Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HijackThis Log: Please help Diagnose


  • This topic is locked This topic is locked
68 replies to this topic

#1 phoenix1206

phoenix1206

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 12 June 2012 - 05:40 AM

A few days ago, I had some heard Congratulations You win soundbites and my computer has been pretty slow, especially Firefox. I wonder whether it is infected by malware. Thanks.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:33:14, on 12.06.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
C:\Windows\Explorer.EXE
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\TpShocks.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe
C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\SCHTASK.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
C:\Program Files\Sandboxie\SandboxieRpcSs.exe
C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
C:\Program Files\3 Mobile Broadband\3Connect\Wilog.exe
C:\Program Files\Sandboxie\SandboxieCrypto.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\rundll32.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [Message Center Plus] C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe /start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe"
O4 - HKLM\..\Run: [IdeaNotesUser] C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AcWin7Hlpr] C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe
O4 - HKLM\..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Radio Downloader] "C:\Program Files\Radio Downloader\Radio Downloader.exe" /hidemainwindow
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [chromium] C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe --no-startup-window
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [Spotify] "C:\Users\Phoenix\AppData\Roaming\Spotify\spotify.exe" /uri spotify:autostart
O4 - Startup: OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: 新增到卡巴斯基廣告橫幅防護清單 - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: 虛擬鍵盤(&V) - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: 檢查網址(&H) - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\youku\common\ikutm.dll
O10 - Unknown file in Winsock LSP: c:\program files\youku\common\ikutm.dll
O10 - Unknown file in Winsock LSP: c:\program files\youku\common\ikutm.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{20AF87F5-CE7A-4203-9AA7-E841AA2A2023}: NameServer = 217.171.135.1 217.171.132.1
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: AcPrfMgrSvc - Lenovo - C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe
O23 - Service: AcSvc - Lenovo - C:\Program Files\Lenovo\Access Connections\AcSvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: 卡巴斯基防病毒服務 (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
O23 - Service: BecHelperService - Unknown owner - C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
O23 - Service: Bonjour 服務 (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel® Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: DDNIMSGService - Digital Delivery Networks, Inc. - C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe
O23 - Service: DDNIService - Digital Delivery Networks, Inc. - C:\Program Files\DDNI\DIBS\DDNIService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google更新 服務 (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google更新 服務 (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo. - C:\Windows\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod 服務 (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Lenovo Auto Scroll (Lenovo.VIRTSCRLSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Power Manager DBC Service - Lenovo - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: Cisco EnergyWise Enabler (PwmEWSvc) - Lenovo Group Limited - C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - C:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\Windows\System32\TPHDEXLG.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

--
End of file - 20029 bytes

BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:46 PM

Posted 15 June 2012 - 12:36 AM

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your computer problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.


DeFogger:

  • Please download DeFogger to your desktop.

    Double click DeFogger to run the tool.
  • The application window will appear
  • Click the Disable button to disable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger may ask you to reboot the machine, if it does - click OK
Do not re-enable these drivers until otherwise instructed.


Security Check

  • Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


Download DDS:

  • Please download DDS by sUBs from one of the links below and save it to your desktop:

    Posted Image
    Download DDS and save it to your desktop

    Link1
    Link2
    Link3

    Please disable any anti-malware program that will block scripts from running before running DDS.

    • Double-Click on dds.scr and a command window will appear. This is normal.
    • Shortly after two logs will appear:
    • DDS.txt
    • Attach.txt
  • A window will open instructing you save & post the logs
  • Save the logs to a convenient place such as your desktop
  • Copy the contents of both logs & post in your next reply

information and logs:

  • In your next post I need the following

  • .logs from DDS
  • let me know of any problems you may have had

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 15 June 2012 - 03:58 AM

Results of screen317's Security Check version 0.99.41
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Kaspersky Internet Security
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Java™ 6 Update 31
Java™ 7 Update 4
Adobe Flash Player 10 Flash Player out of date!
Adobe Flash Player 11.3.300.257
Mozilla Firefox (12.0)
Google Chrome 19.0.1084.52
Google Chrome 19.0.1084.56
````````Process Check: objlist.exe by Laurent````````
Kaspersky Lab Kaspersky Internet Security 2012 avp.exe
Kaspersky Lab Kaspersky Internet Security 2012 klwtblfs.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 23.09.2011 17:09:51
System Uptime: 15.06.2012 08:28:26 (1 hours ago)
.
Motherboard: LENOVO | | 28476WB
Processor: Pentium® Dual-Core CPU T4500 @ 2.30GHz | U2E1 | 2300/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 287 GiB total, 97.88 GiB free.
D: is CDROM ()
F: is CDROM (CDFS)
G: is Removable
I: is CDROM (CDFS)
J: is Removable
Q: is FIXED (NTFS) - 10 GiB total, 5.144 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP132: 12.06.2012 20:46:24 - Windows Update
.
==== Installed Programs ======================
.
Registry Patch to arrange icons in Device and Printers folder of Windows 7
32 Bit HP CIO Components Installer
3Connect
Access Help
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.3)
AIO_Scan
Amazon MP3 Downloader 1.0.9
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft MediaImpression 2
AT&T Service Activation
Audacity 1.3.13 (Unicode)
Bing Bar
BisonCam Twain Pro
Bonjour
BufferChm
Cassini-Huygens Photojournal Screen Saver
CCleaner
Chinese Traditional Fonts Support For Adobe Reader X
Copy
Create Recovery Media
CutePDF Writer 2.8
D3DX10
Debut Video Capture Software
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Destinations
Dev-C++ 5 beta 9 release (4.9.9.2)
DeviceDiscovery
DIBS
DirectX 9 Runtime
DJ_AIO_ProductContext
DJ_AIO_Software
DJ_AIO_Software_min
Exact Audio Copy 1.0beta3
FLAC 1.2.1b (remove only)
foobar2000 v1.1.7
GeoGebra
Glovius
Google Chrome
Google Earth
Google Gears
Google Update Helper
GPBaseService2
Graph 4.3
HiJackThis
HP Customer Participation Program 13.0
HP Deskjet All-In-One Driver Software 13.0 Rel. 1
HP Imaging Device Functions 13.0
HP Solution Center 13.0
HPPhotoGadget
HPProductAssistant
HPSSupply
Huawei modem
iKu 2
Integrated Camera Driver Installer Package Ver.1.0.1.2
Intel PROSet Wireless
Intel® Graphics Media Accelerator Driver
Intel® PROSet/無線 WiFi 軟體
Intel® TV Wizard
IntelR Matrix Storage Manager
InterVideo WinDVD 8
iTunes
Java Auto Updater
Java™ 6 Update 31
JMicron Flash Media Controller Driver
Junk Mail filter update
Kaspersky Internet Security 2012
Lenovo Auto Scroll Utility
Lenovo Central
Lenovo Idea Notes
Lenovo Patch Utility
Lenovo System Interface Driver
Lenovo ThinkVantage Toolbox
Lenovo Welcome
Little Fighter 2 version 2.0a
Mesh Runtime
Message Center Plus
Messenger Companion
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Home and Student 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Word MUI (English) 2010
Microsoft Research AutoCollage Touch 2009
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.5026
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mobile Broadband Connect
Mozilla Firefox 12.0 (x86 en-GB)
Mozilla Maintenance Service
MSVCRT
MSXML 4.0 SP2 (KB973688)
MuseScore 0.9.6.3 MuseScore score typesetter
On Screen Display
Parmen
Picasa 3
QuickTime
Radio Downloader
Realtek Ethernet Controller Driver For Windows 7
Realtek High Definition Audio Driver
Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7
Reimage Repair
Rescue and Recovery
Roxio Activation Module
Roxio Central Audio
Roxio Central Copy
Roxio Central Core
Roxio Central Data
Roxio Central Tools
Roxio Creator Small Business Edition
Roxio Express Labeler 3
Ruby 1.9.3-p0
Sandboxie 3.70 (32-bit)
Scan
Security Task Manager 1.8d
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft Visio Viewer 2010 (KB2597981) 32-Bit Edition
Shop for HP Supplies
Skype Click to Call
Skype™ 5.9
snaap! Uploader
SolutionCenter
Sonic CinePlayer Decoder Pack
Sonic Icons for Lenovo
SoundTap Streaming Audio Recorder
Spotify
Station Spacewalk Game 2.0
Status
Stellaris 1.60
Stellarium 0.10.6.1
System Migration Assistant
System Update
ThinkPad Bluetooth with Enhanced Data Rate Software
ThinkPad FullScreen Magnifier
ThinkPad Hotkey Features Integration Setup
ThinkPad Hotkey Features Setup
ThinkPad Power Management Driver
ThinkPad Power Manager
ThinkPad UltraNav Driver
ThinkPad UltraNav Utility
ThinkVantage Access Connections
ThinkVantage Active Protection System
ThinkVantage Communications Utility
Toolbox
Total Video Converter 3.61 100319
TrayApp
Ulead PhotoImpact 10
UnloadSupport
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Verizon Wireless Mobile Broadband Self Activation
VLC media player 1.1.9
WebReg
Windows Driver Package - Intel hdc (06/04/2009 7.0.0.1013)
Windows Driver Package - Intel System (06/04/2009 1.0.0.0002)
Windows Driver Package - Lenovo 1.55 (08/18/2009 1.55)
Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (07/10/2009 6.0.1.5892)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
WinRAR 4.00 beta 1 (32-bit)
Xvid Video Codec
ZTE_1.2059.0.8
.
==== Event Viewer Messages From Past Week ========
.
15.06.2012 08:32:22, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
14.06.2012 23:25:04, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
13.06.2012 10:59:09, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{14C8C72B-448D-4D7B-BF91-C11B89D962E4} because another computer on the network has the same name. The server could not start.
12.06.2012 14:55:55, Error: Service Control Manager [7022] - The Bluetooth Service service hung on starting.
12.06.2012 10:16:06, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
12.06.2012 08:38:08, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
11.06.2012 15:53:50, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Appinfo service.
11.06.2012 15:53:17, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AcPrfMgrSvc service.
10.06.2012 15:23:37, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TPHKSVC service.
10.06.2012 15:23:37, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
10.06.2012 09:30:54, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
10.06.2012 09:30:54, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10.06.2012 09:30:54, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
10.06.2012 09:30:31, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
10.06.2012 09:30:31, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.
09.06.2012 08:57:21, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the CryptSvc service.
08.06.2012 17:13:00, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WinDefend service.
08.06.2012 17:09:57, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Apple Mobile Device service.
.
==== End Of File ===========================


.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31
Run by Phoenix at 9:50:26 on 2012-06-15
Microsoft Windows 7 Home Premium 6.1.7601.1.950.852.1033.18.1913.577 [GMT 1:00]
.
AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\spoolsv.exe
C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
C:\Program Files\DDNI\DIBS\DDNIService.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Lenovo\Access Connections\AcSvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\Google\Update\1.3.21.111\GoogleCrashHandler.exe
C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\TpShocks.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe
C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\SCHTASK.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\igfxext.exe
C:\Users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Users\Phoenix\AppData\Roaming\Spotify\spotify.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
C:\Program Files\Sandboxie\SandboxieRpcSs.exe
C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
C:\Program Files\Lenovo\System Update\SUService.exe
C:\Program Files\Sandboxie\SandboxieCrypto.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\rundll32.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\notepad.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\perfmon.exe
C:\Program Files\3 Mobile Broadband\3Connect\Wilog.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\conhost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://lenovo.msn.com
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyServer = 172.16.0.3:8881
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2012\ievkbd.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~4\office14\URLREDIR.DLL
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2012\klwtbbho.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Radio Downloader] "c:\program files\radio downloader\Radio Downloader.exe" /hidemainwindow
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
uRun: [Xvid] c:\program files\xvid\CheckUpdate.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Spotify Web Helper] "c:\users\phoenix\appdata\roaming\spotify\data\SpotifyWebHelper.exe"
uRun: [chromium] c:\users\phoenix\appdata\local\google\chrome\application\chrome.exe --no-startup-window
uRun: [SandboxieControl] "c:\program files\sandboxie\SbieCtrl.exe"
uRun: [Spotify] "c:\users\phoenix\appdata\roaming\spotify\spotify.exe" /uri spotify:autostart
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [TpShocks] TpShocks.exe
mRun: [PWMTRV] rundll32 c:\progra~1\thinkpad\utilit~1\PWMTR32V.DLL,PwrMgrBkGndMonitor
mRun: [Message Center Plus] c:\program files\lenovo\message center plus\MCPLaunch.exe /start
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\10.0\sharedcom\RoxWatchTray10.exe"
mRun: [IdeaNotesUser] c:\program files\ddni\lenovo idea notes\DDNIMSGUser.exe
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [AcWin7Hlpr] c:\program files\lenovo\access connections\AcTBenabler.exe
mRun: [LENOVO.TPKNRRES] c:\program files\lenovo\communications utility\TPKNRRES.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Ulead AutoDetector v2] c:\program files\common files\ulead systems\autodetector\monitor.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2012\avp.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
StartupFolder: c:\users\phoenix\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office14\ONENOTEM.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~4\office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm
IE: 新增到卡巴斯基廣告橫幅防護清單 - c:\program files\kaspersky lab\kaspersky internet security 2012\ie_banner_deny.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2012\ievkbd.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2012\klwtbbho.dll
LSP: c:\program files\youku\common\ikutm.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
TCP: DhcpNameServer = 208.67.222.222
TCP: Interfaces\{14C8C72B-448D-4D7B-BF91-C11B89D962E4} : DhcpNameServer = 208.67.222.222
TCP: Interfaces\{14C8C72B-448D-4D7B-BF91-C11B89D962E4}\342796070737 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{14C8C72B-448D-4D7B-BF91-C11B89D962E4}\46166756 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{C0D43FEA-7B50-476E-9FE1-8E01BC63934E} : DhcpNameServer = 192.168.8.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: igfxcui - igfxdev.dll
Notify: klogon - c:\windows\system32\klogon.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\phoenix\appdata\roaming\mozilla\firefox\profiles\dr9oautu.default\
FF - prefs.js: network.proxy.ftp - 172.16.0.3
FF - prefs.js: network.proxy.ftp_port - 8881
FF - prefs.js: network.proxy.http - 172.16.0.3
FF - prefs.js: network.proxy.http_port - 8881
FF - prefs.js: network.proxy.socks - 172.16.0.3
FF - prefs.js: network.proxy.socks_port - 8881
FF - prefs.js: network.proxy.ssl - 172.16.0.3
FF - prefs.js: network.proxy.ssl_port - 8881
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\progra~1\micros~4\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\micros~4\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\phoenix\appdata\local\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_235.dll
.
============= SERVICES / DRIVERS ===============
.
R3 5U877;USB Video Device;c:\windows\system32\drivers\5U877.sys [2011-9-22 125568]
R3 AMPPAL;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Virtual Adapter;c:\windows\system32\drivers\AmpPal.sys [2011-8-8 243712]
S3 AMPPALP;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Protocol;c:\windows\system32\drivers\AmpPal.sys [2011-8-8 243712]
.
=============== Created Last 30 ================
.
2012-06-13 06:30:53 -------- d-----w- c:\users\phoenix\appdata\local\{CEAA4D68-FD1A-4BE5-9B8A-5DAE71E373B0}
2012-06-13 06:27:33 -------- d-----w- c:\users\phoenix\appdata\local\{AE67A9A1-2BA9-4F0C-AC0B-773CA373C19B}
2012-06-12 19:47:50 6737808 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{04fb8e19-dd28-4132-b483-4dc3f41166df}\mpengine.dll
2012-06-12 19:44:42 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2012-06-12 19:44:42 1158656 ----a-w- c:\windows\system32\crypt32.dll
2012-06-12 19:44:42 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-12 19:43:00 2342400 ----a-w- c:\windows\system32\msi.dll
2012-06-12 19:42:57 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-12 19:42:55 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-12 19:42:55 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-12 19:42:55 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-12 19:42:52 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-06-12 19:42:51 2343936 ----a-w- c:\windows\system32\win32k.sys
2012-06-12 19:42:43 164352 ----a-w- c:\windows\system32\profsvc.dll
2012-06-12 13:54:01 -------- d-----w- c:\users\phoenix\appdata\local\{8064DAFD-E19F-4D8E-B814-1B3D354D98E9}
2012-06-12 07:31:58 -------- d-----w- c:\users\phoenix\appdata\local\{62F6A186-A202-42EA-89F6-77D179595F50}
2012-06-10 08:34:48 -------- d-----w- c:\users\phoenix\appdata\local\{5C147FF1-DB22-4F09-933F-6F231B420F56}
2012-06-10 08:33:48 -------- d-----w- c:\users\phoenix\appdata\local\{9CD507D9-9AF9-48C3-A292-06C20C6FDC4F}
2012-06-08 19:08:22 -------- d-----r- C:\Sandbox
2012-06-08 19:03:13 -------- d-----w- c:\program files\Sandboxie
2012-06-08 18:44:49 388096 ----a-r- c:\users\phoenix\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2012-06-08 18:44:44 -------- d-----w- c:\program files\Trend Micro
2012-06-08 08:42:20 -------- d-----w- c:\users\phoenix\appdata\local\{938D0570-6159-4B09-AB3A-528134FFD41E}
2012-06-08 08:41:56 -------- d-----w- c:\users\phoenix\appdata\local\{F5FA75E2-0BEA-449F-82F0-67BF69E00CAB}
2012-06-07 09:05:04 -------- d-----w- c:\users\phoenix\appdata\local\{6DF69612-16D8-45E2-96B4-4C7F0F2C4A67}
2012-06-07 09:04:52 -------- d-----w- c:\users\phoenix\appdata\local\{48733FCC-0841-4C7B-8957-8D4FA0B9B621}
2012-06-06 21:04:17 -------- d-----w- c:\users\phoenix\appdata\local\{91F53140-184F-49F0-92CC-82CB5529E3AE}
2012-06-06 21:04:04 -------- d-----w- c:\users\phoenix\appdata\local\{F0FE11E4-CE73-4898-A76E-9032800855E1}
2012-06-06 09:03:35 -------- d-----w- c:\users\phoenix\appdata\local\{557DA066-454A-482D-A249-86201668A9B1}
2012-06-06 09:03:19 -------- d-----w- c:\users\phoenix\appdata\local\{FD981802-DCA3-4430-B5CE-DF27BA63E370}
2012-06-05 20:37:16 -------- d-----w- c:\users\phoenix\appdata\local\{BC96475A-BE1A-45C5-ADE7-376D1E71DB15}
2012-06-05 20:37:01 -------- d-----w- c:\users\phoenix\appdata\local\{B3402106-7E99-4325-A232-1BAD0DA5B1ED}
2012-06-05 08:35:52 -------- d-----w- c:\users\phoenix\appdata\local\{E2EE5E0E-2A10-4B00-982D-EFACE0712EC3}
2012-06-05 08:35:27 -------- d-----w- c:\users\phoenix\appdata\local\{45F70AC0-569A-4DDB-A8A6-A495ADF7D1D5}
2012-06-04 20:25:48 -------- d-----w- c:\users\phoenix\appdata\local\{DDAB5A9D-3A1A-4982-8B2F-345005762AF4}
2012-06-04 20:25:35 -------- d-----w- c:\users\phoenix\appdata\local\{34FBF0CD-F7B5-491E-BE5D-62F65CAA5D13}
2012-06-04 08:24:16 -------- d-----w- c:\users\phoenix\appdata\local\{A25C9548-22A6-4379-B7AE-227C636B8502}
2012-06-04 08:23:41 -------- d-----w- c:\users\phoenix\appdata\local\{F68ACF32-2151-447C-A71F-82BABFCC6715}
2012-06-03 20:23:11 -------- d-----w- c:\users\phoenix\appdata\local\{3EB1765E-A715-4899-B267-CD7AC5312FFB}
2012-06-03 20:22:56 -------- d-----w- c:\users\phoenix\appdata\local\{83989303-694F-43DC-89C6-DD25D0F8550B}
2012-06-03 08:19:49 -------- d-----w- c:\users\phoenix\appdata\local\{C72C156D-67D7-445B-AEED-2BB5268FB7F2}
2012-06-03 08:19:01 -------- d-----w- c:\users\phoenix\appdata\local\{56A7F80E-593F-42DD-A990-9BBB2395EF1E}
2012-06-02 19:51:47 -------- d-----w- c:\users\phoenix\appdata\local\{282C0569-38A0-4E70-913B-9F0D4C610830}
2012-06-02 19:51:32 -------- d-----w- c:\users\phoenix\appdata\local\{CA9AD72C-55B2-4E18-86B0-A32D6FCFDF58}
2012-06-02 07:50:06 -------- d-----w- c:\users\phoenix\appdata\local\{125DA07B-B83B-4C7D-A3D8-F0EA0B92F24A}
2012-06-02 07:49:25 -------- d-----w- c:\users\phoenix\appdata\local\{77FF7490-AACB-4889-9928-D4F2EF8EE52C}
2012-06-01 12:55:34 -------- d-----w- c:\users\phoenix\appdata\local\{01FD5B23-1DA7-417D-BF01-54DD576E6B91}
2012-06-01 06:29:05 -------- d-----w- c:\users\phoenix\appdata\local\{6D73E470-CA09-4402-83AC-BD48CAEA2236}
2012-05-31 06:52:21 -------- d-----w- c:\users\phoenix\appdata\local\{EB8C4874-4CF8-49B0-936F-3309D2B4FC6F}
2012-05-30 12:59:30 4966600 ----a-w- c:\program files\mozilla firefox\extensions\{82af8dca-6de9-405d-bd5e-43525bdad38a}\components\SkypeFfComponent.dll
2012-05-30 07:19:09 -------- d-----w- c:\users\phoenix\appdata\local\{98339BA1-2136-489C-B1F0-B10FE2FE042F}
2012-05-29 06:59:36 -------- d-----w- c:\users\phoenix\appdata\local\{6C487B6D-B792-4407-962E-6396CC2D2A25}
2012-05-28 07:17:49 -------- d-----w- c:\users\phoenix\appdata\local\{9702AF88-4646-41E8-A634-AED48D96EE0C}
2012-05-27 08:40:01 -------- d-----w- c:\users\phoenix\appdata\local\{170AE207-41DC-4DFD-A7E2-95317DAD8A47}
2012-05-26 12:48:10 -------- d-----w- c:\users\phoenix\appdata\local\{28EC108C-CC0A-44D3-B797-1646160728AB}
2012-05-26 08:00:34 -------- d-----w- c:\users\phoenix\appdata\local\{B8D6C216-2CEA-4E9E-B5C1-62462E6D96F3}
2012-05-25 06:59:00 -------- d-----w- c:\users\phoenix\appdata\local\{77076257-0728-4875-A70C-250BD9BB5297}
2012-05-24 07:11:04 -------- d-----w- c:\users\phoenix\appdata\local\{B50816CD-137F-4F68-BC9F-F5443B7B7B7A}
2012-05-23 18:50:00 -------- d-----w- c:\users\phoenix\appdata\local\{934DF608-2E2C-4504-A47A-576D885C4FA4}
2012-05-23 06:49:18 -------- d-----w- c:\users\phoenix\appdata\local\{CA253CB3-08E0-4453-A008-326F985E3EE3}
2012-05-22 06:47:58 -------- d-----w- c:\users\phoenix\appdata\local\{C28CFFCF-2754-4C1B-9724-A9A246B187B1}
2012-05-21 06:47:59 -------- d-----w- c:\users\phoenix\appdata\local\{0CE86004-50E7-476B-A9AF-A7B7FB75B64B}
2012-05-20 08:41:15 -------- d-----w- c:\users\phoenix\appdata\local\{0B67C8A2-2177-4636-B44A-06729ADC87EE}
2012-05-19 18:30:02 -------- d-----w- c:\users\phoenix\appdata\local\{CC0E5346-6268-4DD3-9FCA-16F5F36C8C99}
2012-05-19 08:32:12 -------- d-----w- c:\users\phoenix\appdata\local\{408259C5-B816-475B-BCFF-23C793C3C0BA}
2012-05-18 07:10:02 -------- d-----w- c:\users\phoenix\appdata\local\{948C0619-438A-4B90-9640-D71823F58B9A}
2012-05-17 07:12:49 -------- d-----w- c:\users\phoenix\appdata\local\{438C970F-E047-463A-AC0A-119D6B874D5A}
.
==================== Find3M ====================
.
2012-05-22 07:08:25 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-22 07:08:25 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-17 22:45:37 1800192 ----a-w- c:\windows\system32\jscript9.dll
2012-05-17 22:35:47 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-05-17 22:35:39 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-05-17 22:29:45 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-05-17 22:24:45 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-03-31 04:39:37 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-31 04:39:37 3913072 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-30 10:23:11 1291632 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
============= FINISH: 9:52:57.16 ===============

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:46 PM

Posted 15 June 2012 - 07:07 AM

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 15 June 2012 - 02:45 PM

ComboFix 12-06-15.02 - Phoenix 15.06.2012 18:22:01.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.950.852.1033.18.1913.923 [GMT 1:00]
執行位置: c:\users\Phoenix\Downloads\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( 2012-05-15 至 2012-06-15 的新的檔案 )))))))))))))))))))))))))))))))
.
.
2012-06-15 18:28 . 2012-06-15 18:28 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{04FB8E19-DD28-4132-B483-4DC3F41166DF}\offreg.dll
2012-06-15 17:36 . 2012-06-15 18:36 -------- d-----w- c:\users\Phoenix\AppData\Local\temp
2012-06-15 17:36 . 2012-06-15 17:36 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-06-15 17:36 . 2012-06-15 17:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-12 19:47 . 2012-05-08 16:40 6737808 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{04FB8E19-DD28-4132-B483-4DC3F41166DF}\mpengine.dll
2012-06-12 19:44 . 2012-04-24 04:36 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2012-06-12 19:44 . 2012-04-24 04:36 1158656 ----a-w- c:\windows\system32\crypt32.dll
2012-06-12 19:44 . 2012-04-24 04:36 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-12 19:43 . 2012-04-07 11:26 2342400 ----a-w- c:\windows\system32\msi.dll
2012-06-12 19:42 . 2012-04-28 03:17 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-12 19:42 . 2012-04-26 04:45 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-12 19:42 . 2012-04-26 04:45 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-12 19:42 . 2012-04-26 04:41 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-12 19:42 . 2012-05-04 09:59 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-06-12 19:42 . 2012-05-01 04:44 164352 ----a-w- c:\windows\system32\profsvc.dll
2012-06-08 19:08 . 2012-06-08 19:08 -------- d-----r- C:\Sandbox
2012-06-08 19:03 . 2012-06-08 19:03 -------- d-----w- c:\program files\Sandboxie
2012-06-08 18:44 . 2012-06-08 18:44 388096 ----a-r- c:\users\Phoenix\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-06-08 18:44 . 2012-06-08 18:44 -------- d-----w- c:\program files\Trend Micro
2012-05-30 12:59 . 2012-05-30 12:59 4966600 ----a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三個月內被修改的檔案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-22 07:08 . 2012-03-31 09:54 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-22 07:08 . 2011-10-12 16:11 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-17 22:35 . 2012-06-12 19:48 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 01:05 . 2012-06-12 19:42 2343936 ----a-w- c:\windows\system32\win32k.sys
2012-03-31 04:39 . 2012-05-14 07:35 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-31 04:39 . 2012-05-14 07:35 3913072 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-30 10:23 . 2012-05-14 07:37 1291632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-04 18:45 . 2011-09-23 16:13 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( 重要登入點 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白與合法缺省登錄將不會被顯示
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Radio Downloader"="c:\program files\Radio Downloader\Radio Downloader.exe" [2011-05-26 506792]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-06-05 17344176]
"Xvid"="c:\program files\Xvid\CheckUpdate.exe" [2011-01-17 8192]
"Spotify Web Helper"="c:\users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-05-04 932528]
"chromium"="c:\users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe" [2012-06-07 1239576]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-05-31 466704]
"Spotify"="c:\users\Phoenix\AppData\Roaming\Spotify\spotify.exe" [2012-05-04 9478320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-10 7612960]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-07 186904]
"TpShocks"="TpShocks.exe" [2011-03-29 337256]
"PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2011-11-30 1322048]
"Message Center Plus"="c:\program files\LENOVO\Message Center Plus\MCPLaunch.exe" [2009-05-28 49976]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe" [2009-08-05 244208]
"IdeaNotesUser"="c:\program files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe" [2009-08-24 221872]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-04-22 1725736]
"AcWin7Hlpr"="c:\program files\Lenovo\Access Connections\AcTBenabler.exe" [2011-04-14 31592]
"LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2010-07-27 62312]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-08 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-08 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-08 151064]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-08-27 90112]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-24 202296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
.
c:\users\Phoenix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2009-7-2 795936]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google更新 服務 (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 136176]
R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-08-05 362992]
R2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [2009-08-05 309744]
R2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [2009-08-05 166384]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-06-05 160944]
R3 AMPPALP;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [2011-08-08 243712]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2011-03-23 102784]
R3 gupdatem;Google更新 服務 (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 136176]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-07-28 25112]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2010-01-19 9216]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-05-04 129976]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-05-13 4231680]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.EXE [2011-11-30 89152]
R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files\ThinkPad\Utilities\PWMEWSVC.EXE [2011-11-30 175168]
R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-08-05 313840]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-08-05 1124848]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-09-24 1343400]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-05-06 11520]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM86.sys [2011-03-29 20592]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2011-03-04 11352]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2011-03-10 23856]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiif32.sys [2010-09-07 13680]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 AMPPALR3;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-08-08 948736]
S2 BecHelperService;BecHelperService;c:\program files\3 Mobile Broadband\3Connect\BecHelperService.exe [2011-03-23 1740696]
S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-06-03 102672]
S2 DDNIMSGService;DDNIMSGService;c:\program files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe [2010-07-20 171872]
S2 DDNIService;DDNIService;c:\program files\DDNI\DIBS\DDNIService.exe [2010-07-23 163680]
S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [2010-07-27 50536]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2011-04-04 45496]
S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [2010-07-27 74088]
S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [2010-04-07 93032]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-18 11032]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-05-30 3048136]
S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [2011-04-20 130920]
S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2011-03-29 64952]
S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys [2009-06-18 125568]
S3 AMPPAL;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [2011-08-08 243712]
S3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [2011-03-23 11136]
S3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys [2011-03-23 353280]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2011-03-23 73216]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-07-10 122880]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2010-12-13 144472]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]
S3 NETwNs32;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETwNs32.sys [2011-08-03 7517696]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S3 stdriver;Sound Tap Upper Class Filter Driver v2.0.0.0;c:\windows\system32\DRIVERS\stdriver32.sys [2011-10-14 49240]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
‘計劃任務’ 文件夾 裡的內容
.
2012-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 09:43]
.
2012-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 09:43]
.
2012-06-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000Core.job
- c:\users\Phoenix\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-23 17:47]
.
2012-06-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000UA.job
- c:\users\Phoenix\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-23 17:47]
.
2012-05-30 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:54]
.
2012-06-15 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:54]
.
.
------- 而外的掃描 -------
.
uStart Page = hxxp://lenovo.msn.com
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyServer = 172.16.0.3:8881
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
IE: 新增到卡巴斯基廣告橫幅防護清單 - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
LSP: c:\program files\YouKu\common\ikutm.dll
TCP: DhcpNameServer = 208.67.222.222
FF - ProfilePath - c:\users\Phoenix\AppData\Roaming\Mozilla\Firefox\Profiles\dr9oautu.default\
FF - prefs.js: network.proxy.ftp - 172.16.0.3
FF - prefs.js: network.proxy.ftp_port - 8881
FF - prefs.js: network.proxy.http - 172.16.0.3
FF - prefs.js: network.proxy.http_port - 8881
FF - prefs.js: network.proxy.socks - 172.16.0.3
FF - prefs.js: network.proxy.socks_port - 8881
FF - prefs.js: network.proxy.ssl - 172.16.0.3
FF - prefs.js: network.proxy.ssl_port - 8881
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*魯 
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*魯 OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.3GP\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.ASF\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.AVI\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DAT\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DVIX\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.FLV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.M4V\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MKV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MOV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MP4\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MPEG\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MPG\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.RM\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.RMVB\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.WMV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- 運行進程下的動態鏈接庫 ---------------------
.
- - - - - - - > 'Explorer.exe'(4528)
c:\program files\ThinkPad\Bluetooth Software\btmmhook.dll
c:\program files\Lenovo\Access Connections\ACDeskBand.dll
c:\program files\Lenovo\Access Connections\AcLocSettings.dll
c:\program files\Lenovo\Access Connections\AcCryptHlpr.dll
c:\program files\Lenovo\Access Connections\ACHelper.dll
c:\program files\Lenovo\Access Connections\AcSvcStub.dll
c:\program files\ThinkPad\Utilities\PWMTR32V.DLL
c:\progra~1\ThinkPad\UTILIT~1\US\PWMRT32V.DLL
c:\progra~1\ThinkPad\UTILIT~1\PWMIF32V.DLL
c:\program files\ThinkPad\Bluetooth Software\btncopy.dll
.
------------------------ 其他運行進程 ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\Sandboxie\SbieSvc.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Lenovo\Access Connections\AcPrfMgrSvc.exe
c:\progra~1\Lenovo\HOTKEY\tpnumlk.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Lenovo\Access Connections\AcSvc.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\WUDFHost.exe
c:\program files\ThinkPad\Bluetooth Software\btwdins.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Google\Update\1.3.21.111\GoogleCrashHandler.exe
c:\program files\Lenovo\System Update\SUService.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\system32\taskhost.exe
c:\progra~1\LENOVO\VIRTSCRL\virtscrl.exe
c:\program files\LENOVO\HOTKEY\tposdsvc.exe
c:\progra~1\Lenovo\HOTKEY\tpnumlkd.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\Zoom\TpScrex.exe
c:\windows\system32\conhost.exe
c:\windows\System32\TpShocks.exe
c:\windows\System32\rundll32.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Synaptics\SynTP\SynTPLpr.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\igfxext.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
c:\program files\windows defender\MpCmdRun.exe
.
**************************************************************************
.
完成時間: 2012-06-15 19:43:46 - 電腦已重新啟動
ComboFix-quarantined-files.txt 2012-06-15 18:43
ComboFix2.txt 2012-04-19 02:27
.
Pre-Run: 104,454,590,464 bytes free
Post-Run: 103,680,610,304 bytes free
.
- - End Of File - - D67E29CB321271F7DC3C580D3DFDD131

My computer is ok. It is a bit faster now. Occasionally, the web browser is rather slow.
After I run combofix, and the log file was generated, I receive the following message whenever I try to open some programs or files:
'illegal operation attempted on a registry key that has been marked for deletion'
My computer is fine after rebooting it.
Thanks a lot.

#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:46 PM

Posted 15 June 2012 - 09:26 PM

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.
  • Download TDSSKiller and save it to your Desktop.
  • doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.
  • Double click the aswMBR.exe icon to run it
  • it will ask to download extra definitions - ALLOW IT
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 16 June 2012 - 04:01 AM

Log for TDSS Killer

09:53:25.0634 7084 TDSS rootkit removing tool 2.7.40.0 Jun 15 2012 15:13:31
09:53:27.0676 7084 ============================================================
09:53:27.0676 7084 Current date / time: 2012/06/16 09:53:27.0676
09:53:27.0676 7084 SystemInfo:
09:53:27.0676 7084
09:53:27.0677 7084 OS Version: 6.1.7601 ServicePack: 1.0
09:53:27.0677 7084 Product type: Workstation
09:53:27.0677 7084 ComputerName: PHOENIX-THINK
09:53:27.0677 7084 UserName: Phoenix
09:53:27.0677 7084 Windows directory: C:\Windows
09:53:27.0677 7084 System windows directory: C:\Windows
09:53:27.0677 7084 Processor architecture: Intel x86
09:53:27.0677 7084 Number of processors: 2
09:53:27.0677 7084 Page size: 0x1000
09:53:27.0677 7084 Boot type: Normal boot
09:53:27.0677 7084 ============================================================
09:54:11.0516 7084 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
09:54:11.0519 7084 ============================================================
09:54:11.0519 7084 \Device\Harddisk0\DR0:
09:54:11.0521 7084 MBR partitions:
09:54:11.0521 7084 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x258000
09:54:11.0521 7084 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x258800, BlocksNum 0x23D53800
09:54:11.0521 7084 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x23FAC000, BlocksNum 0x14822B0
09:54:11.0521 7084 ============================================================
09:54:11.0784 7084 C: <-> \Device\Harddisk0\DR0\Partition1
09:54:12.0421 7084 Q: <-> \Device\Harddisk0\DR0\Partition2
09:54:12.0447 7084 ============================================================
09:54:12.0447 7084 Initialize success
09:54:12.0447 7084 ============================================================
09:54:34.0217 7896 ============================================================
09:54:34.0217 7896 Scan started
09:54:34.0217 7896 Mode: Manual;
09:54:34.0217 7896 ============================================================
09:54:39.0450 7896 1394ohci (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
09:54:39.0490 7896 1394ohci - ok
09:54:39.0600 7896 5U877 (d623af0d0db0f13d32cae34d3f0dad39) C:\Windows\system32\DRIVERS\5U877.sys
09:54:39.0615 7896 5U877 - ok
09:54:39.0864 7896 ACDaemon (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
09:54:39.0935 7896 ACDaemon - ok
09:54:40.0056 7896 ACPI (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
09:54:40.0125 7896 ACPI - ok
09:54:40.0195 7896 AcpiPmi (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
09:54:40.0250 7896 AcpiPmi - ok
09:54:40.0612 7896 AcPrfMgrSvc (deeccadbd25f65d65293a09721b3a447) C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe
09:54:40.0672 7896 AcPrfMgrSvc - ok
09:54:40.0811 7896 AcSvc (a7753804c6c66c9c80f4e29659fd721c) C:\Program Files\Lenovo\Access Connections\AcSvc.exe
09:54:40.0826 7896 AcSvc - ok
09:54:41.0071 7896 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
09:54:41.0161 7896 AdobeARMservice - ok
09:54:41.0323 7896 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
09:54:41.0366 7896 adp94xx - ok
09:54:41.0553 7896 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
09:54:41.0618 7896 adpahci - ok
09:54:41.0691 7896 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
09:54:41.0695 7896 adpu320 - ok
09:54:41.0781 7896 AeLookupSvc (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll
09:54:41.0789 7896 AeLookupSvc - ok
09:54:41.0903 7896 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\Windows\system32\drivers\Afc.sys
09:54:41.0931 7896 Afc - ok
09:54:42.0222 7896 AFD (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys
09:54:42.0262 7896 AFD - ok
09:54:42.0346 7896 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
09:54:42.0349 7896 agp440 - ok
09:54:42.0465 7896 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
09:54:42.0510 7896 aic78xx - ok
09:54:42.0591 7896 ALG (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe
09:54:42.0692 7896 ALG - ok
09:54:42.0764 7896 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
09:54:42.0768 7896 aliide - ok
09:54:42.0820 7896 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
09:54:42.0833 7896 amdagp - ok
09:54:42.0875 7896 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys
09:54:42.0878 7896 amdide - ok
09:54:42.0974 7896 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
09:54:42.0978 7896 AmdK8 - ok
09:54:43.0034 7896 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
09:54:43.0046 7896 AmdPPM - ok
09:54:43.0151 7896 amdsata (d320bf87125326f996d4904fe24300fc) C:\Windows\system32\drivers\amdsata.sys
09:54:43.0163 7896 amdsata - ok
09:54:43.0252 7896 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
09:54:43.0257 7896 amdsbs - ok
09:54:43.0302 7896 amdxata (46387fb17b086d16dea267d5be23a2f2) C:\Windows\system32\drivers\amdxata.sys
09:54:43.0305 7896 amdxata - ok
09:54:43.0397 7896 AMPPAL (99bbef4a68bf398ed647f4eeb8ff66d4) C:\Windows\system32\DRIVERS\AMPPAL.sys
09:54:43.0410 7896 AMPPAL - ok
09:54:43.0462 7896 AMPPALP (99bbef4a68bf398ed647f4eeb8ff66d4) C:\Windows\system32\DRIVERS\amppal.sys
09:54:43.0472 7896 AMPPALP - ok
09:54:43.0919 7896 AMPPALR3 (ef4022e9c59b20438c1304424d9441f4) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
09:54:44.0010 7896 AMPPALR3 - ok
09:54:44.0099 7896 AppID (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
09:54:44.0102 7896 AppID - ok
09:54:44.0151 7896 AppIDSvc (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll
09:54:44.0155 7896 AppIDSvc - ok
09:54:44.0253 7896 Appinfo (fb1959012294d6ad43e5304df65e3c26) C:\Windows\System32\appinfo.dll
09:54:44.0256 7896 Appinfo - ok
09:54:44.0411 7896 Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
09:54:44.0415 7896 Apple Mobile Device - ok
09:54:44.0521 7896 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
09:54:44.0524 7896 arc - ok
09:54:44.0565 7896 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
09:54:44.0569 7896 arcsas - ok
09:54:44.0832 7896 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
09:54:44.0963 7896 aspnet_state - ok
09:54:45.0024 7896 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
09:54:45.0027 7896 AsyncMac - ok
09:54:45.0180 7896 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
09:54:45.0183 7896 atapi - ok
09:54:45.0317 7896 AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
09:54:45.0373 7896 AudioEndpointBuilder - ok
09:54:45.0399 7896 Audiosrv (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
09:54:45.0403 7896 Audiosrv - ok
09:54:45.0570 7896 AVP (2718dc27571bd1e37813f5759d2dc118) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
09:54:45.0577 7896 AVP - ok
09:54:45.0698 7896 AxInstSV (6e30d02aac9cac84f421622e3a2f6178) C:\Windows\System32\AxInstSV.dll
09:54:45.0795 7896 AxInstSV - ok
09:54:45.0878 7896 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
09:54:45.0889 7896 b06bdrv - ok
09:54:45.0966 7896 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
09:54:45.0972 7896 b57nd60x - ok
09:54:46.0151 7896 BBSvc (0d1ea7509f394d8b705b239ee71f5118) C:\Program Files\Microsoft\BingBar\BBSvc.EXE
09:54:46.0283 7896 BBSvc - ok
09:54:46.0460 7896 BDESVC (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll
09:54:46.0468 7896 BDESVC - ok
09:54:46.0946 7896 BecHelperService (68bf3520fe759c91fd9182f36e585374) C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
09:54:47.0010 7896 BecHelperService - ok
09:54:47.0258 7896 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
09:54:47.0262 7896 Beep - ok
09:54:47.0430 7896 BFE (1e2bac209d184bb851e1a187d8a29136) C:\Windows\System32\bfe.dll
09:54:47.0466 7896 BFE - ok
09:54:47.0541 7896 BITS (e585445d5021971fae10393f0f1c3961) C:\Windows\system32\qmgr.dll
09:54:47.0632 7896 BITS - ok
09:54:47.0689 7896 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
09:54:47.0711 7896 blbdrive - ok
09:54:47.0883 7896 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe
09:54:47.0902 7896 Bonjour Service - ok
09:54:47.0962 7896 bowser (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
09:54:48.0039 7896 bowser - ok
09:54:48.0098 7896 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
09:54:48.0168 7896 BrFiltLo - ok
09:54:48.0210 7896 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
09:54:48.0254 7896 BrFiltUp - ok
09:54:48.0314 7896 BridgeMP (77361d72a04f18809d0efb6cceb74d4b) C:\Windows\system32\DRIVERS\bridge.sys
09:54:48.0319 7896 BridgeMP - ok
09:54:48.0413 7896 Browser (6e11f33d14d020f58d5e02e4d67dfa19) C:\Windows\System32\browser.dll
09:54:48.0415 7896 Browser - ok
09:54:48.0465 7896 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
09:54:48.0471 7896 Brserid - ok
09:54:48.0522 7896 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
09:54:48.0528 7896 BrSerWdm - ok
09:54:48.0562 7896 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
09:54:48.0564 7896 BrUsbMdm - ok
09:54:48.0607 7896 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
09:54:48.0684 7896 BrUsbSer - ok
09:54:48.0904 7896 BthEnum (2865a5c8e98c70c605f417908cebb3a4) C:\Windows\system32\drivers\BthEnum.sys
09:54:48.0950 7896 BthEnum - ok
09:54:49.0062 7896 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
09:54:49.0103 7896 BTHMODEM - ok
09:54:49.0158 7896 BthPan (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\Windows\system32\DRIVERS\bthpan.sys
09:54:49.0235 7896 BthPan - ok
09:54:49.0307 7896 BTHPORT (c2fbf6d271d9a94d839c416bf186ead9) C:\Windows\System32\Drivers\BTHport.sys
09:54:49.0321 7896 BTHPORT - ok
09:54:49.0407 7896 bthserv (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll
09:54:49.0446 7896 bthserv - ok
09:54:49.0645 7896 BTHSSecurityMgr (8893814133afdd17431e2682ede2dce9) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
09:54:49.0717 7896 BTHSSecurityMgr - ok
09:54:49.0799 7896 BTHUSB (c81e9413a25a439f436b1d4b6a0cf9e9) C:\Windows\System32\Drivers\BTHUSB.sys
09:54:49.0802 7896 BTHUSB - ok
09:54:49.0875 7896 btwaudio (d57d29132efe13a83133d9bd449e0cf1) C:\Windows\system32\drivers\btwaudio.sys
09:54:49.0948 7896 btwaudio - ok
09:54:50.0022 7896 btwavdt (d282c14a69357d0e1bafaecc2ca98c3a) C:\Windows\system32\DRIVERS\btwavdt.sys
09:54:50.0070 7896 btwavdt - ok
09:54:50.0254 7896 btwdins (f7434401ae320bb97903a3c1865242fb) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
09:54:50.0299 7896 btwdins - ok
09:54:50.0326 7896 btwl2cap (aafd7cb76ba61fbb08e302da208c974a) C:\Windows\system32\DRIVERS\btwl2cap.sys
09:54:50.0337 7896 btwl2cap - ok
09:54:50.0405 7896 btwrchid (02eb4d2b05967df2d32f29c84ab1fb17) C:\Windows\system32\DRIVERS\btwrchid.sys
09:54:50.0439 7896 btwrchid - ok
09:54:51.0012 7896 catchme - ok
09:54:51.0064 7896 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
09:54:51.0081 7896 cdfs - ok
09:54:51.0165 7896 cdrom (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\DRIVERS\cdrom.sys
09:54:51.0195 7896 cdrom - ok
09:54:51.0311 7896 CertPropSvc (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
09:54:51.0421 7896 CertPropSvc - ok
09:54:51.0726 7896 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
09:54:51.0729 7896 circlass - ok
09:54:51.0806 7896 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
09:54:51.0827 7896 CLFS - ok
09:54:52.0043 7896 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
09:54:52.0101 7896 clr_optimization_v2.0.50727_32 - ok
09:54:52.0327 7896 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
09:54:52.0491 7896 clr_optimization_v4.0.30319_32 - ok
09:54:52.0581 7896 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
09:54:52.0615 7896 CmBatt - ok
09:54:52.0732 7896 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
09:54:52.0754 7896 cmdide - ok
09:54:52.0908 7896 CNG (6427525d76f61d0c519b008d3680e8e7) C:\Windows\system32\Drivers\cng.sys
09:54:52.0947 7896 CNG - ok
09:54:53.0003 7896 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
09:54:53.0011 7896 Compbatt - ok
09:54:53.0090 7896 CompositeBus (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys
09:54:53.0155 7896 CompositeBus - ok
09:54:53.0187 7896 COMSysApp - ok
09:54:53.0220 7896 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
09:54:53.0275 7896 crcdisk - ok
09:54:53.0377 7896 CryptSvc (06e771aa596b8761107ab57e99f128d7) C:\Windows\system32\cryptsvc.dll
09:54:53.0449 7896 CryptSvc - ok
09:54:53.0593 7896 DcomLaunch (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll
09:54:53.0603 7896 DcomLaunch - ok
09:54:53.0762 7896 DDNIMSGService (696c496ddab0a608d02894e9d4f62980) C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe
09:54:53.0819 7896 DDNIMSGService - ok
09:54:54.0030 7896 DDNIService (a767a85632556477021d43259397b21a) C:\Program Files\DDNI\DIBS\DDNIService.exe
09:54:54.0128 7896 DDNIService - ok
09:54:54.0241 7896 defragsvc (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll
09:54:54.0249 7896 defragsvc - ok
09:54:54.0319 7896 DfsC (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
09:54:54.0398 7896 DfsC - ok
09:54:54.0537 7896 Dhcp (e9e01eb683c132f7fa27cd607b8a2b63) C:\Windows\system32\dhcpcore.dll
09:54:54.0549 7896 Dhcp - ok
09:54:54.0637 7896 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
09:54:54.0642 7896 discache - ok
09:54:54.0724 7896 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
09:54:54.0787 7896 Disk - ok
09:54:54.0953 7896 Dnscache (33ef4861f19a0736b11314aad9ae28d0) C:\Windows\System32\dnsrslvr.dll
09:54:54.0961 7896 Dnscache - ok
09:54:55.0637 7896 dot3svc (366ba8fb4b7bb7435e3b9eacb3843f67) C:\Windows\System32\dot3svc.dll
09:54:55.0645 7896 dot3svc - ok
09:54:55.0772 7896 Dot4 (b5e479eb83707dd698f66953e922042c) C:\Windows\system32\DRIVERS\Dot4.sys
09:54:55.0785 7896 Dot4 - ok
09:54:55.0847 7896 Dot4Print (caefd09b6a6249c53a67d55a9a9fcabf) C:\Windows\system32\DRIVERS\Dot4Prt.sys
09:54:55.0849 7896 Dot4Print - ok
09:54:55.0896 7896 dot4usb (cf491ff38d62143203c065260567e2f7) C:\Windows\system32\DRIVERS\dot4usb.sys
09:54:55.0942 7896 dot4usb - ok
09:54:56.0015 7896 DPS (8ec04ca86f1d68da9e11952eb85973d6) C:\Windows\system32\dps.dll
09:54:56.0038 7896 DPS - ok
09:54:56.0095 7896 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
09:54:56.0098 7896 drmkaud - ok
09:54:56.0440 7896 DXGKrnl (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
09:54:56.0453 7896 DXGKrnl - ok
09:54:56.0505 7896 EapHost (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll
09:54:56.0508 7896 EapHost - ok
09:54:57.0213 7896 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
09:54:57.0363 7896 ebdrv - ok
09:54:57.0975 7896 EFS (81951f51e318aecc2d68559e47485cc4) C:\Windows\System32\lsass.exe
09:54:58.0087 7896 EFS - ok
09:54:58.0334 7896 ehRecvr (a8c362018efc87beb013ee28f29c0863) C:\Windows\ehome\ehRecvr.exe
09:54:58.0391 7896 ehRecvr - ok
09:54:58.0454 7896 ehSched (d389bff34f80caede417bf9d1507996a) C:\Windows\ehome\ehsched.exe
09:54:58.0459 7896 ehSched - ok
09:54:58.0663 7896 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
09:54:58.0695 7896 elxstor - ok
09:54:58.0801 7896 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
09:54:58.0803 7896 ErrDev - ok
09:54:58.0976 7896 EventSystem (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll
09:54:59.0048 7896 EventSystem - ok
09:54:59.0600 7896 EvtEng (b6c691d8cae275ed9b2782e62626f36a) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
09:54:59.0656 7896 EvtEng - ok
09:54:59.0764 7896 ewusbmbb (026f6d48cc5293c7b8a696376618b9d2) C:\Windows\system32\DRIVERS\ewusbwwan.sys
09:54:59.0808 7896 ewusbmbb - ok
09:54:59.0912 7896 ew_hwusbdev (57c171ea22f0a7f068fcb0caedd1e8e7) C:\Windows\system32\DRIVERS\ew_hwusbdev.sys
09:54:59.0967 7896 ew_hwusbdev - ok
09:55:00.0063 7896 ew_usbenumfilter (61a973f60e94a551ba7b15f3460444fb) C:\Windows\system32\DRIVERS\ew_usbenumfilter.sys
09:55:00.0176 7896 ew_usbenumfilter - ok
09:55:00.0260 7896 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
09:55:00.0265 7896 exfat - ok
09:55:00.0317 7896 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
09:55:00.0364 7896 fastfat - ok
09:55:00.0494 7896 Fax (967ea5b213e9984cbe270205df37755b) C:\Windows\system32\fxssvc.exe
09:55:00.0528 7896 Fax - ok
09:55:00.0570 7896 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
09:55:00.0573 7896 fdc - ok
09:55:00.0627 7896 fdPHost (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll
09:55:00.0635 7896 fdPHost - ok
09:55:00.0704 7896 FDResPub (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll
09:55:00.0728 7896 FDResPub - ok
09:55:00.0770 7896 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
09:55:00.0774 7896 FileInfo - ok
09:55:00.0808 7896 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
09:55:00.0821 7896 Filetrace - ok
09:55:00.0861 7896 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
09:55:00.0876 7896 flpydisk - ok
09:55:00.0962 7896 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
09:55:00.0969 7896 FltMgr - ok
09:55:01.0153 7896 FontCache (b3a5ec6b6b6673db7e87c2bcdbddc074) C:\Windows\system32\FntCache.dll
09:55:01.0173 7896 FontCache - ok
09:55:01.0293 7896 FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
09:55:01.0298 7896 FontCache3.0.0.0 - ok
09:55:01.0357 7896 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
09:55:01.0360 7896 FsDepends - ok
09:55:01.0438 7896 fssfltr (b0082808a6856a252f7cdd939892ce50) C:\Windows\system32\DRIVERS\fssfltr.sys
09:55:01.0442 7896 fssfltr - ok
09:55:02.0110 7896 fsssvc (28ddeeec44e988657b732cf404d504cb) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
09:55:02.0299 7896 fsssvc - ok
09:55:02.0715 7896 Fs_Rec (7dae5ebcc80e45d3253f4923dc424d05) C:\Windows\system32\drivers\Fs_Rec.sys
09:55:02.0732 7896 Fs_Rec - ok
09:55:02.0871 7896 fvevol (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
09:55:02.0892 7896 fvevol - ok
09:55:02.0969 7896 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
09:55:02.0973 7896 gagp30kx - ok
09:55:03.0063 7896 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
09:55:03.0151 7896 GEARAspiWDM - ok
09:55:03.0283 7896 gpsvc (e897eaf5ed6ba41e081060c9b447a673) C:\Windows\System32\gpsvc.dll
09:55:03.0322 7896 gpsvc - ok
09:55:03.0467 7896 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
09:55:03.0471 7896 gupdate - ok
09:55:03.0509 7896 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
09:55:03.0510 7896 gupdatem - ok
09:55:03.0650 7896 gusvc (c1b577b2169900f4cf7190c39f085794) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
09:55:03.0672 7896 gusvc - ok
09:55:03.0751 7896 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
09:55:03.0757 7896 hcw85cir - ok
09:55:03.0973 7896 HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys
09:55:03.0981 7896 HdAudAddService - ok
09:55:04.0046 7896 HDAudBus (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys
09:55:04.0052 7896 HDAudBus - ok
09:55:04.0082 7896 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
09:55:04.0136 7896 HidBatt - ok
09:55:04.0219 7896 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
09:55:04.0226 7896 HidBth - ok
09:55:04.0349 7896 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
09:55:04.0422 7896 HidIr - ok
09:55:04.0490 7896 hidserv (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\System32\hidserv.dll
09:55:04.0579 7896 hidserv - ok
09:55:04.0835 7896 HidUsb (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\DRIVERS\hidusb.sys
09:55:04.0875 7896 HidUsb - ok
09:55:04.0958 7896 hkmsvc (196b4e3f4cccc24af836ce58facbb699) C:\Windows\system32\kmsvc.dll
09:55:04.0968 7896 hkmsvc - ok
09:55:05.0123 7896 HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\Windows\system32\ListSvc.dll
09:55:05.0242 7896 HomeGroupListener - ok
09:55:05.0344 7896 HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\Windows\system32\provsvc.dll
09:55:05.0375 7896 HomeGroupProvider - ok
09:55:05.0706 7896 hpqcxs08 (1dae5c46d42b02a6d5862e1482efb390) C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
09:55:05.0760 7896 hpqcxs08 - ok
09:55:06.0058 7896 hpqddsvc (99e8eef42fe2f4af29b08c3355dd7685) C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
09:55:06.0108 7896 hpqddsvc - ok
09:55:06.0227 7896 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
09:55:06.0250 7896 HpSAMD - ok
09:55:06.0337 7896 HTTP (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
09:55:06.0445 7896 HTTP - ok
09:55:06.0566 7896 huawei_enumerator (f44461e66f1b7dd267957fe9baa63ed0) C:\Windows\system32\DRIVERS\ew_jubusenum.sys
09:55:06.0630 7896 huawei_enumerator - ok
09:55:06.0750 7896 hwdatacard (f547f862b8907f1bcbd9b72a72a6449e) C:\Windows\system32\DRIVERS\ewusbmdm.sys
09:55:06.0811 7896 hwdatacard - ok
09:55:07.0054 7896 hwpolicy (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
09:55:07.0076 7896 hwpolicy - ok
09:55:07.0170 7896 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys
09:55:07.0239 7896 i8042prt - ok
09:55:07.0811 7896 IAANTMON (0e899d0db39617aa0b2f992e7e95b5eb) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
09:55:07.0822 7896 IAANTMON - ok
09:55:07.0901 7896 iaStor (01446278d4563b3013c92830ae6cbb26) C:\Windows\system32\DRIVERS\iaStor.sys
09:55:07.0906 7896 iaStor - ok
09:55:08.0082 7896 iaStorV (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys
09:55:08.0091 7896 iaStorV - ok
09:55:08.0154 7896 IBMPMDRV (fa3d0a6da7bb7968efe5c5bc267f0e55) C:\Windows\system32\DRIVERS\ibmpmdrv.sys
09:55:08.0163 7896 IBMPMDRV - ok
09:55:08.0220 7896 IBMPMSVC (495f184a29b80b51735bcee91d84fe8f) C:\Windows\system32\ibmpmsvc.exe
09:55:08.0286 7896 IBMPMSVC - ok
09:55:08.0437 7896 IDriverT (6f95324909b502e2651442c1548ab12f) C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
09:55:08.0451 7896 IDriverT - ok
09:55:08.0750 7896 idsvc (c521d7eb6497bb1af6afa89e322fb43c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
09:55:08.0850 7896 idsvc - ok
09:55:11.0336 7896 igfx (c7fee838fd0216ee0ad3d765ab4f40f4) C:\Windows\system32\DRIVERS\igdkmd32.sys
09:55:11.0569 7896 igfx - ok
09:55:11.0823 7896 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
09:55:11.0831 7896 iirsp - ok
09:55:12.0018 7896 IKEEXT (f95622f161474511b8d80d6b093aa610) C:\Windows\System32\ikeext.dll
09:55:12.0034 7896 IKEEXT - ok
09:55:12.0504 7896 IntcAzAudAddService (d991871aa47da7989540ac2c0f6ec533) C:\Windows\system32\drivers\RTKVHDA.sys
09:55:12.0699 7896 IntcAzAudAddService - ok
09:55:12.0942 7896 IntcHdmiAddService (264632ade8127b7baa2190cf6fad435b) C:\Windows\system32\drivers\IntcHdmi.sys
09:55:12.0948 7896 IntcHdmiAddService - ok
09:55:13.0056 7896 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
09:55:13.0059 7896 intelide - ok
09:55:13.0116 7896 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
09:55:13.0133 7896 intelppm - ok
09:55:13.0210 7896 IPBusEnum (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll
09:55:13.0252 7896 IPBusEnum - ok
09:55:13.0340 7896 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
09:55:13.0347 7896 IpFilterDriver - ok
09:55:13.0497 7896 iphlpsvc (4d65a07b795d6674312f879d09aa7663) C:\Windows\System32\iphlpsvc.dll
09:55:13.0514 7896 iphlpsvc - ok
09:55:13.0567 7896 IPMIDRV (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
09:55:13.0589 7896 IPMIDRV - ok
09:55:13.0614 7896 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
09:55:13.0618 7896 IPNAT - ok
09:55:13.0847 7896 iPod Service (49918803b661367023bf325cf602afdc) C:\Program Files\iPod\bin\iPodService.exe
09:55:13.0867 7896 iPod Service - ok
09:55:13.0921 7896 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
09:55:13.0925 7896 IRENUM - ok
09:55:14.0023 7896 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
09:55:14.0032 7896 isapnp - ok
09:55:14.0113 7896 iScsiPrt (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
09:55:14.0158 7896 iScsiPrt - ok
09:55:14.0253 7896 IviRegMgr (213822072085b5bbad9af30ab577d817) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
09:55:14.0292 7896 IviRegMgr - ok
09:55:14.0367 7896 ivusb (994ebb45c4b438e1f6ea0b958ae9b9a3) C:\Windows\system32\DRIVERS\ivusb.sys
09:55:14.0388 7896 ivusb - ok
09:55:14.0473 7896 JMCR (8bbe388234c79e51ebb091edbfa77ea7) C:\Windows\system32\DRIVERS\jmcr.sys
09:55:14.0543 7896 JMCR - ok
09:55:14.0616 7896 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys
09:55:14.0662 7896 kbdclass - ok
09:55:14.0716 7896 kbdhid (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys
09:55:14.0722 7896 kbdhid - ok
09:55:14.0801 7896 KeyIso (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
09:55:14.0804 7896 KeyIso - ok
09:55:14.0913 7896 KL1 (186b54479d98e48aee0e9ada4b3c4d31) C:\Windows\system32\DRIVERS\kl1.sys
09:55:14.0976 7896 KL1 - ok
09:55:15.0228 7896 kl2 (bf485bfba13c0ab116701fd9c55324d0) C:\Windows\system32\DRIVERS\kl2.sys
09:55:15.0232 7896 kl2 - ok
09:55:15.0488 7896 KLIF (af04d0ce7939324e9a605b159295706c) C:\Windows\system32\DRIVERS\klif.sys
09:55:15.0514 7896 KLIF - ok
09:55:15.0593 7896 KLIM6 (6295a19003f935ecc6ccbe9e2376427b) C:\Windows\system32\DRIVERS\klim6.sys
09:55:15.0595 7896 KLIM6 - ok
09:55:15.0691 7896 klmouflt (3de1771c135328420315e21dde229bba) C:\Windows\system32\DRIVERS\klmouflt.sys
09:55:15.0750 7896 klmouflt - ok
09:55:15.0893 7896 KSecDD (f4647bb23db9038a7536cf6b68f4207f) C:\Windows\system32\Drivers\ksecdd.sys
09:55:15.0918 7896 KSecDD - ok
09:55:16.0013 7896 KSecPkg (e73cae53bbb72ba26918492c6b4c229d) C:\Windows\system32\Drivers\ksecpkg.sys
09:55:16.0071 7896 KSecPkg - ok
09:55:16.0152 7896 KtmRm (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll
09:55:16.0780 7896 KtmRm - ok
09:55:16.0905 7896 LanmanServer (d64af876d53eca3668bb97b51b4e70ab) C:\Windows\System32\srvsvc.dll
09:55:16.0941 7896 LanmanServer - ok
09:55:17.0109 7896 LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\Windows\System32\wkssvc.dll
09:55:17.0117 7896 LanmanWorkstation - ok
09:55:17.0393 7896 LENOVO.CAMMUTE (cab9c6c37fd0f9612b269349116504b6) C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
09:55:17.0439 7896 LENOVO.CAMMUTE - ok
09:55:17.0718 7896 LENOVO.MICMUTE (128158d8b1df639bf3e3fdbcbb64cdac) C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
09:55:17.0721 7896 LENOVO.MICMUTE - ok
09:55:17.0784 7896 lenovo.smi (9aac267a225f3caebb9e633f7eb16e4b) C:\Windows\system32\DRIVERS\smiif32.sys
09:55:17.0817 7896 lenovo.smi - ok
09:55:17.0899 7896 LENOVO.TPKNRSVC (04b5f7f44ccb2fab615c67ed0e6c8323) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
09:55:17.0924 7896 LENOVO.TPKNRSVC - ok
09:55:17.0983 7896 Lenovo.VIRTSCRLSVC (6f2cc57eb5836d2ac9bd37f3554d55f8) C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
09:55:18.0000 7896 Lenovo.VIRTSCRLSVC - ok
09:55:18.0051 7896 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
09:55:18.0057 7896 lltdio - ok
09:55:18.0119 7896 lltdsvc (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll
09:55:18.0170 7896 lltdsvc - ok
09:55:18.0212 7896 lmhosts (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll
09:55:18.0217 7896 lmhosts - ok
09:55:18.0362 7896 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
09:55:18.0378 7896 LSI_FC - ok
09:55:18.0405 7896 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
09:55:18.0443 7896 LSI_SAS - ok
09:55:18.0469 7896 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
09:55:18.0580 7896 LSI_SAS2 - ok
09:55:18.0603 7896 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
09:55:18.0607 7896 LSI_SCSI - ok
09:55:18.0774 7896 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
09:55:18.0778 7896 luafv - ok
09:55:19.0010 7896 massfilter (59a2783aba6019bed0c843c706e10a6a) C:\Windows\system32\drivers\massfilter.sys
09:55:19.0034 7896 massfilter - ok
09:55:19.0292 7896 Mcx2Svc (bfb9ee8ee977efe85d1a3105abef6dd1) C:\Windows\system32\Mcx2Svc.dll
09:55:19.0406 7896 Mcx2Svc - ok
09:55:19.0806 7896 mdvrmng (4e10e84320a8ec1c12bd0d00973b22ab) C:\Windows\system32\drivers\mdvrmng.sys
09:55:19.0810 7896 mdvrmng - ok
09:55:19.0858 7896 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
09:55:20.0035 7896 megasas - ok
09:55:20.0139 7896 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
09:55:20.0201 7896 MegaSR - ok
09:55:20.0293 7896 MMCSS (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
09:55:20.0296 7896 MMCSS - ok
09:55:20.0335 7896 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
09:55:20.0488 7896 Modem - ok
09:55:20.0609 7896 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
09:55:20.0942 7896 monitor - ok
09:55:21.0537 7896 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
09:55:21.0579 7896 mouclass - ok
09:55:21.0641 7896 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
09:55:21.0644 7896 mouhid - ok
09:55:21.0716 7896 mountmgr (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
09:55:21.0791 7896 mountmgr - ok
09:55:21.0920 7896 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
09:55:21.0935 7896 MozillaMaintenance - ok
09:55:22.0027 7896 mpio (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
09:55:22.0051 7896 mpio - ok
09:55:22.0114 7896 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
09:55:22.0118 7896 mpsdrv - ok
09:55:22.0238 7896 MpsSvc (9835584e999d25004e1ee8e5f3e3b881) C:\Windows\system32\mpssvc.dll
09:55:22.0261 7896 MpsSvc - ok
09:55:22.0341 7896 MRxDAV (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
09:55:22.0347 7896 MRxDAV - ok
09:55:22.0460 7896 mrxsmb (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
09:55:22.0496 7896 mrxsmb - ok
09:55:22.0570 7896 mrxsmb10 (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
09:55:22.0737 7896 mrxsmb10 - ok
09:55:22.0788 7896 mrxsmb20 (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
09:55:22.0829 7896 mrxsmb20 - ok
09:55:22.0881 7896 msahci (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
09:55:22.0884 7896 msahci - ok
09:55:22.0955 7896 msdsm (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
09:55:23.0018 7896 msdsm - ok
09:55:23.0064 7896 MSDTC (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe
09:55:23.0088 7896 MSDTC - ok
09:55:23.0154 7896 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
09:55:23.0159 7896 Msfs - ok
09:55:23.0258 7896 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
09:55:23.0266 7896 mshidkmdf - ok
09:55:23.0343 7896 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
09:55:23.0401 7896 msisadrv - ok
09:55:23.0457 7896 MSiSCSI (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll
09:55:23.0536 7896 MSiSCSI - ok
09:55:23.0553 7896 msiserver - ok
09:55:23.0600 7896 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
09:55:23.0622 7896 MSKSSRV - ok
09:55:23.0651 7896 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
09:55:23.0655 7896 MSPCLOCK - ok
09:55:23.0666 7896 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
09:55:23.0675 7896 MSPQM - ok
09:55:23.0706 7896 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
09:55:23.0752 7896 MsRPC - ok
09:55:23.0808 7896 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys
09:55:23.0830 7896 mssmbios - ok
09:55:23.0880 7896 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
09:55:23.0890 7896 MSTEE - ok
09:55:23.0916 7896 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
09:55:23.0920 7896 MTConfig - ok
09:55:23.0942 7896 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
09:55:23.0948 7896 Mup - ok
09:55:24.0023 7896 napagent (61d57a5d7c6d9afe10e77dae6e1b445e) C:\Windows\system32\qagentRT.dll
09:55:24.0234 7896 napagent - ok
09:55:24.0313 7896 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
09:55:24.0340 7896 NativeWifiP - ok
09:55:24.0668 7896 NDIS (3723262737d90f58059ceda7373b0387) C:\Windows\system32\drivers\ndis.sys
09:55:24.0779 7896 NDIS - ok
09:55:24.0852 7896 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
09:55:24.0856 7896 NdisCap - ok
09:55:24.0904 7896 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
09:55:24.0911 7896 NdisTapi - ok
09:55:24.0991 7896 Ndisuio (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
09:55:24.0999 7896 Ndisuio - ok
09:55:25.0093 7896 NdisWan (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
09:55:25.0114 7896 NdisWan - ok
09:55:25.0170 7896 NDProxy (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
09:55:25.0177 7896 NDProxy - ok
09:55:25.0310 7896 Net Driver HPZ12 (510c138564486ff926a3f773205c63d1) C:\Windows\system32\HPZinw12.dll
09:55:25.0316 7896 Net Driver HPZ12 - ok
09:55:25.0389 7896 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
09:55:25.0432 7896 NetBIOS - ok
09:55:26.0036 7896 NetBT (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
09:55:26.0042 7896 NetBT - ok
09:55:26.0168 7896 Netlogon (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
09:55:26.0171 7896 Netlogon - ok
09:55:26.0287 7896 Netman (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll
09:55:26.0313 7896 Netman - ok
09:55:26.0702 7896 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
09:55:26.0848 7896 NetMsmqActivator - ok
09:55:26.0900 7896 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
09:55:26.0902 7896 NetPipeActivator - ok
09:55:26.0966 7896 netprofm (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll
09:55:26.0978 7896 netprofm - ok
09:55:26.0998 7896 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
09:55:27.0000 7896 NetTcpActivator - ok
09:55:27.0016 7896 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
09:55:27.0018 7896 NetTcpPortSharing - ok
09:55:27.0461 7896 netw5v32 (af1ae2e42b03395560b1cde03230205c) C:\Windows\system32\DRIVERS\netw5v32.sys
09:55:27.0608 7896 netw5v32 - ok
09:55:28.0813 7896 NETwNs32 (5c979c481981e04919ecbb3b88d54b34) C:\Windows\system32\DRIVERS\NETwNs32.sys
09:55:29.0067 7896 NETwNs32 - ok
09:55:32.0251 7896 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
09:55:32.0256 7896 nfrd960 - ok
09:55:32.0394 7896 NlaSvc (912084381d30d8b89ec4e293053f4710) C:\Windows\System32\nlasvc.dll
09:55:32.0445 7896 NlaSvc - ok
09:55:32.0512 7896 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
09:55:32.0577 7896 Npfs - ok
09:55:32.0609 7896 nsi (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll
09:55:32.0612 7896 nsi - ok
09:55:32.0661 7896 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
09:55:32.0808 7896 nsiproxy - ok
09:55:33.0503 7896 Ntfs (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys
09:55:33.0696 7896 Ntfs - ok
09:55:33.0764 7896 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
09:55:33.0770 7896 Null - ok
09:55:34.0599 7896 nvraid (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys
09:55:34.0657 7896 nvraid - ok
09:55:34.0721 7896 nvstor (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys
09:55:34.0765 7896 nvstor - ok
09:55:34.0984 7896 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
09:55:35.0039 7896 nv_agp - ok
09:55:35.0243 7896 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
09:55:35.0247 7896 ohci1394 - ok
09:55:35.0430 7896 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
09:55:35.0495 7896 ose - ok
09:55:37.0376 7896 osppsvc (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
09:55:37.0498 7896 osppsvc - ok
09:55:37.0918 7896 p2pimsvc (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
09:55:37.0958 7896 p2pimsvc - ok
09:55:38.0077 7896 p2psvc (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll
09:55:38.0092 7896 p2psvc - ok
09:55:38.0198 7896 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
09:55:38.0265 7896 Parport - ok
09:55:38.0325 7896 partmgr (3f34a1b4c5f6475f320c275e63afce9b) C:\Windows\system32\drivers\partmgr.sys
09:55:38.0400 7896 partmgr - ok
09:55:38.0435 7896 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
09:55:38.0439 7896 Parvdm - ok
09:55:38.0482 7896 PcaSvc (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll
09:55:38.0558 7896 PcaSvc - ok
09:55:38.0679 7896 PcdrNdisuio - ok
09:55:38.0883 7896 pci (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
09:55:38.0928 7896 pci - ok
09:55:38.0978 7896 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
09:55:38.0992 7896 pciide - ok
09:55:39.0063 7896 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
09:55:39.0074 7896 pcmcia - ok
09:55:39.0122 7896 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
09:55:39.0125 7896 pcw - ok
09:55:39.0352 7896 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
09:55:39.0364 7896 PEAUTH - ok
09:55:39.0615 7896 pla (414bba67a3ded1d28437eb66aeb8a720) C:\Windows\system32\pla.dll
09:55:39.0713 7896 pla - ok
09:55:39.0945 7896 PlugPlay (ec7bc28d207da09e79b3e9faf8b232ca) C:\Windows\system32\umpnpmgr.dll
09:55:39.0971 7896 PlugPlay - ok
09:55:40.0050 7896 Pml Driver HPZ12 (37e5e8ffbad35605daeec3224ea0e465) C:\Windows\system32\HPZipm12.dll
09:55:40.0055 7896 Pml Driver HPZ12 - ok
09:55:40.0086 7896 PNRPAutoReg (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll
09:55:40.0171 7896 PNRPAutoReg - ok
09:55:40.0257 7896 PNRPsvc (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
09:55:40.0263 7896 PNRPsvc - ok
09:55:40.0369 7896 PolicyAgent (53946b69ba0836bd95b03759530c81ec) C:\Windows\System32\ipsecsvc.dll
09:55:40.0389 7896 PolicyAgent - ok
09:55:40.0473 7896 Power (f87d30e72e03d579a5199ccb3831d6ea) C:\Windows\system32\umpo.dll
09:55:40.0484 7896 Power - ok
09:55:40.0683 7896 Power Manager DBC Service (ebf8a077be308c0c6d55d90f89a43547) C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
09:55:40.0688 7896 Power Manager DBC Service - ok
09:55:40.0768 7896 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
09:55:40.0799 7896 PptpMiniport - ok
09:55:40.0834 7896 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
09:55:40.0838 7896 Processor - ok
09:55:41.0132 7896 ProfSvc (cadefac453040e370a1bdff3973be00d) C:\Windows\system32\profsvc.dll
09:55:41.0210 7896 ProfSvc - ok
09:55:41.0330 7896 ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
09:55:41.0333 7896 ProtectedStorage - ok
09:55:41.0526 7896 psadd (72de205cd4006dc45b1401859c506679) C:\Windows\system32\DRIVERS\psadd.sys
09:55:41.0529 7896 psadd - ok
09:55:41.0591 7896 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
09:55:41.0635 7896 Psched - ok
09:55:41.0807 7896 PwmEWSvc (254de0e4fb8822ca9e5495dcac3bf11c) C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE
09:55:41.0839 7896 PwmEWSvc - ok
09:55:41.0963 7896 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\Windows\system32\Drivers\PxHelp20.sys
09:55:41.0966 7896 PxHelp20 - ok
09:55:42.0619 7896 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
09:55:42.0668 7896 ql2300 - ok
09:55:43.0127 7896 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
09:55:43.0336 7896 ql40xx - ok
09:55:43.0377 7896 QWAVE (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll
09:55:43.0432 7896 QWAVE - ok
09:55:43.0525 7896 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
09:55:43.0528 7896 QWAVEdrv - ok
09:55:43.0657 7896 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
09:55:43.0662 7896 RasAcd - ok
09:55:43.0722 7896 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
09:55:43.0726 7896 RasAgileVpn - ok
09:55:43.0900 7896 RasAuto (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll
09:55:43.0926 7896 RasAuto - ok
09:55:44.0068 7896 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
09:55:44.0084 7896 Rasl2tp - ok
09:55:44.0246 7896 RasMan (cb9e04dc05eacf5b9a36ca276d475006) C:\Windows\System32\rasmans.dll
09:55:44.0258 7896 RasMan - ok
09:55:44.0319 7896 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
09:55:44.0363 7896 RasPppoe - ok
09:55:44.0414 7896 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
09:55:44.0469 7896 RasSstp - ok
09:55:44.0770 7896 rdbss (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
09:55:44.0813 7896 rdbss - ok
09:55:44.0941 7896 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
09:55:44.0996 7896 rdpbus - ok
09:55:45.0187 7896 RDPCDD (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
09:55:45.0265 7896 RDPCDD - ok
09:55:45.0397 7896 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
09:55:45.0400 7896 RDPENCDD - ok
09:55:45.0427 7896 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
09:55:45.0437 7896 RDPREFMP - ok
09:55:45.0590 7896 RDPWD (f031683e6d1fea157abb2ff260b51e61) C:\Windows\system32\drivers\RDPWD.sys
09:55:45.0659 7896 RDPWD - ok
09:55:45.0901 7896 rdyboost (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
09:55:45.0972 7896 rdyboost - ok
09:55:46.0010 7896 regi (001b4278407f4303efc902a2b16f2453) C:\Windows\system32\drivers\regi.sys
09:55:46.0014 7896 regi - ok
09:55:46.0239 7896 RegSrvc (6c47ac711f5fb55c5387a85d50ab4703) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
09:55:46.0252 7896 RegSrvc - ok
09:55:46.0332 7896 RemoteAccess (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll
09:55:46.0464 7896 RemoteAccess - ok
09:55:46.0666 7896 RemoteRegistry (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll
09:55:46.0714 7896 RemoteRegistry - ok
09:55:46.0876 7896 RFCOMM (cb928d9e6daf51879dd6ba8d02f01321) C:\Windows\system32\DRIVERS\rfcomm.sys
09:55:46.0903 7896 RFCOMM - ok
09:55:47.0061 7896 Roxio UPnP Renderer 10 (14a99fd851272c73b758546ef8f0e641) C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
09:55:47.0089 7896 Roxio UPnP Renderer 10 - ok
09:55:47.0222 7896 Roxio Upnp Server 10 (ba917f2f2bd5033e70823797c73cdfcb) C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe
09:55:47.0271 7896 Roxio Upnp Server 10 - ok
09:55:47.0729 7896 RoxLiveShare10 (8986d20cf294d794a79fb18ff697b68b) C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe
09:55:47.0841 7896 RoxLiveShare10 - ok
09:55:48.0127 7896 RoxMediaDB10 (d8c44229eb2495e774350529ed9be08d) C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
09:55:48.0152 7896 RoxMediaDB10 - ok
09:55:48.0250 7896 RoxWatch10 (53716357f4b3c99112cf0a21932c5688) C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe
09:55:48.0287 7896 RoxWatch10 - ok
09:55:48.0536 7896 RpcEptMapper (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll
09:55:48.0540 7896 RpcEptMapper - ok
09:55:48.0686 7896 RpcLocator (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe
09:55:48.0694 7896 RpcLocator - ok
09:55:48.0786 7896 RpcSs (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll
09:55:48.0793 7896 RpcSs - ok
09:55:48.0925 7896 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
09:55:48.0928 7896 rspndr - ok
09:55:49.0051 7896 RTL8167 (5283b9a27ff230f2ff70d92451ff409a) C:\Windows\system32\DRIVERS\Rt86win7.sys
09:55:49.0095 7896 RTL8167 - ok
09:55:49.0191 7896 SamSs (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
09:55:49.0194 7896 SamSs - ok
09:55:49.0380 7896 SbieDrv (8fa4d399e5c063fd24a617767e49c7b6) C:\Program Files\Sandboxie\SbieDrv.sys
09:55:49.0437 7896 SbieDrv - ok
09:55:49.0483 7896 SbieSvc (bd4f118ae72edcfd435bf4e3937de737) C:\Program Files\Sandboxie\SbieSvc.exe
09:55:49.0485 7896 SbieSvc - ok
09:55:49.0574 7896 sbp2port (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
09:55:49.0578 7896 sbp2port - ok
09:55:49.0709 7896 SCardSvr (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll
09:55:49.0787 7896 SCardSvr - ok
09:55:49.0838 7896 scfilter (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
09:55:49.0843 7896 scfilter - ok
09:55:50.0022 7896 Schedule (a04bb13f8a72f8b6e8b4071723e4e336) C:\Windows\system32\schedsvc.dll
09:55:50.0103 7896 Schedule - ok
09:55:50.0217 7896 SCPolicySvc (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
09:55:50.0218 7896 SCPolicySvc - ok
09:55:50.0323 7896 sdbus (0328be1c7f1cba23848179f8762e391c) C:\Windows\system32\drivers\sdbus.sys
09:55:50.0326 7896 sdbus - ok
09:55:50.0430 7896 SDRSVC (08236c4bce5edd0a0318a438af28e0f7) C:\Windows\System32\SDRSVC.dll
09:55:50.0440 7896 SDRSVC - ok
09:55:51.0053 7896 SeaPort (78779ee07231c658b483b1f38b5088df) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
09:55:51.0162 7896 SeaPort - ok
09:55:51.0682 7896 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
09:55:51.0726 7896 secdrv - ok
09:55:51.0803 7896 seclogon (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll
09:55:51.0815 7896 seclogon - ok
09:55:51.0883 7896 SENS (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\system32\sens.dll
09:55:51.0904 7896 SENS - ok
09:55:51.0953 7896 SensrSvc (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll
09:55:52.0056 7896 SensrSvc - ok
09:55:52.0103 7896 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
09:55:52.0131 7896 Serenum - ok
09:55:52.0190 7896 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
09:55:52.0194 7896 Serial - ok
09:55:52.0283 7896 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
09:55:52.0286 7896 sermouse - ok
09:55:52.0385 7896 SessionEnv (4ae380f39a0032eab7dd953030b26d28) C:\Windows\system32\sessenv.dll
09:55:52.0458 7896 SessionEnv - ok
09:55:52.0513 7896 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
09:55:52.0591 7896 sffdisk - ok
09:55:52.0635 7896 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
09:55:52.0638 7896 sffp_mmc - ok
09:55:52.0708 7896 sffp_sd (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
09:55:52.0710 7896 sffp_sd - ok
09:55:52.0762 7896 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
09:55:52.0766 7896 sfloppy - ok
09:55:53.0014 7896 SharedAccess (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll
09:55:53.0851 7896 SharedAccess - ok
09:55:54.0014 7896 ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\Windows\System32\shsvcs.dll
09:55:54.0048 7896 ShellHWDetection - ok
09:55:54.0163 7896 Shockprf (1624530d05155f4e5a4736531523bff5) C:\Windows\system32\DRIVERS\Apsx86.sys
09:55:54.0346 7896 Shockprf - ok
09:55:54.0460 7896 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
09:55:54.0478 7896 sisagp - ok
09:55:54.0535 7896 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
09:55:54.0555 7896 SiSRaid2 - ok
09:55:54.0580 7896 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
09:55:54.0593 7896 SiSRaid4 - ok
09:55:55.0711 7896 Skype C2C Service (4ca43b85f22c7739311788b651a779cb) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
09:55:55.0873 7896 Skype C2C Service - ok
09:55:56.0058 7896 SkypeUpdate (c70aebd3608ed9fcea2a1bae83567ffc) C:\Program Files\Skype\Updater\Updater.exe
09:55:56.0116 7896 SkypeUpdate - ok
09:55:56.0374 7896 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
09:55:56.0421 7896 Smb - ok
09:55:56.0495 7896 SNMPTRAP (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe
09:55:56.0500 7896 SNMPTRAP - ok
09:55:56.0531 7896 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
09:55:56.0534 7896 spldr - ok
09:55:56.0616 7896 Spooler (866a43013535dc8587c258e43579c764) C:\Windows\System32\spoolsv.exe
09:55:56.0633 7896 Spooler - ok
09:55:57.0353 7896 sppsvc (cf87a1de791347e75b98885214ced2b8) C:\Windows\system32\sppsvc.exe
09:55:57.0491 7896 sppsvc - ok
09:55:58.0422 7896 sppuinotify (b0180b20b065d89232a78a40fe56eaa6) C:\Windows\system32\sppuinotify.dll
09:55:58.0448 7896 sppuinotify - ok
09:55:58.0624 7896 srv (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
09:55:58.0666 7896 srv - ok
09:55:58.0746 7896 srv2 (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
09:55:58.0807 7896 srv2 - ok
09:55:58.0873 7896 SrvHsfHDA (e00fdfaff025e94f9821153750c35a6d) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
09:55:58.0916 7896 SrvHsfHDA - ok
09:55:59.0246 7896 SrvHsfV92 (ceb4e3b6890e1e42dca6694d9e59e1a0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
09:55:59.0335 7896 SrvHsfV92 - ok
09:55:59.0436 7896 SrvHsfWinac (bc0c7ea89194c299f051c24119000e17) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
09:55:59.0471 7896 SrvHsfWinac - ok
09:55:59.0542 7896 srvnet (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
09:55:59.0560 7896 srvnet - ok
09:55:59.0662 7896 SSDPSRV (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll
09:55:59.0727 7896 SSDPSRV - ok
09:55:59.0764 7896 SstpSvc (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll
09:55:59.0770 7896 SstpSvc - ok
09:55:59.0893 7896 stdriver (5c031c715e14f10dfc9395004f54ee21) C:\Windows\system32\DRIVERS\stdriver32.sys
09:55:59.0951 7896 stdriver - ok
09:55:59.0998 7896 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
09:56:00.0002 7896 stexstor - ok
09:56:00.0127 7896 StiSvc (e1fb3706030fb4578a0d72c2fc3689e4) C:\Windows\System32\wiaservc.dll
09:56:00.0161 7896 StiSvc - ok
09:56:00.0256 7896 stllssvr (ff5eb78af7dfb68c2fb363537aaf753e) C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
09:56:00.0261 7896 stllssvr - ok
09:56:00.0383 7896 SUService (6ea2f517373771cac5188e82617c9c0b) C:\Program Files\Lenovo\System Update\SUService.exe
09:56:00.0434 7896 SUService - ok
09:56:00.0473 7896 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys
09:56:00.0476 7896 swenum - ok
09:56:00.0530 7896 swprv (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll
09:56:00.0569 7896 swprv - ok
09:56:00.0637 7896 SynTP (d7dc30b8b41e7a913c3fccc0631e72ec) C:\Windows\system32\DRIVERS\SynTP.sys
09:56:00.0675 7896 SynTP - ok
09:56:00.0845 7896 SysMain (36650d618ca34c9d357dfd3d89b2c56f) C:\Windows\system32\sysmain.dll
09:56:00.0950 7896 SysMain - ok
09:56:01.0077 7896 TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\Windows\System32\TabSvc.dll
09:56:01.0097 7896 TabletInputService - ok
09:56:01.0198 7896 TapiSrv (613bf4820361543956909043a265c6ac) C:\Windows\System32\tapisrv.dll
09:56:01.0228 7896 TapiSrv - ok
09:56:01.0296 7896 TBS (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll
09:56:01.0350 7896 TBS - ok
09:56:01.0601 7896 Tcpip (7fa2e0f8b072bd04b77b421480b6cc22) C:\Windows\system32\drivers\tcpip.sys
09:56:01.0623 7896 Tcpip - ok
09:56:01.0697 7896 TCPIP6 (7fa2e0f8b072bd04b77b421480b6cc22) C:\Windows\system32\DRIVERS\tcpip.sys
09:56:01.0708 7896 TCPIP6 - ok
09:56:01.0755 7896 tcpipreg (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
09:56:01.0831 7896 tcpipreg - ok
09:56:01.0934 7896 TDPIPE (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
09:56:02.0000 7896 TDPIPE - ok
09:56:02.0049 7896 TDTCP (2c2c5afe7ee4f620d69c23c0617651a8) C:\Windows\system32\drivers\tdtcp.sys
09:56:02.0057 7896 TDTCP - ok
09:56:02.0108 7896 tdx (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
09:56:02.0138 7896 tdx - ok
09:56:02.0177 7896 TermDD (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys
09:56:02.0195 7896 TermDD - ok
09:56:02.0275 7896 TermService (382c804c92811be57829d8e550a900e2) C:\Windows\System32\termsrv.dll
09:56:02.0339 7896 TermService - ok
09:56:02.0367 7896 Themes (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll
09:56:02.0407 7896 Themes - ok
09:56:02.0556 7896 ThinkVantage Registry Monitor Service (39ac444e07fdbd8c2e8e291a65d515d3) C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
09:56:02.0607 7896 ThinkVantage Registry Monitor Service - ok
09:56:02.0668 7896 THREADORDER (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
09:56:02.0671 7896 THREADORDER - ok
09:56:02.0764 7896 TPDIGIMN (d2378fbbd668d9fe9b6b5e3139d506d3) C:\Windows\system32\DRIVERS\ApsHM86.sys
09:56:02.0928 7896 TPDIGIMN - ok
09:56:02.0987 7896 TPHDEXLGSVC (a34a1e6b5461273846d30f5898602a72) C:\Windows\system32\TPHDEXLG.exe
09:56:02.0994 7896 TPHDEXLGSVC - ok
09:56:03.0098 7896 TPHKLOAD (1dbf0267cebf80f0bd24dfe895367db5) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
09:56:03.0149 7896 TPHKLOAD - ok
09:56:03.0335 7896 TPHKSVC (cb0625c2f5b7c72c50c5ae34f8e8f7d0) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
09:56:03.0340 7896 TPHKSVC - ok
09:56:03.0415 7896 TPM (5ad05191dc8b444a7ba4d79b76c42a30) C:\Windows\system32\drivers\tpm.sys
09:56:03.0418 7896 TPM - ok
09:56:03.0510 7896 TPPWRIF (c16ec6a5390904d3971179553852025b) C:\Windows\system32\drivers\Tppwr32v.sys
09:56:03.0513 7896 TPPWRIF - ok
09:56:03.0587 7896 TrkWks (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll
09:56:03.0592 7896 TrkWks - ok
09:56:03.0706 7896 TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\Windows\servicing\TrustedInstaller.exe
09:56:03.0741 7896 TrustedInstaller - ok
09:56:03.0863 7896 tssecsrv (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
09:56:03.0866 7896 tssecsrv - ok
09:56:04.0012 7896 TsUsbFlt (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
09:56:04.0018 7896 TsUsbFlt - ok
09:56:04.0101 7896 tunnel (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
09:56:04.0146 7896 tunnel - ok
09:56:04.0670 7896 TVT Backup Service (a87be63239ffdc22f963e9bafefeb2c9) C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
09:56:04.0910 7896 TVT Backup Service - ok
09:56:05.0116 7896 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
09:56:05.0119 7896 uagp35 - ok
09:56:05.0213 7896 udfs (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
09:56:05.0249 7896 udfs - ok
09:56:05.0366 7896 UI0Detect (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe
09:56:05.0372 7896 UI0Detect - ok
09:56:05.0466 7896 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
09:56:05.0470 7896 uliagpkx - ok
09:56:05.0555 7896 umbus (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys
09:56:05.0559 7896 umbus - ok
09:56:05.0587 7896 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
09:56:05.0591 7896 UmPass - ok
09:56:05.0664 7896 upnphost (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll
09:56:05.0711 7896 upnphost - ok
09:56:05.0747 7896 usbccgp (bd9c55d7023c5de374507acc7a14e2ac) C:\Windows\system32\DRIVERS\usbccgp.sys
09:56:05.0757 7896 usbccgp - ok
09:56:05.0815 7896 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
09:56:05.0818 7896 usbcir - ok
09:56:05.0907 7896 usbehci (f92de757e4b7ce9c07c5e65423f3ae3b) C:\Windows\system32\DRIVERS\usbehci.sys
09:56:06.0003 7896 usbehci - ok
09:56:06.0061 7896 usbhub (8dc94aec6a7e644a06135ae7506dc2e9) C:\Windows\system32\DRIVERS\usbhub.sys
09:56:06.0069 7896 usbhub - ok
09:56:06.0125 7896 usbohci (e185d44fac515a18d9deddc23c2cdf44) C:\Windows\system32\drivers\usbohci.sys
09:56:06.0128 7896 usbohci - ok
09:56:06.0278 7896 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
09:56:06.0281 7896 usbprint - ok
09:56:06.0691 7896 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys
09:56:06.0704 7896 usbscan - ok
09:56:07.0035 7896 USBSTOR (f991ab9cc6b908db552166768176896a) C:\Windows\system32\DRIVERS\USBSTOR.SYS
09:56:07.0041 7896 USBSTOR - ok
09:56:07.0091 7896 usbuhci (68df884cf41cdada664beb01daf67e3d) C:\Windows\system32\DRIVERS\usbuhci.sys
09:56:07.0096 7896 usbuhci - ok
09:56:07.0183 7896 usbvideo (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\Windows\system32\Drivers\usbvideo.sys
09:56:07.0213 7896 usbvideo - ok
09:56:07.0344 7896 UxSms (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll
09:56:07.0348 7896 UxSms - ok
09:56:07.0433 7896 VaultSvc (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
09:56:07.0435 7896 VaultSvc - ok
09:56:07.0522 7896 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
09:56:07.0528 7896 vdrvroot - ok
09:56:07.0616 7896 vds (c3cd30495687c2a2f66a65ca6fd89be9) C:\Windows\System32\vds.exe
09:56:07.0738 7896 vds - ok
09:56:07.0785 7896 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
09:56:07.0789 7896 vga - ok
09:56:07.0822 7896 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
09:56:07.0826 7896 VgaSave - ok
09:56:07.0982 7896 vhdmp (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
09:56:08.0057 7896 vhdmp - ok
09:56:08.0125 7896 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
09:56:08.0129 7896 viaagp - ok
09:56:08.0207 7896 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
09:56:08.0234 7896 ViaC7 - ok
09:56:08.0421 7896 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
09:56:08.0509 7896 viaide - ok
09:56:08.0676 7896 volmgr (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
09:56:08.0722 7896 volmgr - ok
09:56:08.0875 7896 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
09:56:09.0000 7896 volmgrx - ok
09:56:09.0144 7896 volsnap (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
09:56:09.0377 7896 volsnap - ok
09:56:09.0621 7896 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
09:56:09.0627 7896 vsmraid - ok
09:56:10.0207 7896 VSS (209a3b1901b83aeb8527ed211cce9e4c) C:\Windows\system32\vssvc.exe
09:56:10.0265 7896 VSS - ok
09:56:10.0392 7896 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys
09:56:10.0397 7896 vwifibus - ok
09:56:10.0472 7896 vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys
09:56:10.0478 7896 vwififlt - ok
09:56:10.0527 7896 vwifimp (a3f04cbea6c2a10e6cb01f8b47611882) C:\Windows\system32\DRIVERS\vwifimp.sys
09:56:10.0529 7896 vwifimp - ok
09:56:10.0605 7896 W32Time (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll
09:56:10.0654 7896 W32Time - ok
09:56:10.0702 7896 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
09:56:10.0767 7896 WacomPen - ok
09:56:10.0869 7896 WANARP (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
09:56:10.0995 7896 WANARP - ok
09:56:11.0009 7896 Wanarpv6 (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
09:56:11.0010 7896 Wanarpv6 - ok
09:56:11.0568 7896 WatAdminSvc (353a04c273ec58475d8633e75ccd5604) C:\Windows\system32\Wat\WatAdminSvc.exe
09:56:11.0733 7896 WatAdminSvc - ok
09:56:11.0951 7896 wbengine (691e3285e53dca558e1a84667f13e15a) C:\Windows\system32\wbengine.exe
09:56:12.0038 7896 wbengine - ok
09:56:12.0114 7896 WbioSrvc (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll
09:56:12.0177 7896 WbioSrvc - ok
09:56:12.0241 7896 wcncsvc (34eee0dfaadb4f691d6d5308a51315dc) C:\Windows\System32\wcncsvc.dll
09:56:12.0311 7896 wcncsvc - ok
09:56:12.0352 7896 WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll
09:56:12.0359 7896 WcsPlugInService - ok
09:56:12.0428 7896 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
09:56:12.0431 7896 Wd - ok
09:56:12.0577 7896 WDC_SAM (d6efaf429fd30c5df613d220e344cce7) C:\Windows\system32\DRIVERS\wdcsam.sys
09:56:12.0580 7896 WDC_SAM - ok
09:56:12.0707 7896 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
09:56:12.0760 7896 Wdf01000 - ok
09:56:12.0809 7896 WdiServiceHost (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
09:56:12.0814 7896 WdiServiceHost - ok
09:56:12.0862 7896 WdiSystemHost (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
09:56:12.0867 7896 WdiSystemHost - ok
09:56:12.0971 7896 WebClient (a9d880f97530d5b8fee278923349929d) C:\Windows\System32\webclnt.dll
09:56:12.0980 7896 WebClient - ok
09:56:13.0166 7896 Wecsvc (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll
09:56:13.0178 7896 Wecsvc - ok
09:56:13.0250 7896 wercplsupport (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll
09:56:13.0260 7896 wercplsupport - ok
09:56:13.0315 7896 WerSvc (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll
09:56:13.0320 7896 WerSvc - ok
09:56:13.0391 7896 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
09:56:13.0395 7896 WfpLwf - ok
09:56:13.0476 7896 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
09:56:13.0479 7896 WIMMount - ok
09:56:14.0225 7896 WinDefend (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll
09:56:14.0242 7896 WinDefend - ok
09:56:14.0291 7896 WinHttpAutoProxySvc - ok
09:56:14.0461 7896 Winmgmt (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll
09:56:14.0533 7896 Winmgmt - ok
09:56:14.0711 7896 WinRM (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\Windows\system32\WsmSvc.dll
09:56:14.0790 7896 WinRM - ok
09:56:14.0906 7896 WinUsb (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\DRIVERS\WinUsb.sys
09:56:14.0910 7896 WinUsb - ok
09:56:15.0068 7896 Wlansvc (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll
09:56:15.0086 7896 Wlansvc - ok
09:56:15.0172 7896 wlcrasvc (6067acef367e79914af628fa1e9b5330) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
09:56:15.0215 7896 wlcrasvc - ok
09:56:15.0431 7896 wlidsvc (fb01d4ae207b9efdbabfc55dc95c7e31) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
09:56:15.0500 7896 wlidsvc - ok
09:56:15.0862 7896 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
09:56:15.0864 7896 WmiAcpi - ok
09:56:16.0059 7896 wmiApSrv (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe
09:56:16.0114 7896 wmiApSrv - ok
09:56:16.0933 7896 WMPNetworkSvc (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe
09:56:16.0977 7896 WMPNetworkSvc - ok
09:56:17.0004 7896 WPCSvc (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll
09:56:17.0011 7896 WPCSvc - ok
09:56:17.0090 7896 WPDBusEnum (aa53356d60af47eacc85bc617a4f3f66) C:\Windows\system32\wpdbusenum.dll
09:56:17.0153 7896 WPDBusEnum - ok
09:56:17.0208 7896 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
09:56:17.0213 7896 ws2ifsl - ok
09:56:17.0233 7896 wscsvc (6f5d49efe0e7164e03ae773a3fe25340) C:\Windows\system32\wscsvc.dll
09:56:17.0240 7896 wscsvc - ok
09:56:17.0249 7896 WSearch - ok
09:56:17.0483 7896 wuauserv (3026418a50c5b4761befa632cedb7406) C:\Windows\system32\wuaueng.dll
09:56:17.0578 7896 wuauserv - ok
09:56:18.0015 7896 WudfPf (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
09:56:18.0019 7896 WudfPf - ok
09:56:18.0075 7896 WUDFRd (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys
09:56:18.0089 7896 WUDFRd - ok
09:56:18.0186 7896 wudfsvc (8d1e1e529a2c9e9b6a85b55a345f7629) C:\Windows\System32\WUDFSvc.dll
09:56:18.0191 7896 wudfsvc - ok
09:56:18.0275 7896 WwanSvc (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll
09:56:18.0333 7896 WwanSvc - ok
09:56:18.0418 7896 ZTEusbmdm6k (3862318f85be7a91957ada5e814ed58c) C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys
09:56:18.0423 7896 ZTEusbmdm6k - ok
09:56:18.0498 7896 ZTEusbnmea (3862318f85be7a91957ada5e814ed58c) C:\Windows\system32\DRIVERS\ZTEusbnmea.sys
09:56:18.0514 7896 ZTEusbnmea - ok
09:56:18.0551 7896 ZTEusbser6k (3862318f85be7a91957ada5e814ed58c) C:\Windows\system32\DRIVERS\ZTEusbser6k.sys
09:56:18.0568 7896 ZTEusbser6k - ok
09:56:18.0639 7896 MBR (0x1B8) (4d3df799f91f23bd025ce550100f7662) \Device\Harddisk0\DR0
09:56:18.0956 7896 \Device\Harddisk0\DR0 - ok
09:56:18.0967 7896 Boot (0x1200) (7635bf983df3cc02360fc8e48524f904) \Device\Harddisk0\DR0\Partition0
09:56:18.0968 7896 \Device\Harddisk0\DR0\Partition0 - ok
09:56:18.0997 7896 Boot (0x1200) (17ce923dca9191a13c32facbb91ef525) \Device\Harddisk0\DR0\Partition1
09:56:18.0999 7896 \Device\Harddisk0\DR0\Partition1 - ok
09:56:19.0027 7896 Boot (0x1200) (5e7c9dabe2a58d293862e5c989fc0522) \Device\Harddisk0\DR0\Partition2
09:56:19.0029 7896 \Device\Harddisk0\DR0\Partition2 - ok
09:56:19.0030 7896 ============================================================
09:56:19.0030 7896 Scan finished
09:56:19.0030 7896 ============================================================
09:56:19.0055 9000 Detected object count: 0
09:56:19.0055 9000 Actual detected object count: 0

#8 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 16 June 2012 - 04:20 AM

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-06-16 10:15:31
-----------------------------
10:15:31.949 OS Version: Windows 6.1.7601 Service Pack 1
10:15:31.949 Number of processors: 2 586 0x170A
10:15:31.953 ComputerName: PHOENIX-THINK UserName: Phoenix
10:16:42.646 Initialize success
10:17:27.826 AVAST engine download error: 0
10:17:50.121 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
10:17:50.124 Disk 0 Vendor: WDC_WD32 14.0 Size: 305245MB BusType: 3
10:17:50.153 Disk 0 MBR read successfully
10:17:50.157 Disk 0 MBR scan
10:17:50.162 Disk 0 unknown MBR code
10:17:50.189 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 1200 MB offset 2048
10:17:50.199 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 293543 MB offset 2459648
10:17:50.229 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 10500 MB offset 603635712
10:17:50.237 Disk 0 scanning sectors +625140400
10:17:50.349 Disk 0 scanning C:\Windows\system32\drivers
10:18:03.752 Service scanning
10:18:16.835 Service KL1 C:\Windows\system32\DRIVERS\kl1.sys **LOCKED** 5
10:18:17.546 Service kl2 C:\Windows\system32\DRIVERS\kl2.sys **LOCKED** 5
10:18:17.866 Service KLIM6 C:\Windows\system32\DRIVERS\klim6.sys **LOCKED** 5
10:18:17.942 Service klmouflt C:\Windows\system32\DRIVERS\klmouflt.sys **LOCKED** 5
10:18:34.069 Modules scanning
10:18:48.819 Disk 0 trace - called modules:
10:18:48.851 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys
10:18:48.858 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x870fa9e8]
10:18:48.865 3 CLASSPNP.SYS[899df59e] -> nt!IofCallDriver -> [0x862bb868]
10:18:48.873 5 ACPI.sys[8428c3d4] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x862cf028]
10:18:48.881 Scan finished successfully
10:19:22.906 Disk 0 MBR has been saved successfully to "C:\Users\Phoenix\Desktop\Log\MBR.dat"
10:19:22.913 The log file has been saved successfully to "C:\Users\Phoenix\Desktop\Log\aswMBR.txt"

#9 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:46 PM

Posted 16 June 2012 - 12:33 PM

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe
Posted Image
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following

  • report from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now after running the script?

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#10 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 16 June 2012 - 01:40 PM

ComboFix 12-06-15.02 - Phoenix 16.06.2012 18:56:39.3.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.950.852.1033.18.1913.975 [GMT 1:00]
執行位置: c:\users\Phoenix\Desktop\Log\ComboFix.exe
Command switches used :: c:\users\Phoenix\Desktop\Log\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( 2012-05-16 至 2012-06-16 的新的檔案 )))))))))))))))))))))))))))))))
.
.
2012-06-16 18:10 . 2012-06-16 18:10 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-06-16 18:10 . 2012-06-16 18:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-16 14:22 . 2012-05-08 16:40 6737808 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BE376029-F404-498D-B5AA-F71CC1E32341}\mpengine.dll
2012-06-15 17:36 . 2012-06-16 18:28 -------- d-----w- c:\users\Phoenix\AppData\Local\temp
2012-06-12 19:44 . 2012-04-24 04:36 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2012-06-12 19:44 . 2012-04-24 04:36 1158656 ----a-w- c:\windows\system32\crypt32.dll
2012-06-12 19:44 . 2012-04-24 04:36 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-12 19:43 . 2012-04-07 11:26 2342400 ----a-w- c:\windows\system32\msi.dll
2012-06-12 19:42 . 2012-04-28 03:17 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-08 19:08 . 2012-06-08 19:08 -------- d-----r- C:\Sandbox
2012-06-08 19:03 . 2012-06-08 19:03 -------- d-----w- c:\program files\Sandboxie
2012-06-08 18:44 . 2012-06-08 18:44 388096 ----a-r- c:\users\Phoenix\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-06-08 18:44 . 2012-06-08 18:44 -------- d-----w- c:\program files\Trend Micro
2012-05-30 12:59 . 2012-05-30 12:59 4966600 ----a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三個月內被修改的檔案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-22 07:08 . 2012-03-31 09:54 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-22 07:08 . 2011-10-12 16:11 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-17 22:35 . 2012-06-12 19:48 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 01:05 . 2012-06-12 19:42 2343936 ----a-w- c:\windows\system32\win32k.sys
2012-05-04 09:59 . 2012-06-12 19:42 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-05-01 04:44 . 2012-06-12 19:42 164352 ----a-w- c:\windows\system32\profsvc.dll
2012-04-26 04:45 . 2012-06-12 19:42 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 04:45 . 2012-06-12 19:42 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 04:41 . 2012-06-12 19:42 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-31 04:39 . 2012-05-14 07:35 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-31 04:39 . 2012-05-14 07:35 3913072 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-30 10:23 . 2012-05-14 07:37 1291632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-04 18:45 . 2011-09-23 16:13 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( 重要登入點 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白與合法缺省登錄將不會被顯示
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Radio Downloader"="c:\program files\Radio Downloader\Radio Downloader.exe" [2011-05-26 506792]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-06-05 17344176]
"Xvid"="c:\program files\Xvid\CheckUpdate.exe" [2011-01-17 8192]
"Spotify Web Helper"="c:\users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-05-04 932528]
"chromium"="c:\users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe" [2012-06-07 1239576]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-05-31 466704]
"Spotify"="c:\users\Phoenix\AppData\Roaming\Spotify\spotify.exe" [2012-05-04 9478320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-10 7612960]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-07 186904]
"TpShocks"="TpShocks.exe" [2011-03-29 337256]
"PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2011-11-30 1322048]
"Message Center Plus"="c:\program files\LENOVO\Message Center Plus\MCPLaunch.exe" [2009-05-28 49976]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe" [2009-08-05 244208]
"IdeaNotesUser"="c:\program files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe" [2009-08-24 221872]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-04-22 1725736]
"AcWin7Hlpr"="c:\program files\Lenovo\Access Connections\AcTBenabler.exe" [2011-04-14 31592]
"LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2010-07-27 62312]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-08 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-08 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-08 151064]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-08-27 90112]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-24 202296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
.
c:\users\Phoenix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2009-7-2 795936]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google更新 服務 (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 136176]
R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-08-05 362992]
R2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [2009-08-05 309744]
R2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [2009-08-05 166384]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-06-05 160944]
R3 AMPPALP;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [2011-08-08 243712]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2011-03-23 102784]
R3 gupdatem;Google更新 服務 (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 136176]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-07-28 25112]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2010-01-19 9216]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-05-04 129976]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-05-13 4231680]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 PCDSRVC{3037D694-FD904ACA-06020200}_0;PCDSRVC{3037D694-FD904ACA-06020200}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\pc-doctor\pcdsrvc.pkms [2011-06-27 22640]
R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.EXE [2011-11-30 89152]
R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files\ThinkPad\Utilities\PWMEWSVC.EXE [2011-11-30 175168]
R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-08-05 313840]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-08-05 1124848]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-09-24 1343400]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-05-06 11520]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM86.sys [2011-03-29 20592]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2011-03-04 11352]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2011-03-10 23856]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiif32.sys [2010-09-07 13680]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 AMPPALR3;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-08-08 948736]
S2 BecHelperService;BecHelperService;c:\program files\3 Mobile Broadband\3Connect\BecHelperService.exe [2011-03-23 1740696]
S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-06-03 102672]
S2 DDNIMSGService;DDNIMSGService;c:\program files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe [2010-07-20 171872]
S2 DDNIService;DDNIService;c:\program files\DDNI\DIBS\DDNIService.exe [2010-07-23 163680]
S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [2010-07-27 50536]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2011-04-04 45496]
S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [2010-07-27 74088]
S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [2010-04-07 93032]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-18 11032]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-05-30 3048136]
S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [2011-04-20 130920]
S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2011-03-29 64952]
S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys [2009-06-18 125568]
S3 AMPPAL;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [2011-08-08 243712]
S3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [2011-03-23 11136]
S3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys [2011-03-23 353280]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2011-03-23 73216]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-07-10 122880]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2010-12-13 144472]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]
S3 NETwNs32;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETwNs32.sys [2011-08-03 7517696]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S3 stdriver;Sound Tap Upper Class Filter Driver v2.0.0.0;c:\windows\system32\DRIVERS\stdriver32.sys [2011-10-14 49240]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
‘計劃任務’ 文件夾 裡的內容
.
2012-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 09:43]
.
2012-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 09:43]
.
2012-06-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000Core.job
- c:\users\Phoenix\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-23 17:47]
.
2012-06-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000UA.job
- c:\users\Phoenix\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-23 17:47]
.
2012-05-30 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:54]
.
2012-06-16 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:54]
.
.
------- 而外的掃描 -------
.
uStart Page = hxxp://lenovo.msn.com
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyServer = 172.16.0.3:8881
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
IE: 新增到卡巴斯基廣告橫幅防護清單 - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
LSP: c:\program files\YouKu\common\ikutm.dll
TCP: DhcpNameServer = 208.67.222.222
FF - ProfilePath - c:\users\Phoenix\AppData\Roaming\Mozilla\Firefox\Profiles\dr9oautu.default\
FF - prefs.js: network.proxy.ftp - 172.16.0.3
FF - prefs.js: network.proxy.ftp_port - 8881
FF - prefs.js: network.proxy.http - 172.16.0.3
FF - prefs.js: network.proxy.http_port - 8881
FF - prefs.js: network.proxy.socks - 172.16.0.3
FF - prefs.js: network.proxy.socks_port - 8881
FF - prefs.js: network.proxy.ssl - 172.16.0.3
FF - prefs.js: network.proxy.ssl_port - 8881
FF - prefs.js: network.proxy.type - 0
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{3037D694-FD904ACA-06020200}_0]
"ImagePath"="\??\c:\program files\pc-doctor\pcdsrvc.pkms"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*魯 
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*魯 OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.3GP\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.ASF\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.AVI\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DAT\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DVIX\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.FLV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.M4V\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MKV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MOV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MP4\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MPEG\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MPG\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.RM\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.RMVB\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.WMV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- 運行進程下的動態鏈接庫 ---------------------
.
- - - - - - - > 'Explorer.exe'(7232)
c:\program files\ThinkPad\Bluetooth Software\btmmhook.dll
c:\program files\Lenovo\Access Connections\ACDeskBand.dll
c:\program files\Lenovo\Access Connections\AcLocSettings.dll
c:\program files\Lenovo\Access Connections\AcCryptHlpr.dll
c:\program files\Lenovo\Access Connections\ACHelper.dll
c:\program files\Lenovo\Access Connections\AcSvcStub.dll
c:\program files\ThinkPad\Utilities\PWMTR32V.DLL
c:\progra~1\ThinkPad\UTILIT~1\US\PWMRT32V.DLL
c:\progra~1\ThinkPad\UTILIT~1\PWMIF32V.DLL
c:\program files\ThinkPad\Bluetooth Software\btncopy.dll
.
------------------------ 其他運行進程 ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\Sandboxie\SbieSvc.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Lenovo\Access Connections\AcPrfMgrSvc.exe
c:\progra~1\Lenovo\HOTKEY\tpnumlk.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Lenovo\Access Connections\AcSvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\WUDFHost.exe
c:\program files\ThinkPad\Bluetooth Software\btwdins.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Google\Update\1.3.21.111\GoogleCrashHandler.exe
c:\program files\Lenovo\System Update\SUService.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\system32\taskhost.exe
c:\progra~1\LENOVO\VIRTSCRL\virtscrl.exe
c:\program files\LENOVO\HOTKEY\tposdsvc.exe
c:\progra~1\Lenovo\HOTKEY\tpnumlkd.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\Zoom\TpScrex.exe
c:\windows\system32\conhost.exe
c:\windows\System32\TpShocks.exe
c:\windows\System32\rundll32.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Synaptics\SynTP\SynTPLpr.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\igfxext.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
.
**************************************************************************
.
完成時間: 2012-06-16 19:35:35 - 電腦已重新啟動
ComboFix-quarantined-files.txt 2012-06-16 18:35
ComboFix2.txt 2012-06-15 18:43
ComboFix3.txt 2012-04-19 02:27
.
Pre-Run: 101,839,437,824 bytes free
Post-Run: 102,633,168,896 bytes free
.
- - End Of File - - 6701D7D8394CE75C46A5D902FB2B0514

The computer is running ok. Thanks

#11 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:46 PM

Posted 16 June 2012 - 09:50 PM

These logs are looking allot better. But we still have some work to do.

Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..

uninstall some programs

NOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore this is fine just move to the next item on the list.

You can remove these programs using add/remove or you can use the free uninstaller from Revo (it does allot better of a job

Programs to remove

Bing Bar
Java™ 6 Update 31
[/list]


  • Please download and install Revo Uninstaller Free
  • Double click Revo Uninstaller to run it.
  • From the list of programs double click on The Program to remove
  • When prompted if you want to uninstall click Yes.
  • Be sure the Moderate option is selected then click Next.
  • The program will run, If prompted again click Yes
  • when the built-in uninstaller is finished click on Next.
  • Once the program has searched for leftovers click Next.
  • Check/tick the bolded items only on the list then click Delete
  • when prompted click on Yes and then on next.
  • put a check on any folders that are found and select delete
  • when prompted select yes then on next
  • Once done click Finish.
.


Install Java:

Please go here to install Java

  • click on the Free Java Download Button
  • click on Agree and start Free download
  • click on Run
  • click on run again
  • click on install
  • when install is complete click on close

Clean Out Temp Files

  • This small application you may want to keep and use once a week to keep the computer clean.

    Download CCleaner from here http://www.ccleaner.com/

  • Run the installer to install the application.
  • When it gives you the option to install Yahoo toolbar uncheck the box next to it.
  • Run CCleaner. (make sure under Windows tab all the boxes of Internet Explorer and Windows explorer are checked. Under System check Empty Recycle Bin and Temporary Files. Under Application tab all the boxes should be checked).
  • Click Run Cleaner.
  • Close CCleaner.

: Malwarebytes' Anti-Malware :

  • Please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.


Download HijackThis

If you have any problems running Hijackthis see NOTE** below (Host file not read, blank notepad ...)

  • Go Here to download HijackThis Installer
  • Save HijackThis Installer to your desktop.
  • Double-click on the HijackThis Installer icon on your desktop. (Vista and Win 7 right click and run as admin)
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed it will launch Hijackthis.
  • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  • Click on Edit > Select All then click on Edit > Copy to copy the entire contents of the log.
  • Come back here to this thread and Paste the log in your next reply.
  • DO NOT use the AnalyseThis button its findings are dangerous if misinterpreted.
  • DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.


NOTE**
sometimes we have to run it like this To run HijackThis as an administrator, right-click HijackThis.exe
(located: C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe)<--32bit
(located: C:\Program Files(86)\Trend Micro\HiJackThis\HiJackThis.exe)<--64bit
and select to run as administrator

"information and logs"

  • In your next post I need the following

  • Log From MBAM
  • report from Hijackthis
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#12 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 17 June 2012 - 06:28 AM

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.06.17.03

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Phoenix :: PHOENIX-THINK [administrator]

Protection: Enabled

17.06.2012 12:06:03
mbam-log-2012-06-17 (12-06-03).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 218507
Time elapsed: 20 minute(s), 2 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
C:\Users\Phoenix\AppData\Roaming\baidu (PUP.Baidu) -> Quarantined and deleted successfully.

Files Detected: 0
(No malicious items detected)

(end)

It is running ok, less slow than before

#13 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 17 June 2012 - 07:01 AM

I fail to get a log file after the scan. The notepad opens up but it is blank. It says 'Cannot find the C:\Program Files\Trend Micro\Hijackthis\hijackthis.log file'

#14 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 17 June 2012 - 07:03 AM

I have manage to run a scan and save log


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:03:30, on 17.06.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16446)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\TpShocks.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe
C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\SCHTASK.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Sandboxie\SandboxieRpcSs.exe
C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
C:\Program Files\Sandboxie\SandboxieCrypto.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\Users\Phoenix\AppData\Roaming\Spotify\spotify.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\rundll32.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\msfeedssync.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\DllHost.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [Message Center Plus] C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe /start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe"
O4 - HKLM\..\Run: [IdeaNotesUser] C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AcWin7Hlpr] C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe
O4 - HKLM\..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Radio Downloader] "C:\Program Files\Radio Downloader\Radio Downloader.exe" /hidemainwindow
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [chromium] C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe --no-startup-window
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [Spotify] "C:\Users\Phoenix\AppData\Roaming\Spotify\spotify.exe" /uri spotify:autostart
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe -update plugin
O4 - Startup: OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: 新增到卡巴斯基廣告橫幅防護清單 - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: 虛擬鍵盤(&V) - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: 檢查網址(&H) - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\youku\common\ikutm.dll
O10 - Unknown file in Winsock LSP: c:\program files\youku\common\ikutm.dll
O10 - Unknown file in Winsock LSP: c:\program files\youku\common\ikutm.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: AcPrfMgrSvc - Lenovo - C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe
O23 - Service: AcSvc - Lenovo - C:\Program Files\Lenovo\Access Connections\AcSvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: 卡巴斯基防病毒服務 (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
O23 - Service: BecHelperService - Unknown owner - C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
O23 - Service: Bonjour 服務 (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel® Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: DDNIMSGService - Digital Delivery Networks, Inc. - C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe
O23 - Service: DDNIService - Digital Delivery Networks, Inc. - C:\Program Files\DDNI\DIBS\DDNIService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google更新 服務 (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google更新 服務 (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo. - C:\Windows\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod 服務 (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Lenovo Auto Scroll (Lenovo.VIRTSCRLSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Power Manager DBC Service - Lenovo - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: Cisco EnergyWise Enabler (PwmEWSvc) - Lenovo Group Limited - C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - C:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\Windows\System32\TPHDEXLG.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

--
End of file - 19790 bytes

#15 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 17 June 2012 - 09:52 AM

I have just got the following message from the MBAM

IP-BLOCK 222.69.157.154 (Type: incoming, Port: 23, Process: svchost.exe)

However, my Kaspersky did not give me any alert. Is my machine still infected? Thanks.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users