Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Vipre found a trojan


  • This topic is locked This topic is locked
16 replies to this topic

#1 Trident18

Trident18

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:07:01 PM

Posted 21 August 2011 - 12:59 PM

Vipre keeps finding the trojan, but it can't seem to get rid of it. It's disabled the Windows firewall and is causing some redirects to sites like this.
Vipre finds Backdoor.Win32.ZAccess.dg (v), Trojan.Win32.Generic!BT and then the active scanner keeps stopping 800000cb.@ (Trojan).

.
DDS (Ver_2011-06-23.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Stephen at 13:47:35 on 2011-08-21
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4010.1161 [GMT -4:00]
.
AV: Sunbelt VIPRE *Enabled/Updated* {BE5DD172-7F42-7948-1A60-E6A720288F81}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Sunbelt VIPRE *Enabled/Updated* {053C3096-5978-76C6-20D0-DDD55BAFC53C}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\Program Files (x86)\Nero\Tools\InCD\InCDSrv.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\WLANExt.exe
C:\windows\system32\conhost.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Nero\Tools\InCD\NBHRegInCDSrv.exe
C:\windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
C:\windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files (x86)\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\system32\wbem\unsecapp.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe
C:\windows\system32\svchost.exe -k HPService
C:\windows\system32\svchost.exe -k bthsvcs
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
C:\windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
C:\windows\system32\wbem\unsecapp.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\windows\system32\taskeng.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\BOINC\boinctray.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\BOINC\boinc.exe
C:\windows\system32\conhost.exe
C:\Program Files (x86)\CompanionLink\CompanionLink.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
C:\Program Files (x86)\USB Camera\VM331_STI.EXE
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files (x86)\Nero\Tools\InCD\NBHGui.exe
C:\Program Files (x86)\Nero\Tools\InCD\InCD.exe
C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\windows\SysWOW64\RunDll32.exe
C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe
C:\Program Files\Lenovo\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\DDNi\Oasis2Service 1.0\Oasis2Service.exe
C:\Program Files\Realtek\RtLED\RtLEDService.exe
C:\Program Files\Realtek\RtLED\RtLED.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMUI.exe
C:\windows\system32\svchost.exe -k SDRSVC
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\sysWow64\SearchProtocolHost.exe
C:\windows\system32\DllHost.exe
C:\windows\system32\DllHost.exe
C:\windows\SysWOW64\cmd.exe
C:\windows\system32\DllHost.exe
C:\windows\system32\conhost.exe
C:\windows\SysWOW64\cscript.exe
C:\windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uWindow Title = Internet Explorer, optimized for Bing and MSN
mStart Page = hxxp://lenovo.msn.com
mWinlogon: Userinit=userinit.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [cdloader] "C:\Users\Stephen\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [CompanionLink] "c:\program files (x86)\companionlink\companionlink.exe" -Icon
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
mRun: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE
mRun: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
mRun: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
mRun: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
mRun: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
mRun: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
mRun: [NBHGui] C:\Program Files (x86)\Nero\Tools\InCD\NBHGui.exe
mRun: [InCD] C:\Program Files (x86)\Nero\Tools\InCD\InCD.exe
mRun: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
mRun: [<NO NAME>]
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
mRun: [SBAMTray] "C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe"
StartupFolder: C:\Users\Stephen\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\Lenovo\Bluetooth Software\BTTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~1.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SRSPRE~1.LNK - C:\Program Files (x86)\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
LSP: mswsock.dll
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{1DF6B644-46D0-438F-BB33-338014F769BA} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{6DD73882-DDD6-4D38-BCEC-25CE20FA828B} : DhcpNameServer = 192.168.42.129
TCP: Interfaces\{73F51104-5D67-4967-8088-2EADFC2B319F} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{73F51104-5D67-4967-8088-2EADFC2B319F}\2454E4E49454 : DhcpNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - C:\Program Files (x86)\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\System32\mscoree.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
AppInit_DLLs: C:\PROGRA~2\Google\GOOGLE~3\GO36F4~1.DLL acaptuser32.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-X64: 0x1 - No File
BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO-X64: HP Print Enhancer - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: SmartSelect - No File
BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
BHO-X64: HP Smart BHO Class - No File
TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE
mRun-x64: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
mRun-x64: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
mRun-x64: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
mRun-x64: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
mRun-x64: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun-x64: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
mRun-x64: [NBHGui] C:\Program Files (x86)\Nero\Tools\InCD\NBHGui.exe
mRun-x64: [InCD] C:\Program Files (x86)\Nero\Tools\InCD\InCD.exe
mRun-x64: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
mRun-x64: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
mRun-x64: [(Default)]
mRun-x64: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
mRun-x64: [SBAMTray] "C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe"
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
AppInit_DLLs-X64: C:\PROGRA~2\Google\GOOGLE~3\GO36F4~1.DLL acaptuser32.dll
SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\lymaqvdl.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - component: C:\Program Files (x86)\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 fbfmon;fbfmon;C:\windows\system32\drivers\fbfmon.sys --> C:\windows\system32\drivers\fbfmon.sys [?]
R0 LHDmgr;LHDmgr;C:\windows\system32\DRIVERS\LhdX64.sys --> C:\windows\system32\DRIVERS\LhdX64.sys [?]
R1 BPntDrv;BPntDrv;C:\windows\system32\drivers\BPntDrv.sys --> C:\windows\system32\drivers\BPntDrv.sys [?]
R1 SBRE;SBRE;C:\Windows\System32\drivers\SBREDrv.sys [2011-4-29 101720]
R2 sbapifs;sbapifs;C:\windows\system32\DRIVERS\sbapifs.sys --> C:\windows\system32\DRIVERS\sbapifs.sys [?]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\windows\system32\DRIVERS\AcpiVpc.sys --> C:\windows\system32\DRIVERS\AcpiVpc.sys [?]
R3 BTWAMPFL;BTWAMPFL;C:\windows\system32\DRIVERS\btwampfl.sys --> C:\windows\system32\DRIVERS\btwampfl.sys [?]
R3 btwl2cap;Bluetooth L2CAP Service;C:\windows\system32\DRIVERS\btwl2cap.sys --> C:\windows\system32\DRIVERS\btwl2cap.sys [?]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\windows\system32\DRIVERS\clwvd.sys --> C:\windows\system32\DRIVERS\clwvd.sys [?]
R3 IntcDAud;Intel® Display Audio;C:\windows\system32\DRIVERS\IntcDAud.sys --> C:\windows\system32\DRIVERS\IntcDAud.sys [?]
R3 MEIx64;Intel® Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\windows\system32\DRIVERS\NETwNs64.sys --> C:\windows\system32\DRIVERS\NETwNs64.sys [?]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUVStor.sys --> C:\windows\system32\Drivers\RtsUVStor.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\windows\system32\Drivers\ssadadb.sys --> C:\windows\system32\Drivers\ssadadb.sys [?]
S3 HTCAND64;HTC Device Driver;C:\windows\system32\Drivers\ANDROIDUSB.sys --> C:\windows\system32\Drivers\ANDROIDUSB.sys [?]
S3 htcnprot;HTC NDIS Protocol Driver;C:\windows\system32\DRIVERS\htcnprot.sys --> C:\windows\system32\DRIVERS\htcnprot.sys [?]
.
=============== Created Last 30 ================
.
2011-08-21 05:39:48 -------- d-----we C:\windows\system64
2011-08-20 22:22:16 -------- d-----w- C:\CONTACT_16X9_LB
2011-08-20 18:55:59 -------- d-----w- C:\Users\Stephen\AppData\Roaming\Malwarebytes
2011-08-20 18:55:26 41272 ----a-w- C:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-20 18:55:25 -------- d-----w- C:\ProgramData\Malwarebytes
2011-08-20 18:55:22 25912 ----a-w- C:\windows\System32\drivers\mbam.sys
2011-08-20 18:55:22 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-08-13 05:32:18 24416 ----a-r- C:\windows\System32\AdobePDFUI.dll
2011-08-13 05:29:54 112056 ----a-w- C:\windows\SysWow64\acaptuser32.dll
2011-08-11 05:25:32 -------- d-----w- C:\IN_THE_VALLEY_OF_ELAH
2011-08-11 04:24:31 -------- d-----w- C:\BUCKAROO
2011-08-11 03:58:07 -------- d-----w- C:\CHOCOLAT
2011-08-11 03:17:22 -------- d-----w- C:\FIGHTCLB
2011-08-11 02:26:48 -------- d-----w- C:\BLADE_RUNNER_16X9
2011-08-11 01:17:42 -------- d-----w- C:\Users\Stephen\AppData\Local\{ED9A4D25-65B6-4844-8077-619C512A96AB}
2011-08-11 01:11:35 -------- d-----w- C:\Users\Stephen\AppData\Local\{7BD15F4D-8B18-4A19-A3B2-D52336C97C50}
2011-08-11 01:10:18 -------- d-----w- C:\Users\Stephen\AppData\Local\{EDE0A923-6806-469A-8B2A-31192975ABF5}
2011-08-11 01:09:25 -------- d-----w- C:\Users\Stephen\AppData\Local\{53359677-D15F-4E22-AA32-422C4F0DB509}
2011-08-11 01:08:18 -------- d-----w- C:\Users\Stephen\AppData\Local\{F5C3860B-D9F6-4814-8039-41C6D15EA159}
2011-08-11 01:06:17 -------- d-----w- C:\Users\Stephen\AppData\Local\{C4D19035-5FFA-4748-B4C3-DA7023BF193A}
2011-08-11 01:05:36 -------- d-----w- C:\Users\Stephen\AppData\Local\{729CE3E1-F0C5-49AD-BC4B-026420C3A3C4}
2011-08-11 01:00:04 -------- d-----w- C:\Users\Stephen\AppData\Local\{C834BD3A-B936-4705-828D-3438B056CC41}
2011-08-11 00:45:21 -------- d-----w- C:\Users\Stephen\AppData\Local\{2B0368E7-0B1E-4A36-B09E-3DD8CE014EB5}
2011-08-11 00:42:19 -------- d-----w- C:\Users\Stephen\AppData\Local\{198D226D-BEF4-487B-A8CD-9178B65110BD}
2011-08-11 00:32:49 -------- d-----w- C:\Users\Stephen\AppData\Local\{3C5AA503-B8CC-4AA2-B340-F51A71343CB3}
2011-08-10 03:53:18 69464 ----a-w- C:\windows\SysWow64\XAPOFX1_3.dll
2011-08-10 03:53:18 515416 ----a-w- C:\windows\SysWow64\XAudio2_5.dll
2011-08-10 03:53:15 523088 ----a-w- C:\windows\System32\d3dx10_42.dll
2011-08-10 03:53:15 453456 ----a-w- C:\windows\SysWow64\d3dx10_42.dll
2011-08-10 03:53:08 4398360 ----a-w- C:\windows\System32\d3dx9_32.dll
2011-08-10 03:53:08 3426072 ----a-w- C:\windows\SysWow64\d3dx9_32.dll
2011-08-10 03:51:15 -------- d-----w- C:\Program Files\Microsoft IntelliType Pro
2011-08-10 03:49:08 -------- d-----w- C:\Users\Stephen\AppData\Local\Windows Live
2011-08-10 03:07:34 -------- d-----w- C:\Users\Stephen\AppData\Local\Intel Wireless Display
2011-08-10 03:02:47 -------- d-----w- C:\Users\Stephen\AppData\Local\CyberLink
2011-08-09 19:33:29 288768 ----a-w- C:\windows\System32\drivers\mrxsmb10.sys
2011-08-09 19:32:59 1923968 ----a-w- C:\windows\System32\drivers\tcpip.sys
2011-08-09 19:32:57 3912576 ----a-w- C:\windows\SysWow64\ntoskrnl.exe
2011-08-09 19:32:56 5561216 ----a-w- C:\windows\System32\ntoskrnl.exe
2011-08-09 19:32:56 3967872 ----a-w- C:\windows\SysWow64\ntkrnlpa.exe
2011-08-06 20:55:13 -------- d-----w- C:\ProgramData\dbg
2011-08-05 03:34:12 -------- d-----w- C:\Program Files\BOINC
2011-08-05 03:34:11 -------- d-----w- C:\ProgramData\BOINC
2011-08-05 03:32:55 -------- d-----w- C:\windows\Downloaded Installations
2011-08-04 17:58:30 -------- d-----w- C:\Users\Stephen\My Others
2011-08-04 17:58:30 -------- d-----w- C:\Users\Stephen\AppData\Roaming\ArcSyncConfig
2011-08-03 21:52:59 -------- d-----w- C:\Users\Stephen\AppData\Local\{78E49033-9401-404D-8F0B-1244FBBAF538}
2011-08-03 21:52:59 -------- d-----w- C:\Users\Stephen\AppData\Local\{14D39863-7007-47F5-B497-D722AD5A3383}
2011-07-29 21:45:25 -------- d-----w- C:\ProgramData\Sunbelt
2011-07-29 21:45:20 -------- d-----w- C:\Users\Stephen\AppData\Roaming\Sunbelt
2011-07-29 21:39:20 94296 ----a-w- C:\windows\System32\drivers\sbtis.sys
2011-07-29 21:39:20 55384 ----a-w- C:\windows\System32\drivers\sbredrv.sys
2011-07-29 21:39:20 45904 ----a-w- C:\windows\System32\sbbd.exe
2011-07-29 21:39:19 -------- d-----w- C:\Program Files (x86)\Sunbelt Software
2011-07-29 21:29:59 -------- d-----w- C:\Users\Stephen\AppData\Roaming\IrfanView
2011-07-29 21:29:54 -------- d-----w- C:\Program Files (x86)\IrfanView
2011-07-29 01:35:33 53248 ----a-r- C:\Users\Stephen\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-07-29 01:35:25 18960 ----a-w- C:\windows\System32\drivers\LNonPnP.sys
2011-07-29 01:33:49 -------- d-----w- C:\Users\Stephen\AppData\Roaming\Logishrd
2011-07-27 18:36:33 -------- d-----w- C:\Users\Stephen\AppData\Local\Apps
2011-07-27 18:10:30 -------- d-----w- C:\Users\Stephen\AppData\Roaming\magicJackOutlookAddIn
2011-07-27 04:05:39 119808 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\GoogleDesktopMozilla.dll
2011-07-27 04:04:41 52568 ----a-w- C:\windows\System32\AdobePDF.dll
2011-07-27 03:41:27 -------- d-----w- C:\Program Files (x86)\Common Files\Macrovision Shared
2011-07-27 03:24:32 -------- d-----w- C:\activation
2011-07-27 01:19:11 902656 ----a-w- C:\windows\System32\d2d1.dll
2011-07-27 01:19:11 739840 ----a-w- C:\windows\SysWow64\d2d1.dll
2011-07-27 01:19:11 1544192 ----a-w- C:\windows\System32\DWrite.dll
2011-07-27 01:19:11 1139200 ----a-w- C:\windows\System32\FntCache.dll
2011-07-27 01:19:11 1076736 ----a-w- C:\windows\SysWow64\DWrite.dll
2011-07-26 23:43:21 -------- d-----w- C:\V_FOR_VENDETTA
2011-07-26 23:18:57 -------- d-----w- C:\GLADIATOR
2011-07-26 23:07:31 737072 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-07-26 23:07:18 4283672 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-07-26 23:07:05 42776 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-07-26 23:07:02 539968 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-07-26 20:50:44 -------- d-----w- C:\SERENITY
2011-07-26 20:44:14 -------- d-----w- C:\Program Files (x86)\DVD Decrypter
2011-07-26 18:52:32 -------- d-----w- C:\Users\Stephen\AppData\Roaming\Thinstall
2011-07-26 16:41:18 14848 ----a-w- C:\windows\System32\Spool\prtprocs\x64\MIMFPR03.DLL
2011-07-26 15:16:53 -------- d-----r- C:\Program Files (x86)\Skype
2011-07-26 15:00:59 -------- d-----w- C:\Users\Stephen\AppData\Roaming\ooVoo Details
2011-07-26 14:50:38 -------- d-----w- C:\Users\Stephen\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
2011-07-26 14:50:28 -------- d-----w- C:\Users\Stephen\AppData\Roaming\HTC
2011-07-26 14:41:13 -------- d-----w- C:\Users\Stephen\AppData\Local\Downloaded Installations
2011-07-26 14:40:58 -------- d-----w- C:\Program Files (x86)\Spirent Communications
2011-07-26 14:40:46 -------- d-----w- C:\Program Files (x86)\HTC
2011-07-26 09:43:48 -------- d-sh--w- C:\Recovery
2011-07-26 04:43:02 -------- d-----w- C:\CCCFI
2011-07-26 04:39:46 -------- d-----w- C:\Users\Stephen\AppData\Local\WinZip Courier
2011-07-26 04:37:07 -------- d-----w- C:\Program Files\Common Files\Intuit
2011-07-26 04:30:48 -------- d-----w- C:\Users\Stephen\AppData\Local\tjnet
2011-07-26 04:09:38 -------- d-----w- C:\windows\SysWow64\Wat
2011-07-26 04:09:38 -------- d-----w- C:\windows\System32\Wat
2011-07-26 03:16:36 -------- d-----w- C:\Users\Stephen\AppData\Roaming\CompanionLink
2011-07-26 03:16:32 -------- d-----w- C:\Program Files (x86)\CompanionLink
2011-07-26 03:06:47 -------- d-----w- C:\Users\Stephen\AppData\Local\Intuit
2011-07-26 03:06:13 22040 ----a-w- C:\windows\System32\drivers\InCDRec.sys
2011-07-26 03:06:13 168984 ----a-w- C:\windows\System32\drivers\InCDFs.sys
2011-07-26 03:06:05 60952 ----a-w- C:\windows\System32\drivers\InCDPass.sys
2011-07-26 03:06:02 -------- d-----w- C:\Program Files\Nero
2011-07-26 03:06:02 -------- d-----w- C:\Program Files (x86)\Nero
2011-07-26 03:05:05 -------- d-----w- C:\Program Files (x86)\Common Files\supportsoft
2011-07-26 03:03:07 3833856 ----a-w- C:\windows\SysWow64\cdintf300.dll
2011-07-26 03:03:07 1843200 ----a-w- C:\windows\SysWow64\acXMLParser.dll
2011-07-26 03:01:38 -------- d-----w- C:\ProgramData\Intuit
2011-07-26 03:01:38 -------- d-----w- C:\Program Files (x86)\Intuit
2011-07-26 03:01:38 -------- d-----w- C:\Program Files (x86)\Common Files\Intuit
2011-07-26 02:59:53 -------- d-----w- C:\ProgramData\COMMON FILES
2011-07-26 02:59:49 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
2011-07-26 02:53:54 -------- d-----w- C:\Program Files (x86)\Akamai
2011-07-26 01:23:10 -------- d-----w- C:\FAX
2011-07-26 01:22:21 -------- d-----w- C:\ProgramData\WinZipEC
2011-07-26 01:22:20 -------- d-----w- C:\windows\CD95F661A5C411AFB2CCABCD21A325B4.TMP
2011-07-26 01:21:11 -------- d-----w- C:\Users\Stephen\AppData\Local\magicJack
2011-07-26 01:21:07 -------- d-----w- C:\ProgramData\magicJack
2011-07-26 01:20:53 -------- d-----w- C:\Users\Stephen\AppData\Roaming\mjusbsp
2011-07-26 01:19:11 -------- d-----w- C:\Users\Stephen\AppData\Local\WinZip
2011-07-26 01:05:32 -------- d-----w- C:\ProgramData\WEBREG
2011-07-26 01:05:22 -------- d-----w- C:\Users\Stephen\AppData\Local\HP
2011-07-26 01:04:16 249856 ----a-w- C:\windows\System32\Spool\prtprocs\x64\hpfpp092.dll
2011-07-26 01:02:57 -------- d-----w- C:\Program Files (x86)\Yahoo!
2011-07-26 01:00:40 -------- d-----w- C:\windows\SysWow64\spool
2011-07-26 00:59:19 -------- d-----w- C:\Program Files (x86)\Common Files\HP
2011-07-26 00:59:18 -------- d-----w- C:\Program Files (x86)\Common Files\Hewlett-Packard
2011-07-26 00:59:03 -------- d-----w- C:\windows\hpoj4500g510n-z
2011-07-26 00:58:24 902656 ----a-w- C:\windows\System32\hpwwiax9.dll
2011-07-26 00:58:24 742912 ----a-w- C:\windows\System32\hpwtscl5.dll
2011-07-26 00:58:24 551424 ----a-w- C:\windows\System32\hppldcoi.dll
2011-07-26 00:58:24 503296 ----a-w- C:\windows\System32\hpwvst01.dll
2011-07-26 00:58:19 642360 ----a-w- C:\windows\System32\hpzids40.dll
2011-07-26 00:58:15 136704 ----a-w- C:\windows\System32\hpf3l092.dll
2011-07-26 00:57:29 -------- d-----w- C:\Program Files (x86)\HP
2011-07-26 00:52:07 -------- d-----w- C:\Users\Stephen\AppData\Local\Adobe
2011-07-26 00:24:41 -------- d-----w- C:\Users\Stephen\AppData\Local\ElevatedDiagnostics
2011-07-25 23:48:15 404640 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-25 23:43:38 134104 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
2011-07-25 23:43:37 89048 ----a-w- C:\Program Files (x86)\Mozilla Firefox\libEGL.dll
2011-07-25 23:43:37 785368 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozsqlite3.dll
2011-07-25 23:43:37 478168 ----a-w- C:\Program Files (x86)\Mozilla Firefox\libGLESv2.dll
2011-07-25 23:43:37 2106216 ----a-w- C:\Program Files (x86)\Mozilla Firefox\D3DCompiler_43.dll
2011-07-25 23:43:37 1998168 ----a-w- C:\Program Files (x86)\Mozilla Firefox\d3dx9_43.dll
2011-07-25 23:43:37 1846232 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-07-25 23:43:37 15832 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozalloc.dll
2011-07-25 23:32:57 -------- d-----w- C:\Users\Stephen\AppData\Local\Mozilla
2011-07-25 22:59:06 204800 ------w- C:\windows\SysWow64\MPSMC__U.EXE
2011-07-25 22:59:05 172032 ------w- C:\windows\SysWow64\MSTMON_U.EXE
2011-07-25 22:59:05 1282048 ------w- C:\windows\SysWow64\MSTMON_U.DLL
2011-07-25 22:58:33 -------- d-----w- C:\Program Files (x86)\KONICA MINOLTA
2011-07-25 22:51:52 -------- d-----w- C:\Program Files (x86)\Microsoft Synchronization Services
2011-07-25 22:49:23 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8
2011-07-25 22:48:55 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services
2011-07-25 22:48:41 -------- d-----w- C:\Users\Stephen\AppData\Local\Microsoft Help
2011-07-25 22:23:26 -------- d--h--w- C:\windows\msdownld.tmp
2011-07-25 22:08:55 961024 ----a-w- C:\windows\System32\CPFilters.dll
2011-07-25 22:06:48 976896 ----a-w- C:\windows\System32\inetcomm.dll
2011-07-25 22:06:48 741376 ----a-w- C:\windows\SysWow64\inetcomm.dll
2011-07-25 22:06:35 90624 ----a-w- C:\windows\System32\drivers\bowser.sys
2011-07-25 21:55:46 -------- d-----w- C:\Users\Stephen\AppData\Local\Google
2011-07-25 21:53:55 -------- d-----w- C:\Users\Stephen\AppData\Local\Broadcom
2011-07-25 21:53:18 -------- d-----w- C:\Users\Stephen\AppData\Local\SRS Labs
2011-07-25 21:53:14 -------- d-----w- C:\ProgramData\Energy Management
2011-07-25 21:51:42 712976 ----a-w- C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
.
==================== Find3M ====================
.
2011-07-22 05:42:23 2303488 ----a-w- C:\windows\System32\jscript9.dll
2011-07-22 05:36:16 1389056 ----a-w- C:\windows\System32\wininet.dll
2011-07-22 05:32:40 2382848 ----a-w- C:\windows\System32\mshtml.tlb
2011-07-22 02:54:43 1797632 ----a-w- C:\windows\SysWow64\jscript9.dll
2011-07-22 02:48:26 1126912 ----a-w- C:\windows\SysWow64\wininet.dll
2011-07-22 02:44:36 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb
2011-07-16 05:41:50 362496 ----a-w- C:\windows\System32\wow64win.dll
2011-07-16 05:41:49 243200 ----a-w- C:\windows\System32\wow64.dll
2011-07-16 05:41:49 13312 ----a-w- C:\windows\System32\wow64cpu.dll
2011-07-16 05:39:10 16384 ----a-w- C:\windows\System32\ntvdm64.dll
2011-07-16 05:37:12 421888 ----a-w- C:\windows\System32\KernelBase.dll
2011-07-16 04:29:19 14336 ----a-w- C:\windows\SysWow64\ntvdm64.dll
2011-07-16 04:26:00 44032 ----a-w- C:\windows\apppatch\acwow64.dll
2011-07-16 04:25:37 25600 ----a-w- C:\windows\SysWow64\setup16.exe
2011-07-16 04:24:23 5120 ----a-w- C:\windows\SysWow64\wow32.dll
2011-07-16 04:24:22 272384 ----a-w- C:\windows\SysWow64\KernelBase.dll
2011-07-16 02:21:44 7680 ----a-w- C:\windows\SysWow64\instnm.exe
2011-07-16 02:21:41 2048 ----a-w- C:\windows\SysWow64\user.exe
2011-07-16 02:17:19 6144 ---ha-w- C:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:17:19 4608 ---ha-w- C:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:17:19 3584 ---ha-w- C:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:17:19 3072 ---ha-w- C:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2011-06-24 05:34:53 214528 ----a-w- C:\windows\System32\winsrv.dll
2011-06-24 05:25:49 338432 ----a-w- C:\windows\System32\conhost.exe
2011-06-15 10:02:23 212992 ----a-w- C:\windows\System32\odbctrac.dll
2011-06-15 10:02:23 163840 ----a-w- C:\windows\System32\odbccp32.dll
2011-06-15 10:02:23 106496 ----a-w- C:\windows\System32\odbccu32.dll
2011-06-15 10:02:23 106496 ----a-w- C:\windows\System32\odbccr32.dll
2011-06-15 08:55:19 86016 ----a-w- C:\windows\SysWow64\odbccu32.dll
2011-06-15 08:55:19 81920 ----a-w- C:\windows\SysWow64\odbccr32.dll
2011-06-15 08:55:19 319488 ----a-w- C:\windows\SysWow64\odbcjt32.dll
2011-06-15 08:55:19 163840 ----a-w- C:\windows\SysWow64\odbctrac.dll
2011-06-15 08:55:19 122880 ----a-w- C:\windows\SysWow64\odbccp32.dll
2011-06-13 16:50:14 1007792 ----a-w- C:\windows\boinc.scr
2011-06-11 03:07:25 3137536 ----a-w- C:\windows\System32\win32k.sys
2011-06-08 06:21:40 39008 ----a-w- C:\windows\System32\drivers\LhdX64.sys
2011-06-08 06:21:40 19872 ----a-w- C:\windows\System32\LenovoSDKEmSubSystem.dll
2011-06-08 06:21:37 29792 ----a-w- C:\windows\System32\drivers\AcpiVpc.sys
2011-06-08 06:10:24 279968 ----a-w- C:\windows\System32\LenovoSdk.OKTDLL.dll
2011-06-08 06:09:03 57952 ----a-w- C:\windows\System32\drivers\fbfmon.sys
2011-06-08 06:09:03 46176 ----a-w- C:\windows\System32\FbDefrag.exe
2011-06-08 06:09:03 15968 ----a-w- C:\windows\System32\NFbfmon.dll
2011-06-08 06:09:03 13408 ----a-w- C:\windows\System32\drivers\BPntDrv.sys
2011-06-08 05:55:18 951680 ----a-w- C:\windows\System32\drivers\ndis.sys
2011-06-04 02:53:58 1508 ----a-w- C:\windows\CONNNET.CMD
2011-05-24 11:42:55 404480 ----a-w- C:\windows\System32\umpnpmgr.dll
2011-05-24 10:40:05 64512 ----a-w- C:\windows\SysWow64\devobj.dll
2011-05-24 10:40:05 44544 ----a-w- C:\windows\SysWow64\devrtl.dll
2011-05-24 10:39:38 145920 ----a-w- C:\windows\SysWow64\cfgmgr32.dll
2011-05-24 10:37:54 252928 ----a-w- C:\windows\SysWow64\drvinst.exe
.
============= FINISH: 13:49:13.26 ===============

Attached Files


Edited by Trident18, 22 August 2011 - 12:31 AM.


BC AdBot (Login to Remove)

 


#2 Trident18

Trident18
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:07:01 PM

Posted 21 August 2011 - 04:43 PM

I tried following the directions under the thread, "How to remove a Trojan, Virus, Worm, or other Malware", but I didn't see any of the files using "Autoruns".

I did find the names and locations of two files using Vipre, but when I tried to find the first one, it didn't show and when I clicked on the second one, it disappeared immediately. Vipre noticed it, but I can't find any evidence that it's really gone.

Backdoor.Win32.ZAccess.dg (v)
c:\Windows\assembly\GAC_32\Desktop.ini


Trojan.Win32.Generic!BT
c:\Windows\System32\consrv.dll

#3 Trident18

Trident18
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:07:01 PM

Posted 21 August 2011 - 11:13 PM

Just to keep up to date... Vipre A/V keeps trying to remove this stuff and asking me to reboot. This last time, when it started to load Windows it went into System Restore in Safe mode by itself. After trying to repair the system for about 10 minutes, it booted up and immediately started giving me warnings that the same files were being blocked and I needed to reboot again.
I'm about to do so... not optimistic about it.

UPDATE:
I ran the Kaspersky Virus Removal app and it found and removed one of the infections.
My Windows Firewall is now on and I'm not getting any more messages/warnings and no redirects.
I'm going to sleep and see how it does tomorrow- I'll run the DDS scan again then.

Edited by Trident18, 22 August 2011 - 11:52 AM.


#4 Trident18

Trident18
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:07:01 PM

Posted 22 August 2011 - 12:30 AM

Couldn't wait.
Here are the scans.
.
DDS (Ver_2011-06-23.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Stephen at 1:26:30 on 2011-08-22
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4010.2369 [GMT -4:00]
.
AV: Sunbelt VIPRE *Enabled/Updated* {BE5DD172-7F42-7948-1A60-E6A720288F81}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Sunbelt VIPRE *Enabled/Updated* {053C3096-5978-76C6-20D0-DDD55BAFC53C}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\Program Files (x86)\Nero\Tools\InCD\InCDSrv.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\WLANExt.exe
C:\windows\system32\conhost.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Nero\Tools\InCD\NBHRegInCDSrv.exe
C:\windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
C:\windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files (x86)\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\wbem\unsecapp.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\svchost.exe -k HPService
C:\windows\system32\svchost.exe -k bthsvcs
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
C:\windows\system32\SearchIndexer.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\BOINC\boinctray.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\CompanionLink\CompanionLink.exe
C:\Program Files\BOINC\boinc.exe
C:\windows\system32\conhost.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\USB Camera\VM331_STI.EXE
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
C:\windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files (x86)\Nero\Tools\InCD\NBHGui.exe
C:\Program Files (x86)\Nero\Tools\InCD\InCD.exe
C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\windows\system32\DllHost.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\windows\SysWOW64\RunDll32.exe
C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe
C:\Program Files\Lenovo\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\DDNi\Oasis2Service 1.0\Oasis2Service.exe
C:\Program Files\Realtek\RtLED\RtLEDService.exe
C:\Program Files\Realtek\RtLED\RtLED.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\windows\system32\svchost.exe -k SDRSVC
C:\windows\system32\taskeng.exe
C:\windows\system32\DllHost.exe
C:\windows\system32\DllHost.exe
C:\windows\SysWOW64\cmd.exe
C:\windows\system32\conhost.exe
C:\windows\SysWOW64\cscript.exe
C:\windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uWindow Title = Internet Explorer, optimized for Bing and MSN
mStart Page = hxxp://lenovo.msn.com
mWinlogon: Userinit=userinit.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [cdloader] "C:\Users\Stephen\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [CompanionLink] "c:\program files (x86)\companionlink\companionlink.exe" -Icon
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
mRun: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE
mRun: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
mRun: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
mRun: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
mRun: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
mRun: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
mRun: [NBHGui] C:\Program Files (x86)\Nero\Tools\InCD\NBHGui.exe
mRun: [InCD] C:\Program Files (x86)\Nero\Tools\InCD\InCD.exe
mRun: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
mRun: [<NO NAME>]
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
mRun: [SBAMTray] "C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe"
mRunOnce: [GrpConv] grpconv -o
StartupFolder: C:\Users\Stephen\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe
StartupFolder: C:\Users\Stephen\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\_UNINS~1.LNK - C:\Users\Stephen\AppData\Local\Temp\_uninst_89080730.bat
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\Lenovo\Bluetooth Software\BTTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~1.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SRSPRE~1.LNK - C:\Program Files (x86)\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
LSP: mswsock.dll
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{1DF6B644-46D0-438F-BB33-338014F769BA} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{6DD73882-DDD6-4D38-BCEC-25CE20FA828B} : DhcpNameServer = 192.168.42.129
TCP: Interfaces\{73F51104-5D67-4967-8088-2EADFC2B319F} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{73F51104-5D67-4967-8088-2EADFC2B319F}\2454E4E49454 : DhcpNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - C:\Program Files (x86)\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\System32\mscoree.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
AppInit_DLLs: C:\PROGRA~2\Google\GOOGLE~3\GO36F4~1.DLL acaptuser32.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-X64: 0x1 - No File
BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO-X64: HP Print Enhancer - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: SmartSelect - No File
BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
BHO-X64: HP Smart BHO Class - No File
TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE
mRun-x64: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
mRun-x64: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
mRun-x64: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
mRun-x64: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
mRun-x64: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun-x64: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
mRun-x64: [NBHGui] C:\Program Files (x86)\Nero\Tools\InCD\NBHGui.exe
mRun-x64: [InCD] C:\Program Files (x86)\Nero\Tools\InCD\InCD.exe
mRun-x64: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
mRun-x64: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
mRun-x64: [(Default)]
mRun-x64: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
mRun-x64: [SBAMTray] "C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe"
mRunOnce-x64: [GrpConv] grpconv -o
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
AppInit_DLLs-X64: C:\PROGRA~2\Google\GOOGLE~3\GO36F4~1.DLL acaptuser32.dll
SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\lymaqvdl.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - component: C:\Program Files (x86)\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 fbfmon;fbfmon;C:\windows\system32\drivers\fbfmon.sys --> C:\windows\system32\drivers\fbfmon.sys [?]
R0 LHDmgr;LHDmgr;C:\windows\system32\DRIVERS\LhdX64.sys --> C:\windows\system32\DRIVERS\LhdX64.sys [?]
R1 BPntDrv;BPntDrv;C:\windows\system32\drivers\BPntDrv.sys --> C:\windows\system32\drivers\BPntDrv.sys [?]
R1 SBRE;SBRE;C:\Windows\System32\drivers\SBREDrv.sys [2011-4-29 101720]
R1 SbTis;SbTis;C:\windows\system32\drivers\sbtis.sys --> C:\windows\system32\drivers\sbtis.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
R2 NeroRegInCDSrv;Nero Registry InCD Service;C:\Program Files (x86)\Nero\Tools\InCD\NBHRegInCDSrv.exe [2009-10-16 53560]
R2 Oasis2Service;Oasis2Service;C:\Program Files (x86)\DDNi\Oasis2Service 1.0\Oasis2Service.exe [2010-12-22 46080]
R2 PassThru Service;Internet Pass-Through Service;C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2010-9-16 80896]
R2 RtLedService;RtLedService Installer;C:\Program Files\Realtek\RtLED\RtLEDService.exe [2010-9-30 311296]
R2 SBAMSvc;VIPRE Antivirus;C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMSvc.exe [2011-5-11 2804280]
R2 sbapifs;sbapifs;C:\windows\system32\DRIVERS\sbapifs.sys --> C:\windows\system32\DRIVERS\sbapifs.sys [?]
R2 SBPIMSvc;SB Recovery Service;C:\Program Files (x86)\Sunbelt Software\VIPRE\SBPIMSvc.exe [2011-5-11 181584]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-6-8 2656280]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\windows\system32\DRIVERS\AcpiVpc.sys --> C:\windows\system32\DRIVERS\AcpiVpc.sys [?]
R3 BTWAMPFL;BTWAMPFL;C:\windows\system32\DRIVERS\btwampfl.sys --> C:\windows\system32\DRIVERS\btwampfl.sys [?]
R3 btwl2cap;Bluetooth L2CAP Service;C:\windows\system32\DRIVERS\btwl2cap.sys --> C:\windows\system32\DRIVERS\btwl2cap.sys [?]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\windows\system32\DRIVERS\clwvd.sys --> C:\windows\system32\DRIVERS\clwvd.sys [?]
R3 IntcDAud;Intel® Display Audio;C:\windows\system32\DRIVERS\IntcDAud.sys --> C:\windows\system32\DRIVERS\IntcDAud.sys [?]
R3 MEIx64;Intel® Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\windows\system32\DRIVERS\NETwNs64.sys --> C:\windows\system32\DRIVERS\NETwNs64.sys [?]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUVStor.sys --> C:\windows\system32\Drivers\RtsUVStor.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]
R3 vm331avs;Digital Camera 1;C:\windows\system32\Drivers\vm331avs.sys --> C:\windows\system32\Drivers\vm331avs.sys [?]
R3 vmuvcflt;Vimicro USB Camera Filter;C:\windows\system32\Drivers\vmuvcflt.sys --> C:\windows\system32\Drivers\vmuvcflt.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\windows\system32\DRIVERS\vwifimp.sys --> C:\windows\system32\DRIVERS\vwifimp.sys [?]
R3 wdkmd;Intel WiDi KMD;C:\windows\system32\DRIVERS\WDKMD.sys --> C:\windows\system32\DRIVERS\WDKMD.sys [?]
RUnknown 3020375drv;3020375drv; [x]
RUnknown 33070147;33070147; [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-6-8 136176]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\windows\system32\Drivers\ssadadb.sys --> C:\windows\system32\Drivers\ssadadb.sys [?]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-7-25 30192]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-6-8 136176]
S3 HTCAND64;HTC Device Driver;C:\windows\system32\Drivers\ANDROIDUSB.sys --> C:\windows\system32\Drivers\ANDROIDUSB.sys [?]
S3 htcnprot;HTC NDIS Protocol Driver;C:\windows\system32\DRIVERS\htcnprot.sys --> C:\windows\system32\DRIVERS\htcnprot.sys [?]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-1-21 30963576]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-11-2 340240]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\windows\system32\DRIVERS\ssadbus.sys --> C:\windows\system32\DRIVERS\ssadbus.sys [?]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\windows\system32\DRIVERS\ssadmdfl.sys --> C:\windows\system32\DRIVERS\ssadmdfl.sys [?]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\windows\system32\DRIVERS\ssadmdm.sys --> C:\windows\system32\DRIVERS\ssadmdm.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\system32\drivers\TsUsbGD.sys --> C:\windows\system32\drivers\TsUsbGD.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]
S3 WSDPrintDevice;WSD Print Support via UMB;C:\windows\system32\DRIVERS\WSDPrint.sys --> C:\windows\system32\DRIVERS\WSDPrint.sys [?]
S3 wsvd;wsvd;C:\windows\system32\DRIVERS\wsvd.sys --> C:\windows\system32\DRIVERS\wsvd.sys [?]
.
=============== Created Last 30 ================
.
2011-08-22 04:51:56 -------- d-----w- C:\ProgramData\Kaspersky Lab
2011-08-21 21:11:55 -------- d-----w- C:\Autoruns
2011-08-21 05:39:48 -------- d-----we C:\windows\system64
2011-08-20 22:22:16 -------- d-----w- C:\CONTACT_16X9_LB
2011-08-20 18:55:59 -------- d-----w- C:\Users\Stephen\AppData\Roaming\Malwarebytes
2011-08-20 18:55:26 41272 ----a-w- C:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-20 18:55:25 -------- d-----w- C:\ProgramData\Malwarebytes
2011-08-20 18:55:22 25912 ----a-w- C:\windows\System32\drivers\mbam.sys
2011-08-20 18:55:22 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-08-13 05:32:18 24416 ----a-r- C:\windows\System32\AdobePDFUI.dll
2011-08-13 05:29:54 112056 ----a-w- C:\windows\SysWow64\acaptuser32.dll
2011-08-11 05:25:32 -------- d-----w- C:\IN_THE_VALLEY_OF_ELAH
2011-08-11 04:24:31 -------- d-----w- C:\BUCKAROO
2011-08-11 03:58:07 -------- d-----w- C:\CHOCOLAT
2011-08-11 03:17:22 -------- d-----w- C:\FIGHTCLB
2011-08-11 02:26:48 -------- d-----w- C:\BLADE_RUNNER_16X9
2011-08-11 01:17:42 -------- d-----w- C:\Users\Stephen\AppData\Local\{ED9A4D25-65B6-4844-8077-619C512A96AB}
2011-08-11 01:11:35 -------- d-----w- C:\Users\Stephen\AppData\Local\{7BD15F4D-8B18-4A19-A3B2-D52336C97C50}
2011-08-11 01:10:18 -------- d-----w- C:\Users\Stephen\AppData\Local\{EDE0A923-6806-469A-8B2A-31192975ABF5}
2011-08-11 01:09:25 -------- d-----w- C:\Users\Stephen\AppData\Local\{53359677-D15F-4E22-AA32-422C4F0DB509}
2011-08-11 01:08:18 -------- d-----w- C:\Users\Stephen\AppData\Local\{F5C3860B-D9F6-4814-8039-41C6D15EA159}
2011-08-11 01:06:17 -------- d-----w- C:\Users\Stephen\AppData\Local\{C4D19035-5FFA-4748-B4C3-DA7023BF193A}
2011-08-11 01:05:36 -------- d-----w- C:\Users\Stephen\AppData\Local\{729CE3E1-F0C5-49AD-BC4B-026420C3A3C4}
2011-08-11 01:00:04 -------- d-----w- C:\Users\Stephen\AppData\Local\{C834BD3A-B936-4705-828D-3438B056CC41}
2011-08-11 00:45:21 -------- d-----w- C:\Users\Stephen\AppData\Local\{2B0368E7-0B1E-4A36-B09E-3DD8CE014EB5}
2011-08-11 00:42:19 -------- d-----w- C:\Users\Stephen\AppData\Local\{198D226D-BEF4-487B-A8CD-9178B65110BD}
2011-08-11 00:32:49 -------- d-----w- C:\Users\Stephen\AppData\Local\{3C5AA503-B8CC-4AA2-B340-F51A71343CB3}
2011-08-10 03:53:18 69464 ----a-w- C:\windows\SysWow64\XAPOFX1_3.dll
2011-08-10 03:53:18 515416 ----a-w- C:\windows\SysWow64\XAudio2_5.dll
2011-08-10 03:53:15 523088 ----a-w- C:\windows\System32\d3dx10_42.dll
2011-08-10 03:53:15 453456 ----a-w- C:\windows\SysWow64\d3dx10_42.dll
2011-08-10 03:53:08 4398360 ----a-w- C:\windows\System32\d3dx9_32.dll
2011-08-10 03:53:08 3426072 ----a-w- C:\windows\SysWow64\d3dx9_32.dll
2011-08-10 03:51:15 -------- d-----w- C:\Program Files\Microsoft IntelliType Pro
2011-08-10 03:49:08 -------- d-----w- C:\Users\Stephen\AppData\Local\Windows Live
2011-08-10 03:07:34 -------- d-----w- C:\Users\Stephen\AppData\Local\Intel Wireless Display
2011-08-10 03:02:47 -------- d-----w- C:\Users\Stephen\AppData\Local\CyberLink
2011-08-09 19:33:29 288768 ----a-w- C:\windows\System32\drivers\mrxsmb10.sys
2011-08-09 19:32:59 1923968 ----a-w- C:\windows\System32\drivers\tcpip.sys
2011-08-09 19:32:57 3912576 ----a-w- C:\windows\SysWow64\ntoskrnl.exe
2011-08-09 19:32:56 5561216 ----a-w- C:\windows\System32\ntoskrnl.exe
2011-08-09 19:32:56 3967872 ----a-w- C:\windows\SysWow64\ntkrnlpa.exe
2011-08-06 20:55:13 -------- d-----w- C:\ProgramData\dbg
2011-08-05 03:34:12 -------- d-----w- C:\Program Files\BOINC
2011-08-05 03:34:11 -------- d-----w- C:\ProgramData\BOINC
2011-08-05 03:32:55 -------- d-----w- C:\windows\Downloaded Installations
2011-08-04 17:58:30 -------- d-----w- C:\Users\Stephen\My Others
2011-08-04 17:58:30 -------- d-----w- C:\Users\Stephen\AppData\Roaming\ArcSyncConfig
2011-08-03 21:52:59 -------- d-----w- C:\Users\Stephen\AppData\Local\{78E49033-9401-404D-8F0B-1244FBBAF538}
2011-08-03 21:52:59 -------- d-----w- C:\Users\Stephen\AppData\Local\{14D39863-7007-47F5-B497-D722AD5A3383}
2011-07-29 21:45:25 -------- d-----w- C:\ProgramData\Sunbelt
2011-07-29 21:45:20 -------- d-----w- C:\Users\Stephen\AppData\Roaming\Sunbelt
2011-07-29 21:39:20 94296 ----a-w- C:\windows\System32\drivers\sbtis.sys
2011-07-29 21:39:20 55384 ----a-w- C:\windows\System32\drivers\sbredrv.sys
2011-07-29 21:39:20 45904 ----a-w- C:\windows\System32\sbbd.exe
2011-07-29 21:39:19 -------- d-----w- C:\Program Files (x86)\Sunbelt Software
2011-07-29 21:29:59 -------- d-----w- C:\Users\Stephen\AppData\Roaming\IrfanView
2011-07-29 21:29:54 -------- d-----w- C:\Program Files (x86)\IrfanView
2011-07-29 01:35:33 53248 ----a-r- C:\Users\Stephen\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-07-29 01:35:25 18960 ----a-w- C:\windows\System32\drivers\LNonPnP.sys
2011-07-29 01:33:49 -------- d-----w- C:\Users\Stephen\AppData\Roaming\Logishrd
2011-07-27 18:36:33 -------- d-----w- C:\Users\Stephen\AppData\Local\Apps
2011-07-27 18:10:30 -------- d-----w- C:\Users\Stephen\AppData\Roaming\magicJackOutlookAddIn
2011-07-27 04:05:39 119808 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\GoogleDesktopMozilla.dll
2011-07-27 04:04:41 52568 ----a-w- C:\windows\System32\AdobePDF.dll
2011-07-27 03:41:27 -------- d-----w- C:\Program Files (x86)\Common Files\Macrovision Shared
2011-07-27 03:24:32 -------- d-----w- C:\activation
2011-07-27 01:19:11 902656 ----a-w- C:\windows\System32\d2d1.dll
2011-07-27 01:19:11 739840 ----a-w- C:\windows\SysWow64\d2d1.dll
2011-07-27 01:19:11 1544192 ----a-w- C:\windows\System32\DWrite.dll
2011-07-27 01:19:11 1139200 ----a-w- C:\windows\System32\FntCache.dll
2011-07-27 01:19:11 1076736 ----a-w- C:\windows\SysWow64\DWrite.dll
2011-07-26 23:43:21 -------- d-----w- C:\V_FOR_VENDETTA
2011-07-26 23:18:57 -------- d-----w- C:\GLADIATOR
2011-07-26 23:07:31 737072 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-07-26 23:07:18 4283672 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-07-26 23:07:05 42776 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-07-26 23:07:02 539968 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-07-26 20:50:44 -------- d-----w- C:\SERENITY
2011-07-26 20:44:14 -------- d-----w- C:\Program Files (x86)\DVD Decrypter
2011-07-26 18:52:32 -------- d-----w- C:\Users\Stephen\AppData\Roaming\Thinstall
2011-07-26 16:41:18 14848 ----a-w- C:\windows\System32\Spool\prtprocs\x64\MIMFPR03.DLL
2011-07-26 15:16:53 -------- d-----r- C:\Program Files (x86)\Skype
2011-07-26 15:00:59 -------- d-----w- C:\Users\Stephen\AppData\Roaming\ooVoo Details
2011-07-26 14:50:38 -------- d-----w- C:\Users\Stephen\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
2011-07-26 14:50:28 -------- d-----w- C:\Users\Stephen\AppData\Roaming\HTC
2011-07-26 14:41:13 -------- d-----w- C:\Users\Stephen\AppData\Local\Downloaded Installations
2011-07-26 14:40:58 -------- d-----w- C:\Program Files (x86)\Spirent Communications
2011-07-26 14:40:46 -------- d-----w- C:\Program Files (x86)\HTC
2011-07-26 09:43:48 -------- d-sh--w- C:\Recovery
2011-07-26 04:43:02 -------- d-----w- C:\CCCFI
2011-07-26 04:39:46 -------- d-----w- C:\Users\Stephen\AppData\Local\WinZip Courier
2011-07-26 04:37:07 -------- d-----w- C:\Program Files\Common Files\Intuit
2011-07-26 04:30:48 -------- d-----w- C:\Users\Stephen\AppData\Local\tjnet
2011-07-26 04:09:38 -------- d-----w- C:\windows\SysWow64\Wat
2011-07-26 04:09:38 -------- d-----w- C:\windows\System32\Wat
2011-07-26 03:16:36 -------- d-----w- C:\Users\Stephen\AppData\Roaming\CompanionLink
2011-07-26 03:16:32 -------- d-----w- C:\Program Files (x86)\CompanionLink
2011-07-26 03:06:47 -------- d-----w- C:\Users\Stephen\AppData\Local\Intuit
2011-07-26 03:06:13 22040 ----a-w- C:\windows\System32\drivers\InCDRec.sys
2011-07-26 03:06:13 168984 ----a-w- C:\windows\System32\drivers\InCDFs.sys
2011-07-26 03:06:05 60952 ----a-w- C:\windows\System32\drivers\InCDPass.sys
2011-07-26 03:06:02 -------- d-----w- C:\Program Files\Nero
2011-07-26 03:06:02 -------- d-----w- C:\Program Files (x86)\Nero
2011-07-26 03:05:05 -------- d-----w- C:\Program Files (x86)\Common Files\supportsoft
2011-07-26 03:03:07 3833856 ----a-w- C:\windows\SysWow64\cdintf300.dll
2011-07-26 03:03:07 1843200 ----a-w- C:\windows\SysWow64\acXMLParser.dll
2011-07-26 03:01:38 -------- d-----w- C:\ProgramData\Intuit
2011-07-26 03:01:38 -------- d-----w- C:\Program Files (x86)\Intuit
2011-07-26 03:01:38 -------- d-----w- C:\Program Files (x86)\Common Files\Intuit
2011-07-26 02:59:53 -------- d-----w- C:\ProgramData\COMMON FILES
2011-07-26 02:59:49 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
2011-07-26 02:53:54 -------- d-----w- C:\Program Files (x86)\Akamai
2011-07-26 01:23:10 -------- d-----w- C:\FAX
2011-07-26 01:22:21 -------- d-----w- C:\ProgramData\WinZipEC
2011-07-26 01:22:20 -------- d-----w- C:\windows\CD95F661A5C411AFB2CCABCD21A325B4.TMP
2011-07-26 01:21:11 -------- d-----w- C:\Users\Stephen\AppData\Local\magicJack
2011-07-26 01:21:07 -------- d-----w- C:\ProgramData\magicJack
2011-07-26 01:20:53 -------- d-----w- C:\Users\Stephen\AppData\Roaming\mjusbsp
2011-07-26 01:19:11 -------- d-----w- C:\Users\Stephen\AppData\Local\WinZip
2011-07-26 01:05:32 -------- d-----w- C:\ProgramData\WEBREG
2011-07-26 01:05:22 -------- d-----w- C:\Users\Stephen\AppData\Local\HP
2011-07-26 01:04:16 249856 ----a-w- C:\windows\System32\Spool\prtprocs\x64\hpfpp092.dll
2011-07-26 01:02:57 -------- d-----w- C:\Program Files (x86)\Yahoo!
2011-07-26 01:00:40 -------- d-----w- C:\windows\SysWow64\spool
2011-07-26 00:59:19 -------- d-----w- C:\Program Files (x86)\Common Files\HP
2011-07-26 00:59:18 -------- d-----w- C:\Program Files (x86)\Common Files\Hewlett-Packard
2011-07-26 00:59:03 -------- d-----w- C:\windows\hpoj4500g510n-z
2011-07-26 00:58:24 902656 ----a-w- C:\windows\System32\hpwwiax9.dll
2011-07-26 00:58:24 742912 ----a-w- C:\windows\System32\hpwtscl5.dll
2011-07-26 00:58:24 551424 ----a-w- C:\windows\System32\hppldcoi.dll
2011-07-26 00:58:24 503296 ----a-w- C:\windows\System32\hpwvst01.dll
2011-07-26 00:58:19 642360 ----a-w- C:\windows\System32\hpzids40.dll
2011-07-26 00:58:15 136704 ----a-w- C:\windows\System32\hpf3l092.dll
2011-07-26 00:57:29 -------- d-----w- C:\Program Files (x86)\HP
2011-07-26 00:52:07 -------- d-----w- C:\Users\Stephen\AppData\Local\Adobe
2011-07-26 00:24:41 -------- d-----w- C:\Users\Stephen\AppData\Local\ElevatedDiagnostics
2011-07-25 23:48:15 404640 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-25 23:43:38 134104 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
2011-07-25 23:43:37 89048 ----a-w- C:\Program Files (x86)\Mozilla Firefox\libEGL.dll
2011-07-25 23:43:37 785368 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozsqlite3.dll
2011-07-25 23:43:37 478168 ----a-w- C:\Program Files (x86)\Mozilla Firefox\libGLESv2.dll
2011-07-25 23:43:37 2106216 ----a-w- C:\Program Files (x86)\Mozilla Firefox\D3DCompiler_43.dll
2011-07-25 23:43:37 1998168 ----a-w- C:\Program Files (x86)\Mozilla Firefox\d3dx9_43.dll
2011-07-25 23:43:37 1846232 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-07-25 23:43:37 15832 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozalloc.dll
2011-07-25 23:32:57 -------- d-----w- C:\Users\Stephen\AppData\Local\Mozilla
2011-07-25 22:59:06 204800 ------w- C:\windows\SysWow64\MPSMC__U.EXE
2011-07-25 22:59:05 172032 ------w- C:\windows\SysWow64\MSTMON_U.EXE
2011-07-25 22:59:05 1282048 ------w- C:\windows\SysWow64\MSTMON_U.DLL
2011-07-25 22:58:33 -------- d-----w- C:\Program Files (x86)\KONICA MINOLTA
2011-07-25 22:51:52 -------- d-----w- C:\Program Files (x86)\Microsoft Synchronization Services
2011-07-25 22:49:23 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8
2011-07-25 22:48:55 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services
2011-07-25 22:48:41 -------- d-----w- C:\Users\Stephen\AppData\Local\Microsoft Help
2011-07-25 22:23:26 -------- d--h--w- C:\windows\msdownld.tmp
2011-07-25 22:08:55 961024 ----a-w- C:\windows\System32\CPFilters.dll
2011-07-25 22:06:48 976896 ----a-w- C:\windows\System32\inetcomm.dll
2011-07-25 22:06:48 741376 ----a-w- C:\windows\SysWow64\inetcomm.dll
2011-07-25 22:06:35 90624 ----a-w- C:\windows\System32\drivers\bowser.sys
2011-07-25 21:55:46 -------- d-----w- C:\Users\Stephen\AppData\Local\Google
2011-07-25 21:53:55 -------- d-----w- C:\Users\Stephen\AppData\Local\Broadcom
2011-07-25 21:53:18 -------- d-----w- C:\Users\Stephen\AppData\Local\SRS Labs
2011-07-25 21:53:14 -------- d-----w- C:\ProgramData\Energy Management
2011-07-25 21:51:42 712976 ----a-w- C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
.
==================== Find3M ====================
.
2011-07-22 05:42:23 2303488 ----a-w- C:\windows\System32\jscript9.dll
2011-07-22 05:36:16 1389056 ----a-w- C:\windows\System32\wininet.dll
2011-07-22 05:32:40 2382848 ----a-w- C:\windows\System32\mshtml.tlb
2011-07-22 02:54:43 1797632 ----a-w- C:\windows\SysWow64\jscript9.dll
2011-07-22 02:48:26 1126912 ----a-w- C:\windows\SysWow64\wininet.dll
2011-07-22 02:44:36 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb
2011-07-16 05:41:50 362496 ----a-w- C:\windows\System32\wow64win.dll
2011-07-16 05:41:49 243200 ----a-w- C:\windows\System32\wow64.dll
2011-07-16 05:41:49 13312 ----a-w- C:\windows\System32\wow64cpu.dll
2011-07-16 05:39:10 16384 ----a-w- C:\windows\System32\ntvdm64.dll
2011-07-16 05:37:12 421888 ----a-w- C:\windows\System32\KernelBase.dll
2011-07-16 04:29:19 14336 ----a-w- C:\windows\SysWow64\ntvdm64.dll
2011-07-16 04:26:00 44032 ----a-w- C:\windows\apppatch\acwow64.dll
2011-07-16 04:25:37 25600 ----a-w- C:\windows\SysWow64\setup16.exe
2011-07-16 04:24:23 5120 ----a-w- C:\windows\SysWow64\wow32.dll
2011-07-16 04:24:22 272384 ----a-w- C:\windows\SysWow64\KernelBase.dll
2011-07-16 02:21:44 7680 ----a-w- C:\windows\SysWow64\instnm.exe
2011-07-16 02:21:41 2048 ----a-w- C:\windows\SysWow64\user.exe
2011-07-16 02:17:19 6144 ---ha-w- C:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:17:19 4608 ---ha-w- C:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:17:19 3584 ---ha-w- C:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:17:19 3072 ---ha-w- C:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2011-06-24 05:34:53 214528 ----a-w- C:\windows\System32\winsrv.dll
2011-06-24 05:25:49 338432 ----a-w- C:\windows\System32\conhost.exe
2011-06-15 10:02:23 212992 ----a-w- C:\windows\System32\odbctrac.dll
2011-06-15 10:02:23 163840 ----a-w- C:\windows\System32\odbccp32.dll
2011-06-15 10:02:23 106496 ----a-w- C:\windows\System32\odbccu32.dll
2011-06-15 10:02:23 106496 ----a-w- C:\windows\System32\odbccr32.dll
2011-06-15 08:55:19 86016 ----a-w- C:\windows\SysWow64\odbccu32.dll
2011-06-15 08:55:19 81920 ----a-w- C:\windows\SysWow64\odbccr32.dll
2011-06-15 08:55:19 319488 ----a-w- C:\windows\SysWow64\odbcjt32.dll
2011-06-15 08:55:19 163840 ----a-w- C:\windows\SysWow64\odbctrac.dll
2011-06-15 08:55:19 122880 ----a-w- C:\windows\SysWow64\odbccp32.dll
2011-06-13 16:50:14 1007792 ----a-w- C:\windows\boinc.scr
2011-06-11 03:07:25 3137536 ----a-w- C:\windows\System32\win32k.sys
2011-06-08 06:21:40 39008 ----a-w- C:\windows\System32\drivers\LhdX64.sys
2011-06-08 06:21:40 19872 ----a-w- C:\windows\System32\LenovoSDKEmSubSystem.dll
2011-06-08 06:21:37 29792 ----a-w- C:\windows\System32\drivers\AcpiVpc.sys
2011-06-08 06:10:24 279968 ----a-w- C:\windows\System32\LenovoSdk.OKTDLL.dll
2011-06-08 06:09:03 57952 ----a-w- C:\windows\System32\drivers\fbfmon.sys
2011-06-08 06:09:03 46176 ----a-w- C:\windows\System32\FbDefrag.exe
2011-06-08 06:09:03 15968 ----a-w- C:\windows\System32\NFbfmon.dll
2011-06-08 06:09:03 13408 ----a-w- C:\windows\System32\drivers\BPntDrv.sys
2011-06-08 05:55:18 951680 ----a-w- C:\windows\System32\drivers\ndis.sys
2011-06-04 02:53:58 1508 ----a-w- C:\windows\CONNNET.CMD
2011-05-24 11:42:55 404480 ----a-w- C:\windows\System32\umpnpmgr.dll
2011-05-24 10:40:05 64512 ----a-w- C:\windows\SysWow64\devobj.dll
2011-05-24 10:40:05 44544 ----a-w- C:\windows\SysWow64\devrtl.dll
2011-05-24 10:39:38 145920 ----a-w- C:\windows\SysWow64\cfgmgr32.dll
2011-05-24 10:37:54 252928 ----a-w- C:\windows\SysWow64\drvinst.exe
.
============= FINISH: 1:27:45.44 ===============

Attached Files



#5 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,600 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:01 PM

Posted 26 August 2011 - 01:00 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

Posted Image In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/415455 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

Posted Image If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#6 Trident18

Trident18
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:07:01 PM

Posted 26 August 2011 - 02:58 PM

Things seem to be OK, but I've had this happen before... it goes away and then reappears.
No redirects or notifications from Vipre- so that's good. Malwarebytes doesn't find anything on a quick scan.

Here's DDS. No GMER, as I have a 64bit system.

.
DDS (Ver_2011-06-23.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Stephen at 15:50:08 on 2011-08-26
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4010.983 [GMT -4:00]
.
AV: Sunbelt VIPRE *Enabled/Updated* {BE5DD172-7F42-7948-1A60-E6A720288F81}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Sunbelt VIPRE *Enabled/Updated* {053C3096-5978-76C6-20D0-DDD55BAFC53C}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\Program Files (x86)\Nero\Tools\InCD\InCDSrv.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\WLANExt.exe
C:\windows\system32\conhost.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Nero\Tools\InCD\NBHRegInCDSrv.exe
C:\windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
C:\windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files (x86)\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\wbem\unsecapp.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\svchost.exe -k HPService
C:\windows\system32\svchost.exe -k bthsvcs
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\system32\taskhost.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\BOINC\boinctray.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files\BOINC\boinc.exe
C:\windows\system32\conhost.exe
C:\windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\CompanionLink\CompanionLink.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files (x86)\USB Camera\VM331_STI.EXE
C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files (x86)\Nero\Tools\InCD\NBHGui.exe
C:\Program Files (x86)\Nero\Tools\InCD\InCD.exe
C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\windows\SysWOW64\RunDll32.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe
C:\windows\system32\DllHost.exe
C:\Program Files\Lenovo\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\DDNi\Oasis2Service 1.0\Oasis2Service.exe
C:\Program Files\Realtek\RtLED\RtLEDService.exe
C:\Program Files\Realtek\RtLED\RtLED.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\windows\system32\svchost.exe -k SDRSVC
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\windows\system32\SearchIndexer.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
C:\windows\splwow64.exe
C:\Windows\system32\WUDFHost.exe
C:\Users\Stephen\AppData\Roaming\mjusbsp\magicJack.exe
C:\windows\explorer.exe
C:\Program Files (x86)\HTC\HTC Sync 3.0\adb.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\windows\SysWOW64\cmd.exe
C:\windows\system32\conhost.exe
C:\windows\system32\DllHost.exe
C:\windows\SysWOW64\cscript.exe
C:\windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uWindow Title = Internet Explorer, optimized for Bing and MSN
mStart Page = hxxp://lenovo.msn.com
mWinlogon: Userinit=userinit.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [cdloader] "C:\Users\Stephen\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [CompanionLink] "c:\program files (x86)\companionlink\companionlink.exe" -Icon
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
mRun: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE
mRun: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
mRun: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
mRun: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
mRun: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
mRun: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
mRun: [NBHGui] C:\Program Files (x86)\Nero\Tools\InCD\NBHGui.exe
mRun: [InCD] C:\Program Files (x86)\Nero\Tools\InCD\InCD.exe
mRun: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
mRun: [<NO NAME>]
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
mRun: [SBAMTray] "C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe"
mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
StartupFolder: C:\Users\Stephen\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\Lenovo\Bluetooth Software\BTTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~1.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SRSPRE~1.LNK - C:\Program Files (x86)\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{1DF6B644-46D0-438F-BB33-338014F769BA} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{6DD73882-DDD6-4D38-BCEC-25CE20FA828B} : DhcpNameServer = 192.168.42.129
TCP: Interfaces\{73F51104-5D67-4967-8088-2EADFC2B319F} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{73F51104-5D67-4967-8088-2EADFC2B319F}\2454E4E49454 : DhcpNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - C:\Program Files (x86)\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\System32\mscoree.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
AppInit_DLLs: C:\PROGRA~2\Google\GOOGLE~3\GO36F4~1.DLL acaptuser32.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-X64: 0x1 - No File
BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO-X64: HP Print Enhancer - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: SmartSelect - No File
BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
BHO-X64: HP Smart BHO Class - No File
TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE
mRun-x64: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
mRun-x64: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
mRun-x64: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
mRun-x64: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
mRun-x64: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
mRun-x64: [NBHGui] C:\Program Files (x86)\Nero\Tools\InCD\NBHGui.exe
mRun-x64: [InCD] C:\Program Files (x86)\Nero\Tools\InCD\InCD.exe
mRun-x64: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
mRun-x64: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
mRun-x64: [(Default)]
mRun-x64: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
mRun-x64: [SBAMTray] "C:\Program Files (x86)\Sunbelt Software\VIPRE\SBAMTray.exe"
mRun-x64: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
AppInit_DLLs-X64: C:\PROGRA~2\Google\GOOGLE~3\GO36F4~1.DLL acaptuser32.dll
SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\lymaqvdl.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - component: C:\Program Files (x86)\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 fbfmon;fbfmon;C:\windows\system32\drivers\fbfmon.sys --> C:\windows\system32\drivers\fbfmon.sys [?]
R0 LHDmgr;LHDmgr;C:\windows\system32\DRIVERS\LhdX64.sys --> C:\windows\system32\DRIVERS\LhdX64.sys [?]
R1 BPntDrv;BPntDrv;C:\windows\system32\drivers\BPntDrv.sys --> C:\windows\system32\drivers\BPntDrv.sys [?]
R1 SBRE;SBRE;C:\Windows\System32\drivers\SBREDrv.sys [2011-4-29 101720]
R1 SbTis;SbTis;C:\windows\system32\drivers\sbtis.sys --> C:\windows\system32\drivers\sbtis.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
R2 sbapifs;sbapifs;C:\windows\system32\DRIVERS\sbapifs.sys --> C:\windows\system32\DRIVERS\sbapifs.sys [?]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\windows\system32\DRIVERS\AcpiVpc.sys --> C:\windows\system32\DRIVERS\AcpiVpc.sys [?]
R3 BTWAMPFL;BTWAMPFL;C:\windows\system32\DRIVERS\btwampfl.sys --> C:\windows\system32\DRIVERS\btwampfl.sys [?]
R3 btwl2cap;Bluetooth L2CAP Service;C:\windows\system32\DRIVERS\btwl2cap.sys --> C:\windows\system32\DRIVERS\btwl2cap.sys [?]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\windows\system32\DRIVERS\clwvd.sys --> C:\windows\system32\DRIVERS\clwvd.sys [?]
R3 IntcDAud;Intel® Display Audio;C:\windows\system32\DRIVERS\IntcDAud.sys --> C:\windows\system32\DRIVERS\IntcDAud.sys [?]
R3 MEIx64;Intel® Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\windows\system32\DRIVERS\NETwNs64.sys --> C:\windows\system32\DRIVERS\NETwNs64.sys [?]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUVStor.sys --> C:\windows\system32\Drivers\RtsUVStor.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]
R3 vm331avs;Digital Camera 1;C:\windows\system32\Drivers\vm331avs.sys --> C:\windows\system32\Drivers\vm331avs.sys [?]
R3 vmuvcflt;Vimicro USB Camera Filter;C:\windows\system32\Drivers\vmuvcflt.sys --> C:\windows\system32\Drivers\vmuvcflt.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\windows\system32\DRIVERS\vwifimp.sys --> C:\windows\system32\DRIVERS\vwifimp.sys [?]
R3 wdkmd;Intel WiDi KMD;C:\windows\system32\DRIVERS\WDKMD.sys --> C:\windows\system32\DRIVERS\WDKMD.sys [?]
R3 WSDPrintDevice;WSD Print Support via UMB;C:\windows\system32\DRIVERS\WSDPrint.sys --> C:\windows\system32\DRIVERS\WSDPrint.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\windows\system32\Drivers\ssadadb.sys --> C:\windows\system32\Drivers\ssadadb.sys [?]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-7-25 30192]
S3 HTCAND64;HTC Device Driver;C:\windows\system32\Drivers\ANDROIDUSB.sys --> C:\windows\system32\Drivers\ANDROIDUSB.sys [?]
S3 htcnprot;HTC NDIS Protocol Driver;C:\windows\system32\DRIVERS\htcnprot.sys --> C:\windows\system32\DRIVERS\htcnprot.sys [?]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\windows\system32\DRIVERS\ssadbus.sys --> C:\windows\system32\DRIVERS\ssadbus.sys [?]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\windows\system32\DRIVERS\ssadmdfl.sys --> C:\windows\system32\DRIVERS\ssadmdfl.sys [?]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\windows\system32\DRIVERS\ssadmdm.sys --> C:\windows\system32\DRIVERS\ssadmdm.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\system32\drivers\TsUsbGD.sys --> C:\windows\system32\drivers\TsUsbGD.sys [?]
S3 wsvd;wsvd;C:\windows\system32\DRIVERS\wsvd.sys --> C:\windows\system32\DRIVERS\wsvd.sys [?]
.
=============== Created Last 30 ================
.
2011-08-23 21:55:37 2048 ----a-w- C:\windows\SysWow64\tzres.dll
2011-08-23 21:55:37 2048 ----a-w- C:\windows\System32\tzres.dll
2011-08-22 21:59:29 -------- d-----w- C:\Program Files (x86)\Microsoft Synchronization Services
2011-08-22 21:58:50 -------- d-----w- C:\windows\PCHEALTH
2011-08-22 21:58:50 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2011-08-22 21:56:11 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8
2011-08-22 21:55:24 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services
2011-08-22 19:02:26 257024 ----a-w- C:\Users\Stephen\taskmgr.exe
2011-08-22 04:51:56 -------- d-----w- C:\ProgramData\Kaspersky Lab
2011-08-21 21:11:55 -------- d-----w- C:\Autoruns
2011-08-21 05:39:48 -------- d-----we C:\windows\system64
2011-08-20 22:22:16 -------- d-----w- C:\CONTACT_16X9_LB
2011-08-20 18:55:59 -------- d-----w- C:\Users\Stephen\AppData\Roaming\Malwarebytes
2011-08-20 18:55:26 41272 ----a-w- C:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-20 18:55:25 -------- d-----w- C:\ProgramData\Malwarebytes
2011-08-20 18:55:22 25912 ----a-w- C:\windows\System32\drivers\mbam.sys
2011-08-20 18:55:22 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-08-13 05:32:18 24416 ----a-r- C:\windows\System32\AdobePDFUI.dll
2011-08-13 05:29:54 112056 ----a-w- C:\windows\SysWow64\acaptuser32.dll
2011-08-11 05:25:32 -------- d-----w- C:\IN_THE_VALLEY_OF_ELAH
2011-08-11 04:24:31 -------- d-----w- C:\BUCKAROO
2011-08-11 03:58:07 -------- d-----w- C:\CHOCOLAT
2011-08-11 03:17:22 -------- d-----w- C:\FIGHTCLB
2011-08-11 02:26:48 -------- d-----w- C:\BLADE_RUNNER_16X9
2011-08-11 01:17:42 -------- d-----w- C:\Users\Stephen\AppData\Local\{ED9A4D25-65B6-4844-8077-619C512A96AB}
2011-08-11 01:11:35 -------- d-----w- C:\Users\Stephen\AppData\Local\{7BD15F4D-8B18-4A19-A3B2-D52336C97C50}
2011-08-11 01:10:18 -------- d-----w- C:\Users\Stephen\AppData\Local\{EDE0A923-6806-469A-8B2A-31192975ABF5}
2011-08-11 01:09:25 -------- d-----w- C:\Users\Stephen\AppData\Local\{53359677-D15F-4E22-AA32-422C4F0DB509}
2011-08-11 01:08:18 -------- d-----w- C:\Users\Stephen\AppData\Local\{F5C3860B-D9F6-4814-8039-41C6D15EA159}
2011-08-11 01:06:17 -------- d-----w- C:\Users\Stephen\AppData\Local\{C4D19035-5FFA-4748-B4C3-DA7023BF193A}
2011-08-11 01:05:36 -------- d-----w- C:\Users\Stephen\AppData\Local\{729CE3E1-F0C5-49AD-BC4B-026420C3A3C4}
2011-08-11 01:00:04 -------- d-----w- C:\Users\Stephen\AppData\Local\{C834BD3A-B936-4705-828D-3438B056CC41}
2011-08-11 00:45:21 -------- d-----w- C:\Users\Stephen\AppData\Local\{2B0368E7-0B1E-4A36-B09E-3DD8CE014EB5}
2011-08-11 00:42:19 -------- d-----w- C:\Users\Stephen\AppData\Local\{198D226D-BEF4-487B-A8CD-9178B65110BD}
2011-08-11 00:32:49 -------- d-----w- C:\Users\Stephen\AppData\Local\{3C5AA503-B8CC-4AA2-B340-F51A71343CB3}
2011-08-10 03:53:18 69464 ----a-w- C:\windows\SysWow64\XAPOFX1_3.dll
2011-08-10 03:53:18 515416 ----a-w- C:\windows\SysWow64\XAudio2_5.dll
2011-08-10 03:53:15 523088 ----a-w- C:\windows\System32\d3dx10_42.dll
2011-08-10 03:53:15 453456 ----a-w- C:\windows\SysWow64\d3dx10_42.dll
2011-08-10 03:53:08 4398360 ----a-w- C:\windows\System32\d3dx9_32.dll
2011-08-10 03:53:08 3426072 ----a-w- C:\windows\SysWow64\d3dx9_32.dll
2011-08-10 03:51:15 -------- d-----w- C:\Program Files\Microsoft IntelliType Pro
2011-08-10 03:49:08 -------- d-----w- C:\Users\Stephen\AppData\Local\Windows Live
2011-08-10 03:07:34 -------- d-----w- C:\Users\Stephen\AppData\Local\Intel Wireless Display
2011-08-10 03:02:47 -------- d-----w- C:\Users\Stephen\AppData\Local\CyberLink
2011-08-09 19:33:29 288768 ----a-w- C:\windows\System32\drivers\mrxsmb10.sys
2011-08-09 19:32:59 1923968 ----a-w- C:\windows\System32\drivers\tcpip.sys
2011-08-09 19:32:57 3912576 ----a-w- C:\windows\SysWow64\ntoskrnl.exe
2011-08-09 19:32:56 5561216 ----a-w- C:\windows\System32\ntoskrnl.exe
2011-08-09 19:32:56 3967872 ----a-w- C:\windows\SysWow64\ntkrnlpa.exe
2011-08-06 20:55:13 -------- d-----w- C:\ProgramData\dbg
2011-08-05 03:34:12 -------- d-----w- C:\Program Files\BOINC
2011-08-05 03:34:11 -------- d-----w- C:\ProgramData\BOINC
2011-08-05 03:32:55 -------- d-----w- C:\windows\Downloaded Installations
2011-08-04 17:58:30 -------- d-----w- C:\Users\Stephen\My Others
2011-08-04 17:58:30 -------- d-----w- C:\Users\Stephen\AppData\Roaming\ArcSyncConfig
2011-08-03 21:52:59 -------- d-----w- C:\Users\Stephen\AppData\Local\{78E49033-9401-404D-8F0B-1244FBBAF538}
2011-08-03 21:52:59 -------- d-----w- C:\Users\Stephen\AppData\Local\{14D39863-7007-47F5-B497-D722AD5A3383}
2011-07-29 21:45:25 -------- d-----w- C:\ProgramData\Sunbelt
2011-07-29 21:45:20 -------- d-----w- C:\Users\Stephen\AppData\Roaming\Sunbelt
2011-07-29 21:39:20 94296 ----a-w- C:\windows\System32\drivers\sbtis.sys
2011-07-29 21:39:20 55384 ----a-w- C:\windows\System32\drivers\sbredrv.sys
2011-07-29 21:39:20 45904 ----a-w- C:\windows\System32\sbbd.exe
2011-07-29 21:39:19 -------- d-----w- C:\Program Files (x86)\Sunbelt Software
2011-07-29 21:29:59 -------- d-----w- C:\Users\Stephen\AppData\Roaming\IrfanView
2011-07-29 21:29:54 -------- d-----w- C:\Program Files (x86)\IrfanView
2011-07-29 01:35:33 53248 ----a-r- C:\Users\Stephen\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-07-29 01:35:25 18960 ----a-w- C:\windows\System32\drivers\LNonPnP.sys
2011-07-29 01:33:49 -------- d-----w- C:\Users\Stephen\AppData\Roaming\Logishrd
.
==================== Find3M ====================
.
2011-08-19 12:43:12 404640 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-22 05:42:23 2303488 ----a-w- C:\windows\System32\jscript9.dll
2011-07-22 05:36:16 1389056 ----a-w- C:\windows\System32\wininet.dll
2011-07-22 05:32:40 2382848 ----a-w- C:\windows\System32\mshtml.tlb
2011-07-22 02:54:43 1797632 ----a-w- C:\windows\SysWow64\jscript9.dll
2011-07-22 02:48:26 1126912 ----a-w- C:\windows\SysWow64\wininet.dll
2011-07-22 02:44:36 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb
2011-07-16 05:41:50 362496 ----a-w- C:\windows\System32\wow64win.dll
2011-07-16 05:41:49 243200 ----a-w- C:\windows\System32\wow64.dll
2011-07-16 05:41:49 13312 ----a-w- C:\windows\System32\wow64cpu.dll
2011-07-16 05:39:10 16384 ----a-w- C:\windows\System32\ntvdm64.dll
2011-07-16 05:37:12 421888 ----a-w- C:\windows\System32\KernelBase.dll
2011-07-16 04:29:19 14336 ----a-w- C:\windows\SysWow64\ntvdm64.dll
2011-07-16 04:26:00 44032 ----a-w- C:\windows\apppatch\acwow64.dll
2011-07-16 04:25:37 25600 ----a-w- C:\windows\SysWow64\setup16.exe
2011-07-16 04:24:23 5120 ----a-w- C:\windows\SysWow64\wow32.dll
2011-07-16 04:24:22 272384 ----a-w- C:\windows\SysWow64\KernelBase.dll
2011-07-16 02:21:44 7680 ----a-w- C:\windows\SysWow64\instnm.exe
2011-07-16 02:21:41 2048 ----a-w- C:\windows\SysWow64\user.exe
2011-07-16 02:17:19 6144 ---ha-w- C:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:17:19 4608 ---ha-w- C:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:17:19 3584 ---ha-w- C:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:17:19 3072 ---ha-w- C:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2011-06-24 05:34:53 214528 ----a-w- C:\windows\System32\winsrv.dll
2011-06-24 05:25:49 338432 ----a-w- C:\windows\System32\conhost.exe
2011-06-15 10:02:23 212992 ----a-w- C:\windows\System32\odbctrac.dll
2011-06-15 10:02:23 163840 ----a-w- C:\windows\System32\odbccp32.dll
2011-06-15 10:02:23 106496 ----a-w- C:\windows\System32\odbccu32.dll
2011-06-15 10:02:23 106496 ----a-w- C:\windows\System32\odbccr32.dll
2011-06-15 08:55:19 86016 ----a-w- C:\windows\SysWow64\odbccu32.dll
2011-06-15 08:55:19 81920 ----a-w- C:\windows\SysWow64\odbccr32.dll
2011-06-15 08:55:19 319488 ----a-w- C:\windows\SysWow64\odbcjt32.dll
2011-06-15 08:55:19 163840 ----a-w- C:\windows\SysWow64\odbctrac.dll
2011-06-15 08:55:19 122880 ----a-w- C:\windows\SysWow64\odbccp32.dll
2011-06-13 16:50:14 1007792 ----a-w- C:\windows\boinc.scr
2011-06-11 03:07:25 3137536 ----a-w- C:\windows\System32\win32k.sys
2011-06-08 06:21:40 39008 ----a-w- C:\windows\System32\drivers\LhdX64.sys
2011-06-08 06:21:40 19872 ----a-w- C:\windows\System32\LenovoSDKEmSubSystem.dll
2011-06-08 06:21:37 29792 ----a-w- C:\windows\System32\drivers\AcpiVpc.sys
2011-06-08 06:10:24 279968 ----a-w- C:\windows\System32\LenovoSdk.OKTDLL.dll
2011-06-08 06:09:03 57952 ----a-w- C:\windows\System32\drivers\fbfmon.sys
2011-06-08 06:09:03 46176 ----a-w- C:\windows\System32\FbDefrag.exe
2011-06-08 06:09:03 15968 ----a-w- C:\windows\System32\NFbfmon.dll
2011-06-08 06:09:03 13408 ----a-w- C:\windows\System32\drivers\BPntDrv.sys
2011-06-08 05:55:18 951680 ----a-w- C:\windows\System32\drivers\ndis.sys
2011-06-04 02:53:58 1508 ----a-w- C:\windows\CONNNET.CMD
.
============= FINISH: 15:51:44.93 ===============

Attached Files



#7 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:01 AM

Posted 27 August 2011 - 09:01 AM

Hello Trident18,

Apologies for the delay. I will be assisting you.

Please download TDSSKiller.zip and and extract it.
  • Run TDSSKiller.exe.
  • Click Start scan.
  • When it is finished the utility outputs a list of detected objects with description.
    The utility automatically selects an action (Cure or Delete) for malicious objects.
    The utility prompts the user to select an action to apply to suspicious objects (Skip, by default). Let the options as it is and click Continue
  • Let reboot if needed and tell me if the tool needed a reboot.
  • Click on Report and post the contents of the text file that will open.

    Note: By default, the utility outputs the log into system disk (it is usually the disk with installed operating system, C:\) root folder. The Log have a name like: TDSSKiller.Version_Date_Time_log.txt.


#8 Trident18

Trident18
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:07:01 PM

Posted 27 August 2011 - 09:14 AM

Hello Trident18,

Apologies for the delay. I will be assisting you.

Please download TDSSKiller.zip and and extract it.

  • Run TDSSKiller.exe.
  • Click Start scan.
  • When it is finished the utility outputs a list of detected objects with description.
    The utility automatically selects an action (Cure or Delete) for malicious objects.
    The utility prompts the user to select an action to apply to suspicious objects (Skip, by default). Let the options as it is and click Continue
  • Let reboot if needed and tell me if the tool needed a reboot.
  • Click on Report and post the contents of the text file that will open.

    Note: By default, the utility outputs the log into system disk (it is usually the disk with installed operating system, C:\) root folder. The Log have a name like: TDSSKiller.Version_Date_Time_log.txt.

Ran it. No threats found.

2011/08/27 10:12:26.0057 7988 TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57
2011/08/27 10:12:26.0416 7988 ================================================================================
2011/08/27 10:12:26.0416 7988 SystemInfo:
2011/08/27 10:12:26.0416 7988
2011/08/27 10:12:26.0416 7988 OS Version: 6.1.7601 ServicePack: 1.0
2011/08/27 10:12:26.0416 7988 Product type: Workstation
2011/08/27 10:12:26.0416 7988 ComputerName: STEPHEN-PC
2011/08/27 10:12:26.0416 7988 UserName: Stephen
2011/08/27 10:12:26.0416 7988 Windows directory: C:\windows
2011/08/27 10:12:26.0416 7988 System windows directory: C:\windows
2011/08/27 10:12:26.0416 7988 Running under WOW64
2011/08/27 10:12:26.0416 7988 Processor architecture: Intel x64
2011/08/27 10:12:26.0416 7988 Number of processors: 4
2011/08/27 10:12:26.0416 7988 Page size: 0x1000
2011/08/27 10:12:26.0416 7988 Boot type: Normal boot
2011/08/27 10:12:26.0416 7988 ================================================================================
2011/08/27 10:12:26.0962 7988 Initialize success
2011/08/27 10:12:30.0909 2072 ================================================================================
2011/08/27 10:12:30.0909 2072 Scan started
2011/08/27 10:12:30.0909 2072 Mode: Manual;
2011/08/27 10:12:30.0909 2072 ================================================================================
2011/08/27 10:12:31.0330 2072 1394ohci (a87d604aea360176311474c87a63bb88) C:\windows\system32\drivers\1394ohci.sys
2011/08/27 10:12:31.0439 2072 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\windows\system32\drivers\ACPI.sys
2011/08/27 10:12:31.0502 2072 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\windows\system32\drivers\acpipmi.sys
2011/08/27 10:12:31.0626 2072 ACPIVPC (5bbff8b826ec38d32c26334e079c7efc) C:\windows\system32\DRIVERS\AcpiVpc.sys
2011/08/27 10:12:31.0782 2072 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\windows\system32\drivers\adp94xx.sys
2011/08/27 10:12:31.0829 2072 adpahci (597f78224ee9224ea1a13d6350ced962) C:\windows\system32\drivers\adpahci.sys
2011/08/27 10:12:31.0860 2072 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\windows\system32\drivers\adpu320.sys
2011/08/27 10:12:31.0938 2072 AFD (d5b031c308a409a0a576bff4cf083d30) C:\windows\system32\drivers\afd.sys
2011/08/27 10:12:31.0985 2072 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\windows\system32\drivers\agp440.sys
2011/08/27 10:12:32.0032 2072 aliide (5812713a477a3ad7363c7438ca2ee038) C:\windows\system32\drivers\aliide.sys
2011/08/27 10:12:32.0063 2072 amdide (1ff8b4431c353ce385c875f194924c0c) C:\windows\system32\drivers\amdide.sys
2011/08/27 10:12:32.0110 2072 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\windows\system32\drivers\amdk8.sys
2011/08/27 10:12:32.0141 2072 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\windows\system32\drivers\amdppm.sys
2011/08/27 10:12:32.0204 2072 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\windows\system32\drivers\amdsata.sys
2011/08/27 10:12:32.0219 2072 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\windows\system32\drivers\amdsbs.sys
2011/08/27 10:12:32.0250 2072 amdxata (540daf1cea6094886d72126fd7c33048) C:\windows\system32\drivers\amdxata.sys
2011/08/27 10:12:32.0313 2072 androidusb (4de0d5d747a73797c95a97dcce5018b5) C:\windows\system32\Drivers\ssadadb.sys
2011/08/27 10:12:32.0375 2072 AppID (89a69c3f2f319b43379399547526d952) C:\windows\system32\drivers\appid.sys
2011/08/27 10:12:32.0438 2072 arc (c484f8ceb1717c540242531db7845c4e) C:\windows\system32\drivers\arc.sys
2011/08/27 10:12:32.0453 2072 arcsas (019af6924aefe7839f61c830227fe79c) C:\windows\system32\drivers\arcsas.sys
2011/08/27 10:12:32.0516 2072 AsyncMac (769765ce2cc62867468cea93969b2242) C:\windows\system32\DRIVERS\asyncmac.sys
2011/08/27 10:12:32.0578 2072 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\windows\system32\drivers\atapi.sys
2011/08/27 10:12:32.0703 2072 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\windows\system32\drivers\bxvbda.sys
2011/08/27 10:12:32.0796 2072 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\windows\system32\DRIVERS\b57nd60a.sys
2011/08/27 10:12:32.0968 2072 Beep (16a47ce2decc9b099349a5f840654746) C:\windows\system32\drivers\Beep.sys
2011/08/27 10:12:33.0046 2072 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\windows\system32\DRIVERS\blbdrive.sys
2011/08/27 10:12:33.0108 2072 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\windows\system32\DRIVERS\bowser.sys
2011/08/27 10:12:33.0155 2072 BPntDrv (aaa4f992f879977a000fe8b8c730cd2c) C:\windows\system32\drivers\BPntDrv.sys
2011/08/27 10:12:33.0233 2072 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\windows\system32\drivers\BrFiltLo.sys
2011/08/27 10:12:33.0249 2072 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\windows\system32\drivers\BrFiltUp.sys
2011/08/27 10:12:33.0280 2072 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\windows\System32\Drivers\Brserid.sys
2011/08/27 10:12:33.0311 2072 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\windows\System32\Drivers\BrSerWdm.sys
2011/08/27 10:12:33.0327 2072 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\windows\System32\Drivers\BrUsbMdm.sys
2011/08/27 10:12:33.0327 2072 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\windows\System32\Drivers\BrUsbSer.sys
2011/08/27 10:12:33.0389 2072 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\windows\system32\drivers\BthEnum.sys
2011/08/27 10:12:33.0452 2072 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\windows\system32\drivers\bthmodem.sys
2011/08/27 10:12:33.0514 2072 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\windows\system32\DRIVERS\bthpan.sys
2011/08/27 10:12:33.0576 2072 BTHPORT (64c198198501f7560ee41d8d1efa7952) C:\windows\System32\Drivers\BTHport.sys
2011/08/27 10:12:33.0623 2072 BTHUSB (f188b7394d81010767b6df3178519a37) C:\windows\System32\Drivers\BTHUSB.sys
2011/08/27 10:12:33.0795 2072 BTWAMPFL (a0dfb69ade3444c78b17636fcf28e898) C:\windows\system32\DRIVERS\btwampfl.sys
2011/08/27 10:12:33.0888 2072 btwaudio (7cf028ce78696882b327ff13d2dfa534) C:\windows\system32\drivers\btwaudio.sys
2011/08/27 10:12:33.0951 2072 btwavdt (3def2370e414b4e299673558ba171a51) C:\windows\system32\DRIVERS\btwavdt.sys
2011/08/27 10:12:33.0998 2072 btwl2cap (346b4051b3d7ff70e8f027869b8eca6e) C:\windows\system32\DRIVERS\btwl2cap.sys
2011/08/27 10:12:34.0029 2072 btwrchid (9937e0e4dfc0030560a6dfe9d3a94b39) C:\windows\system32\DRIVERS\btwrchid.sys
2011/08/27 10:12:34.0060 2072 cdfs (b8bd2bb284668c84865658c77574381a) C:\windows\system32\DRIVERS\cdfs.sys
2011/08/27 10:12:34.0107 2072 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\windows\system32\DRIVERS\cdrom.sys
2011/08/27 10:12:34.0169 2072 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\windows\system32\drivers\circlass.sys
2011/08/27 10:12:34.0232 2072 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\windows\system32\CLFS.sys
2011/08/27 10:12:34.0403 2072 clwvd (50f92c943f18b070f166d019dfab3d9a) C:\windows\system32\DRIVERS\clwvd.sys
2011/08/27 10:12:34.0450 2072 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\windows\system32\DRIVERS\CmBatt.sys
2011/08/27 10:12:34.0481 2072 cmdide (e19d3f095812725d88f9001985b94edd) C:\windows\system32\drivers\cmdide.sys
2011/08/27 10:12:34.0528 2072 CNG (d5fea92400f12412b3922087c09da6a5) C:\windows\system32\Drivers\cng.sys
2011/08/27 10:12:34.0575 2072 Compbatt (102de219c3f61415f964c88e9085ad14) C:\windows\system32\drivers\compbatt.sys
2011/08/27 10:12:34.0606 2072 CompositeBus (03edb043586cceba243d689bdda370a8) C:\windows\system32\DRIVERS\CompositeBus.sys
2011/08/27 10:12:34.0653 2072 crcdisk (1c827878a998c18847245fe1f34ee597) C:\windows\system32\drivers\crcdisk.sys
2011/08/27 10:12:34.0700 2072 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\windows\system32\Drivers\dfsc.sys
2011/08/27 10:12:34.0715 2072 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\windows\system32\drivers\discache.sys
2011/08/27 10:12:34.0809 2072 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\windows\system32\drivers\disk.sys
2011/08/27 10:12:34.0902 2072 drmkaud (9b19f34400d24df84c858a421c205754) C:\windows\system32\drivers\drmkaud.sys
2011/08/27 10:12:34.0949 2072 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\windows\System32\drivers\dxgkrnl.sys
2011/08/27 10:12:35.0074 2072 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\windows\system32\drivers\evbda.sys
2011/08/27 10:12:35.0183 2072 elxstor (0e5da5369a0fcaea12456dd852545184) C:\windows\system32\drivers\elxstor.sys
2011/08/27 10:12:35.0199 2072 ErrDev (34a3c54752046e79a126e15c51db409b) C:\windows\system32\drivers\errdev.sys
2011/08/27 10:12:35.0292 2072 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\windows\system32\drivers\exfat.sys
2011/08/27 10:12:35.0339 2072 fastfat (0adc83218b66a6db380c330836f3e36d) C:\windows\system32\drivers\fastfat.sys
2011/08/27 10:12:35.0386 2072 fbfmon (3191aca33088ee2481044fc0db736442) C:\windows\system32\drivers\fbfmon.sys
2011/08/27 10:12:35.0433 2072 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\windows\system32\drivers\fdc.sys
2011/08/27 10:12:35.0511 2072 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\windows\system32\drivers\fileinfo.sys
2011/08/27 10:12:35.0558 2072 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\windows\system32\drivers\filetrace.sys
2011/08/27 10:12:35.0636 2072 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\windows\system32\drivers\flpydisk.sys
2011/08/27 10:12:35.0682 2072 FltMgr (da6b67270fd9db3697b20fce94950741) C:\windows\system32\drivers\fltmgr.sys
2011/08/27 10:12:35.0714 2072 FsDepends (d43703496149971890703b4b1b723eac) C:\windows\system32\drivers\FsDepends.sys
2011/08/27 10:12:35.0745 2072 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\windows\system32\drivers\Fs_Rec.sys
2011/08/27 10:12:35.0760 2072 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\windows\system32\DRIVERS\fvevol.sys
2011/08/27 10:12:35.0807 2072 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\windows\system32\drivers\gagp30kx.sys
2011/08/27 10:12:35.0885 2072 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\windows\system32\drivers\hcw85cir.sys
2011/08/27 10:12:35.0916 2072 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\windows\system32\drivers\HdAudio.sys
2011/08/27 10:12:36.0026 2072 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\windows\system32\DRIVERS\HDAudBus.sys
2011/08/27 10:12:36.0057 2072 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\windows\system32\drivers\HidBatt.sys
2011/08/27 10:12:36.0072 2072 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\windows\system32\drivers\hidbth.sys
2011/08/27 10:12:36.0119 2072 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\windows\system32\drivers\hidir.sys
2011/08/27 10:12:36.0150 2072 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\windows\system32\DRIVERS\hidusb.sys
2011/08/27 10:12:36.0197 2072 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\windows\system32\drivers\HpSAMD.sys
2011/08/27 10:12:36.0244 2072 HTCAND64 (f47cec45fb85791d4ab237563ad0fa8f) C:\windows\system32\Drivers\ANDROIDUSB.sys
2011/08/27 10:12:36.0291 2072 htcnprot (b8b1b284362e1d8135112573395d5da5) C:\windows\system32\DRIVERS\htcnprot.sys
2011/08/27 10:12:36.0353 2072 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\windows\system32\drivers\HTTP.sys
2011/08/27 10:12:36.0384 2072 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\windows\system32\drivers\hwpolicy.sys
2011/08/27 10:12:36.0400 2072 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\windows\system32\DRIVERS\i8042prt.sys
2011/08/27 10:12:36.0447 2072 iaStor (53cc5bf8b5a219119953c7abb19a7705) C:\windows\system32\DRIVERS\iaStor.sys
2011/08/27 10:12:36.0540 2072 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\windows\system32\drivers\iaStorV.sys
2011/08/27 10:12:36.0852 2072 igfx (795c99dc4f574c97c03d0bb39cf099ee) C:\windows\system32\DRIVERS\igdkmd64.sys
2011/08/27 10:12:36.0977 2072 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\windows\system32\drivers\iirsp.sys
2011/08/27 10:12:37.0086 2072 InCDFs (3eb21c4bf2cf274b547a397d140dab99) C:\windows\system32\DRIVERS\InCDFs.sys
2011/08/27 10:12:37.0118 2072 InCDPass (0a88f26aa60e1952301eaf2558e07617) C:\windows\system32\DRIVERS\InCDPass.sys
2011/08/27 10:12:37.0133 2072 InCDRec (58455b0f5adfd73aef55084f8afe0f74) C:\windows\system32\DRIVERS\InCDRec.sys
2011/08/27 10:12:37.0320 2072 IntcAzAudAddService (a9853214cc97796579d75b1f59c51dcd) C:\windows\system32\drivers\RTKVHD64.sys
2011/08/27 10:12:37.0414 2072 IntcDAud (fc727061c0f47c8059e88e05d5c8e381) C:\windows\system32\DRIVERS\IntcDAud.sys
2011/08/27 10:12:37.0476 2072 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\windows\system32\drivers\intelide.sys
2011/08/27 10:12:37.0508 2072 intelppm (ada036632c664caa754079041cf1f8c1) C:\windows\system32\DRIVERS\intelppm.sys
2011/08/27 10:12:37.0601 2072 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\windows\system32\DRIVERS\ipfltdrv.sys
2011/08/27 10:12:37.0632 2072 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\windows\system32\drivers\IPMIDrv.sys
2011/08/27 10:12:37.0648 2072 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\windows\system32\drivers\ipnat.sys
2011/08/27 10:12:37.0679 2072 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\windows\system32\drivers\irenum.sys
2011/08/27 10:12:37.0695 2072 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\windows\system32\drivers\isapnp.sys
2011/08/27 10:12:37.0742 2072 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\windows\system32\drivers\msiscsi.sys
2011/08/27 10:12:37.0773 2072 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\windows\system32\DRIVERS\kbdclass.sys
2011/08/27 10:12:37.0804 2072 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\windows\system32\DRIVERS\kbdhid.sys
2011/08/27 10:12:37.0835 2072 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\windows\system32\Drivers\ksecdd.sys
2011/08/27 10:12:37.0866 2072 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\windows\system32\Drivers\ksecpkg.sys
2011/08/27 10:12:37.0898 2072 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\windows\system32\drivers\ksthunk.sys
2011/08/27 10:12:38.0038 2072 LHDmgr (be166935083f9c38edfdc21b9a7a679b) C:\windows\system32\DRIVERS\LhdX64.sys
2011/08/27 10:12:38.0100 2072 LHidFilt (1074c77a47835e03c15bf92452f9a750) C:\windows\system32\DRIVERS\LHidFilt.Sys
2011/08/27 10:12:38.0178 2072 lltdio (1538831cf8ad2979a04c423779465827) C:\windows\system32\DRIVERS\lltdio.sys
2011/08/27 10:12:38.0241 2072 LMouFilt (96999c364c649e2866a268f7420a304a) C:\windows\system32\DRIVERS\LMouFilt.Sys
2011/08/27 10:12:38.0288 2072 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\windows\system32\drivers\lsi_fc.sys
2011/08/27 10:12:38.0319 2072 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\windows\system32\drivers\lsi_sas.sys
2011/08/27 10:12:38.0350 2072 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\windows\system32\drivers\lsi_sas2.sys
2011/08/27 10:12:38.0366 2072 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\windows\system32\drivers\lsi_scsi.sys
2011/08/27 10:12:38.0397 2072 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\windows\system32\drivers\luafv.sys
2011/08/27 10:12:38.0412 2072 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\windows\system32\drivers\megasas.sys
2011/08/27 10:12:38.0459 2072 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\windows\system32\drivers\MegaSR.sys
2011/08/27 10:12:38.0506 2072 MEIx64 (a6518dcc42f7a6e999bb3bea8fd87567) C:\windows\system32\DRIVERS\HECIx64.sys
2011/08/27 10:12:38.0553 2072 Modem (800ba92f7010378b09f9ed9270f07137) C:\windows\system32\drivers\modem.sys
2011/08/27 10:12:38.0600 2072 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\windows\system32\DRIVERS\monitor.sys
2011/08/27 10:12:38.0646 2072 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\windows\system32\DRIVERS\mouclass.sys
2011/08/27 10:12:38.0678 2072 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\windows\system32\DRIVERS\mouhid.sys
2011/08/27 10:12:38.0709 2072 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\windows\system32\drivers\mountmgr.sys
2011/08/27 10:12:38.0740 2072 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\windows\system32\drivers\mpio.sys
2011/08/27 10:12:38.0771 2072 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\windows\system32\drivers\mpsdrv.sys
2011/08/27 10:12:38.0787 2072 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\windows\system32\drivers\mrxdav.sys
2011/08/27 10:12:38.0849 2072 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\windows\system32\DRIVERS\mrxsmb.sys
2011/08/27 10:12:38.0912 2072 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\windows\system32\DRIVERS\mrxsmb10.sys
2011/08/27 10:12:38.0943 2072 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\windows\system32\DRIVERS\mrxsmb20.sys
2011/08/27 10:12:38.0974 2072 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\windows\system32\drivers\msahci.sys
2011/08/27 10:12:39.0005 2072 msdsm (db801a638d011b9633829eb6f663c900) C:\windows\system32\drivers\msdsm.sys
2011/08/27 10:12:39.0052 2072 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\windows\system32\drivers\Msfs.sys
2011/08/27 10:12:39.0068 2072 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\windows\System32\drivers\mshidkmdf.sys
2011/08/27 10:12:39.0099 2072 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\windows\system32\drivers\msisadrv.sys
2011/08/27 10:12:39.0146 2072 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\windows\system32\drivers\MSKSSRV.sys
2011/08/27 10:12:39.0161 2072 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\windows\system32\drivers\MSPCLOCK.sys
2011/08/27 10:12:39.0177 2072 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\windows\system32\drivers\MSPQM.sys
2011/08/27 10:12:39.0208 2072 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\windows\system32\drivers\MsRPC.sys
2011/08/27 10:12:39.0239 2072 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\windows\system32\DRIVERS\mssmbios.sys
2011/08/27 10:12:39.0255 2072 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\windows\system32\drivers\MSTEE.sys
2011/08/27 10:12:39.0270 2072 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\windows\system32\drivers\MTConfig.sys
2011/08/27 10:12:39.0302 2072 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\windows\system32\Drivers\mup.sys
2011/08/27 10:12:39.0348 2072 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\windows\system32\DRIVERS\nwifi.sys
2011/08/27 10:12:39.0411 2072 NDIS (c38b8ae57f78915905064a9a24dc1586) C:\windows\system32\drivers\ndis.sys
2011/08/27 10:12:39.0458 2072 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\windows\system32\DRIVERS\ndiscap.sys
2011/08/27 10:12:39.0504 2072 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\windows\system32\DRIVERS\ndistapi.sys
2011/08/27 10:12:39.0551 2072 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\windows\system32\DRIVERS\ndisuio.sys
2011/08/27 10:12:39.0582 2072 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\windows\system32\DRIVERS\ndiswan.sys
2011/08/27 10:12:39.0629 2072 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\windows\system32\drivers\NDProxy.sys
2011/08/27 10:12:39.0676 2072 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\windows\system32\DRIVERS\netbios.sys
2011/08/27 10:12:39.0692 2072 NetBT (09594d1089c523423b32a4229263f068) C:\windows\system32\DRIVERS\netbt.sys
2011/08/27 10:12:39.0894 2072 NETwNs64 (30933bb56fb611d0252bad488adfb533) C:\windows\system32\DRIVERS\NETwNs64.sys
2011/08/27 10:12:40.0004 2072 nfrd960 (77889813be4d166cdab78ddba990da92) C:\windows\system32\drivers\nfrd960.sys
2011/08/27 10:12:40.0066 2072 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\windows\system32\drivers\Npfs.sys
2011/08/27 10:12:40.0097 2072 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\windows\system32\drivers\nsiproxy.sys
2011/08/27 10:12:40.0175 2072 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\windows\system32\drivers\Ntfs.sys
2011/08/27 10:12:40.0238 2072 Null (9899284589f75fa8724ff3d16aed75c1) C:\windows\system32\drivers\Null.sys
2011/08/27 10:12:40.0300 2072 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\windows\system32\drivers\nvraid.sys
2011/08/27 10:12:40.0316 2072 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\windows\system32\drivers\nvstor.sys
2011/08/27 10:12:40.0347 2072 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\windows\system32\drivers\nv_agp.sys
2011/08/27 10:12:40.0394 2072 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\windows\system32\drivers\ohci1394.sys
2011/08/27 10:12:40.0534 2072 Parport (0086431c29c35be1dbc43f52cc273887) C:\windows\system32\drivers\parport.sys
2011/08/27 10:12:40.0565 2072 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\windows\system32\drivers\partmgr.sys
2011/08/27 10:12:40.0643 2072 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\windows\system32\drivers\pci.sys
2011/08/27 10:12:40.0690 2072 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\windows\system32\drivers\pciide.sys
2011/08/27 10:12:40.0706 2072 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\windows\system32\drivers\pcmcia.sys
2011/08/27 10:12:40.0721 2072 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\windows\system32\drivers\pcw.sys
2011/08/27 10:12:40.0752 2072 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\windows\system32\drivers\peauth.sys
2011/08/27 10:12:40.0877 2072 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\windows\system32\DRIVERS\raspptp.sys
2011/08/27 10:12:40.0908 2072 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\windows\system32\drivers\processr.sys
2011/08/27 10:12:40.0955 2072 Psched (0557cf5a2556bd58e26384169d72438d) C:\windows\system32\DRIVERS\pacer.sys
2011/08/27 10:12:41.0033 2072 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\windows\system32\drivers\ql2300.sys
2011/08/27 10:12:41.0064 2072 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\windows\system32\drivers\ql40xx.sys
2011/08/27 10:12:41.0080 2072 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\windows\system32\drivers\qwavedrv.sys
2011/08/27 10:12:41.0096 2072 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\windows\system32\DRIVERS\rasacd.sys
2011/08/27 10:12:41.0158 2072 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\windows\system32\DRIVERS\AgileVpn.sys
2011/08/27 10:12:41.0189 2072 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\windows\system32\DRIVERS\rasl2tp.sys
2011/08/27 10:12:41.0220 2072 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\windows\system32\DRIVERS\raspppoe.sys
2011/08/27 10:12:41.0252 2072 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\windows\system32\DRIVERS\rassstp.sys
2011/08/27 10:12:41.0283 2072 rdbss (77f665941019a1594d887a74f301fa2f) C:\windows\system32\DRIVERS\rdbss.sys
2011/08/27 10:12:41.0314 2072 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\windows\system32\drivers\rdpbus.sys
2011/08/27 10:12:41.0345 2072 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\windows\system32\DRIVERS\RDPCDD.sys
2011/08/27 10:12:41.0376 2072 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\windows\system32\drivers\rdpencdd.sys
2011/08/27 10:12:41.0408 2072 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\windows\system32\drivers\rdprefmp.sys
2011/08/27 10:12:41.0423 2072 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\windows\system32\drivers\RDPWD.sys
2011/08/27 10:12:41.0470 2072 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\windows\system32\drivers\rdyboost.sys
2011/08/27 10:12:41.0517 2072 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\windows\system32\DRIVERS\rfcomm.sys
2011/08/27 10:12:41.0564 2072 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\windows\system32\DRIVERS\rspndr.sys
2011/08/27 10:12:41.0610 2072 RSUSBVSTOR (e54a5586a28d0630a79a68bbab84bfcf) C:\windows\system32\Drivers\RtsUVStor.sys
2011/08/27 10:12:41.0688 2072 RTL8167 (20a466b9ea2bd828c0ec723f99b8cfe7) C:\windows\system32\DRIVERS\Rt64win7.sys
2011/08/27 10:12:41.0766 2072 sbapifs (db7f9394b2f2d446df14d46c61b0e94b) C:\windows\system32\DRIVERS\sbapifs.sys
2011/08/27 10:12:41.0813 2072 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\windows\system32\drivers\sbp2port.sys
2011/08/27 10:12:41.0876 2072 SBRE (fd833bee2fd9befdc0afd1941a306d9e) C:\windows\system32\drivers\SBREdrv.sys
2011/08/27 10:12:41.0922 2072 SbTis (f9955774a6bf0a5ca696f591c7b80a79) C:\windows\system32\drivers\sbtis.sys
2011/08/27 10:12:41.0954 2072 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\windows\system32\DRIVERS\scfilter.sys
2011/08/27 10:12:42.0032 2072 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\windows\system32\drivers\secdrv.sys
2011/08/27 10:12:42.0063 2072 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\windows\system32\drivers\serenum.sys
2011/08/27 10:12:42.0094 2072 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\windows\system32\drivers\serial.sys
2011/08/27 10:12:42.0110 2072 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\windows\system32\drivers\sermouse.sys
2011/08/27 10:12:42.0141 2072 sffdisk (a554811bcd09279536440c964ae35bbf) C:\windows\system32\drivers\sffdisk.sys
2011/08/27 10:12:42.0156 2072 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\windows\system32\drivers\sffp_mmc.sys
2011/08/27 10:12:42.0172 2072 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\windows\system32\drivers\sffp_sd.sys
2011/08/27 10:12:42.0188 2072 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\windows\system32\drivers\sfloppy.sys
2011/08/27 10:12:42.0219 2072 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\windows\system32\drivers\SiSRaid2.sys
2011/08/27 10:12:42.0234 2072 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\windows\system32\drivers\sisraid4.sys
2011/08/27 10:12:42.0250 2072 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\windows\system32\DRIVERS\smb.sys
2011/08/27 10:12:42.0281 2072 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\windows\system32\drivers\spldr.sys
2011/08/27 10:12:42.0328 2072 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\windows\system32\DRIVERS\srv.sys
2011/08/27 10:12:42.0406 2072 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\windows\system32\DRIVERS\srv2.sys
2011/08/27 10:12:42.0500 2072 srvnet (27e461f0be5bff5fc737328f749538c3) C:\windows\system32\DRIVERS\srvnet.sys
2011/08/27 10:12:42.0578 2072 ssadbus (866f8212ef7e75bac8bca03331e30cb4) C:\windows\system32\DRIVERS\ssadbus.sys
2011/08/27 10:12:42.0609 2072 ssadmdfl (73e2ba39e7eb024dc686412e2e924a74) C:\windows\system32\DRIVERS\ssadmdfl.sys
2011/08/27 10:12:42.0640 2072 ssadmdm (74b032d6c1e36ae2f790752fde8ce055) C:\windows\system32\DRIVERS\ssadmdm.sys
2011/08/27 10:12:42.0702 2072 sscdbus (f4f1e1ff6986fe8914525af751ea3eac) C:\windows\system32\DRIVERS\sscdbus.sys
2011/08/27 10:12:42.0734 2072 sscdmdfl (5447690d2cfe1bde1be3a5a5a3e2f796) C:\windows\system32\DRIVERS\sscdmdfl.sys
2011/08/27 10:12:42.0765 2072 sscdmdm (bfda292053aeb76a0c1d63b2279d5138) C:\windows\system32\DRIVERS\sscdmdm.sys
2011/08/27 10:12:42.0843 2072 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\windows\system32\drivers\stexstor.sys
2011/08/27 10:12:42.0890 2072 StillCam (decacb6921ded1a38642642685d77dac) C:\windows\system32\DRIVERS\serscan.sys
2011/08/27 10:12:42.0936 2072 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\windows\system32\DRIVERS\swenum.sys
2011/08/27 10:12:43.0014 2072 SynTP (08425cd92972c6430f350a9697f4a553) C:\windows\system32\DRIVERS\SynTP.sys
2011/08/27 10:12:43.0155 2072 Tcpip (f0e98c00a09fdf791525829a1d14240f) C:\windows\system32\drivers\tcpip.sys
2011/08/27 10:12:43.0264 2072 TCPIP6 (f0e98c00a09fdf791525829a1d14240f) C:\windows\system32\DRIVERS\tcpip.sys
2011/08/27 10:12:43.0389 2072 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\windows\system32\drivers\tcpipreg.sys
2011/08/27 10:12:43.0420 2072 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\windows\system32\drivers\tdpipe.sys
2011/08/27 10:12:43.0436 2072 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\windows\system32\drivers\tdtcp.sys
2011/08/27 10:12:43.0467 2072 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\windows\system32\DRIVERS\tdx.sys
2011/08/27 10:12:43.0498 2072 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\windows\system32\DRIVERS\termdd.sys
2011/08/27 10:12:43.0545 2072 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\windows\system32\DRIVERS\tssecsrv.sys
2011/08/27 10:12:43.0560 2072 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\windows\system32\drivers\tsusbflt.sys
2011/08/27 10:12:43.0592 2072 TsUsbGD (9cc2ccae8a84820eaecb886d477cbcb8) C:\windows\system32\drivers\TsUsbGD.sys
2011/08/27 10:12:43.0623 2072 tunnel (3566a8daafa27af944f5d705eaa64894) C:\windows\system32\DRIVERS\tunnel.sys
2011/08/27 10:12:43.0654 2072 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\windows\system32\drivers\uagp35.sys
2011/08/27 10:12:43.0685 2072 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\windows\system32\DRIVERS\udfs.sys
2011/08/27 10:12:43.0748 2072 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\windows\system32\drivers\uliagpkx.sys
2011/08/27 10:12:43.0779 2072 umbus (dc54a574663a895c8763af0fa1ff7561) C:\windows\system32\DRIVERS\umbus.sys
2011/08/27 10:12:43.0810 2072 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\windows\system32\drivers\umpass.sys
2011/08/27 10:12:43.0872 2072 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\windows\system32\drivers\usbaudio.sys
2011/08/27 10:12:43.0935 2072 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\windows\system32\DRIVERS\usbccgp.sys
2011/08/27 10:12:43.0997 2072 usbcir (af0892a803fdda7492f595368e3b68e7) C:\windows\system32\drivers\usbcir.sys
2011/08/27 10:12:44.0044 2072 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\windows\system32\drivers\usbehci.sys
2011/08/27 10:12:44.0091 2072 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\windows\system32\DRIVERS\usbhub.sys
2011/08/27 10:12:44.0122 2072 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\windows\system32\drivers\usbohci.sys
2011/08/27 10:12:44.0153 2072 usbprint (73188f58fb384e75c4063d29413cee3d) C:\windows\system32\drivers\usbprint.sys
2011/08/27 10:12:44.0184 2072 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\windows\system32\DRIVERS\USBSTOR.SYS
2011/08/27 10:12:44.0247 2072 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\windows\system32\drivers\usbuhci.sys
2011/08/27 10:12:44.0528 2072 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\windows\system32\Drivers\usbvideo.sys
2011/08/27 10:12:44.0793 2072 usb_rndisx (70d05ee263568a742d14e1876df80532) C:\windows\system32\DRIVERS\usb8023x.sys
2011/08/27 10:12:44.0949 2072 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\windows\system32\drivers\vdrvroot.sys
2011/08/27 10:12:45.0183 2072 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\windows\system32\DRIVERS\vgapnp.sys
2011/08/27 10:12:45.0245 2072 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\windows\System32\drivers\vga.sys
2011/08/27 10:12:45.0464 2072 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\windows\system32\drivers\vhdmp.sys
2011/08/27 10:12:45.0682 2072 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\windows\system32\drivers\viaide.sys
2011/08/27 10:12:45.0854 2072 vm331avs (b977390908f5fc42b66e74d1e96843e6) C:\windows\system32\Drivers\vm331avs.sys
2011/08/27 10:12:46.0509 2072 vmuvcflt (40c39413a2458016ff43444750f467ca) C:\windows\system32\Drivers\vmuvcflt.sys
2011/08/27 10:12:46.0571 2072 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\windows\system32\drivers\volmgr.sys
2011/08/27 10:12:46.0665 2072 volmgrx (a255814907c89be58b79ef2f189b843b) C:\windows\system32\drivers\volmgrx.sys
2011/08/27 10:12:46.0743 2072 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\windows\system32\drivers\volsnap.sys
2011/08/27 10:12:46.0852 2072 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\windows\system32\drivers\vsmraid.sys
2011/08/27 10:12:46.0914 2072 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\windows\system32\DRIVERS\vwifibus.sys
2011/08/27 10:12:47.0055 2072 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\windows\system32\DRIVERS\vwififlt.sys
2011/08/27 10:12:47.0102 2072 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\windows\system32\DRIVERS\vwifimp.sys
2011/08/27 10:12:47.0148 2072 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\windows\system32\drivers\wacompen.sys
2011/08/27 10:12:47.0226 2072 WANARP (356afd78a6ed4457169241ac3965230c) C:\windows\system32\DRIVERS\wanarp.sys
2011/08/27 10:12:47.0226 2072 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\windows\system32\DRIVERS\wanarp.sys
2011/08/27 10:12:47.0304 2072 Wd (72889e16ff12ba0f235467d6091b17dc) C:\windows\system32\drivers\wd.sys
2011/08/27 10:12:47.0367 2072 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\windows\system32\drivers\Wdf01000.sys
2011/08/27 10:12:47.0429 2072 wdkmd (94dc2bf6cbaaa95e369c3756d3115a76) C:\windows\system32\DRIVERS\WDKMD.sys
2011/08/27 10:12:47.0507 2072 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\windows\system32\DRIVERS\wfplwf.sys
2011/08/27 10:12:47.0523 2072 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\windows\system32\drivers\wimmount.sys
2011/08/27 10:12:47.0616 2072 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\windows\system32\DRIVERS\wmiacpi.sys
2011/08/27 10:12:47.0679 2072 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\windows\system32\drivers\ws2ifsl.sys
2011/08/27 10:12:47.0726 2072 WSDPrintDevice (8d918b1db190a4d9b1753a66fa8c96e8) C:\windows\system32\DRIVERS\WSDPrint.sys
2011/08/27 10:12:47.0819 2072 wsvd (83575c43b2bfe9ab0661a7f957e843c0) C:\windows\system32\DRIVERS\wsvd.sys
2011/08/27 10:12:47.0850 2072 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\windows\system32\drivers\WudfPf.sys
2011/08/27 10:12:47.0975 2072 WUDFRd (cf8d590be3373029d57af80914190682) C:\windows\system32\DRIVERS\WUDFRd.sys
2011/08/27 10:12:48.0069 2072 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
2011/08/27 10:12:48.0100 2072 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk2\DR2
2011/08/27 10:12:48.0116 2072 Boot (0x1200) (e34fc7246fc3e5c1c8fd654ce9b57816) \Device\Harddisk0\DR0\Partition0
2011/08/27 10:12:48.0147 2072 Boot (0x1200) (8dd0c3daca1089fe20b1dfe139490fa0) \Device\Harddisk0\DR0\Partition1
2011/08/27 10:12:48.0178 2072 Boot (0x1200) (a7d9a35a76a91cd4c8074b752b2ae649) \Device\Harddisk0\DR0\Partition2
2011/08/27 10:12:48.0194 2072 Boot (0x1200) (091a1fb02e4ed28f18bde43e2f7c6a47) \Device\Harddisk2\DR2\Partition0
2011/08/27 10:12:48.0194 2072 ================================================================================
2011/08/27 10:12:48.0194 2072 Scan finished
2011/08/27 10:12:48.0194 2072 ================================================================================
2011/08/27 10:12:48.0209 4608 Detected object count: 0
2011/08/27 10:12:48.0209 4608 Actual detected object count: 0

#9 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:01 AM

Posted 27 August 2011 - 09:25 AM

That is good news. :thumbup2:

Both the DDS log and TDSSKiller confirm that the initial infection (ZeroAccess) is fully taken care of.

Let's check the whole system for any inactive threat.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: Posted Image

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: Posted Image
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats and the option Scan archives are checked.
  • Now click on Advanced Settings and select the following:
  • Enable Anti-Stealth Technology
  • Now click on: Posted Image
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: Posted Image
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.
Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

#10 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:01 AM

Posted 27 August 2011 - 09:37 AM

Please don't miss my earlier post. Please no need to quote my post.:)

#11 Trident18

Trident18
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:07:01 PM

Posted 28 August 2011 - 12:11 PM

ESET log:

C:\Users\Stephen\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0009b4 Win32/Agent.SZI trojan deleted - quarantined
C:\Users\Stephen\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0009c0 a variant of Win32/InstallCore.B application cleaned by deleting - quarantined
C:\Users\Stephen\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000a52 a variant of Win32/Kryptik.RZF trojan deleted - quarantined
C:\Users\Stephen\AppData\Local\Temp\ICReinstall\cnet_iview430_setup_exe.exe a variant of Win32/InstallCore.B application cleaned by deleting - quarantined
C:\Users\Stephen\Downloads\cnet_iview430_setup_exe.exe a variant of Win32/InstallCore.B application cleaned by deleting - quarantined

I was doing a little reading. It looks like iview430 is a harmless app that I've used for years that throws false positives on some a/v software. There was a discussion about it on cnet, and a few other places. It's the setup program for IrfanView. Irfanview still works... so doesn't seem to be a big deal.

Edited by Trident18, 28 August 2011 - 12:14 PM.


#12 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:01 AM

Posted 28 August 2011 - 01:08 PM

It's the setup program for IrfanView. Irfanview still works... so doesn't seem to be a big deal.

It is because ESET only removed the installer.

We are going to do a final check to see if the infection has locked any files.

  • We need to scan the system with this special tool.
    • Please download Junction.zip and save it.
    • Unzip it and put junction.exe in the Windows directory (C:\Windows). No need to run it.
  • Please run Notepad (start > All Programs > Accessories > Notepad) and copy and paste the text in the code box into a new file:

    @ECHO OFF
    junction -s >log.txt
    start log.txt
    del c:\windows\junction.exe
    
    • Go to the File menu at the top of the Notepad and select Save as.
    • Select Save in: desktop
    • Fill in File name: look.bat
    • Save as type: All file types (*.*)
    • Click save.
    • Close the Notepad.
    • Locate look.bat on the desktop. It should look like this: Posted Image
    • Right-click and run it as administrator.
    • The command prompt opens, wait until a notepad opens, copy and paste the content (log.txt) to your reply.


#13 Trident18

Trident18
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:07:01 PM

Posted 28 August 2011 - 01:30 PM

It was almost instantaneous, but the log.txt opened up- and was blank.
Hopefully, that's a good thing.

#14 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:02:01 AM

Posted 28 August 2011 - 01:55 PM

It didn't run at all. :P

Where did you put Junction.exe? Did you first unzip the zipped file, then put Junctions.exe in the Windows directory?

#15 Trident18

Trident18
  • Topic Starter

  • Members
  • 48 posts
  • OFFLINE
  •  
  • Local time:07:01 PM

Posted 28 August 2011 - 02:53 PM

I had just unzipped Junction directly to c:\Windows, but apparently that didn't work.
So I unzipped to a new folder and copy/pasted it there.

Ran it and accepted the permission and got this:

Junction v1.06 - Windows junction creator and reparse point viewer
Copyright © 2000-2010 Mark Russinovich
Sysinternals - www.sysinternals.com

.No reparse points found.


Is something still not running right or is this good?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users