Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

redirect, antivirus malware attack


  • This topic is locked This topic is locked
27 replies to this topic

#1 galoot

galoot

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:02:12 AM

Posted 05 August 2011 - 04:36 PM

My MSSE and windows security would not open or run and I was being redirected on web pages. I ran MBAM it found one trojan, but it came back. Spybot GAVE A Windows Security Disabled alert. I ran rkill and uninstalled MSSE and reinstalled and it seems to be working ok and it reports no infections. I am concerned that it was too easy and that I may have one of those imitation programs fooling me into thinking all is well or that it will all come back when I reboot. How can I be sure that I am safe from hack?

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:12 AM

Posted 05 August 2011 - 07:55 PM

Hello, rerun rkill ,do not reboot, rerun MBAM then SAS.

Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal/regular mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Reboot into Safe Mode with Networking
How to enter safe mode(XP/Vista)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode with Networking using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode
.


Next run Superantisypware (SAS):

Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner instead. Save the randomly named file (i.e. SAS_1710895.COM) to a usb drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.


Reboot

Edited by boopme, 05 August 2011 - 09:26 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 galoot

galoot
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:02:12 AM

Posted 05 August 2011 - 08:52 PM

RKILL LOG
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 08/05/2011 at 19:20:55.
Operating System: Microsoft Windows XP


Processes terminated by Rkill or while it was running:

C:\Documents and Settings\Randall\Local Settings\Application Data\Google\Update\GoogleUpdate.exe


Rkill completed on 08/05/2011 at 19:21:03.


MBAM LOG
ase version: 7390

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/5/2011 7:46:15 PM
mbam-log-2011-08-05 (19-45-37).txt

Scan type: Quick scan
Objects scanned: 202508
Time elapsed: 12 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\8DDYX0ZBPZ (Trojan.FakeAlert.SA) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\ZU6RKI1ONY (Trojan.FakeAlert.SA) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\Randall\my documents\downloads\mp3convertersetup.exe (Adware.Agent) -> No action taken.(I deleted this manually)

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:12 AM

Posted 05 August 2011 - 09:01 PM

You did not Remove these??

HKEY_CURRENT_USER\SOFTWARE\8DDYX0ZBPZ (Trojan.FakeAlert.SA) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\ZU6RKI1ONY (Trojan.FakeAlert.SA) -> No action taken.

Edited by boopme, 05 August 2011 - 09:02 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 galoot

galoot
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:02:12 AM

Posted 05 August 2011 - 09:23 PM

I did. Running SAS now.

#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:12 AM

Posted 05 August 2011 - 09:26 PM

Ok thanks.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 galoot

galoot
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:02:12 AM

Posted 05 August 2011 - 10:58 PM

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/05/2011 at 09:05 PM

Application Version : 5.0.1108

Core Rules Database Version : 7523
Trace Rules Database Version: 5335

Scan type : Complete Scan
Total Scan Time : 00:48:17

Operating System Information
Windows XP Home Edition 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned : 308
Memory threats detected : 0
Registry items scanned : 36687
Registry threats detected : 0
File items scanned : 44793
File threats detected : 38

Adware.Tracking Cookie
C:\Documents and Settings\Administrator\Cookies\administrator@interclick[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@liveperson[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@liveperson[3].txt
C:\Documents and Settings\Administrator\Cookies\administrator@microsoftwindows.112.2o7[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@server.iad.liveperson[2].txt
cdn4.specificclick.net [ C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\W54KPXF9 ]
core.insightexpressai.com [ C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\W54KPXF9 ]
media.mtvnservices.com [ C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\W54KPXF9 ]
media.scanscout.com [ C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\W54KPXF9 ]
media1.break.com [ C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\W54KPXF9 ]
objects.tremormedia.com [ C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\W54KPXF9 ]
secure-us.imrworldwide.com [ C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\W54KPXF9 ]
ad.insightexpressai.com [ C:\DOCUMENTS AND SETTINGS\RANDALL\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\9DNNAYAX ]
content.yieldmanager.edgesuite.net [ C:\DOCUMENTS AND SETTINGS\RANDALL\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\9DNNAYAX ]
convoad.technoratimedia.net [ C:\DOCUMENTS AND SETTINGS\RANDALL\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\9DNNAYAX ]
media.scanscout.com [ C:\DOCUMENTS AND SETTINGS\RANDALL\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\9DNNAYAX ]
media1.break.com [ C:\DOCUMENTS AND SETTINGS\RANDALL\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\9DNNAYAX ]
objects.tremormedia.com [ C:\DOCUMENTS AND SETTINGS\RANDALL\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\9DNNAYAX ]
secure-us.imrworldwide.com [ C:\DOCUMENTS AND SETTINGS\RANDALL\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\9DNNAYAX ]
stat.easydate.biz [ C:\DOCUMENTS AND SETTINGS\RANDALL\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\9DNNAYAX ]
www.redorbit.com [ C:\DOCUMENTS AND SETTINGS\RANDALL\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\9DNNAYAX ]
cdn-www.pornhub.com [ C:\DOCUMENTS AND SETTINGS\ROBERT\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\JBV27YVC ]
ec.atdmt.com [ C:\DOCUMENTS AND SETTINGS\ROBERT\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\JBV27YVC ]
media1.break.com [ C:\DOCUMENTS AND SETTINGS\ROBERT\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\JBV27YVC ]
msntest.serving-sys.com [ C:\DOCUMENTS AND SETTINGS\ROBERT\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\JBV27YVC ]
udn.specificclick.net [ C:\DOCUMENTS AND SETTINGS\ROBERT\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\JBV27YVC ]
www.youngporn.net [ C:\DOCUMENTS AND SETTINGS\ROBERT\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\JBV27YVC ]
www.ziporn.com [ C:\DOCUMENTS AND SETTINGS\ROBERT\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\JBV27YVC ]
cdn4.specificclick.net [ C:\DOCUMENTS AND SETTINGS\SARAH\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\PWDRZ68R ]
ec.atdmt.com [ C:\DOCUMENTS AND SETTINGS\SARAH\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\PWDRZ68R ]
udn.specificclick.net [ C:\DOCUMENTS AND SETTINGS\SARAH\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\PWDRZ68R ]
www.crackle.com [ C:\DOCUMENTS AND SETTINGS\SARAH\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\PWDRZ68R ]
cdn4.specificclick.net [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\7FFHDUT8 ]
media.mtvnservices.com [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\7FFHDUT8 ]
media.scanscout.com [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\7FFHDUT8 ]
objects.tremormedia.com [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\7FFHDUT8 ]
udn.specificclick.net [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\7FFHDUT8 ]
video.redorbit.com [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\7FFHDUT8 ]


So the porn trackers listed under my son's name. Does this mean that he is porn surfing?

#8 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:12 AM

Posted 05 August 2011 - 11:04 PM

Sure looks that way, Can you lod into that account and rerun SAS from there?

Then Update MBAM and run a Full scan.

I'll look back tomorrow ,have to go.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#9 galoot

galoot
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:02:12 AM

Posted 05 August 2011 - 11:12 PM

Time for that safe-surf talk. Thanks for the help. Have a good night.

#10 galoot

galoot
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:02:12 AM

Posted 06 August 2011 - 10:42 AM

SAS found 42 ad trackers on my Son's sign in and 12 on my daughter's. MBAM :
found this
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7390

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/6/2011 9:13:16 AM
mbam-log-2011-08-06 (09-13-16).txt

Scan type: Full scan (C:\|)
Objects scanned: 269745
Time elapsed: 1 hour(s), 50 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\RECYCLER\s-1-5-21-1004336348-879983540-682003330-1004\Dc1.exe (Adware.Agent) -> Quarantined and deleted successfully.
I then rebooted and ran both again and it was clean.

#11 galoot

galoot
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:02:12 AM

Posted 06 August 2011 - 11:08 AM

Just did search for Bleeping.com on Google and got redirected to ad site. Something is still going on.

#12 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:12 AM

Posted 06 August 2011 - 01:46 PM

Hello,that was good. Are you on a router? Are other machines on it,if so are they redirecting?

Do you use Firefox?


Please follow our Removal Guide here How to remove Google Redirects. You will move to the Automated Removal Instructions

If it finds something make sure Cure is selected
Next click Continue then Reboot now
A log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.


Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:
  • Flush DNS
  • Report IE Proxy Settings
  • Reset IE Proxy Settings
  • Report FF Proxy Settings
  • Reset FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Users, Partitions and Memory size.
  • List Minidump Files
Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#13 galoot

galoot
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:02:12 AM

Posted 06 August 2011 - 02:57 PM

DSL modem with wireless gateway. No other computers, but my son uses wireless wifi on his phone. He has had no issues. I do use firefox. I will follow your directions and reply with results.

#14 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:12 AM

Posted 06 August 2011 - 03:13 PM

Let me kknow if its still happening after Toolbox,
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#15 galoot

galoot
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:02:12 AM

Posted 06 August 2011 - 03:24 PM

2011/08/06 14:13:23.0750 0364 TDSS rootkit removing tool 2.5.14.0 Aug 5 2011 16:09:29
2011/08/06 14:13:24.0296 0364 ================================================================================
2011/08/06 14:13:24.0296 0364 SystemInfo:
2011/08/06 14:13:24.0296 0364
2011/08/06 14:13:24.0296 0364 OS Version: 5.1.2600 ServicePack: 3.0
2011/08/06 14:13:24.0296 0364 Product type: Workstation
2011/08/06 14:13:24.0296 0364 ComputerName: RELATIONSMART
2011/08/06 14:13:24.0296 0364 UserName: Randall
2011/08/06 14:13:24.0296 0364 Windows directory: C:\WINDOWS
2011/08/06 14:13:24.0296 0364 System windows directory: C:\WINDOWS
2011/08/06 14:13:24.0296 0364 Processor architecture: Intel x86
2011/08/06 14:13:24.0296 0364 Number of processors: 1
2011/08/06 14:13:24.0296 0364 Page size: 0x1000
2011/08/06 14:13:24.0296 0364 Boot type: Normal boot
2011/08/06 14:13:24.0296 0364 ================================================================================
2011/08/06 14:13:25.0796 0364 Initialize success
2011/08/06 14:13:51.0296 3908 ================================================================================
2011/08/06 14:13:51.0296 3908 Scan started
2011/08/06 14:13:51.0296 3908 Mode: Manual;
2011/08/06 14:13:51.0296 3908 ================================================================================
2011/08/06 14:13:51.0859 3908 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/08/06 14:13:52.0000 3908 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/08/06 14:13:52.0218 3908 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/08/06 14:13:52.0359 3908 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/08/06 14:13:52.0484 3908 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/08/06 14:13:53.0437 3908 ASPI32 (54ab078660e536da72b21a27f56b035b) C:\WINDOWS\system32\drivers\ASPI32.sys
2011/08/06 14:13:53.0593 3908 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/08/06 14:13:53.0718 3908 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/08/06 14:13:53.0953 3908 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/08/06 14:13:54.0109 3908 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/08/06 14:13:54.0296 3908 basic2 (1b9c81ab9a456eabd9f8335f04b5f495) C:\WINDOWS\system32\DRIVERS\HSF_BSC2.sys
2011/08/06 14:13:54.0453 3908 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/08/06 14:13:54.0656 3908 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/08/06 14:13:54.0828 3908 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/08/06 14:13:55.0078 3908 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/08/06 14:13:55.0187 3908 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/08/06 14:13:55.0343 3908 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/08/06 14:13:56.0140 3908 ctljystk (71007bd2e1e26927fe3e4eb00c0beedf) C:\WINDOWS\system32\DRIVERS\ctljystk.sys
2011/08/06 14:13:56.0484 3908 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/08/06 14:13:56.0656 3908 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/08/06 14:13:56.0843 3908 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/08/06 14:13:57.0000 3908 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/08/06 14:13:57.0156 3908 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/08/06 14:13:57.0390 3908 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/08/06 14:13:57.0562 3908 emu10k (01f83e1b5dce05f5cb7d99113ca9e890) C:\WINDOWS\system32\drivers\emu10k1m.sys
2011/08/06 14:13:57.0718 3908 emu10k1 (7ffa171cce6a8bfc774862a578ba39a2) C:\WINDOWS\system32\drivers\ctlfacem.sys
2011/08/06 14:13:57.0859 3908 es1371 (a55dd7d8ced5d2624a9ee2dda7be0319) C:\WINDOWS\system32\drivers\es1371mp.sys
2011/08/06 14:13:58.0062 3908 Fallback (c823debe2548656549f84a875d65237b) C:\WINDOWS\system32\DRIVERS\HSF_FALL.sys
2011/08/06 14:13:58.0234 3908 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/08/06 14:13:58.0359 3908 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/08/06 14:13:58.0468 3908 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/08/06 14:13:58.0593 3908 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/08/06 14:13:58.0734 3908 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/08/06 14:13:58.0890 3908 Fsks (6483414841d4cab6c3b4db2ac6edd70b) C:\WINDOWS\system32\DRIVERS\HSF_FSKS.sys
2011/08/06 14:13:59.0062 3908 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/08/06 14:13:59.0250 3908 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/08/06 14:13:59.0390 3908 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
2011/08/06 14:13:59.0531 3908 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/08/06 14:13:59.0671 3908 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/08/06 14:13:59.0828 3908 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/08/06 14:14:00.0156 3908 HPZid412 (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
2011/08/06 14:14:00.0312 3908 HPZipr12 (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
2011/08/06 14:14:00.0468 3908 HPZius12 (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
2011/08/06 14:14:00.0656 3908 HSFHWBS2 (970178e8e003eb1481293830069624b9) C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys
2011/08/06 14:14:00.0843 3908 HSF_DP (ebb354438a4c5a3327fb97306260714a) C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys
2011/08/06 14:14:01.0062 3908 hsf_msft (74e379857d4c0dfb56de2d19b8f4c434) C:\WINDOWS\system32\DRIVERS\HSF_MSFT.sys
2011/08/06 14:14:01.0250 3908 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/08/06 14:14:01.0593 3908 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/08/06 14:14:01.0734 3908 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/08/06 14:14:02.0203 3908 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/08/06 14:14:02.0359 3908 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/08/06 14:14:02.0500 3908 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/08/06 14:14:02.0640 3908 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/08/06 14:14:02.0765 3908 iPodDrv (cf79ff3d10864f73660a34e006b6b8f8) C:\WINDOWS\system32\drivers\iPodDrv.sys
2011/08/06 14:14:02.0875 3908 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/08/06 14:14:03.0015 3908 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/08/06 14:14:03.0171 3908 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/08/06 14:14:03.0343 3908 K56 (9c5e3fdbfcc30cf71a49ca178b9ad442) C:\WINDOWS\system32\DRIVERS\HSF_K56K.sys
2011/08/06 14:14:03.0515 3908 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/08/06 14:14:03.0640 3908 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/08/06 14:14:03.0781 3908 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/08/06 14:14:03.0937 3908 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/08/06 14:14:04.0234 3908 mdmxsdk (195741aee20369980796b557358cd774) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
2011/08/06 14:14:04.0375 3908 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/08/06 14:14:04.0500 3908 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/08/06 14:14:04.0640 3908 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2011/08/06 14:14:04.0781 3908 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/08/06 14:14:04.0953 3908 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/08/06 14:14:05.0078 3908 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/08/06 14:14:05.0203 3908 MpFilter (fee0baded54222e9f1dae9541212aab1) C:\WINDOWS\system32\DRIVERS\MpFilter.sys
2011/08/06 14:14:05.0984 3908 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/08/06 14:14:06.0156 3908 MRxSmb (0dc719e9b15e902346e87e9dcd5751fa) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/08/06 14:14:06.0343 3908 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/08/06 14:14:06.0468 3908 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/08/06 14:14:06.0609 3908 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/08/06 14:14:06.0750 3908 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/08/06 14:14:06.0890 3908 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/08/06 14:14:07.0031 3908 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/08/06 14:14:07.0171 3908 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/08/06 14:14:07.0312 3908 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/08/06 14:14:07.0468 3908 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/08/06 14:14:07.0609 3908 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/08/06 14:14:07.0750 3908 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/08/06 14:14:07.0875 3908 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/08/06 14:14:08.0031 3908 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/08/06 14:14:08.0156 3908 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/08/06 14:14:08.0296 3908 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/08/06 14:14:08.0421 3908 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/08/06 14:14:08.0609 3908 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/08/06 14:14:08.0750 3908 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/08/06 14:14:08.0921 3908 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/08/06 14:14:09.0125 3908 nv (71dbdc08df86b80511e72953fa1ad6b0) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/08/06 14:14:09.0312 3908 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/08/06 14:14:09.0453 3908 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/08/06 14:14:09.0593 3908 OMCI (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS
2011/08/06 14:14:09.0734 3908 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/08/06 14:14:09.0859 3908 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/08/06 14:14:10.0015 3908 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/08/06 14:14:10.0140 3908 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/08/06 14:14:10.0390 3908 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/08/06 14:14:10.0515 3908 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/08/06 14:14:11.0140 3908 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/08/06 14:14:11.0218 3908 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/08/06 14:14:11.0328 3908 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/08/06 14:14:11.0437 3908 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/08/06 14:14:11.0531 3908 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/08/06 14:14:11.0968 3908 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/08/06 14:14:12.0062 3908 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/08/06 14:14:12.0156 3908 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/08/06 14:14:12.0281 3908 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/08/06 14:14:12.0375 3908 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/08/06 14:14:12.0484 3908 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/08/06 14:14:12.0578 3908 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/08/06 14:14:12.0687 3908 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/08/06 14:14:12.0796 3908 Rksample (bb7549bd94d1aac3599c7606c50c48a0) C:\WINDOWS\system32\DRIVERS\HSF_SAMP.sys
2011/08/06 14:14:12.0921 3908 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
2011/08/06 14:14:13.0062 3908 SASDIFSV (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/08/06 14:14:13.0187 3908 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
2011/08/06 14:14:13.0312 3908 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/08/06 14:14:13.0437 3908 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/08/06 14:14:13.0531 3908 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/08/06 14:14:13.0640 3908 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/08/06 14:14:13.0750 3908 sfman (0b1a5e9cacb5cdd54a2815107bd7c772) C:\WINDOWS\system32\drivers\sfmanm.sys
2011/08/06 14:14:13.0953 3908 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/08/06 14:14:14.0078 3908 SoftFax (d9e8e0ce154a2f6430d9efabdf730867) C:\WINDOWS\system32\DRIVERS\HSF_FAXX.sys
2011/08/06 14:14:14.0265 3908 SpeakerPhone (6c843c43fd7f0b42cfe477ce88d0f9b3) C:\WINDOWS\system32\DRIVERS\HSF_SPKP.sys
2011/08/06 14:14:14.0359 3908 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/08/06 14:14:14.0453 3908 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/08/06 14:14:14.0578 3908 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/08/06 14:14:14.0687 3908 StarOpen (f92254b0bcfcd10caac7bccc7cb7f467) C:\WINDOWS\system32\drivers\StarOpen.sys
2011/08/06 14:14:14.0812 3908 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/08/06 14:14:14.0921 3908 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/08/06 14:14:15.0015 3908 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/08/06 14:14:15.0421 3908 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/08/06 14:14:15.0578 3908 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/08/06 14:14:15.0671 3908 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/08/06 14:14:15.0796 3908 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/08/06 14:14:15.0890 3908 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/08/06 14:14:16.0015 3908 Tones (8021a499db46b2961c285168671cb9af) C:\WINDOWS\system32\DRIVERS\HSF_TONE.sys
2011/08/06 14:14:16.0187 3908 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/08/06 14:14:16.0375 3908 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/08/06 14:14:16.0562 3908 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/08/06 14:14:16.0656 3908 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/08/06 14:14:16.0750 3908 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/08/06 14:14:16.0859 3908 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/08/06 14:14:16.0984 3908 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/08/06 14:14:17.0093 3908 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/08/06 14:14:17.0187 3908 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/08/06 14:14:17.0281 3908 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2011/08/06 14:14:17.0375 3908 USB_RNDIS (bee793d4a059caea55d6ac20e19b3a8f) C:\WINDOWS\system32\DRIVERS\usb8023.sys
2011/08/06 14:14:17.0515 3908 V124 (269c0ade94b90029b12497747be408cb) C:\WINDOWS\system32\DRIVERS\HSF_V124.sys
2011/08/06 14:14:17.0656 3908 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/08/06 14:14:17.0890 3908 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/08/06 14:14:18.0062 3908 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/08/06 14:14:18.0187 3908 WDC_SAM (d6efaf429fd30c5df613d220e344cce7) C:\WINDOWS\system32\DRIVERS\wdcsam.sys
2011/08/06 14:14:18.0437 3908 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/08/06 14:14:18.0593 3908 winachsf (1225ebea76aac3c84df6c54fe5e5d8be) C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys
2011/08/06 14:14:18.0859 3908 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/08/06 14:14:19.0015 3908 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/08/06 14:14:19.0187 3908 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/08/06 14:14:19.0343 3908 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/08/06 14:14:19.0421 3908 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/08/06 14:14:19.0578 3908 Boot (0x1200) (5b0cf238c4f13e6bf82139daf57bd0c7) \Device\Harddisk0\DR0\Partition0
2011/08/06 14:14:19.0593 3908 ================================================================================
2011/08/06 14:14:19.0593 3908 Scan finished
2011/08/06 14:14:19.0593 3908 ================================================================================
2011/08/06 14:14:19.0625 2452 Detected object count: 0
2011/08/06 14:14:19.0625 2452 Actual detected object count: 0
2011/08/06 14:14:29.0015 0632 Deinitialize success

Here is the tdss log

It showed a rootkit in Atapi I hit continue it waited about a minute and closed. I then ran again and it said no threats found. There was no log for the first run.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users