Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with malware, google redirects, invisible ads, windows delayed failure hoax


  • This topic is locked This topic is locked
30 replies to this topic

#1 svan81

svan81

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:03:57 PM

Posted 06 November 2011 - 05:37 PM

The infection started today. First, I recieved an error message that said Delayed Write Failed and repeated about 20 times. I had to close all 20, and then another windows popped up that said I could either repair it or ignore it or something like that. If you chose the ignore option, Windows would restart. I went into msconfig and unchecked a EMSTOQkqCSJFM.exe, which has stopped the delayed write error from popping up. But I still had a google redirect problem and another problem where internet explorer would start itself.

Using Malwarebytes and Eset online scan, I think I got rid of the redirect problem but now I have a problem where I am using internet explorer and after a few minutes I begin to hear music in the background but cannot find the source of the music. In the task manager, I see iexplore with abou 400,000 kb of usage and when I end the process, the music stops. So there are hidden iexplorers popping up.

I thought about reformating but I can't find my Windows 7 CD -- I might contact Microsoft about getting a replacement, but since I got this copy through my university I don't know if they will replace it.

Here is my DDS log. I hope you can help me, and thanks in advance.

DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Steve at 11:54:13 on 2011-11-06
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.2046.668 [GMT -5:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\RayV\RayV\RayV.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\RunDll32.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
uRun: [RayV] C:\Program Files (x86)\RayV\RayV\RayV.exe /background
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
Trusted Zone: army.mil\owa.usar
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 68.87.71.230 68.87.73.246 192.168.1.1 68.87.71.230 68.87.73.246
TCP: Interfaces\{0E344D1C-2397-422D-AD36-EA476A889EDA} : DhcpNameServer = 68.87.71.230 68.87.73.246 192.168.1.1 68.87.71.230 68.87.73.246
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
.
============= SERVICES / DRIVERS ===============
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 Stereo Service32;NVIDIA Stereoscopic 3D Driver Service ;C:\ProgramData\api-ms-win-core-memory-l1-1-032.exe --> C:\ProgramData\api-ms-win-core-memory-l1-1-032.exe [?]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2011-11-06 16:41:37 -------- d-sh--w- C:\$RECYCLE.BIN
2011-11-06 15:10:44 -------- d-----w- C:\Windows\System32\SPReview
2011-11-06 15:08:25 -------- d-----w- C:\Windows\System32\EventProviders
2011-11-06 14:06:14 -------- d-----w- C:\ComboFix
2011-11-03 23:06:16 -------- d-----w- C:\Users\Steve\AppData\Local\Google
2011-10-20 22:38:19 4711 ----a-w- C:\Windows\System32\dmouse.vxd
2011-10-11 21:17:18 3134976 ----a-w- C:\Windows\System32\win32k.sys
.
==================== Find3M ====================
.
2011-11-06 16:19:26 175104 ----a-w- C:\Windows\System32\msclmd.dll
2011-11-06 16:19:26 152064 ----a-w- C:\Windows\SysWow64\msclmd.dll
2011-11-06 15:40:59 222208 ----a-w- C:\Windows\System32\msls31.dll
2011-08-27 05:40:28 861184 ----a-w- C:\Windows\System32\oleaut32.dll
2011-08-27 05:40:28 331776 ----a-w- C:\Windows\System32\oleacc.dll
2011-08-27 04:43:07 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
2011-08-27 04:43:06 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll
2011-08-17 05:32:24 613888 ----a-w- C:\Windows\System32\psisdecd.dll
2011-08-17 05:27:46 75776 ----a-w- C:\Windows\System32\MSDvbNP.ax
2011-08-17 05:27:46 288256 ----a-w- C:\Windows\System32\MSNP.ax
2011-08-17 05:27:46 108032 ----a-w- C:\Windows\System32\psisrndr.ax
2011-08-17 05:27:46 104960 ----a-w- C:\Windows\System32\Mpeg2Data.ax
2011-08-17 04:26:02 465408 ----a-w- C:\Windows\SysWow64\psisdecd.dll
2011-08-17 04:22:23 75776 ----a-w- C:\Windows\SysWow64\psisrndr.ax
2011-08-17 04:22:23 72704 ----a-w- C:\Windows\SysWow64\Mpeg2Data.ax
2011-08-17 04:22:23 59904 ----a-w- C:\Windows\SysWow64\MSDvbNP.ax
2011-08-17 04:22:23 204288 ----a-w- C:\Windows\SysWow64\MSNP.ax
.
============= FINISH: 12:01:20.16 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:57 PM

Posted 09 November 2011 - 12:50 PM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

  • Do not run any other tool untill instructed to do so!
  • please Do not Attach logs or put in code boxes.
  • Tell me about any problems that have occurred during the fix.
  • Tell me of any other symptoms you may be having as these can help also.
  • Do not run anything while running a fix.
  • Do not run any other tool untill instructed to do so!


Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 svan81

svan81
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:03:57 PM

Posted 09 November 2011 - 06:26 PM

When I tried to download Combofix, some smartscreen, which I've never seen before, popped up and tried to stop me. But I was able to download it anyway. I am still experiencing the ninja Internet Explorer process that runs in the background while hogging much of the system resources and playing music sometimes. Anyways, here is the Combofix log:

ComboFix 11-11-09.02 - Steve 11/09/2011 16:06:51.5.2 - x64
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.2046.1017 [GMT -5:00]
Running from: c:\users\Steve\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2011-10-09 to 2011-11-09 )))))))))))))))))))))))))))))))
.
.
2011-11-09 21:35 . 2011-11-09 21:35 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-11-09 21:35 . 2011-11-09 21:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-11-09 20:55 . 2011-09-29 16:24 1897328 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-09 20:55 . 2011-09-29 04:09 3141120 ----a-w- c:\windows\system32\win32k.sys
2011-11-08 02:16 . 2011-11-08 02:16 -------- d-----w- c:\program files (x86)\NCsoft
2011-11-08 01:11 . 2011-11-08 01:11 -------- d-----w- c:\program files (x86)\Belarc
2011-11-08 00:22 . 2011-11-08 00:22 -------- d-----w- c:\programdata\WeCareReminder
2011-11-08 00:20 . 2011-11-08 00:20 -------- d-----w- c:\users\Steve\AppData\Roaming\OpenCandy
2011-11-07 23:58 . 2011-11-07 23:58 -------- d-----w- c:\users\Steve\AppData\Local\assembly
2011-11-06 18:46 . 2011-11-06 18:46 -------- d-----w- c:\users\UpdatusUser
2011-11-06 18:45 . 2011-10-15 08:53 837952 ----a-w- c:\windows\system32\easyupdatusapiu64.dll
2011-11-06 17:35 . 2011-11-06 17:44 -------- d-----w- c:\programdata\PC Tools
2011-11-06 15:10 . 2011-11-06 15:10 -------- d-----w- c:\windows\system32\SPReview
2011-11-06 15:08 . 2011-11-06 15:08 -------- d-----w- c:\windows\system32\EventProviders
2011-11-03 23:06 . 2011-11-03 23:06 -------- d-----w- c:\users\Steve\AppData\Local\Google
2011-10-20 22:38 . 2011-10-20 22:38 4711 ----a-w- c:\windows\system32\dmouse.vxd
2011-10-15 05:54 . 2011-10-15 05:54 321856 ----a-w- c:\windows\SysWow64\nvStreaming.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-06 16:19 . 2009-07-14 02:36 175104 ----a-w- c:\windows\system32\msclmd.dll
2011-11-06 16:19 . 2009-07-14 02:36 152064 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-10-15 08:53 . 2010-11-06 18:24 8791360 ----a-w- c:\windows\system32\nvwgf2umx.dll
2011-10-15 08:53 . 2010-11-06 18:24 7041856 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2011-10-15 08:53 . 2010-11-06 18:24 2808128 ----a-w- c:\windows\system32\nvapi64.dll
2011-10-15 08:53 . 2010-11-06 18:24 2458432 ----a-w- c:\windows\SysWow64\nvapi.dll
2011-10-15 08:53 . 2010-10-16 17:13 10406208 ----a-w- c:\windows\system32\nvcpl.dll
2011-10-15 08:53 . 2010-10-16 17:13 5067584 ----a-w- c:\windows\system32\nvsvc64.dll
2011-10-15 08:53 . 2010-10-16 17:13 222528 ----a-w- c:\windows\system32\nvmctray.dll
2011-10-15 08:53 . 2010-10-16 17:13 1640768 ----a-w- c:\windows\system32\nvvsvc.exe
2011-10-15 08:53 . 2010-10-16 17:13 137536 ----a-w- c:\windows\system32\nvshext.dll
2011-10-15 08:53 . 2009-06-10 20:37 13205312 ----a-w- c:\windows\SysWow64\nvd3dum.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-11-11 421160]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R1 SASDIFSV;SASDIFSV;c:\users\Steve\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV64.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\users\Steve\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL64.SYS [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 Stereo Service32;NVIDIA Stereoscopic 3D Driver Service ;c:\programdata\api-ms-win-core-memory-l1-1-032.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-15 381248]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-753235149-1441159140-3465873635-1001Core.job
- c:\users\Steve\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-03 23:06]
.
2011-11-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-753235149-1441159140-3465873635-1001UA.job
- c:\users\Steve\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-03 23:06]
.
.
--------- x86-64 -----------
.
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: army.mil\owa.usar
TCP: DhcpNameServer = 68.87.71.230 68.87.73.246 192.168.1.1 68.87.71.230 68.87.73.246
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-PlayNC Launcher - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2011-11-09 17:01:19 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-09 22:01
ComboFix2.txt 2011-11-06 20:16
.
Pre-Run: 26,405,236,736 bytes free
Post-Run: 25,648,840,704 bytes free
.
- - End Of File - - 8439462A202C07A51FAE57FEB8DF8425

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:57 PM

Posted 09 November 2011 - 06:27 PM

Hello

I want you to run this tool for me next.

tdsskiller:

Please read carefully and follow these steps.
  • Download TDSSKiller and save it to your Desktop.
  • doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 svan81

svan81
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:03:57 PM

Posted 09 November 2011 - 06:31 PM

Hey, thanks for getting back to me so fast. Here is the log:

18:30:27.0914 2288 TDSS rootkit removing tool 2.6.16.0 Nov 7 2011 16:26:51
18:30:28.0054 2288 ============================================================
18:30:28.0054 2288 Current date / time: 2011/11/09 18:30:28.0054
18:30:28.0054 2288 SystemInfo:
18:30:28.0054 2288
18:30:28.0054 2288 OS Version: 6.1.7600 ServicePack: 0.0
18:30:28.0054 2288 Product type: Workstation
18:30:28.0054 2288 ComputerName: STEVE-PC
18:30:28.0054 2288 UserName: Steve
18:30:28.0054 2288 Windows directory: C:\Windows
18:30:28.0054 2288 System windows directory: C:\Windows
18:30:28.0054 2288 Running under WOW64
18:30:28.0054 2288 Processor architecture: Intel x64
18:30:28.0054 2288 Number of processors: 2
18:30:28.0054 2288 Page size: 0x1000
18:30:28.0054 2288 Boot type: Normal boot
18:30:28.0054 2288 ============================================================
18:30:28.0928 2288 Initialize success
18:30:39.0723 1960 ============================================================
18:30:39.0723 1960 Scan started
18:30:39.0723 1960 Mode: Manual;
18:30:39.0723 1960 ============================================================
18:30:53.0763 4008 ============================================================
18:30:53.0763 4008 Scan started
18:30:53.0763 4008 Mode: Manual;
18:30:53.0763 4008 ============================================================
18:30:54.0075 4008 Scan interrupted by user!
18:30:54.0075 4008 Scan interrupted by user!
18:30:54.0075 4008 Scan interrupted by user!
18:30:54.0075 4008 ============================================================
18:30:54.0075 4008 Scan finished
18:30:54.0075 4008 ============================================================
18:30:54.0075 2636 Detected object count: 0
18:30:54.0075 2636 Actual detected object count: 0
18:30:54.0996 3796 ============================================================
18:30:54.0996 3796 Scan started
18:30:54.0996 3796 Mode: Manual;
18:30:54.0996 3796 ============================================================
18:30:55.0198 3796 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\drivers\1394ohci.sys
18:30:55.0198 3796 1394ohci - ok
18:30:55.0230 3796 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\drivers\ACPI.sys
18:30:55.0245 3796 ACPI - ok
18:30:55.0261 3796 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\drivers\acpipmi.sys
18:30:55.0261 3796 AcpiPmi - ok
18:30:55.0308 3796 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
18:30:55.0308 3796 adp94xx - ok
18:30:55.0354 3796 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
18:30:55.0354 3796 adpahci - ok
18:30:55.0386 3796 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
18:30:55.0386 3796 adpu320 - ok
18:30:55.0448 3796 AFD (6ef20ddf3172e97d69f596fb90602f29) C:\Windows\system32\drivers\afd.sys
18:30:55.0464 3796 AFD - ok
18:30:55.0495 3796 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
18:30:55.0495 3796 agp440 - ok
18:30:55.0542 3796 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
18:30:55.0542 3796 aliide - ok
18:30:55.0557 3796 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
18:30:55.0557 3796 amdide - ok
18:30:55.0588 3796 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
18:30:55.0588 3796 AmdK8 - ok
18:30:55.0604 3796 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
18:30:55.0604 3796 AmdPPM - ok
18:30:55.0651 3796 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys
18:30:55.0651 3796 amdsata - ok
18:30:55.0682 3796 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
18:30:55.0682 3796 amdsbs - ok
18:30:55.0713 3796 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys
18:30:55.0713 3796 amdxata - ok
18:30:55.0744 3796 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
18:30:55.0744 3796 AppID - ok
18:30:55.0791 3796 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
18:30:55.0791 3796 arc - ok
18:30:55.0807 3796 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
18:30:55.0822 3796 arcsas - ok
18:30:55.0869 3796 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
18:30:55.0869 3796 AsyncMac - ok
18:30:55.0900 3796 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
18:30:55.0900 3796 atapi - ok
18:30:55.0963 3796 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
18:30:55.0963 3796 b06bdrv - ok
18:30:56.0010 3796 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
18:30:56.0010 3796 b57nd60a - ok
18:30:56.0041 3796 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
18:30:56.0041 3796 Beep - ok
18:30:56.0072 3796 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
18:30:56.0072 3796 blbdrive - ok
18:30:56.0134 3796 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys
18:30:56.0134 3796 bowser - ok
18:30:56.0150 3796 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
18:30:56.0150 3796 BrFiltLo - ok
18:30:56.0166 3796 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
18:30:56.0166 3796 BrFiltUp - ok
18:30:56.0197 3796 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
18:30:56.0197 3796 Brserid - ok
18:30:56.0197 3796 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
18:30:56.0212 3796 BrSerWdm - ok
18:30:56.0212 3796 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
18:30:56.0212 3796 BrUsbMdm - ok
18:30:56.0228 3796 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
18:30:56.0228 3796 BrUsbSer - ok
18:30:56.0259 3796 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
18:30:56.0259 3796 BTHMODEM - ok
18:30:56.0415 3796 catchme - ok
18:30:56.0478 3796 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
18:30:56.0478 3796 cdfs - ok
18:30:56.0540 3796 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\drivers\cdrom.sys
18:30:56.0540 3796 cdrom - ok
18:30:56.0571 3796 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
18:30:56.0571 3796 circlass - ok
18:30:56.0602 3796 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
18:30:56.0618 3796 CLFS - ok
18:30:56.0649 3796 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
18:30:56.0649 3796 CmBatt - ok
18:30:56.0680 3796 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
18:30:56.0680 3796 cmdide - ok
18:30:56.0712 3796 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
18:30:56.0712 3796 CNG - ok
18:30:56.0727 3796 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
18:30:56.0743 3796 Compbatt - ok
18:30:56.0790 3796 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\drivers\CompositeBus.sys
18:30:56.0790 3796 CompositeBus - ok
18:30:56.0821 3796 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
18:30:56.0821 3796 crcdisk - ok
18:30:56.0868 3796 CSC (4a6173c2279b498cd8f57cae504564cb) C:\Windows\system32\drivers\csc.sys
18:30:56.0868 3796 CSC - ok
18:30:56.0914 3796 DfsC (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys
18:30:56.0914 3796 DfsC - ok
18:30:56.0946 3796 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
18:30:56.0946 3796 discache - ok
18:30:56.0977 3796 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
18:30:56.0977 3796 Disk - ok
18:30:57.0024 3796 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
18:30:57.0024 3796 drmkaud - ok
18:30:57.0086 3796 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys
18:30:57.0102 3796 DXGKrnl - ok
18:30:57.0211 3796 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
18:30:57.0304 3796 ebdrv - ok
18:30:57.0351 3796 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
18:30:57.0367 3796 elxstor - ok
18:30:57.0398 3796 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
18:30:57.0398 3796 ErrDev - ok
18:30:57.0429 3796 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
18:30:57.0429 3796 exfat - ok
18:30:57.0460 3796 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
18:30:57.0460 3796 fastfat - ok
18:30:57.0476 3796 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
18:30:57.0476 3796 fdc - ok
18:30:57.0507 3796 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
18:30:57.0507 3796 FileInfo - ok
18:30:57.0523 3796 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
18:30:57.0538 3796 Filetrace - ok
18:30:57.0538 3796 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
18:30:57.0538 3796 flpydisk - ok
18:30:57.0570 3796 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
18:30:57.0585 3796 FltMgr - ok
18:30:57.0616 3796 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
18:30:57.0616 3796 FsDepends - ok
18:30:57.0632 3796 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
18:30:57.0632 3796 Fs_Rec - ok
18:30:57.0679 3796 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
18:30:57.0679 3796 fvevol - ok
18:30:57.0710 3796 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
18:30:57.0726 3796 gagp30kx - ok
18:30:57.0772 3796 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
18:30:57.0772 3796 GEARAspiWDM - ok
18:30:57.0788 3796 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
18:30:57.0788 3796 hcw85cir - ok
18:30:57.0835 3796 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
18:30:57.0850 3796 HdAudAddService - ok
18:30:57.0897 3796 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\drivers\HDAudBus.sys
18:30:57.0897 3796 HDAudBus - ok
18:30:57.0913 3796 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
18:30:57.0913 3796 HidBatt - ok
18:30:57.0928 3796 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
18:30:57.0928 3796 HidBth - ok
18:30:57.0928 3796 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
18:30:57.0944 3796 HidIr - ok
18:30:57.0975 3796 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
18:30:57.0975 3796 HidUsb - ok
18:30:58.0006 3796 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\drivers\HpSAMD.sys
18:30:58.0006 3796 HpSAMD - ok
18:30:58.0038 3796 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
18:30:58.0053 3796 HTTP - ok
18:30:58.0069 3796 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
18:30:58.0069 3796 hwpolicy - ok
18:30:58.0116 3796 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
18:30:58.0116 3796 i8042prt - ok
18:30:58.0162 3796 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys
18:30:58.0162 3796 iaStorV - ok
18:30:58.0194 3796 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
18:30:58.0194 3796 iirsp - ok
18:30:58.0225 3796 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
18:30:58.0225 3796 intelide - ok
18:30:58.0256 3796 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
18:30:58.0256 3796 intelppm - ok
18:30:58.0287 3796 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:30:58.0287 3796 IpFilterDriver - ok
18:30:58.0334 3796 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\drivers\IPMIDrv.sys
18:30:58.0334 3796 IPMIDRV - ok
18:30:58.0350 3796 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
18:30:58.0350 3796 IPNAT - ok
18:30:58.0381 3796 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
18:30:58.0381 3796 IRENUM - ok
18:30:58.0412 3796 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
18:30:58.0412 3796 isapnp - ok
18:30:58.0428 3796 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\drivers\msiscsi.sys
18:30:58.0443 3796 iScsiPrt - ok
18:30:58.0490 3796 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
18:30:58.0490 3796 kbdclass - ok
18:30:58.0521 3796 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\drivers\kbdhid.sys
18:30:58.0521 3796 kbdhid - ok
18:30:58.0552 3796 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
18:30:58.0552 3796 KSecDD - ok
18:30:58.0584 3796 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
18:30:58.0584 3796 KSecPkg - ok
18:30:58.0615 3796 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
18:30:58.0615 3796 ksthunk - ok
18:30:58.0662 3796 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
18:30:58.0662 3796 lltdio - ok
18:30:58.0708 3796 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
18:30:58.0708 3796 LSI_FC - ok
18:30:58.0724 3796 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
18:30:58.0724 3796 LSI_SAS - ok
18:30:58.0740 3796 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
18:30:58.0740 3796 LSI_SAS2 - ok
18:30:58.0755 3796 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
18:30:58.0771 3796 LSI_SCSI - ok
18:30:58.0802 3796 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
18:30:58.0802 3796 luafv - ok
18:30:58.0818 3796 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
18:30:58.0818 3796 megasas - ok
18:30:58.0849 3796 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
18:30:58.0849 3796 MegaSR - ok
18:30:58.0880 3796 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
18:30:58.0880 3796 Modem - ok
18:30:58.0911 3796 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
18:30:58.0911 3796 monitor - ok
18:30:58.0958 3796 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
18:30:58.0958 3796 mouclass - ok
18:30:59.0005 3796 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
18:30:59.0005 3796 mouhid - ok
18:30:59.0020 3796 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
18:30:59.0020 3796 mountmgr - ok
18:30:59.0052 3796 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\drivers\mpio.sys
18:30:59.0067 3796 mpio - ok
18:30:59.0083 3796 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
18:30:59.0083 3796 mpsdrv - ok
18:30:59.0114 3796 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
18:30:59.0114 3796 MRxDAV - ok
18:30:59.0145 3796 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys
18:30:59.0145 3796 mrxsmb - ok
18:30:59.0192 3796 mrxsmb10 (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:30:59.0192 3796 mrxsmb10 - ok
18:30:59.0208 3796 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:30:59.0223 3796 mrxsmb20 - ok
18:30:59.0254 3796 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\drivers\msahci.sys
18:30:59.0254 3796 msahci - ok
18:30:59.0286 3796 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\drivers\msdsm.sys
18:30:59.0286 3796 msdsm - ok
18:30:59.0332 3796 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
18:30:59.0332 3796 Msfs - ok
18:30:59.0348 3796 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
18:30:59.0348 3796 mshidkmdf - ok
18:30:59.0379 3796 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
18:30:59.0379 3796 msisadrv - ok
18:30:59.0426 3796 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
18:30:59.0426 3796 MSKSSRV - ok
18:30:59.0426 3796 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
18:30:59.0426 3796 MSPCLOCK - ok
18:30:59.0442 3796 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
18:30:59.0442 3796 MSPQM - ok
18:30:59.0473 3796 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
18:30:59.0473 3796 MsRPC - ok
18:30:59.0504 3796 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
18:30:59.0504 3796 mssmbios - ok
18:30:59.0520 3796 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
18:30:59.0520 3796 MSTEE - ok
18:30:59.0535 3796 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
18:30:59.0535 3796 MTConfig - ok
18:30:59.0566 3796 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
18:30:59.0566 3796 Mup - ok
18:30:59.0598 3796 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
18:30:59.0613 3796 NativeWifiP - ok
18:30:59.0644 3796 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
18:30:59.0660 3796 NDIS - ok
18:30:59.0676 3796 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
18:30:59.0676 3796 NdisCap - ok
18:30:59.0707 3796 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
18:30:59.0707 3796 NdisTapi - ok
18:30:59.0722 3796 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
18:30:59.0722 3796 Ndisuio - ok
18:30:59.0738 3796 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
18:30:59.0738 3796 NdisWan - ok
18:30:59.0754 3796 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
18:30:59.0754 3796 NDProxy - ok
18:30:59.0785 3796 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
18:30:59.0785 3796 NetBIOS - ok
18:30:59.0800 3796 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
18:30:59.0800 3796 NetBT - ok
18:30:59.0847 3796 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
18:30:59.0847 3796 nfrd960 - ok
18:30:59.0878 3796 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
18:30:59.0878 3796 Npfs - ok
18:30:59.0894 3796 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
18:30:59.0894 3796 nsiproxy - ok
18:30:59.0972 3796 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys
18:30:59.0972 3796 Ntfs - ok
18:30:59.0988 3796 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
18:30:59.0988 3796 Null - ok
18:31:00.0284 3796 nvlddmkm (b15258b1f45f9571758ac6bb2f043b01) C:\Windows\system32\DRIVERS\nvlddmkm.sys
18:31:00.0549 3796 nvlddmkm - ok
18:31:00.0596 3796 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys
18:31:00.0596 3796 nvraid - ok
18:31:00.0612 3796 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys
18:31:00.0627 3796 nvstor - ok
18:31:00.0674 3796 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
18:31:00.0674 3796 nv_agp - ok
18:31:00.0705 3796 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
18:31:00.0721 3796 ohci1394 - ok
18:31:00.0768 3796 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
18:31:00.0768 3796 Parport - ok
18:31:00.0799 3796 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
18:31:00.0799 3796 partmgr - ok
18:31:00.0846 3796 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\drivers\pci.sys
18:31:00.0846 3796 pci - ok
18:31:00.0877 3796 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
18:31:00.0877 3796 pciide - ok
18:31:00.0892 3796 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
18:31:00.0908 3796 pcmcia - ok
18:31:00.0924 3796 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
18:31:00.0924 3796 pcw - ok
18:31:00.0955 3796 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
18:31:00.0955 3796 PEAUTH - ok
18:31:01.0017 3796 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
18:31:01.0017 3796 PptpMiniport - ok
18:31:01.0048 3796 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
18:31:01.0048 3796 Processor - ok
18:31:01.0080 3796 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
18:31:01.0080 3796 Psched - ok
18:31:01.0126 3796 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
18:31:01.0158 3796 ql2300 - ok
18:31:01.0173 3796 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
18:31:01.0173 3796 ql40xx - ok
18:31:01.0204 3796 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
18:31:01.0204 3796 QWAVEdrv - ok
18:31:01.0220 3796 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
18:31:01.0220 3796 RasAcd - ok
18:31:01.0267 3796 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
18:31:01.0267 3796 RasAgileVpn - ok
18:31:01.0282 3796 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
18:31:01.0282 3796 Rasl2tp - ok
18:31:01.0314 3796 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
18:31:01.0314 3796 RasPppoe - ok
18:31:01.0345 3796 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
18:31:01.0345 3796 RasSstp - ok
18:31:01.0376 3796 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
18:31:01.0376 3796 rdbss - ok
18:31:01.0392 3796 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
18:31:01.0392 3796 rdpbus - ok
18:31:01.0407 3796 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
18:31:01.0407 3796 RDPCDD - ok
18:31:01.0438 3796 RDPDR (9706b84dbabfc4b4ca46c5a82b14dfa3) C:\Windows\system32\drivers\rdpdr.sys
18:31:01.0438 3796 RDPDR - ok
18:31:01.0470 3796 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
18:31:01.0470 3796 RDPENCDD - ok
18:31:01.0485 3796 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
18:31:01.0485 3796 RDPREFMP - ok
18:31:01.0516 3796 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
18:31:01.0516 3796 RDPWD - ok
18:31:01.0532 3796 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
18:31:01.0548 3796 rdyboost - ok
18:31:01.0594 3796 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
18:31:01.0594 3796 rspndr - ok
18:31:01.0626 3796 RTL8167 (baefee35d27a5440d35092ce10267bec) C:\Windows\system32\DRIVERS\Rt64win7.sys
18:31:01.0626 3796 RTL8167 - ok
18:31:01.0657 3796 s3cap (88af6e02ab19df7fd07ecdf9c91e9af6) C:\Windows\system32\drivers\vms3cap.sys
18:31:01.0657 3796 s3cap - ok
18:31:01.0735 3796 SASDIFSV - ok
18:31:01.0750 3796 SASKUTIL - ok
18:31:01.0782 3796 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\drivers\sbp2port.sys
18:31:01.0782 3796 sbp2port - ok
18:31:01.0813 3796 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
18:31:01.0813 3796 scfilter - ok
18:31:01.0860 3796 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
18:31:01.0860 3796 secdrv - ok
18:31:01.0891 3796 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
18:31:01.0891 3796 Serenum - ok
18:31:01.0906 3796 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
18:31:01.0906 3796 Serial - ok
18:31:01.0938 3796 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
18:31:01.0938 3796 sermouse - ok
18:31:01.0984 3796 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
18:31:02.0000 3796 sffdisk - ok
18:31:02.0016 3796 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
18:31:02.0016 3796 sffp_mmc - ok
18:31:02.0031 3796 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\Windows\system32\drivers\sffp_sd.sys
18:31:02.0031 3796 sffp_sd - ok
18:31:02.0047 3796 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
18:31:02.0047 3796 sfloppy - ok
18:31:02.0094 3796 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
18:31:02.0094 3796 SiSRaid2 - ok
18:31:02.0109 3796 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
18:31:02.0109 3796 SiSRaid4 - ok
18:31:02.0140 3796 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
18:31:02.0140 3796 Smb - ok
18:31:02.0172 3796 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
18:31:02.0172 3796 spldr - ok
18:31:02.0218 3796 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys
18:31:02.0234 3796 srv - ok
18:31:02.0250 3796 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys
18:31:02.0265 3796 srv2 - ok
18:31:02.0296 3796 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys
18:31:02.0296 3796 srvnet - ok
18:31:02.0328 3796 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
18:31:02.0343 3796 stexstor - ok
18:31:02.0390 3796 storflt (ffd7a6f15b14234b5b0e5d49e7961895) C:\Windows\system32\drivers\vmstorfl.sys
18:31:02.0390 3796 storflt - ok
18:31:02.0437 3796 storvsc (8fccbefc5c440b3c23454656e551b09a) C:\Windows\system32\drivers\storvsc.sys
18:31:02.0437 3796 storvsc - ok
18:31:02.0452 3796 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
18:31:02.0452 3796 swenum - ok
18:31:02.0546 3796 Tcpip (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\drivers\tcpip.sys
18:31:02.0577 3796 Tcpip - ok
18:31:02.0640 3796 TCPIP6 (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\DRIVERS\tcpip.sys
18:31:02.0655 3796 TCPIP6 - ok
18:31:02.0686 3796 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
18:31:02.0686 3796 tcpipreg - ok
18:31:02.0702 3796 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
18:31:02.0718 3796 TDPIPE - ok
18:31:02.0718 3796 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
18:31:02.0718 3796 TDTCP - ok
18:31:02.0764 3796 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
18:31:02.0764 3796 tdx - ok
18:31:02.0796 3796 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\drivers\termdd.sys
18:31:02.0796 3796 TermDD - ok
18:31:02.0827 3796 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
18:31:02.0827 3796 tssecsrv - ok
18:31:02.0858 3796 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
18:31:02.0858 3796 tunnel - ok
18:31:02.0889 3796 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
18:31:02.0889 3796 uagp35 - ok
18:31:02.0920 3796 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
18:31:02.0920 3796 udfs - ok
18:31:02.0952 3796 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
18:31:02.0952 3796 uliagpkx - ok
18:31:03.0014 3796 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\drivers\umbus.sys
18:31:03.0014 3796 umbus - ok
18:31:03.0014 3796 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
18:31:03.0014 3796 UmPass - ok
18:31:03.0076 3796 USBAAPL64 (f724b03c3dfaacf08d17d38bf3333583) C:\Windows\system32\Drivers\usbaapl64.sys
18:31:03.0076 3796 USBAAPL64 - ok
18:31:03.0108 3796 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys
18:31:03.0108 3796 usbaudio - ok
18:31:03.0154 3796 usbccgp (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys
18:31:03.0154 3796 usbccgp - ok
18:31:03.0170 3796 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
18:31:03.0170 3796 usbcir - ok
18:31:03.0201 3796 usbehci (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\DRIVERS\usbehci.sys
18:31:03.0201 3796 usbehci - ok
18:31:03.0232 3796 usbhub (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys
18:31:03.0232 3796 usbhub - ok
18:31:03.0248 3796 usbohci (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\drivers\usbohci.sys
18:31:03.0248 3796 usbohci - ok
18:31:03.0279 3796 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
18:31:03.0279 3796 usbprint - ok
18:31:03.0310 3796 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\drivers\USBSTOR.SYS
18:31:03.0310 3796 USBSTOR - ok
18:31:03.0326 3796 usbuhci (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\DRIVERS\usbuhci.sys
18:31:03.0326 3796 usbuhci - ok
18:31:03.0357 3796 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
18:31:03.0357 3796 vdrvroot - ok
18:31:03.0373 3796 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
18:31:03.0388 3796 vga - ok
18:31:03.0404 3796 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
18:31:03.0404 3796 VgaSave - ok
18:31:03.0435 3796 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\drivers\vhdmp.sys
18:31:03.0435 3796 vhdmp - ok
18:31:03.0482 3796 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
18:31:03.0482 3796 viaide - ok
18:31:03.0513 3796 vmbus (1501699d7eda984abc4155a7da5738d1) C:\Windows\system32\drivers\vmbus.sys
18:31:03.0513 3796 vmbus - ok
18:31:03.0544 3796 VMBusHID (ae10c35761889e65a6f7176937c5592c) C:\Windows\system32\drivers\VMBusHID.sys
18:31:03.0544 3796 VMBusHID - ok
18:31:03.0576 3796 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\drivers\volmgr.sys
18:31:03.0576 3796 volmgr - ok
18:31:03.0607 3796 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
18:31:03.0622 3796 volmgrx - ok
18:31:03.0638 3796 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\drivers\volsnap.sys
18:31:03.0638 3796 volsnap - ok
18:31:03.0716 3796 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
18:31:03.0716 3796 vsmraid - ok
18:31:03.0732 3796 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
18:31:03.0732 3796 vwifibus - ok
18:31:03.0778 3796 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
18:31:03.0778 3796 WacomPen - ok
18:31:03.0810 3796 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
18:31:03.0810 3796 WANARP - ok
18:31:03.0825 3796 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
18:31:03.0825 3796 Wanarpv6 - ok
18:31:03.0856 3796 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
18:31:03.0856 3796 Wd - ok
18:31:03.0888 3796 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
18:31:03.0903 3796 Wdf01000 - ok
18:31:03.0950 3796 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
18:31:03.0950 3796 WfpLwf - ok
18:31:03.0966 3796 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
18:31:03.0966 3796 WIMMount - ok
18:31:04.0044 3796 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys
18:31:04.0044 3796 WinUsb - ok
18:31:04.0075 3796 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
18:31:04.0075 3796 WmiAcpi - ok
18:31:04.0106 3796 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
18:31:04.0106 3796 ws2ifsl - ok
18:31:04.0137 3796 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
18:31:04.0137 3796 WudfPf - ok
18:31:04.0168 3796 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
18:31:04.0184 3796 WUDFRd - ok
18:31:04.0231 3796 xusb21 (2ee48cfce7ca8e0db4c44c7476c0943b) C:\Windows\system32\DRIVERS\xusb21.sys
18:31:04.0231 3796 xusb21 - ok
18:31:04.0246 3796 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
18:31:04.0262 3796 \Device\Harddisk0\DR0 - ok
18:31:04.0262 3796 Boot (0x1200) (88c96bfe1bc02fe223dc0ef3c6f19df3) \Device\Harddisk0\DR0\Partition0
18:31:04.0262 3796 \Device\Harddisk0\DR0\Partition0 - ok
18:31:04.0278 3796 Boot (0x1200) (70b4511bd479a5299c5ce3681406de81) \Device\Harddisk0\DR0\Partition1
18:31:04.0278 3796 \Device\Harddisk0\DR0\Partition1 - ok
18:31:04.0293 3796 Boot (0x1200) (79dd5ebb5f3be1a85bbc34114e536bc3) \Device\Harddisk0\DR0\Partition2
18:31:04.0293 3796 \Device\Harddisk0\DR0\Partition2 - ok
18:31:04.0293 3796 ============================================================
18:31:04.0293 3796 Scan finished
18:31:04.0293 3796 ============================================================
18:31:04.0309 2716 Detected object count: 0
18:31:04.0309 2716 Actual detected object count: 0

#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:57 PM

Posted 09 November 2011 - 08:56 PM

Hello

This is the tool I would like you to try and run next.

Please download aswMBR ( 511KB ) to your desktop.
  • Double click the aswMBR.exe icon to run it
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.



Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 svan81

svan81
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:03:57 PM

Posted 09 November 2011 - 09:14 PM

Here is the log:

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-11-09 21:05:14
-----------------------------
21:05:14.025 OS Version: Windows x64 6.1.7600
21:05:14.025 Number of processors: 2 586 0x1706
21:05:14.025 ComputerName: STEVE-PC UserName: Steve
21:05:15.289 Initialize success
21:06:21.645 AVAST engine defs: 11110901
21:06:26.846 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP5T0L0-5
21:06:26.846 Disk 0 Vendor: ST3250410AS 3.AAC Size: 238474MB BusType: 3
21:06:28.874 Disk 0 MBR read successfully
21:06:28.874 Disk 0 MBR scan
21:06:28.890 Disk 0 Windows 7 default MBR code
21:06:28.890 Disk 0 MBR hidden
21:06:28.890 Service scanning
21:06:30.028 Modules scanning
21:06:30.028 Disk 0 trace - called modules:
21:06:30.028 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80027da334]<<
21:06:30.044 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80027be060]
21:06:30.044 3 CLASSPNP.SYS[fffff8800184543f] -> nt!IofCallDriver -> [0xfffffa800225ce40]
21:06:30.044 5 ACPI.sys[fffff88000e0b781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP5T0L0-5[0xfffffa80026b3060]
21:06:30.044 \Driver\atapi[0xfffffa80022553f0] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xfffffa80027da334
21:06:31.495 AVAST engine scan C:\Windows
21:06:32.899 AVAST engine scan C:\Windows\system32
21:07:47.732 AVAST engine scan C:\Windows\system32\drivers
21:07:54.643 AVAST engine scan C:\Users\Steve
21:12:24.539 AVAST engine scan C:\ProgramData
21:12:43.540 Scan finished successfully
21:13:45.839 Disk 0 MBR has been saved successfully to "C:\Users\Steve\Desktop\MBR.dat"
21:13:45.854 The log file has been saved successfully to "C:\Users\Steve\Desktop\aswMBR.txt"

#8 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:57 PM

Posted 11 November 2011 - 12:36 AM

Please download Kaspersky Virus Removal Tool and SAVE it to your desktop

  • Right click and run as admin (xp please double click to run)
  • select lang
  • click on next
  • accept the license aggreement
  • select location and click on next
  • in autoscan make sure the first three boxes are checked and the box next to the C:/ drive
  • click on start scan
  • when complete click on report
  • in the three drop down boxes choose autoscan - do not group and important events
  • click on save and save to desktop
  • copy and paste this report in your next post

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#9 svan81

svan81
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:03:57 PM

Posted 11 November 2011 - 04:18 PM

Here is the log:

Status: Disinfected (events: 19)
11/11/2011 6:18:58 AM Disinfected Trojan program Exploit.Java.CVE-2010-0840.t File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\ 2dfc311-14cb51ae High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.OpenStream.bo File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\2dfc311-14cb51ae/favort/ gijupo.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.Agent.im File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\ 416192d3-7101fdfd High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.Agent.im File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\416192d3-7101fdfd/ g6k1.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.OpenStream.bo File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\2dfc311-14cb51ae/favort/ jora.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.Agent.im File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\416192d3-7101fdfd/ y6u7.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.Agent.im File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\416192d3-7101fdfd/ g5z6.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.OpenStream.bo File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\2dfc311-14cb51ae/favort/ kilop.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.Agent.im File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\416192d3-7101fdfd/ main.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.OpenStream.bo File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\2dfc311-14cb51ae/favort/ maria.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.Agent.im File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\416192d3-7101fdfd/ q3p0.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Exploit.Java.CVE-2010-0840.t File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\2dfc311-14cb51ae/favort/ siurele.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.Agent.im File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\416192d3-7101fdfd/ h6l4.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.Agent.im File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\416192d3-7101fdfd/ b5n3.class High
11/11/2011 6:18:58 AM Disinfected Trojan program Trojan-Downloader.Java.Agent.im File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\416192d3-7101fdfd/ Tuggoaerffb.class High
11/11/2011 6:19:30 AM Disinfected Trojan program Exploit.Java.CVE-2010-0840.cs File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\ 74cf5ee8-1c4df433 High
11/11/2011 6:19:30 AM Disinfected Trojan program Exploit.Java.CVE-2010-0840.cs File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\74cf5ee8-1c4df433/mail/ MailAgent.class High
11/11/2011 6:20:07 AM Disinfected Trojan program Exploit.Java.CVE-2010-0840.eh File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\ 63f80ab9-47c1e47a High
11/11/2011 6:20:07 AM Disinfected Trojan program Exploit.Java.CVE-2010-0840.eh File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\63f80ab9-47c1e47a/json/ Parser.class High
Status: Absent (events: 3)
11/11/2011 6:20:09 AM Not found Trojan program Exploit.Java.CVE-2010-4452.a File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\ 478781e4-192aec24 High
11/11/2011 6:20:09 AM Not found Trojan program Exploit.Java.CVE-2010-4452.a File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\ 478781e4-22504c3e High
11/11/2011 6:20:09 AM Not found Trojan program Exploit.Java.CVE-2010-4452.a File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\ 478781e4-2e125944 High
Status: Deleted (events: 5)
11/11/2011 6:19:25 AM Deleted Trojan program Exploit.Java.CVE-2010-4452.a File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\ 478781e4-3f2b4e20 High
11/11/2011 6:19:26 AM Deleted Trojan program Exploit.Java.CVE-2010-4452.a File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\ 478781e4-4f1bd319 High
11/11/2011 6:19:26 AM Deleted Trojan program Exploit.Java.CVE-2010-4452.a File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\ 478781e4-68b7f7e7 High
11/11/2011 6:19:31 AM Deleted Trojan program Exploit.Java.CVE-2010-4452.a File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\ 3da29c4-3778cfda High
11/11/2011 6:19:31 AM Deleted Trojan program Exploit.Java.CVE-2010-4452.a File C:\Documents and Settings\Steve\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\ 3da29c4-6c0b81db High

#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:57 PM

Posted 11 November 2011 - 10:14 PM

How are things doing now?

gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 svan81

svan81
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:03:57 PM

Posted 11 November 2011 - 10:37 PM

Same. Iexplorer starts on its own, but runs hidden in the background, while slowly taking up more and more resources. Sometimes musics plays. The google redirect is also still there.

#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:57 PM

Posted 14 November 2011 - 08:15 PM

Try this please. You will need a USB drive.

Download http://unetbootin.sourceforge.net/unetbootin-xpud-windows-latest.exe & http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of your clean computer
  • Insert your USB drive
  • Press Start > My Computer > right click your USB drive > choose Format > Quick format
  • Double click the unetbootin-xpud-windows-387.exe that you just downloaded
  • Press Run then OK
  • Select the DiskImage option then click the browse button located on the right side of the textbox field.
  • Browse to and select the xpud-0.9.2.iso file you downloaded
  • Verify the correct drive letter is selected for your USB device then click OK
  • It will install a little bootable OS on your USB device
  • Once the files have been written to the device you will be prompted to reboot ~ do not reboot and instead just Exit the UNetbootin interface
  • After it has completed do not choose to reboot the clean computer simply close the installer
  • Next download http://noahdfear.net/downloads/driver.sh to your USB
  • Remove the USB and insert it in the sick computer
  • Boot the Sick computer
  • Press F12 and choose to boot from the USB
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh
  • Press Enter
  • After it has finished a report will be located on your USB drive named report.txt
  • Remove the USB drive and insert back in your working computer and navigate to report.txt

    Please note - all text entries are case sensitive
Copy and paste the report.txt for my review
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 svan81

svan81
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:03:57 PM

Posted 14 November 2011 - 11:27 PM

Ok, I will use a clean computer at work tomorrow with a USB to get you that report. Thanks.

#14 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:57 PM

Posted 14 November 2011 - 11:31 PM

:thumbup2:
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#15 svan81

svan81
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:03:57 PM

Posted 15 November 2011 - 06:49 PM

When I first tried to boot from the USB drive my usb keyboard was not working in BIOS. When I got to the boot menu, either the keys wouldn't work or it would just keep paging down the selections over and over. So I plugged in a ps2 keyboard, which worked, but it still wouldn't let me boot from the usb through the boot menu so I had to manually change the boot order in bios and that actually worked. So here is the report:

Tue Nov 15 18:21:44 UTC 2011
Driver report for /mnt/sda2/Windows/System32/drivers

64edd3f59db321947969fdf1dd747323 1394bus.sys
Microsoft Corporation

1b00662092f9f9568b995902f0cc40d5 1394ohci.sys
Microsoft Corporation

63b05a0420ce4bf0e4af6dcc7cada254 acpipmi.sys
Microsoft Corporation

6f11e88748cdefd2f76aa215f97ddfe5 acpi.sys
Microsoft Corporation

2f6b34b83843f0c5118b63ac634f5bf4 adp94xx.sys
Adaptec

597f78224ee9224ea1a13d6350ced962 adpahci.sys
Adaptec

e109549c90f62fb570b9540c4b148e54 adpu320.sys
Adaptec

6ef20ddf3172e97d69f596fb90602f29 afd.sys
Microsoft Corporation

7ecff9b22276b73f43a99a15a6094e90 agilevpn.sys
Microsoft Corporation

608c14dba7299d8cb6ed035a68a15799 AGP440.sys
Microsoft Corporation

5812713a477a3ad7363c7438ca2ee038 aliide.sys
Acer Laboratories

1ff8b4431c353ce385c875f194924c0c amdide.sys
Microsoft Corporation

7024f087cff1833a806193ef9d22cda9 amdk8.sys
Microsoft Corporation

1e56388b3fe0d031c44144eb8c4d6217 amdppm.sys
Microsoft Corporation

ec7ebab00a4d8448bab68d1e49b4beb9 amdsata.sys
Advanced Micro Devices

f67f933e79241ed32ff46a4f29b5120b amdsbs.sys
AMD Technologies

db27766102c7bf7e95140a2aa81d042e amdxata.sys
Advanced Micro Devices

42fd751b27fa0e9c69bb39f39e409594 appid.sys
Microsoft Corporation

019af6924aefe7839f61c830227fe79c arcsas.sys
Adaptec

c484f8ceb1717c540242531db7845c4e arc.sys
Adaptec

769765ce2cc62867468cea93969b2242 asyncmac.sys
Microsoft Corporation

02062c0b390b7729edc9e69c680a6f3c atapi.sys
Microsoft Corporation

aa2186f7944104a16d6ed176ed462cec ataport.sys
Microsoft Corporation

b5ace6968304a3900eeb1ebfd9622df2 b57nd60a.sys
Broadcom Corporation

f4de2ae7a9e1badac70bc71ea2c17612 battc.sys
Microsoft Corporation

16a47ce2decc9b099349a5f840654746 beep.sys
Microsoft Corporation

61583ee3c3a17003c4acd0475646b4d3 blbdrive.sys
Microsoft Corporation

19d20159708e152267e53b66677a4995 bowser.sys
Microsoft Corporation

f09eee9edc320b5e1501f749fde686c8 BrFiltLo.sys
Brother Industries

b114d3098e9bdb8bea8b053685831be6 BrFiltUp.sys
Brother Industries

5c2f352a4e961d72518261257aae204b bridge.sys
Microsoft Corporation

43bea8d483bf1870f018e2d02e06a5bd BrSerId.sys
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries

a6eca2151b08a09caceca35c07f05b42 BrSerWdm.sys
Brother Industries

b79968002c277e869cf38bd22cd61524 BrUsbMdm.sys
Brother Industries

a87528880231c54e75ea7a44943b38bf BrUsbSer.sys
Brother Industries

9da669f11d1f894ab4eb69bf546a42e8 bthmodem.sys
Microsoft Corporation

3e5b191307609f7514148c6832bb0842 bxvbda.sys
Broadcom Corporation

b8bd2bb284668c84865658c77574381a cdfs.sys
Microsoft Corporation

83d2d75e1efb81b3450c18131443f7db cdrom.sys
Microsoft Corporation

d7cd5c4e1b71fa62050515314cfb52cf circlass.sys
Microsoft Corporation

62f1ed63f0cb0b5a2f65d15a6490c2fd Classpnp.sys
Microsoft Corporation

0840155d0bddf1190f84a663c284bd33 CmBatt.sys
Microsoft Corporation

e19d3f095812725d88f9001985b94edd cmdide.sys
CMD Technology

f95fd4cb7da00ba2a63ce9f6b5c053e1 cng.sys
Microsoft Corporation

102de219c3f61415f964c88e9085ad14 compbatt.sys
Microsoft Corporation

f26b3a86f6fa87ca360b879581ab4123 CompositeBus.sys
Microsoft Corporation

3e588b60ec061686ba05d33574a344c6 crashdmp.sys
Microsoft Corporation

1c827878a998c18847245fe1f34ee597 crcdisk.sys
Microsoft Corporation

4a6173c2279b498cd8f57cae504564cb csc.sys
Microsoft Corporation

9c253ce7311ca60fc11c774692a13208 dfsc.sys
Microsoft Corporation

13096b05847ec78f0977f2c0f79e9ab3 discache.sys
Microsoft Corporation

20080512f61d3210e449a1256f66a7fd Diskdump.sys
Microsoft Corporation

9819eee8b5ea3784ec4af3b137a5244c disk.sys
Microsoft Corporation

9b19f34400d24df84c858a421c205754 drmkaud.sys
Microsoft Corporation

21d26064aedb4988f785bb4a3a2c051e drmk.sys
Microsoft Corporation

839b5fe3d48e9f35b22c21a3d5103f6c Dumpata.sys
Microsoft Corporation

814db88f2641691575a455cf25354098 dumpfve.sys
Microsoft Corporation

bf24d6f2ed97fe830bfd52b246f98e67 dxapi.sys
Microsoft Corporation

1633b9abf52784a1331476397a48cbef dxgkrnl.sys
Microsoft Corporation

3238b9078e0766ab5e62dc737a809adb dxgmms1.sys
Microsoft Corporation

fede0629ecb23650d48989517d4914da dxg.sys
Microsoft Corporation

0e5da5369a0fcaea12456dd852545184 elxstor.sys
Emulex

34a3c54752046e79a126e15c51db409b errdev.sys
Microsoft Corporation

dc5d737f51be844d8c82c695eb17372f evbda.sys
Broadcom Corporation

a510c654ec00c1e9bdd91eeb3a59823b exfat.sys
Microsoft Corporation

0adc83218b66a6db380c330836f3e36d fastfat.sys
Microsoft Corporation

d765d19cd8ef61f650c384f62fac00ab fdc.sys
Microsoft Corporation

655661be46b5f5f3fd454e2c3095b930 fileinfo.sys
Microsoft Corporation

5f671ab5bc87eea04ec38a6cd5962a47 filetrace.sys
Microsoft Corporation

c172a0f53008eaeb8ea33fe10e177af5 flpydisk.sys
Microsoft Corporation

f7866af72abbaf84b1fa5aa195378c59 fltMgr.sys
Microsoft Corporation

d43703496149971890703b4b1b723eac fsdepends.sys
Microsoft Corporation

e95ef8547de20cf0603557c0cf7a9462 fs_rec.sys
Microsoft Corporation

ae87ba80d0ec3b57126ed2cdc15b24ed fvevol.sys
Microsoft Corporation

50555005e22a56aef10be607472d0bdc FWPKCLNT.SYS
Microsoft Corporation

8c778d335c9d272cfd3298ab02abe3b6 GAGP30KX.SYS
Microsoft Corporation

e403aacf8c7bb11375122d2464560311 GEARAspiWDM.sys
GEAR Software

f2523ef6460fc42405b12248338ab2f0 hcw85cir.sys
Hauppauge Computer Works

0a49913402747a0b67de940fb42cbdbb hdaudbus.sys
Microsoft Corporation

6410f6f415b2a5a9037224c41da8bf12 HdAudio.sys
Microsoft Corporation

78e86380454a7b10a5eb255dc44a355f hidbatt.sys
Microsoft Corporation

7fd2a313f7afe5c4dab14798c48dd104 hidbth.sys
Microsoft Corporation

685fec2407fc121eb937cb658b3c0f35 hidclass.sys
Microsoft Corporation

0a77d29f311b88cfae3b13f9c1a73825 hidir.sys
Microsoft Corporation

49ee2e52e6cd03947dad72f65367be06 hidparse.sys
Microsoft Corporation

b3bf6b5b50006def50b66306d99fcf6f hidusb.sys
Microsoft Corporation

0886d440058f203eba0e1825e4355914 HpSAMD.sys
Hewlett-Packard

cee049cac4efa7f4e1e4ad014414a5d4 http.sys
Microsoft Corporation

f17766a19145f111856378df337a5d79 hwpolicy.sys
Microsoft Corporation

fa55c73d4affa7ee23ac4be53b4592d3 i8042prt.sys
Microsoft Corporation

b75e45c564e944a2657167d197ab29da iaStorV.sys
Intel Corporation

5c18831c61933628f5bb0ea2675b9d21 iirsp.sys
Intel Corp

f00f20e70c6ec3aa366910083a0518aa intelide.sys
Microsoft Corporation

ada036632c664caa754079041cf1f8c1 intelppm.sys
Microsoft Corporation

722dd294df62483cecaae6e094b4d695 ipfltdrv.sys
Microsoft Corporation

e2b4a4494db7cb9b89b55ca268c337c5 IPMIDrv.sys
Microsoft Corporation

af9b39a7e7b6caa203b3862582e9f2d0 ipnat.sys
Microsoft Corporation

05360b1ea5a2abf620d1d96ebd8bd8f1 irda.sys
Microsoft Corporation

3abf5e7213eb28966d55d58b515d5ce9 irenum.sys
Microsoft Corporation

2f7b28dc3e1183e5eb418df55c204f38 isapnp.sys
Microsoft Corporation

bc02336f1cba7dcc7d1213bb588a68a5 kbdclass.sys
Microsoft Corporation

6def98f8541e1b5dceb2c822a11f7323 kbdhid.sys
Microsoft Corporation

e8b6fcc9c83535c67f835d407620bd27 ksecdd.sys
Microsoft Corporation

a8c63880ef6f4d3fec7b616b9c060215 ksecpkg.sys
Microsoft Corporation

5c7af4a20f5bf67042b2e613d123d111 ks.sys
Microsoft Corporation

6869281e78cb31a43e969f06b57347c4 ksthunk.sys
Microsoft Corporation

1538831cf8ad2979a04c423779465827 lltdio.sys
Microsoft Corporation

1a93e54eb0ece102495a51266dcdb6a6 lsi_fc.sys
LSI Corporation

30f5c0de1ee8b5bc9306c1f0e4a75f93 lsi_sas2.sys
LSI Corporation

1047184a9fdc8bdbff857175875ee810 lsi_sas.sys
LSI Corporation

0504eacaff0d3c8aed161c4b0d369d4a lsi_scsi.sys
LSI Corporation

43d0f98e1d56ccddb0d5254cff7b356e luafv.sys
Microsoft Corporation

3c9f072f9dca856b9fb7a20cbd4281ac mcd.sys
Microsoft Corporation

a55805f747c6edb6a9080d7c633bd0f4 megasas.sys
LSI Corporation

baf74ce0072480c3b6b7c13b2a94d6b3 MegaSR.sys
LSI Corporation

800ba92f7010378b09f9ed9270f07137 modem.sys
Microsoft Corporation

b03d591dc7da45ece20b3b467e6aadaa monitor.sys
Microsoft Corporation

7d27ea49f3c1f687d357e77a470aea99 mouclass.sys
Microsoft Corporation

d3bf052c40b0c4166d9fd86a4288c1e6 mouhid.sys
Microsoft Corporation

791af66c4d0e7c90a3646066386fb571 mountmgr.sys
Microsoft Corporation

609d1d87649ecc19796f4d76d4c15cea mpio.sys
Microsoft Corporation

6c38c9e45ae0ea2fa5e551f2ed5e978f mpsdrv.sys
Microsoft Corporation

30524261bb51d96d6fcbac20c810183c mrxdav.sys
Microsoft Corporation

f0067552f8f9b33d7c59403ab808a3cb mrxsmb10.sys
Microsoft Corporation

3c142d31de9f2f193218a53fe2632051 mrxsmb20.sys
Microsoft Corporation

040d62a9d8ad28922632137acdd984f2 mrxsmb.sys
Microsoft Corporation

5c37497276e3b3a5488b23a326a754b7 msahci.sys
Microsoft Corporation

8d27b597229aed79430fb9db3bcbfbd0 msdsm.sys
Microsoft Corporation

aa3fb40e17ce1388fa1bedab50ea8f96 msfs.sys
Microsoft Corporation

f9d215a46a8b9753f61767fa72a20326 mshidkmdf.sys
Microsoft Corporation

d916874bbd4f8b07bfb7fa9b3ccae29d msisadrv.sys
Microsoft Corporation

fa4d2557de56d45b0a346f93564be6e1 msiscsi.sys
Microsoft Corporation

49ccf2c4fea34ffad8b1b59d49439366 mskssrv.sys
Microsoft Corporation

bdd71ace35a232104ddd349ee70e1ab3 mspclock.sys
Microsoft Corporation

4ed981241db27c3383d72092b618a1d0 mspqm.sys
Microsoft Corporation

89cb141aa8616d8c6a4610fa26c60964 msrpc.sys
Microsoft Corporation

0eed230e37515a0eaee3c2e1bc97b288 mssmbios.sys
Microsoft Corporation

2e66f9ecb30b4221a318c92ac2250779 mstee.sys
Microsoft Corporation

7ea404308934e675bffde8edf0757bcd MTConfig.sys
Microsoft Corporation

f9a18612fd3526fe473c1bda678d61c8 mup.sys
Microsoft Corporation

9f9a1f53aad7da4d6fef5bb73ab811ac ndiscap.sys
Microsoft Corporation

cad515dbd07d082bb317d9928ce8962c ndis.sys
Microsoft Corporation

30639c932d9fef22b31268fe25a1b6e5 ndistapi.sys
Microsoft Corporation

f105ba1e22bf1f2ee8f005d4305e4bec ndisuio.sys
Microsoft Corporation

557dfab9ca1fcb036ac77564c010dad3 ndiswan.sys
Microsoft Corporation

659b74fb74b86228d6338d643cd3e3cf ndproxy.sys
Microsoft Corporation

86743d9f5d2b1048062b14b1d84501c4 netbios.sys
Microsoft Corporation

9162b273a44ab9dce5b44362731d062a netbt.sys
Microsoft Corporation

7b8403912673a87ea6622f5cb867a670 netio.sys
Microsoft Corporation

77889813be4d166cdab78ddba990da92 nfrd960.sys
IBM Corp

1e4c4ab5c9b8dd13179bbdc75a2a01f7 npfs.sys
Microsoft Corporation

e7f5ae18af4168178a642a9247c63001 nsiproxy.sys
Microsoft Corporation

378e0e0dfea67d98ae6ea53adbbd76bc ntfs.sys
Microsoft Corporation

9899284589f75fa8724ff3d16aed75c1 null.sys
Microsoft Corporation

270d7cd42d6e3979f6dd0146650f0e05 NV_AGP.SYS
Microsoft Corporation

b15258b1f45f9571758ac6bb2f043b01 nvlddmkm.sys
NVIDIA Corporation

a4d9c9a608a97f59307c2f2600edc6a4 nvraid.sys
NVIDIA Corporation

6c1d5f70e7a6a3fd1c90d840edc048b9 nvstor.sys
NVIDIA Corporation

1ea3749c4114db3e3161156ffffa6b33 nwifi.sys
Microsoft Corporation

3589478e4b22ce21b41fa1bfc0b8b8a0 ohci1394.sys
Microsoft Corporation

ee992183bd8eaefd9973f352e587a299 pacer.sys
Microsoft Corporation

0086431c29c35be1dbc43f52cc273887 parport.sys
Microsoft Corporation

7daa117143316c4a1537e074a5a9eaf0 partmgr.sys
Microsoft Corporation

b5b8b5ef2e5cb34df8dcf8831e3534fa pciide.sys
Microsoft Corporation

144497daa145ba0f7be896064146c058 pciidex.sys
Microsoft Corporation

f36f6504009f2fb0dfd1b17a116ad74b pci.sys
Microsoft Corporation

b2e81d4e87ce48589f98cb8c05b01f2f pcmcia.sys
Microsoft Corporation

d6b9c2e1a11a3a4b26a182ffef18f603 pcw.sys
Microsoft Corporation

68769c3356b3be5d1c732c97b9a80d6e PEAuth.sys
Microsoft Corporation

32e11315b5126921ffd9074840ef13d3 portcls.sys
Microsoft Corporation

0d922e23c041efb1c3fac2a6f943c9bf processr.sys
Microsoft Corporation

a53a15a11ebfd21077463ee2c7afeef0 ql2300.sys
QLogic Corporation

4f6d12b51de1aaeff7dc58c4d75423c8 ql40xx.sys
QLogic Corporation

76707bb36430888d9ce9d705398adb6c qwavedrv.sys
Microsoft Corporation

5a0da8ad5762fa2d91678a8a01311704 rasacd.sys
Microsoft Corporation

87a6e852a22991580d6d39adc4790463 rasl2tp.sys
Microsoft Corporation

855c9b1cd4756c5e9a2aa58a15f58c25 raspppoe.sys
Microsoft Corporation

27cc19e81ba5e3403c48302127bda717 raspptp.sys
Microsoft Corporation

e8b1e447b008d07ff47d016c2b0eeecb rassstp.sys
Microsoft Corporation

3bac8142102c15d59a87757c1d41dce5 rdbss.sys
Microsoft Corporation

302da2a0539f2cf54d7c6cc30c1f2d8d rdpbus.sys
Microsoft Corporation

cea6cc257fc9b7715f1c2b4849286d24 RDPCDD.sys
Microsoft Corporation

9706b84dbabfc4b4ca46c5a82b14dfa3 rdpdr.sys
Microsoft Corporation

bb5971a4f00659529a5c44831af22365 RDPENCDD.sys
Microsoft Corporation

216f3fa57533d98e1f74ded70113177a RDPREFMP.sys
Microsoft Corporation

8a3e6bea1c53ea6177fe2b6eba2c80d7 rdpwd.sys
Microsoft Corporation

634b9a2181d98f15941236886164ec8b rdyboost.sys
Microsoft Corporation

77b3b747eb2413072b8e4306018d0c9b rmcast.sys
Microsoft Corporation

fc6d5c50d846b795335deb3fce8b33f3 RNDISMP.sys
Microsoft Corporation

388d3dd1a6457280f3badba9f3acd6b1 rootmdm.sys
Microsoft Corporation

ddc86e4f8e7456261e637e3552e804ff rspndr.sys
Microsoft Corporation

baefee35d27a5440d35092ce10267bec Rt64win7.sys
Realtek Corporation

e3bbb89983daf5622c1d50cf49f28227 sbp2port.sys
Microsoft Corporation

c94da20c7e3ba1dca269bc8460d98387 scfilter.sys
Microsoft Corporation

ad3a6838a059d65fb55d2f61cf0a6c1f scsiport.sys
Microsoft Corporation

3ea8a16169c26afbeb544e0e48421186 secdrv.sys
Macrovision Corporation

cb624c0035412af0debec78c41f5ca1b serenum.sys
Microsoft Corporation

c1d8e28b2c2adfaec4ba89e9fda69bd6 serial.sys
Microsoft Corporation

1c545a7d0691cc4a027396535691c3e3 sermouse.sys
Microsoft Corporation

a554811bcd09279536440c964ae35bbf sffdisk.sys
Microsoft Corporation

ff414f0baefeba59bc6c04b3db0b87bf sffp_mmc.sys
Microsoft Corporation

5588b8c6193eb1522490c122eb94dffa sffp_sd.sys
Microsoft Corporation

a9d601643a1647211a1ee2ec4e433ff4 sfloppy.sys
Microsoft Corporation

843caf1e5fde1ffd5ff768f23a51e2e1 sisraid2.sys
Silicon Integrated Systems

6a6c106d42e9ffff8b9fcb4f754f6da4 sisraid4.sys
Silicon Integrated Systems

548260a7b8654e024dc30bf8a7c5baa4 smb.sys
Microsoft Corporation

a80348ba03e96c70852959655ca3e084 smclib.sys
Microsoft Corporation

b9e31e5cacdfe584f34f730a677803f9 spldr.sys
Microsoft Corporation

fff95479c7ab1550f0750a5d01744211 spsys.sys
Microsoft Corporation

76548f7b818881b47d8d1ae1be9c11f8 srv2.sys
Microsoft Corporation

0af6e19d39c70844c5caa8fb0183c36e srvnet.sys
Microsoft Corporation

2408c0366d96bcdf63e8f1c78e4a29c5 srv.sys
Microsoft Corporation

f3817967ed533d08327dc73bc4d5542a stexstor.sys
Promise Technology

cfd8802cac57d3afe0c687786e9e55f8 storport.sys
Microsoft Corporation

8fccbefc5c440b3c23454656e551b09a storvsc.sys
Microsoft Corporation

001cc10fa5e71ae1119115e126c8750d stream.sys
Microsoft Corporation

d01ec09b6711a5f8e7e6564a4d0fbc90 swenum.sys
Microsoft Corporation

6e316c01cba8b785fe495f5cc4f48c6f tape.sys
Microsoft Corporation

76d078af6f587b162d50210f761eb9ed tcpipreg.sys
Microsoft Corporation

f18f56efc0bfb9c87ba01c37b27f4da5 tcpip.sys
Microsoft Corporation

0ca6fe26acc7ffee1bd0463f40835f32 tdi.sys
Microsoft Corporation

3371d21011695b16333a3934340c4e7c tdpipe.sys
Microsoft Corporation

e4245bda3190a582d55ed09e137401a9 tdtcp.sys
Microsoft Corporation

079125c4b17b01fcaeebce0bcb290c0f tdx.sys
Microsoft Corporation

c448651339196c0e869a355171875522 termdd.sys
Microsoft Corporation

61b96c26131e37b24e93327a0bd1fb95 tssecsrv.sys
Microsoft Corporation

3836171a2cdf3af8ef10856db9835a70 tunnel.sys
Microsoft Corporation

b4dd609bd7e282bfc683cec7eaaaad67 UAGP35.SYS
Microsoft Corporation

d47baead86c65d4f4069d7ce0a4edceb udfs.sys
Microsoft Corporation

4bfe1bc28391222894cbf1e7d0e42320 ULIAGPKX.SYS
Microsoft Corporation

eab6c35e62b1b0db0d1b48b671d3a117 umbus.sys
Microsoft Corporation

b2e8e8cb557b156da5493bbddcc1474d umpass.sys
Microsoft Corporation

d0fe8cb5f84303e73ff0754437fad3d1 usb8023.sys
Microsoft Corporation

f724b03c3dfaacf08d17d38bf3333583 usbaapl64.sys
Apple

77b01bc848298223a95d4ec23e1785a1 USBAUDIO.sys
Microsoft Corporation

faec06c1d24e2770ecc4f7c37659824d USBCAMD2.sys
Microsoft Corporation

7b6a127c93ee590e4d79a5f2a76fe46f usbccgp.sys
Microsoft Corporation

af0892a803fdda7492f595368e3b68e7 usbcir.sys
Microsoft Corporation

70b5a5a7e0ddd5ebaf6e35b7257a6b9d usbd.sys
Microsoft Corporation

92969ba5ac44e229c55a332864f79677 usbehci.sys
Microsoft Corporation

e7df1cfd28ca86b35ef5add0735ceef3 usbhub.sys
Microsoft Corporation

f1bb1e55f1e7a65c5839ccc7b36d773e usbohci.sys
Microsoft Corporation

bbf36eb7117f6b976975c9d8d877df18 usbport.sys
Microsoft Corporation

73188f58fb384e75c4063d29413cee3d usbprint.sys
Microsoft Corporation

8f0d9d2ea6cfed2730b5bafb9b5b11c2 usbrpm.sys
Microsoft Corporation

f39983647bc1f3e6100778ddfe9dce29 USBSTOR.SYS
Microsoft Corporation

bc3070350a491d84b518d7cca9abd36f usbuhci.sys
Microsoft Corporation

c5c876ccfc083ff3b128f933823e87bd vdrvroot.sys
Microsoft Corporation

da4da3f5e02943c2dc8c6ed875de68dd vgapnp.sys
Microsoft Corporation

53e92a310193cb3c03bea963de7d9cfc vga.sys
Microsoft Corporation

c82e748660f62a242b2dfac1442f22a4 vhdmp.sys
Microsoft Corporation

e5689d93ffe4e5d66c0178761240dd54 viaide.sys
VIA Technologies

e7353d59c9842bc7299faeb7e7e09340 videoprt.sys
Microsoft Corporation

ae10c35761889e65a6f7176937c5592c VMBusHID.sys
Microsoft Corporation

1501699d7eda984abc4155a7da5738d1 vmbus.sys
Microsoft Corporation

88af6e02ab19df7fd07ecdf9c91e9af6 vms3cap.sys
Microsoft Corporation

ffd7a6f15b14234b5b0e5d49e7961895 vmstorfl.sys
Microsoft Corporation

2b1a3dae2b4e70dbba822b7a03fbd4a3 volmgr.sys
Microsoft Corporation

99b0cbb569ca79acaed8c91461d765fb volmgrx.sys
Microsoft Corporation

58f82eed8ca24b461441f9c3e4f0bf5c volsnap.sys
Microsoft Corporation

5e2016ea6ebaca03c04feac5f330d997 vsmraid.sys
VIA Technologies

36d4720b72b5c5d9cb2b9c29e9df67a1 vwifibus.sys
Microsoft Corporation

6a3d66263414ff0d6fa754c646612f3f vwififlt.sys
Microsoft Corporation

6a638fc4bfddc4d9b186c28c91bd1a01 vwifimp.sys
Microsoft Corporation

4e9440f4f152a7b944cb1663d3935a3e wacompen.sys
Microsoft Corporation

47ca49400643effd3f1c9a27e1d69324 wanarp.sys
Microsoft Corporation

fc438d1430b28618e2d0c7c332a710ad watchdog.sys
Microsoft Corporation

441bd2d7b4f98134c3a4f9fa570fd250 Wdf01000.sys
Microsoft Corporation

1b409454d7a00110fdb06f7e0f155a88 WdfLdr.sys
Microsoft Corporation

72889e16ff12ba0f235467d6091b17dc wd.sys
Microsoft Corporation

611b23304bf067451a9fdee01fbdd725 wfplwf.sys
Microsoft Corporation

05ecaec3e4529a7153b3136ceb49f0ec wimmount.sys
Microsoft Corporation

aaefb9193b31d7eb2425dd3fb6766640 winhv.sys
Microsoft Corporation

817eaff5d38674edd7713b9dfb8e9791 winusb.sys
Microsoft Corporation

f6ff8944478594d0e414d3f048f0d778 wmiacpi.sys
Microsoft Corporation

fc146f46872d4c5b529b89a5131fd1e6 wmilib.sys
Microsoft Corporation

6bcc1d7d2fd2453957c5479a32364e52 ws2ifsl.sys
Microsoft Corporation

7cadc74271dd6461c452c271b30bd378 WUDFPf.sys
Microsoft Corporation

3b197af0fff08aa66b6b2241ca538d64 WUDFRd.sys
Microsoft Corporation

2ee48cfce7ca8e0db4c44c7476c0943b xusb21.sys
Microsoft Corporation




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users