple Computer
2011-01-02 05:39 - 2011-01-02 05:39 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{EF1B3424-D862-404D-BBA8-BB8F9DC3AF02}
2010-12-29 04:21 - 2010-12-29 04:21 - 0084533 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\TransLink - my go card.pdf
2010-12-29 03:56 - 2010-12-29 03:56 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{4580B4EB-B185-48F1-8DBB-747B8C9AFBF9}
2010-12-27 05:30 - 2010-12-05 04:55 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\Mozilla
2010-12-26 17:05 - 2010-12-10 22:26 - 9057645 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\Pursuit of Happiness [Steve Aoki Remix] - Kid Cudi (feat. MGMT &Ratatat).mp3
2010-12-26 07:06 - 2010-12-26 06:04 - 0000117 ____A C:\Users\Jamie.JIMWIN7P01\jagex_runescape_preferences2.dat
2010-12-26 07:06 - 2010-12-26 06:02 - 0000034 ____A C:\Users\Jamie.JIMWIN7P01\jagex_runescape_preferences.dat
2010-12-26 07:04 - 2010-12-26 06:02 - 0000000 ____D C:\Windows\.jagex_cache_32
2010-12-26 06:02 - 2010-12-26 06:02 - 0000000 ____D C:\Windows\Sun
2010-12-26 06:01 - 2010-12-26 06:01 - 0000000 ____D C:\Users\All Users\Sun
2010-12-26 06:01 - 2010-12-26 06:01 - 0000000 ____D C:\ProgramData\Sun
2010-12-26 06:00 - 2010-12-26 06:00 - 0472808 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll
2010-12-26 06:00 - 2010-12-26 06:00 - 0153376 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe
2010-12-26 06:00 - 2010-12-26 06:00 - 0145184 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe
2010-12-26 06:00 - 2010-12-26 06:00 - 0145184 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe
2010-12-26 06:00 - 2010-12-26 06:00 - 0000000 ____D C:\Program Files (x86)\Java
2010-12-24 07:30 - 2010-12-24 07:30 - 0000000 ____D C:\Program Files (x86)\VideoLAN
2010-12-24 07:27 - 2010-12-24 07:27 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{EB512813-68E2-4734-9E51-F3F2656378C2}
2010-12-21 01:01 - 2010-12-21 01:01 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{BBE0A802-8640-49F0-A9D2-48F566DE060E}
2010-12-19 14:51 - 2010-12-19 14:51 - 0186460 ___AH C:\Windows\SysWOW64\mlfcache.dat
2010-12-19 05:55 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\NDF
2010-12-19 05:52 - 2010-12-19 05:52 - 0000957 ____A C:\Users\Public\Desktop\mIRC.lnk
2010-12-18 23:00 - 2010-12-18 23:00 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{5D8D6031-AD63-4F1A-948B-479E9DC46ADC}
2010-12-17 16:10 - 2010-12-17 16:10 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{DE6939BB-564A-40B6-84F9-0D10D700A2BA}
2010-12-17 01:42 - 2010-12-17 01:42 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{C00A1098-5ACA-4FB0-81D2-CBD4AC6DA460}
2010-12-16 01:54 - 2010-12-16 01:53 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{D900DE91-F2AA-4914-9085-A38BA920C57E}
2010-12-15 03:39 - 2010-12-15 03:39 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{B9289DE5-C290-4B15-8C92-B7C5AF602B99}
2010-12-13 01:16 - 2010-12-13 01:16 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{D94663AB-6C3C-4FAA-8EDF-91A22B66E551}
2010-12-13 00:54 - 2010-12-05 05:32 - 0083120 ____A (Avira GmbH) C:\Windows\System32\Drivers\avgntflt.sys
2010-12-11 01:58 - 2010-12-05 20:25 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\foobar2000
2010-12-10 15:58 - 2010-12-10 15:57 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{2038FB77-6891-4A21-907C-2CF6D341C6EC}
2010-12-10 15:57 - 2010-12-10 15:57 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\{D05B5712-71B8-4DCB-9410-F68A854D9248}
2010-12-09 18:40 - 2009-07-13 19:20 - 0000000 __RHD C:\Users\Public\Libraries
2010-12-09 00:19 - 2010-12-09 00:08 - 157303829 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\Annual2011_D1.rar
2010-12-09 00:19 - 2010-12-05 20:27 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\WinRAR
2010-12-09 00:18 - 2010-12-09 00:09 - 148463337 ____A C:\Users\Jamie.JIMWIN7P01\Desktop\Annual2011_D2.rar
2010-12-08 23:48 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\rescache
2010-12-08 03:49 - 2010-12-08 03:49 - 0000000 ____D C:\Users\Jamie.JIMWIN7P01\AppData\Local\Microsoft Games
2010-12-08 03:48 - 2010-12-08 03:48 - 0000000 ____D C:\Program Files\Microsoft Games
2010-12-08 01:08 - 2009-07-13 20:45 - 0416000 ____A C:\Windows\System32\FNTCACHE.DAT

============ Known DLLs ============

[2009-07-13 16:41] - [2009-07-13 17:40] - 0877056 ____A (Microsoft Corporation) C:\Windows\System32\advapi32.dll
[2009-07-13 16:20] - [2009-07-13 17:14] - 0640000 ____A (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
[2009-07-13 16:00] - [2009-07-13 17:40] - 0607744 ____A (Microsoft Corporation) C:\Windows\System32\clbcatq.dll
[2009-07-13 15:44] - [2009-07-13 17:15] - 0522240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\clbcatq.dll
[2009-07-13 15:55] - [2009-07-13 17:40] - 0595456 ____A (Microsoft Corporation) C:\Windows\System32\comdlg32.dll
[2009-07-13 15:39] - [2009-07-13 17:15] - 0486912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\COMDLG32.dll
[2009-07-13 15:39] - [2009-07-13 17:40] - 0404480 ____A (Microsoft Corporation) C:\Windows\System32\gdi32.dll
[2009-07-13 15:25] - [2009-07-13 17:11] - 0310784 ____A (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
[2010-12-04 03:19] - [2010-09-07 21:34] - 2441216 ____A (Microsoft Corporation) C:\Windows\System32\IERTUTIL.dll
[2010-12-04 03:19] - [2010-09-07 20:28] - 2058752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IERTUTIL.dll
[2009-07-13 16:13] - [2009-07-13 17:41] - 0076288 ____A (Microsoft Corporation) C:\Windows\System32\imagehlp.dll
[2009-07-13 15:57] - [2009-07-13 17:15] - 0154624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IMAGEHLP.dll
[2009-07-13 15:38] - [2009-07-13 17:41] - 0167424 ____A (Microsoft Corporation) C:\Windows\System32\IMM32.dll
[2009-07-13 15:25] - [2009-07-13 17:11] - 0119808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IMM32.dll
[2009-07-13 15:28] - [2009-07-13 17:41] - 1162240 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll
[2009-07-13 15:16] - [2009-07-13 17:11] - 0836608 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
[2009-07-13 15:38] - [2009-07-13 17:41] - 0041984 ____A (Microsoft Corporation) C:\Windows\System32\LPK.dll
[2009-07-13 15:25] - [2009-07-13 17:11] - 0025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\LPK.dll
[2009-07-13 15:40] - [2009-07-13 17:41] - 1067008 ____A (Microsoft Corporation) C:\Windows\System32\MSCTF.dll
[2009-07-13 15:28] - [2009-07-13 17:15] - 0828928 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSCTF.dll
[2009-07-13 15:19] - [2009-07-13 17:41] - 0634880 ____A (Microsoft Corporation) C:\Windows\System32\MSVCRT.dll
[2009-07-13 15:12] - [2009-07-13 17:15] - 0690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSVCRT.dll
[2009-07-13 15:26] - [2009-07-13 17:31] - 0002560 ____A (Microsoft Corporation) C:\Windows\System32\NORMALIZ.dll
[2009-07-13 15:15] - [2009-07-13 17:09] - 0002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\NORMALIZ.dll
[2009-07-13 15:21] - [2009-07-13 17:41] - 0013824 ____A (Microsoft Corporation) C:\Windows\System32\NSI.dll
[2009-07-13 15:12] - [2009-07-13 17:16] - 0008704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\NSI.dll
[2010-12-04 03:23] - [2010-06-28 21:39] - 2085376 ____A (Microsoft Corporation) C:\Windows\System32\ole32.dll
[2010-12-04 03:22] - [2010-06-28 21:02] - 1413632 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
[2010-12-04 03:21] - [2010-04-06 23:37] - 0861184 ____A (Microsoft Corporation) C:\Windows\System32\oleaut32.dll
[2010-12-04 03:21] - [2010-04-06 23:10] - 0571904 ____A (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
[2009-07-13 15:26] - [2009-07-13 17:41] - 0009216 ____A (Microsoft Corporation) C:\Windows\System32\PSAPI.dll
[2009-07-13 15:15] - [2009-07-13 17:16] - 0006144 ____A (Microsoft Corporation) C:\Windows\SysWOW64\PSAPI.dll
[2009-07-13 15:23] - [2009-07-13 17:41] - 1221632 ____A (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
[2009-07-13 15:12] - [2009-07-13 17:11] - 0662528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
[2009-07-13 15:20] - [2009-07-13 17:41] - 0113664 ____A (Microsoft Corporation) C:\Windows\System32\sechost.dll
[2009-07-13 15:11] - [2009-07-13 17:16] - 0092160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
[2009-07-13 15:27] - [2009-07-13 17:41] - 1899520 ____A (Microsoft Corporation) C:\Windows\System32\Setupapi.dll
[2009-07-13 15:16] - [2009-07-13 17:16] - 1668608 ____A (Microsoft Corporation) C:\Windows\SysWOW64\Setupapi.dll
[2010-12-04 03:22] - [2010-07-27 06:59] - 14162944 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
[2010-12-04 03:22] - [2010-07-27 06:03] - 12867584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
[2009-07-13 15:55] - [2009-07-13 17:41] - 0449536 ____A (Microsoft Corporation) C:\Windows\System32\SHLWAPI.dll
[2009-07-13 15:39] - [2009-07-13 17:16] - 0350208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SHLWAPI.dll
[2010-12-04 03:19] - [2010-09-07 21:36] - 1495040 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
[2010-12-04 03:19] - [2010-09-07 20:30] - 1226752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
[2009-07-13 15:38] - [2009-07-13 17:41] - 1008640 ____A (Microsoft Corporation) C:\Windows\System32\user32.dll
[2009-07-13 15:24] - [2009-07-13 17:11] - 0833024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
[2009-07-13 15:38] - [2009-07-13 17:41] - 0801280 ____A (Microsoft Corporation) C:\Windows\System32\USP10.dll
[2009-07-13 15:25] - [2009-07-13 17:16] - 0627200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\USP10.dll
[2009-07-13 15:57] - [2009-07-13 17:41] - 0029184 ____A (Microsoft Corporation) C:\Windows\System32\version.dll
[2009-07-13 15:41] - [2009-07-13 17:16] - 0021504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\version.dll
[2010-12-04 03:19] - [2010-09-07 21:36] - 1192960 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
[2010-12-04 03:19] - [2010-09-07 20:30] - 0978432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
[2009-07-13 15:54] - [2009-07-13 17:41] - 0311808 ____A (Microsoft Corporation) C:\Windows\System32\wldap32.dll
[2009-07-13 15:38] - [2009-07-13 17:16] - 0268800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wldap32.dll
[2009-07-13 15:21] - [2009-07-13 17:41] - 0296448 ____A (Microsoft Corporation) C:\Windows\System32\WS2_32.dll
[2009-07-13 15:12] - [2009-07-13 17:16] - 0206336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WS2_32.dll

========================= Memory info ========================

Percentage of memory in use: 12%
Total physical RAM: 4095.29 MB
Available physical RAM: 3575.34 MB
Total Pagefile: 4093.44 MB
Available Pagefile: 3565.43 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB

======================= Partitions ===========================

Attached Files

  • Attached File  FRST.txt   63.56KB   7 downloads

Edited by farbar, 06 March 2011 - 06:31 AM.
Opened the log


#8 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:01:07 AM

Posted 06 March 2011 - 07:17 AM

Thanks for the log madmanjim.
No need to quote the whole post, thank you.

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt

cmd: bootrec /FixMbr
cmd: bcdedit /export c:\frst\bcd.old
cmd: bcdedit /enum all
cmd: bcdedit /set {default} winpe no
cmd: bcdedit /enum all

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Now please enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.
Also restart and tell me how it went.

#9 madmanjim

madmanjim
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:07 AM

Posted 06 March 2011 - 07:53 AM

Wow, booted into Windows fine, no BSOD. Am logging in as I type this, log is below..

Am curious to find out what was causing this, the fix seemed so simple.


Fix result of Farbars's Recovery Tool (FRST written by farbar version 2.0.6)
Ran by SYSTEM at 2011-03-06 22:49:41 R:1
Running from F:\

==============================================


========= bootrec /FixMbr =========

˙ūT h e o p e r a t i o n c o m p l e t e d s u c c e s s f u l l y .

========= End of CMD: =========


========= bcdedit /export c:\frst\bcd.old =========

The operation completed successfully.

========= End of CMD: =========


========= bcdedit /enum all =========


Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=Y:
path \bootmgr
description Windows Boot Manager
locale en-US
inherit {globalsettings}
default {default}
resumeobject {dbcbae8c-ffe1-11df-9371-93aa14e5b9b9}
displayorder {default}
{dbcbae90-ffe1-11df-9371-93aa14e5b9b9}
toolsdisplayorder {memdiag}
timeout 30

Windows Boot Loader
-------------------
identifier {default}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale en-US
inherit {bootloadersettings}
recoverysequence {current}
recoveryenabled Yes
testsigning No
osdevice partition=C:
systemroot \Windows
resumeobject {dbcbae8c-ffe1-11df-9371-93aa14e5b9b9}
nx OptIn

Windows Boot Loader
-------------------
identifier {current}
device ramdisk=[C:]\Recovery\dbcbae8e-ffe1-11df-9371-93aa14e5b9b9\Winre.wim,{dbcbae8f-ffe1-11df-9371-93aa14e5b9b9}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\dbcbae8e-ffe1-11df-9371-93aa14e5b9b9\Winre.wim,{dbcbae8f-ffe1-11df-9371-93aa14e5b9b9}
systemroot \windows
nx OptIn
winpe Yes

Windows Boot Loader
-------------------
identifier {dbcbae90-ffe1-11df-9371-93aa14e5b9b9}
device unknown
path \Windows\system32\winload.exe
description (recovered)
locale
osdevice unknown
systemroot \Windows

Windows Boot Loader
-------------------
identifier {dbcbae91-ffe1-11df-9371-93aa14e5b9b9}

Resume from Hibernate
---------------------
identifier {dbcbae8c-ffe1-11df-9371-93aa14e5b9b9}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale en-US
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No

Windows Memory Tester
---------------------
identifier {memdiag}
device partition=Y:
path \boot\memtest.exe
description Windows Memory Diagnostic
locale en-US
inherit {globalsettings}
badmemoryaccess Yes

EMS Settings
------------
identifier {emssettings}
custom:26000022 Yes

Debugger Settings
-----------------
identifier {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200

RAM Defects
-----------
identifier {badmemory}

Global Settings
---------------
identifier {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}

Boot Loader Settings
--------------------
identifier {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}

Hypervisor Settings
-------------------
identifier {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200

Resume Loader Settings
----------------------
identifier {resumeloadersettings}
inherit {globalsettings}

Device options
--------------
identifier {dbcbae8f-ffe1-11df-9371-93aa14e5b9b9}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\dbcbae8e-ffe1-11df-9371-93aa14e5b9b9\boot.sdi

Device options
--------------
identifier {dbcbae92-ffe1-11df-9371-93aa14e5b9b9}
ramdisksdidevice unknown
ramdisksdipath \Recovery\88c33c4d-da3b-11de-972e-cc75da568136\boot.sdi

========= End of CMD: =========


========= bcdedit /set {default} winpe no =========

The operation completed successfully.

========= End of CMD: =========


========= bcdedit /enum all =========


Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=Y:
path \bootmgr
description Windows Boot Manager
locale en-US
inherit {globalsettings}
default {default}
resumeobject {dbcbae8c-ffe1-11df-9371-93aa14e5b9b9}
displayorder {default}
{dbcbae90-ffe1-11df-9371-93aa14e5b9b9}
toolsdisplayorder {memdiag}
timeout 30

Windows Boot Loader
-------------------
identifier {default}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale en-US
inherit {bootloadersettings}
recoverysequence {current}
recoveryenabled Yes
testsigning No
osdevice partition=C:
systemroot \Windows
resumeobject {dbcbae8c-ffe1-11df-9371-93aa14e5b9b9}
nx OptIn
winpe No

Windows Boot Loader
-------------------
identifier {current}
device ramdisk=[C:]\Recovery\dbcbae8e-ffe1-11df-9371-93aa14e5b9b9\Winre.wim,{dbcbae8f-ffe1-11df-9371-93aa14e5b9b9}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\dbcbae8e-ffe1-11df-9371-93aa14e5b9b9\Winre.wim,{dbcbae8f-ffe1-11df-9371-93aa14e5b9b9}
systemroot \windows
nx OptIn
winpe Yes

Windows Boot Loader
-------------------
identifier {dbcbae90-ffe1-11df-9371-93aa14e5b9b9}
device unknown
path \Windows\system32\winload.exe
description (recovered)
locale
osdevice unknown
systemroot \Windows

Windows Boot Loader
-------------------
identifier {dbcbae91-ffe1-11df-9371-93aa14e5b9b9}

Resume from Hibernate
---------------------
identifier {dbcbae8c-ffe1-11df-9371-93aa14e5b9b9}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale en-US
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No

Windows Memory Tester
---------------------
identifier {memdiag}
device partition=Y:
path \boot\memtest.exe
description Windows Memory Diagnostic
locale en-US
inherit {globalsettings}
badmemoryaccess Yes

EMS Settings
------------
identifier {emssettings}
custom:26000022 Yes

Debugger Settings
-----------------
identifier {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200

RAM Defects
-----------
identifier {badmemory}

Global Settings
---------------
identifier {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}

Boot Loader Settings
--------------------
identifier {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}

Hypervisor Settings
-------------------
identifier {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200

Resume Loader Settings
----------------------
identifier {resumeloadersettings}
inherit {globalsettings}

Device options
--------------
identifier {dbcbae8f-ffe1-11df-9371-93aa14e5b9b9}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\dbcbae8e-ffe1-11df-9371-93aa14e5b9b9\boot.sdi

Device options
--------------
identifier {dbcbae92-ffe1-11df-9371-93aa14e5b9b9}
ramdisksdidevice unknown
ramdisksdipath \Recovery\88c33c4d-da3b-11de-972e-cc75da568136\boot.sdi

========= End of CMD: =========

Attached Files



#10 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:01:07 AM

Posted 06 March 2011 - 10:23 AM

Great. :thumbsup:

This was a case of TDL4 MBR infection.

Now we need to make sure nothing is left there.

Please perform the following scan:
  • Download DDS by sUBs from the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run. When done it will open two logs:
    • DDS.txt
    • Attach.txt
  • Copy and paste the logs to your reply.


#11 madmanjim

madmanjim
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:07 AM

Posted 06 March 2011 - 05:31 PM

Thank you so much farbar, you are a life saver!

Attach.txt is attached, DDS is pasted below.

.
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by Jamie at 8:26:12.41 on Mon 07/03/2011
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24
Microsoft Windows 7 Professional 6.1.7600.0.1252.61.1033.18.4095.2679 [GMT 10:00]
.
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Windows\SOUNDMAN.EXE
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\TeamViewer\Version6\tv_w32.exe
C:\Program Files (x86)\TeamViewer\Version6\tv_x64.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
c:\program files (x86)\avira\antivir desktop\avgnt.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Windows\splwow64.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\taskhost.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskhost.exe
C:\Users\Jamie.JIMWIN7P01\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
uRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10l_Plugin.exe -update plugin
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
mRun-x64: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
mRun-x64: [SoundMan] SOUNDMAN.EXE
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\JAMIE~1.JIM\AppData\Roaming\Mozilla\Firefox\Profiles\ch92lkb9.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en&q=
FF - component: C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\Mozilla\Firefox\Profiles\ch92lkb9.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: C:\Users\Jamie.JIMWIN7P01\AppData\Roaming\Mozilla\Firefox\Profiles\ch92lkb9.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Session Manager: {1280606b-2510-4fe0-97ef-9b5a22eafe30} - %profile%\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
.
============= SERVICES / DRIVERS ===============
.
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2010-12-5 135336]
R2 AntiVirService;Avira AntiVir Guard;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2010-12-5 267944]
R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgntflt.sys [2010-12-5 83120]
R2 TeamViewer6;TeamViewer 6;C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-6 2222376]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-11 389120]
S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2010-4-19 22528]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 27136]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-9-28 51712]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-12-5 1255736]
.
=============== Created Last 30 ================
.
2011-03-06 21:56:24 -------- d-----w- C:\FRST
2011-03-05 16:05:14 -------- d-----w- C:\BackupThis
2011-03-03 21:26:42 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0
2011-03-02 09:35:24 -------- d-----w- C:\WinSetupFromUSB
2011-03-01 13:15:38 -------- d-----w- C:\Users\JAMIE~1.JIM\AppData\Local\QuickPar
2011-03-01 13:15:05 -------- d-----w- C:\Program Files (x86)\QuickPar
2011-02-27 13:00:56 -------- d-----w- C:\Users\JAMIE~1.JIM\AppData\Roaming\DiskAid
2011-02-27 13:00:52 -------- d-----w- C:\Program Files (x86)\DigiDNA
2011-02-27 12:59:14 -------- d-----w- C:\Users\JAMIE~1.JIM\AppData\Local\Cranium
2011-02-26 00:21:41 -------- d-----w- C:\Users\JAMIE~1.JIM\AppData\Local\Cranium_Consulting_and_Cu
2011-02-26 00:21:20 -------- d-----w- C:\Program Files (x86)\iPhoneBrowser
2011-02-20 13:18:34 -------- d-----w- C:\Users\JAMIE~1.JIM\AppData\Local\{AC562A3B-CD56-4A63-933D-542CF98805CE}
2011-02-09 10:56:07 -------- d-----w- C:\Users\JAMIE~1.JIM\AppData\Local\{366E5ECB-0CE3-4F66-922C-548EB78720D3}
2011-02-06 14:27:35 -------- d-----w- C:\PROGRA~3\vsosdk
2011-02-06 11:20:36 -------- d-----w- C:\ConvertXtoDVD
2011-02-06 11:19:49 65602 ----a-w- C:\Windows\SysWow64\cook3260.dll
2011-02-06 11:19:49 626688 ----a-w- C:\Windows\SysWow64\vp7vfw.dll
2011-02-06 11:19:49 217127 ----a-w- C:\Windows\SysWow64\drv43260.dll
2011-02-06 11:19:49 208935 ----a-w- C:\Windows\SysWow64\drv33260.dll
2011-02-06 11:19:49 176165 ----a-w- C:\Windows\SysWow64\drv23260.dll
2011-02-06 11:19:49 1184984 ----a-w- C:\Windows\SysWow64\wvc1dmod.dll
2011-02-06 11:19:49 102439 ----a-w- C:\Windows\SysWow64\sipr3260.dll
2011-02-06 11:19:47 -------- d-----w- C:\Program Files (x86)\VSO
2011-02-06 10:55:13 -------- d-----w- C:\Users\JAMIE~1.JIM\AppData\Local\{A8A07732-A6B0-4766-9AF1-2110B93A180E}
.
==================== Find3M ====================
.
2011-02-02 11:40:23 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-01-30 04:03:08 178800 ----a-w- C:\Windows\SysWow64\CmdLineExt_x64.dll
2011-01-09 05:18:40 319488 ----a-w- C:\Windows\HideWin.exe
2010-12-13 08:54:52 83120 ----a-w- C:\Windows\System32\drivers\avgntflt.sys
.
============= FINISH: 8:26:38.16 ===============

Attached Files



#12 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:01:07 AM

Posted 06 March 2011 - 05:42 PM

Hi madmanjim,

Your log(s) show that you are using so called peer-to-peer or file-sharing programs. These programs allow to share files between users as the name(s) suggest. In today's world the cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it.

It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: "File-Sharing, otherwise known as Peer To Peer" and "Risks of File-Sharing Technology."


Removal Instructions
  • The logs look good but we are going to make sure of any leftover.
  • Open your Malwarebytes' Anti-Malware.
    • First update it, to do that under the Update tab press "Check for Updates".
    • Under Scanner tab select "Perform Quick Scan", then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy&Paste the MBAM log.

    Extra Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

  • I'd like us to scan your machine with ESET OnlineScan
    • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESET OnlineScan
    • Click the Posted Image button.
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image

A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

#13 madmanjim

madmanjim
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:07 AM

Posted 10 March 2011 - 02:29 AM

MBAM Log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5979

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

7/03/2011 7:20:40 PM
mbam-log-2011-03-07 (19-20-40).txt

Scan type: Quick scan
Objects scanned: 196579
Time elapsed: 2 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



ESET Log:

ESETSmartInstaller@High as downloader log:
all ok

#14 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:01:07 AM

Posted 10 March 2011 - 03:16 AM

It looks good. :thumbup2:

First Set a New Restore Point then Remove the Old Restore Points to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

To set a new restore point:
  • Go to Start > All Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next".
  • Give the Restore Point a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

To remove the old restore points:
  • Go to Start > Run (alternatively you can press Windows key+R key) then type: Cleanmgr in the box and click "OK".
  • You get a window to select the drive to clean, the default is already set to (C:) drive. Click OK.
  • Click the "More Options" Tab.
  • Under "System Restore and Shadow copies" section click "Clean Up" to remove all previous restore points except the newly created one.
  • Click OK and Yes.

Happy Surfing madmanjim.:)

#15 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:01:07 AM

Posted 26 March 2011 - 08:33 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users