Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

General check up


  • This topic is locked This topic is locked
18 replies to this topic

#1 grooby

grooby

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:25 AM

Posted 02 March 2012 - 04:49 AM

Hi.

I've had this computer a bit over a year and I want to do an image of the hard drive but first I want to make sure there are no infections. Everything seems alright, I have run a few scans, Avira, MBAM and hitman pro and they all found nothing. I also used Comodo Cleaning Essentials and it also did not find anything bad. The only thing I am still worried about are rootkits, that is why I posted here as scan logs for rootkits are beyond my skill level.

The only symptom I am having is that restore points wont work. Well not last time I tried anyway.

I know I am only supposed to attach the GMER log but it was so small it didn't seem to matter.

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-03-02 17:46:38
Windows 6.1.7601 Service Pack 1
Running: cqg2mosn.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\Dnscache\Parameters\DnsCache@ShutdownOnIdle 1

---- EOF - GMER 1.0.15 ----


DDS LOG

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by a at 17:06:51 on 2012-03-02
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.3894.2678 [GMT 10:00]
.
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Hpservice.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Program Files\IDT\WDM\AESTSr64.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Macrium\Reflect\ReflectService.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\PDF24\pdf24.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
C:\Program Files\Tracker Software\PDF Viewer\PDFXCview.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mWinlogon: Userinit=userinit.exe
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
uRun: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: Interfaces\{45E9BB37-B9C8-4E72-9BB8-A2330CC2B182} : NameServer = 123.200.191.17 123.200.191.18
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun-x64: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\a\AppData\Roaming\Mozilla\Firefox\Profiles\hphxs05b.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;C:\Windows\system32\DRIVERS\avkmgr.sys --> C:\Windows\system32\DRIVERS\avkmgr.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2010-10-25 89600]
R2 AntiVirSchedulerService;Avira Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2011-12-13 86224]
R2 AntiVirService;Avira Realtime Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2011-12-13 110032]
R2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-7-22 103992]
R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-8-6 291896]
R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe --> C:\Windows\system32\Hpservice.exe [?]
R2 ReflectService;Macrium Reflect Image Mounting Service;C:\Program Files\Macrium\Reflect\ReflectService.exe [2011-1-17 301720]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]
R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-10-25 2533400]
R3 clwvd;HP Webcam Splitter;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 ewusbnet;HUAWEI USB-NDIS miniport;C:\Windows\system32\DRIVERS\ewusbnet.sys --> C:\Windows\system32\DRIVERS\ewusbnet.sys [?]
R3 HECIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 Impcd;Impcd;C:\Windows\system32\DRIVERS\Impcd.sys --> C:\Windows\system32\DRIVERS\Impcd.sys [?]
R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
R3 SbieDrv;SbieDrv;C:\Program Files\Sandboxie\SbieDrv.sys [2012-2-8 161432]
R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys --> C:\Windows\system32\DRIVERS\Sftfslh.sys [?]
R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys --> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?]
R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys --> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?]
R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys --> C:\Windows\system32\DRIVERS\Sftvollh.sys [?]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]
S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 PSMounter;Macrium Reflect Image Explorer Service;\??\C:\Windows\system32\drivers\psmounter.sys --> C:\Windows\system32\drivers\psmounter.sys [?]
S3 PSVolAcc;PSVolAcc;C:\Windows\system32\drivers\PSVolAcc.sys --> C:\Windows\system32\drivers\PSVolAcc.sys [?]
S3 pwdrvio;pwdrvio;\??\C:\Windows\system32\pwdrvio.sys --> C:\Windows\system32\pwdrvio.sys [?]
S3 pwdspio;pwdspio;\??\C:\Windows\system32\pwdspio.sys --> C:\Windows\system32\pwdspio.sys [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
.
=============== Created Last 30 ================
.
2012-03-02 06:49:05 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{24B73DF5-01ED-41AC-B91B-75D2DCFD0C84}\offreg.dll
2012-02-26 07:40:20 498688 ----a-w- C:\Windows\System32\drivers\afd.sys
2012-02-26 07:40:19 3145728 ----a-w- C:\Windows\System32\win32k.sys
2012-02-26 07:40:11 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll
2012-02-26 07:40:11 634880 ----a-w- C:\Windows\System32\msvcrt.dll
2012-02-20 08:47:52 134104 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
2012-02-18 08:32:35 -------- d-----w- C:\Users\a\AppData\Local\PDF24
2012-02-18 08:31:55 -------- d-----w- C:\Program Files (x86)\PDF24
2012-02-18 07:41:42 -------- d-----w- C:\Users\a\AppData\Roaming\PDF Writer
2012-02-18 07:41:42 -------- d-----w- C:\Users\a\AppData\Local\PDF Writer
2012-02-18 07:25:08 -------- d-----w- C:\ProgramData\PDF Writer
2012-02-18 07:23:47 101376 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\HPZPPWN7.DLL
2012-02-18 07:23:28 227840 ----a-w- C:\Windows\SysWow64\bzFlRdr.dll
2012-02-18 07:23:28 135168 ----a-w- C:\Windows\SysWow64\bzpdfc.dll
2012-02-18 07:23:28 103424 ----a-w- C:\Windows\SysWow64\bzDCT.dll
2012-02-18 07:23:28 -------- d-----w- C:\Program Files\Common Files\Bullzip
2012-02-18 07:23:25 214528 ----a-w- C:\Windows\System32\bzpdf.dll
2012-02-18 07:23:23 140288 ----a-w- C:\Windows\SysWow64\comdlg32.OCX
2012-02-18 07:23:22 -------- d-----w- C:\Program Files\Bullzip
2012-02-18 04:15:46 1013320 ----a-w- C:\Windows\System32\pwNative.exe
2012-02-18 04:15:45 19936 ------w- C:\Windows\System32\pwdrvio.sys
2012-02-18 04:15:45 13280 ------w- C:\Windows\System32\pwdspio.sys
.
==================== Find3M ====================
.
2012-02-26 07:28:57 25160 ----a-w- C:\Windows\System32\drivers\hitmanpro35.sys
2011-12-14 07:11:03 2308096 ----a-w- C:\Windows\System32\jscript9.dll
2011-12-14 07:04:30 1390080 ----a-w- C:\Windows\System32\wininet.dll
2011-12-14 07:03:38 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl
2011-12-14 06:57:28 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2011-12-14 03:04:54 1798656 ----a-w- C:\Windows\SysWow64\jscript9.dll
2011-12-14 02:57:18 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-12-14 02:56:58 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2011-12-14 02:50:04 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-12-10 05:24:08 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys
.
============= FINISH: 17:07:21.01 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:25 PM

Posted 03 March 2012 - 03:43 AM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

  • Do not run any other tool untill instructed to do so!
  • please Do not Attach logs or put in code boxes.
  • Tell me about any problems that have occurred during the fix.
  • Tell me of any other symptoms you may be having as these can help also.
  • Do not run anything while running a fix.
  • Do not run any other tool untill instructed to do so!


Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 grooby

grooby
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:25 AM

Posted 03 March 2012 - 05:39 AM

Hi Gringo.

I ran combofix in my administrator account it went well. When I logged into my normal limited account I got the following warning.

C:\Windows\system32\GfxUI.exe
A device attached to the system is not functioning

I also got a warning to change my internet settings from medium to medium high.

I tried to run IE in sandboxie but got an error messge from sandboxie and had to close it. IE would open but not sandboxed and I got another waring about the internet settings. I am currently using Firefox sandboxed and it seems fine.

Here is the log.

ComboFix 12-03-02.01 - a 03/03/2012 20:00:20.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.3894.2733 [GMT 10:00]
Running from: c:\users\s\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\rnaph.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-02-03 to 2012-03-03 )))))))))))))))))))))))))))))))
.
.
2012-03-03 10:04 . 2012-03-03 10:04 -------- d-----w- c:\users\s\AppData\Local\temp
2012-03-03 10:04 . 2012-03-03 10:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-26 07:40 . 2011-12-28 03:59 498688 ----a-w- c:\windows\system32\drivers\afd.sys
2012-02-26 07:40 . 2012-01-14 04:06 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-02-26 07:40 . 2011-12-16 08:46 634880 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-26 07:40 . 2011-12-16 07:52 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll
2012-02-20 08:47 . 2012-02-16 14:55 134104 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll
2012-02-18 08:35 . 2012-02-18 08:35 -------- d-----w- c:\users\s\AppData\Local\PDF24
2012-02-18 08:32 . 2012-02-18 08:32 -------- d-----w- c:\users\a\AppData\Local\PDF24
2012-02-18 08:31 . 2012-02-18 08:32 -------- d-----w- c:\program files (x86)\PDF24
2012-02-18 07:41 . 2012-02-18 07:41 -------- d-----w- c:\users\a\AppData\Roaming\PDF Writer
2012-02-18 07:41 . 2012-02-18 07:41 -------- d-----w- c:\users\a\AppData\Local\PDF Writer
2012-02-18 07:25 . 2012-02-18 07:25 -------- d-----w- c:\users\s\AppData\Roaming\PDF Writer
2012-02-18 07:25 . 2012-02-18 07:25 -------- d-----w- c:\users\s\AppData\Local\PDF Writer
2012-02-18 07:25 . 2012-02-18 07:25 -------- d-----w- c:\programdata\PDF Writer
2012-02-18 07:23 . 2009-07-14 01:41 101376 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPWN7.DLL
2012-02-18 07:23 . 2012-02-18 07:23 -------- d-----w- c:\program files\Common Files\Bullzip
2012-02-18 07:23 . 2010-09-27 04:27 135168 ----a-w- c:\windows\SysWow64\bzpdfc.dll
2012-02-18 07:23 . 2008-10-30 12:15 227840 ----a-w- c:\windows\SysWow64\bzFlRdr.dll
2012-02-18 07:23 . 2008-07-09 13:19 103424 ----a-w- c:\windows\SysWow64\bzDCT.dll
2012-02-18 07:23 . 2011-05-17 09:47 214528 ----a-w- c:\windows\system32\bzpdf.dll
2012-02-18 07:23 . 1999-05-06 13:00 140288 ----a-w- c:\windows\SysWow64\comdlg32.OCX
2012-02-18 07:23 . 2012-02-18 07:23 -------- d-----w- c:\program files\Bullzip
2012-02-18 04:15 . 2012-01-18 05:56 1013320 ----a-w- c:\windows\system32\pwNative.exe
2012-02-18 04:15 . 2012-01-18 05:56 19936 ------w- c:\windows\system32\pwdrvio.sys
2012-02-18 04:15 . 2012-01-18 05:56 13280 ------w- c:\windows\system32\pwdspio.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-26 07:28 . 2011-12-23 08:07 25160 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2012-02-15 09:39 . 2011-12-13 07:38 132320 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-12-12 10:37 . 2011-12-12 10:37 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-12-12 10:37 . 2011-12-12 10:37 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2011-12-12 10:37 . 2011-12-12 10:37 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2011-12-12 10:37 . 2011-12-12 10:37 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-12-12 10:37 . 2011-12-12 10:37 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2011-12-12 10:37 . 2011-12-12 10:37 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2011-12-12 10:37 . 2011-12-12 10:37 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2011-12-12 10:37 . 2011-12-12 10:37 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2011-12-12 10:37 . 2011-12-12 10:37 367104 ----a-w- c:\windows\SysWow64\html.iec
2011-12-12 10:37 . 2011-12-12 10:37 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2011-12-12 10:37 . 2011-12-12 10:37 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2011-12-12 10:37 . 2011-12-12 10:37 222208 ----a-w- c:\windows\system32\msls31.dll
2011-12-12 10:37 . 2011-12-12 10:37 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2011-12-12 10:37 . 2011-12-12 10:37 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2011-12-12 10:37 . 2011-12-12 10:37 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2011-12-12 10:37 . 2011-12-12 10:37 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2011-12-12 10:37 . 2011-12-12 10:37 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2011-12-12 10:37 . 2011-12-12 10:37 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2011-12-12 10:37 . 2011-12-12 10:37 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2011-12-12 10:37 . 2011-12-12 10:37 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-12-12 10:37 . 2011-12-12 10:37 85504 ----a-w- c:\windows\system32\iesetup.dll
2011-12-12 10:37 . 2011-12-12 10:37 76800 ----a-w- c:\windows\system32\tdc.ocx
2011-12-12 10:37 . 2011-12-12 10:37 603648 ----a-w- c:\windows\system32\vbscript.dll
2011-12-12 10:37 . 2011-12-12 10:37 49664 ----a-w- c:\windows\system32\imgutil.dll
2011-12-12 10:37 . 2011-12-12 10:37 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-12-12 10:37 . 2011-12-12 10:37 448512 ----a-w- c:\windows\system32\html.iec
2011-12-12 10:37 . 2011-12-12 10:37 30720 ----a-w- c:\windows\system32\licmgr10.dll
2011-12-12 10:37 . 2011-12-12 10:37 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2011-12-12 10:37 . 2011-12-12 10:37 165888 ----a-w- c:\windows\system32\iexpress.exe
2011-12-12 10:37 . 2011-12-12 10:37 160256 ----a-w- c:\windows\system32\wextract.exe
2011-12-12 10:37 . 2011-12-12 10:37 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-12-12 10:37 . 2011-12-12 10:37 12288 ----a-w- c:\windows\system32\mshta.exe
2011-12-12 10:37 . 2011-12-12 10:37 114176 ----a-w- c:\windows\system32\admparse.dll
2011-12-12 10:37 . 2011-12-12 10:37 111616 ----a-w- c:\windows\system32\iesysprep.dll
2011-12-10 05:24 . 2011-02-07 07:47 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-02-07 666384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-09-23 258512]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-02-09 160840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R0 vqdtrh;vqdtrh; [x]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]
R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 PSMounter;Macrium Reflect Image Explorer Service;c:\windows\system32\drivers\psmounter.sys [x]
R3 PSVolAcc;PSVolAcc; [x]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [x]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-04 89600]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-09-23 86224]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
S2 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [2011-01-17 301720]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-09-30 508776]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-05-01 2533400]
S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-09-30 219496]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-08-16 20:43 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-12 c:\windows\Tasks\HPCeeScheduleForA-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-07-23 487424]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-28 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-28 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-28 415256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: Interfaces\{45E9BB37-B9C8-4E72-9BB8-A2330CC2B182}: NameServer = 123.200.191.17 123.200.191.18
FF - ProfilePath - c:\users\a\AppData\Roaming\Mozilla\Firefox\Profiles\hphxs05b.default\
FF - prefs.js: browser.startup.homepage - about:blank
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{10CD364B-FFCC-48BE-B469-B9622A033075} - c:\programdata\{05971B75-B620-4D64-9985-7971BEF763A2}\setup.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="04F0D21-79D8-7A25-D702-433F"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2012-03-03 20:09:22 - machine was rebooted
ComboFix-quarantined-files.txt 2012-03-03 10:09
.
Pre-Run: 264,329,887,744 bytes free
Post-Run: 264,162,865,152 bytes free
.
- - End Of File - - FB713B9650153C57D3ED93DB9132962D

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:25 PM

Posted 03 March 2012 - 12:31 PM

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.
  • Download TDSSKiller and save it to your Desktop.
  • doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.
  • Double click the aswMBR.exe icon to run it
  • it will ask to download extra definitions - ALLOW IT
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 grooby

grooby
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:25 AM

Posted 03 March 2012 - 06:26 PM

I'll get onto it. Just to let you know I have done nothing but IE and sandboxie now seem to be working well.

#6 grooby

grooby
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:25 AM

Posted 03 March 2012 - 07:00 PM

Here are the logs you requested.

aswMBR version 0.9.9.1649 Copyright© 2011 AVAST Software
Run date: 2012-03-04 09:46:02
-----------------------------
09:46:02.643 OS Version: Windows x64 6.1.7601 Service Pack 1
09:46:02.643 Number of processors: 4 586 0x2505
09:46:02.643 ComputerName: A-HP UserName: a
09:46:04.015 Initialize success
09:51:55.741 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
09:51:55.741 Disk 0 Vendor: ST950032 0005 Size: 476940MB BusType: 3
09:51:55.756 Disk 0 MBR read successfully
09:51:55.772 Disk 0 MBR scan
09:51:55.772 Disk 0 unknown MBR code
09:51:55.788 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048
09:51:55.788 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 449110 MB offset 409600
09:51:55.819 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 27522 MB offset 920195072
09:51:55.850 Disk 0 Partition 4 00 0C FAT32 LBA MSDOS5.0 103 MB offset 976560128
09:51:55.897 Disk 0 scanning C:\Windows\system32\drivers
09:52:05.226 Service scanning
09:52:21.450 Modules scanning
09:52:21.450 Disk 0 trace - called modules:
09:52:21.496 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys iaStor.sys hal.dll
09:52:21.496 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80051ff060]
09:52:21.512 3 CLASSPNP.SYS[fffff88001b7d43f] -> nt!IofCallDriver -> [0xfffffa800508db10]
09:52:21.512 5 hpdskflt.sys[fffff88001b24189] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004f3b050]
09:52:21.528 Scan finished successfully
09:52:39.218 Disk 0 MBR has been saved successfully to "C:\Users\a\Desktop\MBR.dat"
09:52:39.234 The log file has been saved successfully to "C:\Users\a\Desktop\aswMBR.txt"



09:29:06.0121 3708 TDSS rootkit removing tool 2.7.18.0 Mar 2 2012 09:40:07
09:29:06.0121 3708 ============================================================
09:29:06.0121 3708 Current date / time: 2012/03/04 09:29:06.0121
09:29:06.0121 3708 SystemInfo:
09:29:06.0121 3708
09:29:06.0121 3708 OS Version: 6.1.7601 ServicePack: 1.0
09:29:06.0121 3708 Product type: Workstation
09:29:06.0121 3708 ComputerName: A-HP
09:29:06.0121 3708 UserName: a
09:29:06.0121 3708 Windows directory: C:\Windows
09:29:06.0121 3708 System windows directory: C:\Windows
09:29:06.0121 3708 Running under WOW64
09:29:06.0121 3708 Processor architecture: Intel x64
09:29:06.0121 3708 Number of processors: 4
09:29:06.0121 3708 Page size: 0x1000
09:29:06.0121 3708 Boot type: Normal boot
09:29:06.0121 3708 ============================================================
09:29:06.0589 3708 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
09:29:06.0620 3708 \Device\Harddisk0\DR0:
09:29:06.0620 3708 MBR used
09:29:06.0620 3708 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800
09:29:06.0620 3708 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x36D2B0FF
09:29:06.0620 3708 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x36D91000, BlocksNum 0x35C1000
09:29:06.0620 3708 \Device\Harddisk0\DR0\Partition3: MBR, Type 0xC, StartLBA 0x3A352000, BlocksNum 0x33830
09:29:06.0745 3708 Initialize success
09:29:06.0745 3708 ============================================================
09:29:11.0862 0712 ============================================================
09:29:11.0862 0712 Scan started
09:29:11.0862 0712 Mode: Manual;
09:29:11.0862 0712 ============================================================
09:29:12.0408 0712 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
09:29:12.0424 0712 1394ohci - ok
09:29:12.0455 0712 Accelerometer (5c368f4b04ed2a923e6afca2d37baff5) C:\Windows\system32\DRIVERS\Accelerometer.sys
09:29:12.0470 0712 Accelerometer - ok
09:29:12.0626 0712 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
09:29:12.0626 0712 ACPI - ok
09:29:12.0673 0712 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
09:29:12.0689 0712 AcpiPmi - ok
09:29:12.0767 0712 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
09:29:12.0782 0712 adp94xx - ok
09:29:12.0814 0712 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
09:29:12.0829 0712 adpahci - ok
09:29:12.0860 0712 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
09:29:12.0876 0712 adpu320 - ok
09:29:12.0954 0712 AF15BDA (0517e1670a58213e3f206066cd209273) C:\Windows\system32\DRIVERS\AF15BDA.sys
09:29:12.0970 0712 AF15BDA - ok
09:29:13.0032 0712 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
09:29:13.0048 0712 AFD - ok
09:29:13.0079 0712 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
09:29:13.0094 0712 agp440 - ok
09:29:13.0141 0712 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
09:29:13.0157 0712 aliide - ok
09:29:13.0172 0712 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
09:29:13.0172 0712 amdide - ok
09:29:13.0219 0712 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
09:29:13.0219 0712 AmdK8 - ok
09:29:13.0266 0712 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
09:29:13.0266 0712 AmdPPM - ok
09:29:13.0328 0712 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
09:29:13.0328 0712 amdsata - ok
09:29:13.0375 0712 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
09:29:13.0391 0712 amdsbs - ok
09:29:13.0422 0712 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
09:29:13.0422 0712 amdxata - ok
09:29:13.0516 0712 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
09:29:13.0516 0712 AppID - ok
09:29:13.0656 0712 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
09:29:13.0672 0712 arc - ok
09:29:13.0718 0712 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
09:29:13.0734 0712 arcsas - ok
09:29:13.0750 0712 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
09:29:13.0765 0712 AsyncMac - ok
09:29:13.0796 0712 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
09:29:13.0812 0712 atapi - ok
09:29:13.0890 0712 athr (f8633cdd09647a64ee8db550630427ff) C:\Windows\system32\DRIVERS\athrx.sys
09:29:13.0984 0712 athr - ok
09:29:14.0077 0712 avgntflt (aa8f79a1bdfc03b3bc70c44ab00589b4) C:\Windows\system32\DRIVERS\avgntflt.sys
09:29:14.0093 0712 avgntflt - ok
09:29:14.0124 0712 avipbb (852e3c0a60d368c487949e55ad52a47f) C:\Windows\system32\DRIVERS\avipbb.sys
09:29:14.0124 0712 avipbb - ok
09:29:14.0155 0712 avkmgr (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys
09:29:14.0171 0712 avkmgr - ok
09:29:14.0264 0712 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
09:29:14.0280 0712 b06bdrv - ok
09:29:14.0327 0712 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
09:29:14.0342 0712 b57nd60a - ok
09:29:14.0420 0712 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
09:29:14.0436 0712 Beep - ok
09:29:14.0514 0712 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
09:29:14.0514 0712 blbdrive - ok
09:29:14.0561 0712 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
09:29:14.0561 0712 bowser - ok
09:29:14.0608 0712 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
09:29:14.0608 0712 BrFiltLo - ok
09:29:14.0654 0712 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
09:29:14.0654 0712 BrFiltUp - ok
09:29:14.0748 0712 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys
09:29:14.0748 0712 BridgeMP - ok
09:29:14.0795 0712 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
09:29:14.0810 0712 Brserid - ok
09:29:14.0842 0712 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
09:29:14.0857 0712 BrSerWdm - ok
09:29:14.0873 0712 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
09:29:14.0888 0712 BrUsbMdm - ok
09:29:14.0904 0712 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
09:29:14.0920 0712 BrUsbSer - ok
09:29:14.0935 0712 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
09:29:14.0935 0712 BTHMODEM - ok
09:29:14.0982 0712 catchme - ok
09:29:15.0029 0712 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
09:29:15.0044 0712 cdfs - ok
09:29:15.0091 0712 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
09:29:15.0091 0712 cdrom - ok
09:29:15.0154 0712 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
09:29:15.0169 0712 circlass - ok
09:29:15.0216 0712 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
09:29:15.0232 0712 CLFS - ok
09:29:15.0310 0712 clwvd (d68d9f4d53010b7e84d4e80a2e485554) C:\Windows\system32\DRIVERS\clwvd.sys
09:29:15.0310 0712 clwvd - ok
09:29:15.0388 0712 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
09:29:15.0388 0712 CmBatt - ok
09:29:15.0419 0712 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
09:29:15.0419 0712 cmdide - ok
09:29:15.0481 0712 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
09:29:15.0512 0712 CNG - ok
09:29:15.0590 0712 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
09:29:15.0606 0712 Compbatt - ok
09:29:15.0653 0712 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
09:29:15.0668 0712 CompositeBus - ok
09:29:15.0700 0712 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
09:29:15.0715 0712 crcdisk - ok
09:29:15.0778 0712 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
09:29:15.0793 0712 DfsC - ok
09:29:15.0824 0712 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
09:29:15.0824 0712 discache - ok
09:29:15.0871 0712 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
09:29:15.0887 0712 Disk - ok
09:29:15.0934 0712 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
09:29:15.0949 0712 drmkaud - ok
09:29:16.0012 0712 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
09:29:16.0027 0712 DXGKrnl - ok
09:29:16.0136 0712 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
09:29:16.0277 0712 ebdrv - ok
09:29:16.0402 0712 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
09:29:16.0433 0712 elxstor - ok
09:29:16.0464 0712 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
09:29:16.0480 0712 ErrDev - ok
09:29:16.0542 0712 ewusbnet (477bc304201197f4057090bd60af1739) C:\Windows\system32\DRIVERS\ewusbnet.sys
09:29:16.0558 0712 ewusbnet - ok
09:29:16.0604 0712 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
09:29:16.0620 0712 exfat - ok
09:29:16.0651 0712 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
09:29:16.0667 0712 fastfat - ok
09:29:16.0698 0712 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
09:29:16.0698 0712 fdc - ok
09:29:16.0745 0712 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
09:29:16.0745 0712 FileInfo - ok
09:29:16.0776 0712 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
09:29:16.0776 0712 Filetrace - ok
09:29:16.0807 0712 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
09:29:16.0807 0712 flpydisk - ok
09:29:16.0838 0712 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
09:29:16.0854 0712 FltMgr - ok
09:29:16.0885 0712 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
09:29:16.0901 0712 FsDepends - ok
09:29:16.0932 0712 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
09:29:16.0932 0712 Fs_Rec - ok
09:29:16.0994 0712 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
09:29:16.0994 0712 fvevol - ok
09:29:17.0041 0712 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
09:29:17.0057 0712 gagp30kx - ok
09:29:17.0104 0712 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
09:29:17.0119 0712 hcw85cir - ok
09:29:17.0150 0712 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
09:29:17.0166 0712 HdAudAddService - ok
09:29:17.0213 0712 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
09:29:17.0213 0712 HDAudBus - ok
09:29:17.0244 0712 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys
09:29:17.0260 0712 HECIx64 - ok
09:29:17.0291 0712 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
09:29:17.0306 0712 HidBatt - ok
09:29:17.0338 0712 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
09:29:17.0338 0712 HidBth - ok
09:29:17.0384 0712 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
09:29:17.0384 0712 HidIr - ok
09:29:17.0431 0712 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
09:29:17.0447 0712 HidUsb - ok
09:29:17.0540 0712 hpdskflt (4e0bec0f78096ffd6d3314b497fc49d3) C:\Windows\system32\DRIVERS\hpdskflt.sys
09:29:17.0556 0712 hpdskflt - ok
09:29:17.0665 0712 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
09:29:17.0681 0712 HpSAMD - ok
09:29:17.0728 0712 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
09:29:17.0759 0712 HTTP - ok
09:29:17.0884 0712 hwdatacard (8f9b0fc4ec3a8194bd4cbc5ed3e7abeb) C:\Windows\system32\DRIVERS\ewusbmdm.sys
09:29:17.0899 0712 hwdatacard - ok
09:29:17.0946 0712 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
09:29:17.0946 0712 hwpolicy - ok
09:29:18.0071 0712 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
09:29:18.0086 0712 i8042prt - ok
09:29:18.0118 0712 iaStor (1384872112e8e7fd5786eceb8bddf4c9) C:\Windows\system32\DRIVERS\iaStor.sys
09:29:18.0133 0712 iaStor - ok
09:29:18.0180 0712 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
09:29:18.0196 0712 iaStorV - ok
09:29:18.0430 0712 igfx (1be8d9ca4f2363b8e8015621878e0043) C:\Windows\system32\DRIVERS\igdkmd64.sys
09:29:18.0695 0712 igfx - ok
09:29:18.0773 0712 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
09:29:18.0788 0712 iirsp - ok
09:29:18.0820 0712 Impcd (dd587a55390ed2295bce6d36ad567da9) C:\Windows\system32\DRIVERS\Impcd.sys
09:29:18.0835 0712 Impcd - ok
09:29:18.0913 0712 IntcDAud (03c74719d48056a1078f3a51ceb76baa) C:\Windows\system32\DRIVERS\IntcDAud.sys
09:29:18.0960 0712 IntcDAud - ok
09:29:18.0991 0712 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
09:29:18.0991 0712 intelide - ok
09:29:19.0054 0712 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
09:29:19.0054 0712 intelppm - ok
09:29:19.0116 0712 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
09:29:19.0132 0712 IpFilterDriver - ok
09:29:19.0178 0712 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
09:29:19.0178 0712 IPMIDRV - ok
09:29:19.0256 0712 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
09:29:19.0272 0712 IPNAT - ok
09:29:19.0319 0712 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
09:29:19.0319 0712 IRENUM - ok
09:29:19.0350 0712 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
09:29:19.0366 0712 isapnp - ok
09:29:19.0397 0712 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
09:29:19.0412 0712 iScsiPrt - ok
09:29:19.0475 0712 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
09:29:19.0475 0712 kbdclass - ok
09:29:19.0522 0712 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
09:29:19.0522 0712 kbdhid - ok
09:29:19.0584 0712 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
09:29:19.0600 0712 KSecDD - ok
09:29:19.0646 0712 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
09:29:19.0646 0712 KSecPkg - ok
09:29:19.0693 0712 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
09:29:19.0693 0712 ksthunk - ok
09:29:19.0787 0712 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
09:29:19.0787 0712 lltdio - ok
09:29:19.0880 0712 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
09:29:19.0896 0712 LSI_FC - ok
09:29:19.0943 0712 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
09:29:19.0958 0712 LSI_SAS - ok
09:29:19.0990 0712 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
09:29:19.0990 0712 LSI_SAS2 - ok
09:29:20.0005 0712 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
09:29:20.0021 0712 LSI_SCSI - ok
09:29:20.0052 0712 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
09:29:20.0052 0712 luafv - ok
09:29:20.0099 0712 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
09:29:20.0114 0712 megasas - ok
09:29:20.0146 0712 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
09:29:20.0161 0712 MegaSR - ok
09:29:20.0192 0712 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
09:29:20.0192 0712 Modem - ok
09:29:20.0224 0712 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
09:29:20.0224 0712 monitor - ok
09:29:20.0317 0712 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
09:29:20.0333 0712 mouclass - ok
09:29:20.0380 0712 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
09:29:20.0380 0712 mouhid - ok
09:29:20.0473 0712 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
09:29:20.0473 0712 mountmgr - ok
09:29:20.0489 0712 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
09:29:20.0504 0712 mpio - ok
09:29:20.0551 0712 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
09:29:20.0551 0712 mpsdrv - ok
09:29:20.0614 0712 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
09:29:20.0614 0712 MRxDAV - ok
09:29:20.0660 0712 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
09:29:20.0676 0712 mrxsmb - ok
09:29:20.0707 0712 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
09:29:20.0723 0712 mrxsmb10 - ok
09:29:20.0738 0712 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
09:29:20.0738 0712 mrxsmb20 - ok
09:29:20.0770 0712 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
09:29:20.0785 0712 msahci - ok
09:29:20.0816 0712 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
09:29:20.0832 0712 msdsm - ok
09:29:20.0863 0712 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
09:29:20.0863 0712 Msfs - ok
09:29:20.0894 0712 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
09:29:20.0894 0712 mshidkmdf - ok
09:29:20.0910 0712 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
09:29:20.0926 0712 msisadrv - ok
09:29:21.0019 0712 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
09:29:21.0019 0712 MSKSSRV - ok
09:29:21.0050 0712 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
09:29:21.0050 0712 MSPCLOCK - ok
09:29:21.0066 0712 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
09:29:21.0066 0712 MSPQM - ok
09:29:21.0113 0712 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
09:29:21.0128 0712 MsRPC - ok
09:29:21.0175 0712 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
09:29:21.0175 0712 mssmbios - ok
09:29:21.0222 0712 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
09:29:21.0222 0712 MSTEE - ok
09:29:21.0253 0712 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
09:29:21.0269 0712 MTConfig - ok
09:29:21.0284 0712 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
09:29:21.0300 0712 Mup - ok
09:29:21.0378 0712 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
09:29:21.0394 0712 NativeWifiP - ok
09:29:21.0456 0712 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
09:29:21.0487 0712 NDIS - ok
09:29:21.0534 0712 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
09:29:21.0534 0712 NdisCap - ok
09:29:21.0565 0712 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
09:29:21.0565 0712 NdisTapi - ok
09:29:21.0612 0712 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
09:29:21.0628 0712 Ndisuio - ok
09:29:21.0659 0712 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
09:29:21.0674 0712 NdisWan - ok
09:29:21.0706 0712 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
09:29:21.0706 0712 NDProxy - ok
09:29:21.0752 0712 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
09:29:21.0752 0712 NetBIOS - ok
09:29:21.0799 0712 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
09:29:21.0815 0712 NetBT - ok
09:29:21.0986 0712 netw5v64 (64428dfdaf6e88366cb51f45a79c5f69) C:\Windows\system32\DRIVERS\netw5v64.sys
09:29:22.0142 0712 netw5v64 - ok
09:29:22.0236 0712 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
09:29:22.0252 0712 nfrd960 - ok
09:29:22.0298 0712 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
09:29:22.0298 0712 Npfs - ok
09:29:22.0314 0712 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
09:29:22.0314 0712 nsiproxy - ok
09:29:22.0376 0712 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
09:29:22.0439 0712 Ntfs - ok
09:29:22.0501 0712 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
09:29:22.0517 0712 Null - ok
09:29:22.0548 0712 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
09:29:22.0564 0712 nvraid - ok
09:29:22.0579 0712 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
09:29:22.0595 0712 nvstor - ok
09:29:22.0642 0712 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
09:29:22.0657 0712 nv_agp - ok
09:29:22.0688 0712 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
09:29:22.0704 0712 ohci1394 - ok
09:29:22.0751 0712 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
09:29:22.0766 0712 Parport - ok
09:29:22.0798 0712 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
09:29:22.0798 0712 partmgr - ok
09:29:22.0829 0712 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
09:29:22.0844 0712 pci - ok
09:29:22.0860 0712 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
09:29:22.0876 0712 pciide - ok
09:29:22.0907 0712 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
09:29:22.0922 0712 pcmcia - ok
09:29:22.0954 0712 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
09:29:22.0969 0712 pcw - ok
09:29:23.0000 0712 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
09:29:23.0032 0712 PEAUTH - ok
09:29:23.0172 0712 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
09:29:23.0188 0712 PptpMiniport - ok
09:29:23.0219 0712 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
09:29:23.0234 0712 Processor - ok
09:29:23.0281 0712 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
09:29:23.0297 0712 Psched - ok
09:29:23.0344 0712 PSMounter (bb50b87757a11fd03eb9051682f63a01) C:\Windows\system32\drivers\psmounter.sys
09:29:23.0359 0712 PSMounter - ok
09:29:23.0437 0712 PSVolAcc (ed15cdfa61f4c54dd1a24a9bb722bef4) C:\Windows\system32\drivers\PSVolAcc.sys
09:29:23.0437 0712 PSVolAcc - ok
09:29:23.0515 0712 pwdrvio (ff40216a382b30cc39372b889ae1f785) C:\Windows\system32\pwdrvio.sys
09:29:23.0531 0712 pwdrvio - ok
09:29:23.0578 0712 pwdspio (bd08a9cdf23502b1c141d52d9d6a6648) C:\Windows\system32\pwdspio.sys
09:29:23.0593 0712 pwdspio - ok
09:29:23.0687 0712 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
09:29:23.0765 0712 ql2300 - ok
09:29:23.0827 0712 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
09:29:23.0843 0712 ql40xx - ok
09:29:23.0890 0712 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
09:29:23.0905 0712 QWAVEdrv - ok
09:29:23.0936 0712 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
09:29:23.0952 0712 RasAcd - ok
09:29:23.0999 0712 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
09:29:23.0999 0712 RasAgileVpn - ok
09:29:24.0046 0712 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
09:29:24.0061 0712 Rasl2tp - ok
09:29:24.0108 0712 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
09:29:24.0124 0712 RasPppoe - ok
09:29:24.0155 0712 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
09:29:24.0155 0712 RasSstp - ok
09:29:24.0186 0712 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
09:29:24.0202 0712 rdbss - ok
09:29:24.0233 0712 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
09:29:24.0233 0712 rdpbus - ok
09:29:24.0264 0712 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
09:29:24.0280 0712 RDPCDD - ok
09:29:24.0295 0712 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
09:29:24.0295 0712 RDPENCDD - ok
09:29:24.0311 0712 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
09:29:24.0326 0712 RDPREFMP - ok
09:29:24.0358 0712 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
09:29:24.0373 0712 RDPWD - ok
09:29:24.0436 0712 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
09:29:24.0451 0712 rdyboost - ok
09:29:24.0592 0712 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
09:29:24.0607 0712 rspndr - ok
09:29:24.0638 0712 RSUSBSTOR (907c4464381b5ebdfdc60f6c7d0dedfc) C:\Windows\system32\Drivers\RtsUStor.sys
09:29:24.0638 0712 RSUSBSTOR - ok
09:29:24.0701 0712 RTL8167 (4b42bc58294e83a6a92ec8b88c14c4a3) C:\Windows\system32\DRIVERS\Rt64win7.sys
09:29:24.0716 0712 RTL8167 - ok
09:29:24.0794 0712 SbieDrv (554cb4c2e076cc0960d9e5590e4c7fa5) C:\Program Files\Sandboxie\SbieDrv.sys
09:29:24.0810 0712 SbieDrv - ok
09:29:24.0888 0712 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
09:29:24.0888 0712 sbp2port - ok
09:29:24.0919 0712 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
09:29:24.0919 0712 scfilter - ok
09:29:24.0966 0712 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys
09:29:24.0982 0712 sdbus - ok
09:29:25.0028 0712 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
09:29:25.0028 0712 secdrv - ok
09:29:25.0060 0712 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
09:29:25.0075 0712 Serenum - ok
09:29:25.0091 0712 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
09:29:25.0106 0712 Serial - ok
09:29:25.0153 0712 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
09:29:25.0153 0712 sermouse - ok
09:29:25.0200 0712 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
09:29:25.0216 0712 sffdisk - ok
09:29:25.0231 0712 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
09:29:25.0247 0712 sffp_mmc - ok
09:29:25.0262 0712 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
09:29:25.0262 0712 sffp_sd - ok
09:29:25.0294 0712 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
09:29:25.0294 0712 sfloppy - ok
09:29:25.0356 0712 Sftfs (c6cc9297bd53e5229653303e556aa539) C:\Windows\system32\DRIVERS\Sftfslh.sys
09:29:25.0372 0712 Sftfs - ok
09:29:25.0434 0712 Sftplay (390aa7bc52cee43f6790cdea1e776703) C:\Windows\system32\DRIVERS\Sftplaylh.sys
09:29:25.0450 0712 Sftplay - ok
09:29:25.0481 0712 Sftredir (617e29a0b0a2807466560d4c4e338d3e) C:\Windows\system32\DRIVERS\Sftredirlh.sys
09:29:25.0481 0712 Sftredir - ok
09:29:25.0528 0712 Sftvol (8f571f016fa1976f445147e9e6c8ae9b) C:\Windows\system32\DRIVERS\Sftvollh.sys
09:29:25.0543 0712 Sftvol - ok
09:29:25.0606 0712 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
09:29:25.0621 0712 SiSRaid2 - ok
09:29:25.0652 0712 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
09:29:25.0668 0712 SiSRaid4 - ok
09:29:25.0699 0712 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
09:29:25.0699 0712 Smb - ok
09:29:25.0730 0712 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
09:29:25.0746 0712 spldr - ok
09:29:25.0793 0712 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
09:29:25.0808 0712 srv - ok
09:29:25.0855 0712 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
09:29:25.0871 0712 srv2 - ok
09:29:25.0918 0712 SrvHsfHDA (0c4540311e11664b245a263e1154cef8) C:\Windows\system32\DRIVERS\VSTAZL6.SYS
09:29:25.0933 0712 SrvHsfHDA - ok
09:29:25.0980 0712 SrvHsfV92 (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS
09:29:26.0042 0712 SrvHsfV92 - ok
09:29:26.0120 0712 SrvHsfWinac (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
09:29:26.0167 0712 SrvHsfWinac - ok
09:29:26.0230 0712 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
09:29:26.0230 0712 srvnet - ok
09:29:26.0323 0712 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
09:29:26.0323 0712 stexstor - ok
09:29:26.0370 0712 STHDA (da40d9c9ccb9836d6abd1706935a2277) C:\Windows\system32\DRIVERS\stwrt64.sys
09:29:26.0401 0712 STHDA - ok
09:29:26.0432 0712 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
09:29:26.0448 0712 swenum - ok
09:29:26.0557 0712 SynTP (33e6a285daa5134d8ea2247914c86c09) C:\Windows\system32\DRIVERS\SynTP.sys
09:29:26.0588 0712 SynTP - ok
09:29:26.0698 0712 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
09:29:26.0822 0712 Tcpip - ok
09:29:26.0916 0712 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
09:29:26.0932 0712 TCPIP6 - ok
09:29:26.0994 0712 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
09:29:26.0994 0712 tcpipreg - ok
09:29:27.0056 0712 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
09:29:27.0056 0712 TDPIPE - ok
09:29:27.0072 0712 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
09:29:27.0072 0712 TDTCP - ok
09:29:27.0103 0712 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
09:29:27.0103 0712 tdx - ok
09:29:27.0134 0712 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
09:29:27.0134 0712 TermDD - ok
09:29:27.0197 0712 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
09:29:27.0197 0712 tssecsrv - ok
09:29:27.0244 0712 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
09:29:27.0244 0712 TsUsbFlt - ok
09:29:27.0275 0712 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
09:29:27.0290 0712 tunnel - ok
09:29:27.0322 0712 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
09:29:27.0322 0712 uagp35 - ok
09:29:27.0384 0712 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
09:29:27.0400 0712 udfs - ok
09:29:27.0431 0712 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
09:29:27.0446 0712 uliagpkx - ok
09:29:27.0478 0712 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
09:29:27.0493 0712 umbus - ok
09:29:27.0524 0712 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
09:29:27.0540 0712 UmPass - ok
09:29:27.0602 0712 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
09:29:27.0602 0712 usbccgp - ok
09:29:27.0649 0712 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
09:29:27.0665 0712 usbcir - ok
09:29:27.0680 0712 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
09:29:27.0696 0712 usbehci - ok
09:29:27.0727 0712 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
09:29:27.0743 0712 usbhub - ok
09:29:27.0774 0712 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
09:29:27.0774 0712 usbohci - ok
09:29:27.0821 0712 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
09:29:27.0821 0712 usbprint - ok
09:29:27.0852 0712 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
09:29:27.0852 0712 USBSTOR - ok
09:29:27.0899 0712 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
09:29:27.0899 0712 usbuhci - ok
09:29:27.0946 0712 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
09:29:27.0946 0712 usbvideo - ok
09:29:28.0008 0712 VBoxNetAdp (85df2c59645d374be7e3234241761230) C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
09:29:28.0008 0712 VBoxNetAdp - ok
09:29:28.0039 0712 VBoxNetFlt - ok
09:29:28.0086 0712 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
09:29:28.0102 0712 vdrvroot - ok
09:29:28.0133 0712 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
09:29:28.0133 0712 vga - ok
09:29:28.0148 0712 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
09:29:28.0164 0712 VgaSave - ok
09:29:28.0180 0712 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
09:29:28.0195 0712 vhdmp - ok
09:29:28.0226 0712 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
09:29:28.0226 0712 viaide - ok
09:29:28.0258 0712 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
09:29:28.0258 0712 volmgr - ok
09:29:28.0289 0712 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
09:29:28.0289 0712 volmgrx - ok
09:29:28.0320 0712 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
09:29:28.0336 0712 volsnap - ok
09:29:28.0336 0712 vqdtrh - ok
09:29:28.0382 0712 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
09:29:28.0398 0712 vsmraid - ok
09:29:28.0429 0712 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
09:29:28.0429 0712 vwifibus - ok
09:29:28.0476 0712 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
09:29:28.0476 0712 vwififlt - ok
09:29:28.0507 0712 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
09:29:28.0523 0712 WacomPen - ok
09:29:28.0554 0712 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
09:29:28.0570 0712 WANARP - ok
09:29:28.0585 0712 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
09:29:28.0585 0712 Wanarpv6 - ok
09:29:28.0679 0712 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
09:29:28.0679 0712 Wd - ok
09:29:28.0726 0712 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
09:29:28.0757 0712 Wdf01000 - ok
09:29:28.0866 0712 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
09:29:28.0866 0712 WfpLwf - ok
09:29:28.0913 0712 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
09:29:28.0928 0712 WIMMount - ok
09:29:28.0991 0712 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
09:29:28.0991 0712 WmiAcpi - ok
09:29:29.0053 0712 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
09:29:29.0053 0712 ws2ifsl - ok
09:29:29.0084 0712 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
09:29:29.0100 0712 WudfPf - ok
09:29:29.0116 0712 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
09:29:29.0116 0712 WUDFRd - ok
09:29:29.0178 0712 yukonw7 (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys
09:29:29.0209 0712 yukonw7 - ok
09:29:29.0240 0712 MBR (0x1B8) (5deeef077ed2627c3f81e8bd3b193a26) \Device\Harddisk0\DR0
09:29:29.0272 0712 \Device\Harddisk0\DR0 - ok
09:29:29.0318 0712 Boot (0x1200) (08e52301a41b01ba0911c2c4c84d032c) \Device\Harddisk0\DR0\Partition0
09:29:29.0318 0712 \Device\Harddisk0\DR0\Partition0 - ok
09:29:29.0350 0712 Boot (0x1200) (764bc3d628cf51e6ace6d80a02817537) \Device\Harddisk0\DR0\Partition1
09:29:29.0350 0712 \Device\Harddisk0\DR0\Partition1 - ok
09:29:29.0381 0712 Boot (0x1200) (debd09c1468b5855239d21fcb9be3bc8) \Device\Harddisk0\DR0\Partition2
09:29:29.0381 0712 \Device\Harddisk0\DR0\Partition2 - ok
09:29:29.0412 0712 Boot (0x1200) (fcf8fac2f0110f60d8e873e0ea262d38) \Device\Harddisk0\DR0\Partition3
09:29:29.0428 0712 \Device\Harddisk0\DR0\Partition3 - ok
09:29:29.0428 0712 ============================================================
09:29:29.0428 0712 Scan finished
09:29:29.0428 0712 ============================================================
09:29:29.0428 4476 Detected object count: 0
09:29:29.0428 4476 Actual detected object count: 0
09:45:20.0754 2956 Deinitialize success

#7 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:25 PM

Posted 03 March 2012 - 08:51 PM

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe
Posted Image
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following

  • report from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now after running the script?

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#8 grooby

grooby
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:25 AM

Posted 04 March 2012 - 04:50 AM

OK, that was a bit of a mess. When I first downloaded combofix I was using my limited account but I ran it from my admin account. This time I ran it from my limited account using admin rights, after the scan the computer restarted, I logged into the limited account and the combofix widow was flickering all over the desktop and nothing would work. I had to restart manually and log into the admin account, combofix continued to run and generated a log but when I tried to open it it said something like "illegal registry item marked for deletion", not exactley sure. I restarted the comp and logged in again and everything seemed fine. This is the log that was generated.

I might need to try it again, just let me know. Does combofix need to be run specifically from the desktop? If so, can it be copied and pasted from the download location to the desktop?

Also, I got a warning when I tried to run combofix after the script, I will attach the screenshot.

I have had no problems other than those mentioned above.


ComboFix 12-03-02.01 - a 04/03/2012 18:59:19.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.3894.2301 [GMT 10:00]
Running from: c:\users\s\Downloads\ComboFix.exe
Command switches used :: c:\users\s\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-02-04 to 2012-03-04 )))))))))))))))))))))))))))))))
.
.
2012-03-04 09:02 . 2012-03-04 09:12 -------- d-----w- c:\users\a\AppData\Local\temp
2012-03-04 09:02 . 2012-03-04 09:02 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-03 10:09 . 2012-03-04 09:08 -------- d-----w- c:\users\s\AppData\Local\temp
2012-02-26 07:40 . 2011-12-28 03:59 498688 ----a-w- c:\windows\system32\drivers\afd.sys
2012-02-26 07:40 . 2012-01-14 04:06 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-02-26 07:40 . 2011-12-16 08:46 634880 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-26 07:40 . 2011-12-16 07:52 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll
2012-02-20 08:47 . 2012-02-16 14:55 134104 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll
2012-02-18 08:35 . 2012-02-18 08:35 -------- d-----w- c:\users\s\AppData\Local\PDF24
2012-02-18 08:32 . 2012-02-18 08:32 -------- d-----w- c:\users\a\AppData\Local\PDF24
2012-02-18 08:31 . 2012-02-18 08:32 -------- d-----w- c:\program files (x86)\PDF24
2012-02-18 07:41 . 2012-02-18 07:41 -------- d-----w- c:\users\a\AppData\Roaming\PDF Writer
2012-02-18 07:41 . 2012-02-18 07:41 -------- d-----w- c:\users\a\AppData\Local\PDF Writer
2012-02-18 07:25 . 2012-02-18 07:25 -------- d-----w- c:\users\s\AppData\Roaming\PDF Writer
2012-02-18 07:25 . 2012-02-18 07:25 -------- d-----w- c:\users\s\AppData\Local\PDF Writer
2012-02-18 07:25 . 2012-02-18 07:25 -------- d-----w- c:\programdata\PDF Writer
2012-02-18 07:23 . 2009-07-14 01:41 101376 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPWN7.DLL
2012-02-18 07:23 . 2012-02-18 07:23 -------- d-----w- c:\program files\Common Files\Bullzip
2012-02-18 07:23 . 2010-09-27 04:27 135168 ----a-w- c:\windows\SysWow64\bzpdfc.dll
2012-02-18 07:23 . 2008-10-30 12:15 227840 ----a-w- c:\windows\SysWow64\bzFlRdr.dll
2012-02-18 07:23 . 2008-07-09 13:19 103424 ----a-w- c:\windows\SysWow64\bzDCT.dll
2012-02-18 07:23 . 2011-05-17 09:47 214528 ----a-w- c:\windows\system32\bzpdf.dll
2012-02-18 07:23 . 1999-05-06 13:00 140288 ----a-w- c:\windows\SysWow64\comdlg32.OCX
2012-02-18 07:23 . 2012-02-18 07:23 -------- d-----w- c:\program files\Bullzip
2012-02-18 04:15 . 2012-01-18 05:56 1013320 ----a-w- c:\windows\system32\pwNative.exe
2012-02-18 04:15 . 2012-01-18 05:56 19936 ------w- c:\windows\system32\pwdrvio.sys
2012-02-18 04:15 . 2012-01-18 05:56 13280 ------w- c:\windows\system32\pwdspio.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-26 07:28 . 2011-12-23 08:07 25160 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2012-02-15 09:39 . 2011-12-13 07:38 132320 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-12-12 10:37 . 2011-12-12 10:37 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-12-12 10:37 . 2011-12-12 10:37 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2011-12-12 10:37 . 2011-12-12 10:37 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2011-12-12 10:37 . 2011-12-12 10:37 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-12-12 10:37 . 2011-12-12 10:37 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2011-12-12 10:37 . 2011-12-12 10:37 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2011-12-12 10:37 . 2011-12-12 10:37 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2011-12-12 10:37 . 2011-12-12 10:37 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2011-12-12 10:37 . 2011-12-12 10:37 367104 ----a-w- c:\windows\SysWow64\html.iec
2011-12-12 10:37 . 2011-12-12 10:37 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2011-12-12 10:37 . 2011-12-12 10:37 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2011-12-12 10:37 . 2011-12-12 10:37 222208 ----a-w- c:\windows\system32\msls31.dll
2011-12-12 10:37 . 2011-12-12 10:37 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2011-12-12 10:37 . 2011-12-12 10:37 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2011-12-12 10:37 . 2011-12-12 10:37 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2011-12-12 10:37 . 2011-12-12 10:37 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2011-12-12 10:37 . 2011-12-12 10:37 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2011-12-12 10:37 . 2011-12-12 10:37 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2011-12-12 10:37 . 2011-12-12 10:37 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2011-12-12 10:37 . 2011-12-12 10:37 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-12-12 10:37 . 2011-12-12 10:37 85504 ----a-w- c:\windows\system32\iesetup.dll
2011-12-12 10:37 . 2011-12-12 10:37 76800 ----a-w- c:\windows\system32\tdc.ocx
2011-12-12 10:37 . 2011-12-12 10:37 603648 ----a-w- c:\windows\system32\vbscript.dll
2011-12-12 10:37 . 2011-12-12 10:37 49664 ----a-w- c:\windows\system32\imgutil.dll
2011-12-12 10:37 . 2011-12-12 10:37 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-12-12 10:37 . 2011-12-12 10:37 448512 ----a-w- c:\windows\system32\html.iec
2011-12-12 10:37 . 2011-12-12 10:37 30720 ----a-w- c:\windows\system32\licmgr10.dll
2011-12-12 10:37 . 2011-12-12 10:37 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2011-12-12 10:37 . 2011-12-12 10:37 165888 ----a-w- c:\windows\system32\iexpress.exe
2011-12-12 10:37 . 2011-12-12 10:37 160256 ----a-w- c:\windows\system32\wextract.exe
2011-12-12 10:37 . 2011-12-12 10:37 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-12-12 10:37 . 2011-12-12 10:37 12288 ----a-w- c:\windows\system32\mshta.exe
2011-12-12 10:37 . 2011-12-12 10:37 114176 ----a-w- c:\windows\system32\admparse.dll
2011-12-12 10:37 . 2011-12-12 10:37 111616 ----a-w- c:\windows\system32\iesysprep.dll
2011-12-10 05:24 . 2011-02-07 07:47 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-03-03_10.06.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-03-04 09:02 . 2012-03-04 09:02 13270 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat
- 2012-03-03 10:04 . 2012-03-03 10:04 13270 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat
+ 2010-10-19 04:30 . 2012-03-04 07:41 50736 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-03-04 09:05 46878 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2011-01-27 07:23 . 2012-03-02 00:42 10386 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3716360468-1753449491-1053856684-1001_UserData.bin
+ 2011-01-27 07:23 . 2012-03-04 09:05 10386 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3716360468-1753449491-1053856684-1001_UserData.bin
+ 2011-01-05 14:25 . 2012-03-03 10:07 8032 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3716360468-1753449491-1053856684-1000_UserData.bin
+ 2012-03-04 09:02 . 2012-03-04 09:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-03-03 10:04 . 2012-03-03 10:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-03-03 10:04 . 2012-03-03 10:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-03-04 09:02 . 2012-03-04 09:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-01-04 23:34 . 2012-03-04 08:55 256230 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-07-14 05:01 . 2012-03-04 09:02 233276 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-03-03 10:04 233276 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-01-27 07:43 . 2012-03-03 09:40 978228 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3716360468-1753449491-1053856684-1001-8192.dat
+ 2011-01-27 07:43 . 2012-03-04 09:02 978228 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3716360468-1753449491-1053856684-1001-8192.dat
- 2011-12-13 06:26 . 2012-02-24 09:40 1040984 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3716360468-1753449491-1053856684-1001-4096.dat
+ 2011-12-13 06:26 . 2012-03-03 10:37 1040984 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3716360468-1753449491-1053856684-1001-4096.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-02-07 666384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-09-23 258512]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-02-09 160840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R0 vqdtrh;vqdtrh; [x]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]
R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 PSMounter;Macrium Reflect Image Explorer Service;c:\windows\system32\drivers\psmounter.sys [x]
R3 PSVolAcc;PSVolAcc; [x]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [x]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-04 89600]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-09-23 86224]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
S2 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [2011-01-17 301720]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-09-30 508776]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-05-01 2533400]
S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-09-30 219496]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-08-16 20:43 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-12 c:\windows\Tasks\HPCeeScheduleForA-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-07-23 487424]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-28 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-28 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-28 415256]
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: Interfaces\{45E9BB37-B9C8-4E72-9BB8-A2330CC2B182}: NameServer = 123.200.191.17 123.200.191.18
FF - ProfilePath - c:\users\a\AppData\Roaming\Mozilla\Firefox\Profiles\hphxs05b.default\
FF - prefs.js: browser.startup.homepage - about:blank
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="04F0D21-79D8-7A25-D702-433F"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2012-03-04 19:15:10 - machine was rebooted
ComboFix-quarantined-files.txt 2012-03-04 09:15
ComboFix2.txt 2012-03-03 10:09
.
Pre-Run: 264,009,773,056 bytes free
Post-Run: 263,987,806,208 bytes free
.
- - End Of File - - DFB5CBFBB44DB8C084076F47EA5FFF43

Attached Files

  • Attached File  cfx.JPG   77.16KB   0 downloads


#9 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:25 PM

Posted 04 March 2012 - 05:08 AM

I
TFC(Temp File Cleaner):

  • Please download TFC to your desktop,
  • Save any unsaved work. TFC will close all open application windows.
  • Double-click TFC.exe to run the program.
  • If prompted, click "Yes" to reboot.
Note: Save your work. TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. Only if needed will you be prompted to reboot.

: Malwarebytes' Anti-Malware :

  • I would like you to rerun MBAM
  • Double-click mbam icon
  • go to the update tab at the top
  • click on check for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidentally close it, the log file is saved here and will be named like this:
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.


Download HijackThis

If you have any problems running Hijackthis see NOTE** below (Host file not read, blank notepad ...)

  • Go Here to download HijackThis Installer
  • Save HijackThis Installer to your desktop.
  • Double-click on the HijackThis Installer icon on your desktop. (Vista and Win 7 right click and run as admin)
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed it will launch Hijackthis.
  • Click on the Do a system scan and save a log file button. It will scan and the log should open in notepad.
  • Click on Edit > Select All then click on Edit > Copy to copy the entire contents of the log.
  • Come back here to this thread and Paste the log in your next reply.
  • DO NOT use the Analyze This button its findings are dangerous if misinterpreted.
  • DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

NOTE**
sometimes we have to run it like this To run HijackThis as an administrator, right-click HijackThis.exe
(located: C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe)<--32bit
(located: C:\Program Files(86)\Trend Micro\HiJackThis\HiJackThis.exe)<--64bit
and select to run as administrator

"information and logs"

  • In your next post I need the following

  • Log From MBAM
  • report from Hijackthis
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#10 grooby

grooby
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:25 AM

Posted 04 March 2012 - 09:41 PM

Here are the scans that you requested. At one point during the MBAM scan it stopped and said "malwarebytes is not responding" but after a few seconds it started running again and generated a log. I re-ran the scan and there was no pause this time. It did run much quicker the second time.

Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.03.05.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
a :: A-HP [administrator]

5/03/2012 12:16:20 PM
mbam-log-2012-03-05 (12-16-20).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 203236
Time elapsed: 2 minute(s), 43 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:03:43 PM, on 5/03/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\PDF24\pdf24.exe
C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/HPALL/14
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (file missing)
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E9BB37-B9C8-4E72-9BB8-A2330CC2B182}: NameServer = 123.200.191.17 123.200.191.18
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Program Files\IDT\WDM\AESTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: HP Health Check Service - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe (file missing)
O23 - Service: HP Wireless Assistant Service - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
O23 - Service: HP Client Services (HPClientSvc) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Macrium Reflect Image Mounting Service (ReflectService) - Unknown owner - C:\Program Files\Macrium\Reflect\ReflectService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10101 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7475 bytes

#11 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:25 PM

Posted 04 March 2012 - 09:46 PM

Greetings

These logs are looking very good, we are almost done!!! Just one more scan to go.

:Remove unneeded start-up entries:

This part of the fix is purely optional
These are programs that start up when you turn on your computer but don't need to be, any of these programs you can click on their icons (or start from the control panel) and start the program when you need it. By stopping these programs you will boot up faster and your computer will work faster.

If you have any problems running Hijackthis see NOTE** below (Host file not read, blank notepad ...)

  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

    • O4 - HKLM\..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe
  • Close all open windows and browsers/email, etc...
  • Click on the "Fix Checked" button
  • When completed, close the application.

    NOTE**You can research each of those lines >here< and see if you want to keep them or not
    just copy the name between the brackets and paste into the search space
    O4 - HKLM\..\Run: [IntelliPoint]


NOTE**
sometimes we have to run it like this To run HijackThis as an administrator, right-click HijackThis.exe
(located: C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe)<--32bit
(located: C:\Program Files(86)\Trend Micro\HiJackThis\HiJackThis.exe)<--64bit
and select to run as administrator

Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

Go Eset web page to run an online scanner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • click on the ESET Online Scanner button
  • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
  • When asked, allow the ActiveX control to install
    • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options
    Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • Click on copy to clipboard or copy and paste the results here in this topic

Copy and paste that log as a reply to this topic

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#12 grooby

grooby
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:25 AM

Posted 05 March 2012 - 02:27 AM

Hi Gringo.

The weather here is bad at the moment and it is messing up my internet connection, I will run that scan in about 24 hours to avoid problems.

#13 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:25 PM

Posted 05 March 2012 - 02:38 AM

no problem :thumbup2:
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#14 grooby

grooby
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:25 AM

Posted 05 March 2012 - 09:52 PM

I ran the scan as you instructed and it found nothing but it did not generate a log.

#15 grooby

grooby
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:25 AM

Posted 06 March 2012 - 12:21 AM

If everyting is ok I was going to download and run Dr Web Cureit, do you think this is a good program. Also is it ok to download it from softpedia rather than from its own site. The download from their site never seems to work either in IE or firefox.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users