Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HijackThis Log: Please help Diagnose


  • This topic is locked This topic is locked
26 replies to this topic

#1 phoenix1206

phoenix1206

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 22 July 2012 - 01:25 AM

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:08:56, on 22.07.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\TpShocks.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Users\Phoenix\AppData\Roaming\Spotify\spotify.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Users\Phoenix\AppData\Local\Facebook\Messenger\2.1.4570.0\FacebookMessenger.exe
C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\SCHTASK.exe
C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Sandboxie\SandboxieRpcSs.exe
C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Sandboxie\SandboxieCrypto.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\rundll32.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\ArcSoft\MediaImpression 2\MediaImpression.exe
C:\Program Files\Common Files\ArcSoft\Media Browser\ArcMediaService.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AcWin7Hlpr] C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe
O4 - HKLM\..\Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [chromium] C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe --no-startup-window
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [Spotify] "C:\Users\Phoenix\AppData\Roaming\Spotify\spotify.exe" /uri spotify:autostart
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Phoenix\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [Google Update] "C:\Users\Phoenix\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - Startup: Facebook Messenger.lnk = C:\Users\Phoenix\AppData\Local\Facebook\Messenger\2.1.4570.0\FacebookMessenger.exe
O4 - Startup: OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: 新增到卡巴斯基廣告橫幅防護清單 - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: 虛擬鍵盤(&V) - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: 檢查網址(&H) - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\youku\common\ikutm.dll
O10 - Unknown file in Winsock LSP: c:\program files\youku\common\ikutm.dll
O10 - Unknown file in Winsock LSP: c:\program files\youku\common\ikutm.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2CC802FF-9E18-4E17-ADBC-E203C71F3944}: NameServer = 172.30.139.17 172.31.139.17
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll
O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\Windows\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\msvidctl.dll
O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\Windows\system32\urlmon.dll
O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\Windows\system32\urlmon.dll
O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\Windows\system32\urlmon.dll
O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\Windows\system32\urlmon.dll
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll
O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\Windows\system32\urlmon.dll
O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\Windows\system32\inetcomm.dll
O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\Windows\system32\urlmon.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: AcPrfMgrSvc - Lenovo - C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe
O23 - Service: AcSvc - Lenovo - C:\Program Files\Lenovo\Access Connections\AcSvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: 卡巴斯基防病毒服務 (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
O23 - Service: BecHelperService - Unknown owner - C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
O23 - Service: Bonjour 服務 (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel® Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: DDNIMSGService - Digital Delivery Networks, Inc. - C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe
O23 - Service: DDNIService - Digital Delivery Networks, Inc. - C:\Program Files\DDNI\DIBS\DDNIService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google更新 服務 (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google更新 服務 (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo. - C:\Windows\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod 服務 (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: Lenovo Auto Scroll (Lenovo.VIRTSCRLSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Power Manager DBC Service - Lenovo - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: Cisco EnergyWise Enabler (PwmEWSvc) - Lenovo Group Limited - C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - C:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\Windows\System32\TPHDEXLG.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

--
End of file - 20608 bytes

BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:42 AM

Posted 22 July 2012 - 01:49 AM

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your computer problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.


DeFogger:

  • Please download DeFogger to your desktop.

    Double click DeFogger to run the tool.
  • The application window will appear
  • Click the Disable button to disable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger may ask you to reboot the machine, if it does - click OK
Do not re-enable these drivers until otherwise instructed.


Security Check

  • Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


Download DDS:

  • Please download DDS by sUBs from one of the links below and save it to your desktop:

    Posted Image
    Download DDS and save it to your desktop

    Link1
    Link2
    Link3

    Please disable any anti-malware program that will block scripts from running before running DDS.

    • Double-Click on dds.scr and a command window will appear. This is normal.
    • Shortly after two logs will appear:
    • DDS.txt
    • Attach.txt
  • A window will open instructing you save & post the logs
  • Save the logs to a convenient place such as your desktop
  • Copy the contents of both logs & post in your next reply

information and logs:

  • In your next post I need the following

  • .logs from DDS
  • let me know of any problems you may have had

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 22 July 2012 - 02:17 AM

Other than my windows explorer hung up quite often. Sometimes the flashplayer appears on the taskbar (as shown in the screencap)

Attached Files


Edited by phoenix1206, 22 July 2012 - 02:19 AM.


#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:42 AM

Posted 22 July 2012 - 02:46 AM

OK let me have the three reports from above



gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 22 July 2012 - 02:52 AM

Results of screen317's Security Check version 0.99.43
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Kaspersky Internet Security
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
WinPatrol
Malwarebytes Anti-Malware version 1.62.0.1300
CCleaner
Java™ 7 Update 5
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.3.300.265
Mozilla Firefox 13.0.1 Firefox out of Date!
Google Chrome 20.0.1132.47
Google Chrome 20.0.1132.57
````````Process Check: objlist.exe by Laurent````````
WinPatrol winpatrol.exe
Kaspersky Lab Kaspersky Internet Security 2012 avp.exe
Kaspersky Lab Kaspersky Internet Security 2012 klwtblfs.exe
BillP Studios WinPatrol WinPatrol.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

#6 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 22 July 2012 - 11:57 PM

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 24.09.2011 00:09:51
System Uptime: 22.07.2012 20:54:05 (16 hours ago)
.
Motherboard: LENOVO | | 28476WB
Processor: Pentium® Dual-Core CPU T4500 @ 2.30GHz | U2E1 | 1196/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 287 GiB total, 78.257 GiB free.
D: is CDROM ()
I: is CDROM (CDFS)
J: is Removable
Q: is FIXED (NTFS) - 10 GiB total, 5.144 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP153: 08.07.2012 00:50:55 - Windows Update
RP154: 11.07.2012 12:00:57 - Windows Update
RP155: 17.07.2012 16:49:33 - Windows Update
RP156: 17.07.2012 16:54:57 - Installed Windows Mobile Device Center
RP157: 21.07.2012 13:56:57 - Windows Update
.
==== Installed Programs ======================
.
Registry Patch to arrange icons in Device and Printers folder of Windows 7
32 Bit HP CIO Components Installer
3Connect
Access Help
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.3)
AIO_Scan
Amazon MP3 Downloader 1.0.9
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft MediaImpression 2
AT&T Service Activation
BisonCam Twain Pro
Bonjour
BufferChm
Cassini-Huygens Photojournal Screen Saver
CCleaner
CDisplay 1.8
Chinese Traditional Fonts Support For Adobe Reader X
Copy
Create Recovery Media
CutePDF Writer 2.8
D3DX10
Debut Video Capture Software
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Destinations
Dev-C++ 5 beta 9 release (4.9.9.2)
DeviceDiscovery
DIBS
DirectX 9 Runtime
DJ_AIO_ProductContext
DJ_AIO_Software
DJ_AIO_Software_min
Exact Audio Copy 1.0beta3
Facebook Messenger 2.1.4570.0
FLAC 1.2.1b (remove only)
foobar2000 v1.1.7
GeoGebra
Glovius
Google Chrome
Google Earth
Google Gears
Google Update Helper
GPBaseService2
HiJackThis
HP Customer Participation Program 13.0
HP Deskjet All-In-One Driver Software 13.0 Rel. 1
HP Imaging Device Functions 13.0
HP Solution Center 13.0
HPPhotoGadget
HPProductAssistant
HPSSupply
Huawei modem
iKu 2
Integrated Camera Driver Installer Package Ver.1.0.1.2
Intel PROSet Wireless
Intel® Graphics Media Accelerator Driver
Intel® PROSet/無線 WiFi 軟體
Intel® TV Wizard
IntelR Matrix Storage Manager
InterVideo WinDVD 8
iTunes
Java Auto Updater
Java™ 7 Update 5
JMicron Flash Media Controller Driver
Junk Mail filter update
Kaspersky Internet Security 2012
Lenovo Auto Scroll Utility
Lenovo Central
Lenovo Idea Notes
Lenovo Patch Utility
Lenovo System Interface Driver
Lenovo ThinkVantage Toolbox
Lenovo Welcome
Little Fighter 2 version 2.0a
Malwarebytes Anti-Malware version 1.62.0.1300
Mesh Runtime
Message Center Plus
Messenger Companion
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Home and Student 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Word MUI (English) 2010
Microsoft Research AutoCollage Touch 2009
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.5026
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mobile Broadband Connect
Mozilla Firefox 14.0.1 (x86 en-GB)
Mozilla Maintenance Service
MSVCRT
MSXML 4.0 SP2 (KB973688)
MuseScore 0.9.6.3 MuseScore score typesetter
On Screen Display
Parmen
Picasa 3
QuickTime
Radio Downloader
Realtek Ethernet Controller Driver For Windows 7
Realtek High Definition Audio Driver
Recover My Files
Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7
Reimage Repair
Rescue and Recovery
Revo Uninstaller 1.94
Roxio Activation Module
Roxio Central Audio
Roxio Central Copy
Roxio Central Core
Roxio Central Data
Roxio Central Tools
Roxio Creator Small Business Edition
Roxio Express Labeler 3
Ruby 1.9.3-p0
Sandboxie 3.70 (32-bit)
Scan
Security Task Manager 1.8d
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2553322) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft Visio Viewer 2010 (KB2597981) 32-Bit Edition
Shop for HP Supplies
Skype Click to Call
Skype™ 5.9
snaap! Uploader
SolutionCenter
Sonic CinePlayer Decoder Pack
Sonic Icons for Lenovo
SoundTap Streaming Audio Recorder
Spotify
Station Spacewalk Game 2.0
Status
Stellaris 1.60
Stellarium 0.10.6.1
System Migration Assistant
System Update
ThinkPad Bluetooth with Enhanced Data Rate Software
ThinkPad FullScreen Magnifier
ThinkPad Hotkey Features Integration Setup
ThinkPad Hotkey Features Setup
ThinkPad Power Management Driver
ThinkPad Power Manager
ThinkPad UltraNav Driver
ThinkPad UltraNav Utility
ThinkVantage Access Connections
ThinkVantage Active Protection System
ThinkVantage Communications Utility
Toolbox
Total Video Converter 3.61 100319
TrayApp
Ulead PhotoImpact 10
UnloadSupport
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Verizon Wireless Mobile Broadband Self Activation
VLC media player 1.1.9
WebReg
Windows Driver Package - Intel hdc (06/04/2009 7.0.0.1013)
Windows Driver Package - Intel System (06/04/2009 1.0.0.0002)
Windows Driver Package - Lenovo 1.55 (08/18/2009 1.55)
Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (07/10/2009 6.0.1.5892)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
Windows Mobile Device Center
WinPatrol
WinRAR 4.00 beta 1 (32-bit)
Xvid Video Codec
ZTE_1.2059.0.8
.
==== Event Viewer Messages From Past Week ========
.
22.07.2012 21:41:18, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WinDefend service.
22.07.2012 11:13:15, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{14C8C72B-448D-4D7B-BF91-C11B89D962E4} because another computer on the network has the same name. The server could not start.
22.07.2012 00:17:03, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WcesComm service.
22.07.2012 00:15:54, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the EvtEng service.
18.07.2012 22:58:34, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.
18.07.2012 22:56:27, Error: Disk [15] - The device, \Device\Harddisk1\DR1, is not ready for access yet.
18.07.2012 09:53:29, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
17.07.2012 19:26:52, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.
17.07.2012 19:26:52, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Lenovo.VIRTSCRLSVC service.
17.07.2012 16:06:50, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
.
==== End Of File ===========================

#7 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 23 July 2012 - 12:00 AM

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.5.0
Run by Phoenix at 12:45:34 on 2012-07-23
Microsoft Windows 7 Home Premium 6.1.7601.1.950.852.1033.18.1913.330 [GMT 8:00]
.
AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\spoolsv.exe
C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe
C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
C:\Program Files\DDNI\DIBS\DDNIService.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Lenovo\Access Connections\AcSvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Google\Update\1.3.21.115\GoogleCrashHandler.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Lenovo\System Update\SUService.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\Windows\system32\taskhost.exe
C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
C:\Windows\system32\Dwm.exe
C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\TpShocks.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Users\Phoenix\AppData\Local\Facebook\Messenger\2.1.4570.0\FacebookMessenger.exe
C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\SCHTASK.exe
C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Sandboxie\SandboxieRpcSs.exe
C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Sandboxie\SandboxieCrypto.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\klwtblfs.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\perfmon.exe
C:\Program Files\Sandboxie\SandboxieBITS.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\YouKu\common\ikucmc.exe
C:\Windows\system32\taskhost.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Java\jre7\bin\jp2launcher.exe
C:\Program Files\Java\jre7\bin\java.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\taskmgr.exe
C:\Program Files\Java\jre7\bin\jp2launcher.exe
C:\Program Files\Java\jre7\bin\java.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Java\jre7\bin\jp2launcher.exe
C:\Program Files\Java\jre7\bin\java.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Java\jre7\bin\jp2launcher.exe
C:\Program Files\Java\jre7\bin\java.exe
C:\Windows\system32\conhost.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\YouKu\common\ikuacc.exe
C:\Windows\System32\rundll32.exe
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\Explorer.EXE
C:\Users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://lenovo.msn.com
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyServer = 172.16.0.3:8881
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2012\ievkbd.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~4\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2012\klwtbbho.dll
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
uRun: [Spotify Web Helper] "c:\users\phoenix\appdata\roaming\spotify\data\SpotifyWebHelper.exe"
uRun: [chromium] c:\users\phoenix\appdata\local\google\chrome\application\chrome.exe --no-startup-window
uRun: [SandboxieControl] "c:\program files\sandboxie\SbieCtrl.exe"
uRun: [Spotify] "c:\users\phoenix\appdata\roaming\spotify\spotify.exe" /uri spotify:autostart
uRun: [Facebook Update] "c:\users\phoenix\appdata\local\facebook\update\FacebookUpdate.exe" /c /nocrashserver
uRun: [Google Update] "c:\users\phoenix\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe
mRun: [TpShocks] TpShocks.exe
mRun: [PWMTRV] rundll32 c:\progra~1\thinkpad\utilit~1\PWMTR32V.DLL,PwrMgrBkGndMonitor
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [AcWin7Hlpr] c:\program files\lenovo\access connections\AcTBenabler.exe
mRun: [LENOVO.TPKNRRES] c:\program files\lenovo\communications utility\TPKNRRES.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2012\avp.exe"
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
StartupFolder: c:\users\phoenix\appdata\roaming\micros~1\windows\startm~1\programs\startup\facebo~1.lnk - c:\users\phoenix\appdata\local\facebook\messenger\2.1.4570.0\FacebookMessenger.exe
StartupFolder: c:\users\phoenix\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office14\ONENOTEM.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~4\office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm
IE: 新增到卡巴斯基廣告橫幅防護清單 - c:\program files\kaspersky lab\kaspersky internet security 2012\ie_banner_deny.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2012\ievkbd.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2012\klwtbbho.dll
LSP: c:\program files\youku\common\ikutm.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
TCP: DhcpNameServer = 192.168.8.1
TCP: Interfaces\{14C8C72B-448D-4D7B-BF91-C11B89D962E4} : DhcpNameServer = 192.168.8.1
TCP: Interfaces\{14C8C72B-448D-4D7B-BF91-C11B89D962E4}\342796070737 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{14C8C72B-448D-4D7B-BF91-C11B89D962E4}\46166756 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{14C8C72B-448D-4D7B-BF91-C11B89D962E4}\96B697473756 : DhcpNameServer = 192.168.8.1
TCP: Interfaces\{2CC802FF-9E18-4E17-ADBC-E203C71F3944} : NameServer = 172.30.139.17 172.31.139.17
TCP: Interfaces\{C0D43FEA-7B50-476E-9FE1-8E01BC63934E} : DhcpNameServer = 192.168.8.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: igfxcui - igfxdev.dll
Notify: klogon - c:\windows\system32\klogon.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\phoenix\appdata\roaming\mozilla\firefox\profiles\dr9oautu.default\
FF - prefs.js: network.proxy.ftp - 172.16.0.3
FF - prefs.js: network.proxy.ftp_port - 8881
FF - prefs.js: network.proxy.http - 172.16.0.3
FF - prefs.js: network.proxy.http_port - 8881
FF - prefs.js: network.proxy.socks - 172.16.0.3
FF - prefs.js: network.proxy.socks_port - 8881
FF - prefs.js: network.proxy.ssl - 172.16.0.3
FF - prefs.js: network.proxy.ssl_port - 8881
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\progra~1\micros~4\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\micros~4\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\phoenix\appdata\local\facebook\messenger\2.1.4570.0\npFbDesktopPlugin.dll
FF - plugin: c:\users\phoenix\appdata\local\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_265.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2011-3-30 20592]
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2011-3-4 11352]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\drivers\klim6.sys [2011-3-10 23856]
R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2011-9-28 13680]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-4-4 63928]
R2 AMPPALR3;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Service;c:\program files\intel\bluetoothhs\BTHSAmpPalService.exe [2011-8-8 948736]
R2 AVP;卡巴斯基防病毒服務;c:\program files\kaspersky lab\kaspersky internet security 2012\avp.exe [2011-4-24 202296]
R2 BecHelperService;BecHelperService;c:\program files\3 mobile broadband\3connect\BecHelperService.exe [2011-9-25 1740696]
R2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\intel\bluetoothhs\BTHSSecurityMgr.exe [2011-6-3 102672]
R2 DDNIMSGService;DDNIMSGService;c:\program files\ddni\lenovo idea notes\DDNIMSGService.exe [2011-9-26 171872]
R2 DDNIService;DDNIService;c:\program files\ddni\dibs\DDNIService.exe [2011-9-26 163680]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032]
R3 5U877;USB Video Device;c:\windows\system32\drivers\5U877.sys [2011-9-23 125568]
R3 AMPPAL;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Virtual Adapter;c:\windows\system32\drivers\AmpPal.sys [2011-8-8 243712]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [2011-9-25 73216]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2011-9-29 122880]
R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2011-10-27 144472]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-11-2 19984]
R3 NETwNs32;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\drivers\NETwNs32.sys [2011-8-4 7517696]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-6-10 394856]
R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2012-5-31 137488]
R3 stdriver;Sound Tap Upper Class Filter Driver v2.0.0.0;c:\windows\system32\drivers\stdriver32.sys [2011-10-15 49240]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AMPPALP;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Protocol;c:\windows\system32\drivers\AmpPal.sys [2011-8-8 243712]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2011-9-23 29472]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [2011-9-25 102784]
S3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\drivers\ew_usbenumfilter.sys [2011-9-25 11136]
S3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\drivers\ewusbwwan.sys [2011-9-25 353280]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2012-4-5 39272]
S3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\drivers\ivusb.sys [2010-7-29 25112]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-9-24 9216]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-6-17 22344]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2011-9-23 4231680]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-9-28 52224]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]
.
=============== Created Last 30 ================
.
2012-07-22 04:10:07 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{5b486c6e-72e7-488d-93b2-f548646b8003}\offreg.dll
2012-07-21 05:59:12 6891424 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{5b486c6e-72e7-488d-93b2-f548646b8003}\mpengine.dll
2012-07-19 14:38:01 -------- d-----w- C:\CDisplay
2012-07-17 08:53:19 -------- d-----w- c:\windows\WindowsMobile
2012-07-11 08:34:08 -------- d-----w- c:\users\phoenix\appdata\local\Facebook
2012-07-11 07:13:32 -------- d-----w- c:\users\phoenix\appdata\roaming\fltk.org
2012-07-11 07:13:32 -------- d-----w- c:\programdata\fltk.org
2012-07-11 06:26:45 -------- d-----w- C:\Octave
2012-07-11 04:06:37 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-07-11 03:59:50 805376 ----a-w- c:\windows\system32\cdosys.dll
2012-07-11 03:59:50 57344 ----a-w- c:\program files\common files\system\ado\msador15.dll
2012-07-11 03:59:50 372736 ----a-w- c:\program files\common files\system\ado\msadox.dll
2012-07-11 03:59:50 352256 ----a-w- c:\program files\common files\system\ado\msadomd.dll
2012-07-11 03:59:50 212992 ----a-w- c:\program files\common files\system\msadc\msadco.dll
2012-07-11 03:59:50 143360 ----a-w- c:\program files\common files\system\ado\msjro.dll
2012-07-11 03:59:50 1019904 ----a-w- c:\program files\common files\system\ado\msado15.dll
2012-07-11 03:59:14 1390080 ----a-w- c:\windows\system32\msxml6.dll
2012-07-11 03:59:11 1236992 ----a-w- c:\windows\system32\msxml3.dll
2012-07-11 03:59:10 2048 ----a-w- c:\windows\system32\msxml3r.dll
2012-07-11 03:59:00 369336 ----a-w- c:\windows\system32\drivers\cng.sys
2012-07-11 03:59:00 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-07-11 03:58:59 225280 ----a-w- c:\windows\system32\schannel.dll
2012-07-11 03:58:59 219136 ----a-w- c:\windows\system32\ncrypt.dll
2012-07-11 03:58:58 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-07-09 03:58:44 -------- d-----w- c:\users\phoenix\appdata\local\Macromedia
2012-07-02 18:57:48 -------- d-----w- c:\program files\GetData
2012-06-23 17:30:48 -------- d-sh--w- C:\$RECYCLE.BIN
2012-06-23 17:30:39 -------- d-----w- c:\users\phoenix\appdata\local\temp
.
==================== Find3M ====================
.
2012-07-17 10:17:16 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-17 10:17:16 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-03 05:46:44 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-17 10:50:50 772592 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-06-17 10:50:50 687600 ----a-w- c:\windows\system32\deployJava1.dll
2012-06-02 22:12:32 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12:13 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 14:19:42 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 14:12:20 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-02 08:33:25 1800192 ----a-w- c:\windows\system32\jscript9.dll
2012-06-02 08:25:08 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-06-02 08:25:03 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-06-02 08:20:33 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-06-02 08:16:52 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-05-31 04:25:14 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-05-04 09:59:54 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-05-01 04:44:12 164352 ----a-w- c:\windows\system32\profsvc.dll
2012-04-28 03:17:07 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-26 04:45:55 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 04:45:54 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 04:41:16 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
.
============= FINISH: 12:53:34.06 ===============

#8 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:42 AM

Posted 23 July 2012 - 12:02 AM

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#9 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 23 July 2012 - 04:10 AM

ComboFix 12-07-21.01 - Phoenix 23.07.2012 16:32:53.7.2 - x86
執行位置: c:\users\Phoenix\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( 被刪除的檔案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Phoenix\AppData\Local\Microsoft\Windows\Temporary Internet Files\{CA62BA58-BA44-48B9-94B8-81ABAF583A0F}.xps
c:\users\Phoenix\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E449EBF5-3384-468E-88D6-5A2E2A8780BE}.xps
c:\windows\system32\DEBUG.log
.
.
((((((((((((((((((((((((( 2012-06-23 至 2012-07-23 的新的檔案 )))))))))))))))))))))))))))))))
.
.
2012-07-23 08:44 . 2012-07-23 08:44 -------- d-----w- c:\users\Phoenix\AppData\Local\temp
2012-07-23 08:44 . 2012-07-23 08:44 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-07-23 08:44 . 2012-07-23 08:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-22 04:10 . 2012-07-22 04:10 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5B486C6E-72E7-488D-93B2-F548646B8003}\offreg.dll
2012-07-21 05:59 . 2012-06-29 08:44 6891424 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5B486C6E-72E7-488D-93B2-F548646B8003}\mpengine.dll
2012-07-19 14:38 . 2012-07-19 14:38 -------- d-----w- C:\CDisplay
2012-07-17 08:53 . 2012-07-17 08:57 -------- d-----w- c:\windows\WindowsMobile
2012-07-11 08:34 . 2012-07-11 08:35 -------- d-----w- c:\users\Phoenix\AppData\Local\Facebook
2012-07-11 07:13 . 2012-07-11 07:13 -------- d-----w- c:\users\Phoenix\AppData\Roaming\fltk.org
2012-07-11 07:13 . 2012-07-11 07:13 -------- d-----w- c:\programdata\fltk.org
2012-07-11 06:26 . 2012-07-11 06:49 -------- d-----w- C:\Octave
2012-07-11 04:06 . 2012-06-12 02:40 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-07-11 03:59 . 2012-06-06 05:05 143360 ----a-w- c:\program files\Common Files\System\ado\msjro.dll
2012-07-11 03:59 . 2012-06-06 05:05 372736 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2012-07-11 03:59 . 2012-06-06 05:05 57344 ----a-w- c:\program files\Common Files\System\ado\msador15.dll
2012-07-11 03:59 . 2012-06-06 05:05 352256 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2012-07-11 03:59 . 2012-06-06 05:05 212992 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2012-07-11 03:59 . 2012-06-06 05:05 1019904 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-07-11 03:59 . 2012-06-06 05:03 805376 ----a-w- c:\windows\system32\cdosys.dll
2012-07-11 03:59 . 2012-06-06 05:05 1390080 ----a-w- c:\windows\system32\msxml6.dll
2012-07-11 03:59 . 2012-06-06 05:05 1236992 ----a-w- c:\windows\system32\msxml3.dll
2012-07-11 03:59 . 2010-06-26 03:24 2048 ----a-w- c:\windows\system32\msxml3r.dll
2012-07-11 03:59 . 2012-06-02 04:45 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-07-11 03:59 . 2012-06-02 04:40 369336 ----a-w- c:\windows\system32\drivers\cng.sys
2012-07-11 03:58 . 2012-06-02 04:40 225280 ----a-w- c:\windows\system32\schannel.dll
2012-07-11 03:58 . 2012-06-02 04:39 219136 ----a-w- c:\windows\system32\ncrypt.dll
2012-07-11 03:58 . 2012-06-02 04:45 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-07-09 03:58 . 2012-07-09 03:58 -------- d-----w- c:\users\Phoenix\AppData\Local\Macromedia
2012-07-02 18:57 . 2012-07-02 18:57 -------- d-----w- c:\program files\GetData
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三個月內被修改的檔案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-17 10:17 . 2012-03-31 09:54 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-17 10:17 . 2011-10-12 16:11 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-03 05:46 . 2012-06-17 10:55 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-17 11:57 . 2012-06-17 11:57 388096 ----a-r- c:\users\Phoenix\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-06-17 10:50 . 2012-06-17 10:52 772592 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-06-17 10:50 . 2012-01-04 04:11 687600 ----a-w- c:\windows\system32\deployJava1.dll
2012-06-02 22:19 . 2012-06-22 19:15 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-22 19:15 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-22 19:15 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-22 19:15 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-22 19:15 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:12 . 2012-06-22 19:15 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12 . 2012-06-22 19:15 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 14:19 . 2012-06-22 19:14 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 14:12 . 2012-06-22 19:14 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-05-31 04:25 . 2011-09-27 07:33 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-05-04 09:59 . 2012-06-12 19:42 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-05-01 04:44 . 2012-06-12 19:42 164352 ----a-w- c:\windows\system32\profsvc.dll
2012-04-28 03:17 . 2012-06-12 19:42 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-26 04:45 . 2012-06-12 19:42 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 04:45 . 2012-06-12 19:42 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 04:41 . 2012-06-12 19:42 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-07-22 07:55 . 2011-09-23 16:13 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( 重要登入點 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白與合法缺省登錄將不會被顯示
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-06-05 17344176]
"Spotify Web Helper"="c:\users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-07-11 1192664]
"chromium"="c:\users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe" [2012-07-10 1250328]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-05-31 466704]
"Spotify"="c:\users\Phoenix\AppData\Roaming\Spotify\spotify.exe" [2012-07-11 7609560]
"Facebook Update"="c:\users\Phoenix\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-10 7612960]
"TpShocks"="TpShocks.exe" [2011-03-29 337256]
"PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2011-11-30 1322048]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-04-22 1725736]
"AcWin7Hlpr"="c:\program files\Lenovo\Access Connections\AcTBenabler.exe" [2011-04-14 31592]
"LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2010-07-27 62312]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-08 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-08 151064]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-24 202296]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2012-04-15 374368]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
.
c:\users\Phoenix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Facebook Messenger.lnk - c:\users\Phoenix\AppData\Local\Facebook\Messenger\2.1.4570.0\FacebookMessenger.exe [2012-7-6 217536]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2009-7-2 795936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 gupdate;Google更新 服務 (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [x]
R2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [x]
R2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AMPPALP;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys [x]
R3 gupdatem;Google更新 服務 (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.EXE [x]
R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files\ThinkPad\Utilities\PWMEWSVC.EXE [x]
R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [x]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [x]
R4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM86.sys [x]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiif32.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 AMPPALR3;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 BecHelperService;BecHelperService;c:\program files\3 Mobile Broadband\3Connect\BecHelperService.exe [x]
S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 DDNIMSGService;DDNIMSGService;c:\program files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe [x]
S2 DDNIService;DDNIService;c:\program files\DDNI\DIBS\DDNIService.exe [x]
S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [x]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [x]
S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [x]
S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [x]
S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [x]
S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [x]
S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys [x]
S3 AMPPAL;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]
S3 NETwNs32;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETwNs32.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 stdriver;Sound Tap Upper Class Filter Driver v2.0.0.0;c:\windows\system32\DRIVERS\stdriver32.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
計劃任務 文件夾 裡的內容
.
2012-07-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000Core.job
- c:\users\Phoenix\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11 03:22]
.
2012-07-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000UA.job
- c:\users\Phoenix\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11 03:22]
.
2012-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 09:43]
.
2012-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 09:43]
.
2012-07-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000Core.job
- c:\users\Phoenix\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-23 17:47]
.
2012-07-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000UA.job
- c:\users\Phoenix\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-23 17:47]
.
2012-07-05 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:54]
.
2012-07-23 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:54]
.
.
------- 而外的掃描 -------
.
uStart Page = hxxp://lenovo.msn.com
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyServer = 172.16.0.3:8881
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
LSP: c:\program files\YouKu\common\ikutm.dll
TCP: Interfaces\{2CC802FF-9E18-4E17-ADBC-E203C71F3944}: NameServer = 172.30.139.17 172.31.139.17
FF - ProfilePath - c:\users\Phoenix\AppData\Roaming\Mozilla\Firefox\Profiles\dr9oautu.default\
FF - prefs.js: network.proxy.ftp - 172.16.0.3
FF - prefs.js: network.proxy.ftp_port - 8881
FF - prefs.js: network.proxy.http - 172.16.0.3
FF - prefs.js: network.proxy.http_port - 8881
FF - prefs.js: network.proxy.socks - 172.16.0.3
FF - prefs.js: network.proxy.socks_port - 8881
FF - prefs.js: network.proxy.ssl - 172.16.0.3
FF - prefs.js: network.proxy.ssl_port - 8881
FF - prefs.js: network.proxy.type - 4
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*魯 
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*魯 OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.3GP\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.ASF\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.AVI\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DAT\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DVIX\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.FLV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.M4V\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MKV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MOV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MP4\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MPEG\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MPG\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.RM\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.RMVB\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.WMV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
完成時間: 2012-07-23 16:47:03
ComboFix-quarantined-files.txt 2012-07-23 08:47
.
Pre-Run: 85,852,999,680 bytes free
Post-Run: 87,185,461,248 bytes free
.
- - End Of File - - 77E4437C17EC9ED95435E64D0778D864

Before I run the Combofix, there is a blue screen showing problems with mbr.sys.

#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:42 AM

Posted 23 July 2012 - 05:20 AM

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.
  • Download TDSSKiller and save it to your Desktop.
  • doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.
  • Double click the aswMBR.exe icon to run it
  • it will ask to download extra definitions - ALLOW IT
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 23 July 2012 - 05:54 AM

18:48:05.0079 4292 TDSS rootkit removing tool 2.7.47.0 Jul 20 2012 20:36:30
18:48:06.0232 4292 ============================================================
18:48:06.0232 4292 Current date / time: 2012/07/23 18:48:06.0232
18:48:06.0232 4292 SystemInfo:
18:48:06.0232 4292
18:48:06.0233 4292 OS Version: 6.1.7601 ServicePack: 1.0
18:48:06.0233 4292 Product type: Workstation
18:48:06.0233 4292 ComputerName: PHOENIX-THINK
18:48:06.0233 4292 UserName: Phoenix
18:48:06.0233 4292 Windows directory: C:\Windows
18:48:06.0233 4292 System windows directory: C:\Windows
18:48:06.0233 4292 Processor architecture: Intel x86
18:48:06.0233 4292 Number of processors: 2
18:48:06.0233 4292 Page size: 0x1000
18:48:06.0233 4292 Boot type: Normal boot
18:48:06.0233 4292 ============================================================
18:48:10.0074 4292 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
18:48:10.0152 4292 Drive \Device\Harddisk1\DR1 - Size: 0x1DE97FE00 (7.48 Gb), SectorSize: 0x200, Cylinders: 0x3D0, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
18:48:10.0154 4292 ============================================================
18:48:10.0154 4292 \Device\Harddisk0\DR0:
18:48:10.0207 4292 MBR partitions:
18:48:10.0207 4292 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x258000
18:48:10.0207 4292 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x258800, BlocksNum 0x23D53800
18:48:10.0207 4292 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x23FAC000, BlocksNum 0x14822B0
18:48:10.0207 4292 \Device\Harddisk1\DR1:
18:48:10.0208 4292 MBR partitions:
18:48:10.0208 4292 \Device\Harddisk1\DR1\Partition0: MBR, Type 0xB, StartLBA 0x2C, BlocksNum 0xEF3FA4
18:48:10.0208 4292 ============================================================
18:48:10.0420 4292 C: <-> \Device\Harddisk0\DR0\Partition1
18:48:10.0589 4292 Q: <-> \Device\Harddisk0\DR0\Partition2
18:48:10.0627 4292 ============================================================
18:48:10.0627 4292 Initialize success
18:48:10.0627 4292 ============================================================
18:48:23.0618 7604 ============================================================
18:48:23.0618 7604 Scan started
18:48:23.0618 7604 Mode: Manual;
18:48:23.0618 7604 ============================================================
18:48:28.0055 7604 1394ohci (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
18:48:28.0103 7604 1394ohci - ok
18:48:28.0148 7604 5U877 (d623af0d0db0f13d32cae34d3f0dad39) C:\Windows\system32\DRIVERS\5U877.sys
18:48:28.0198 7604 5U877 - ok
18:48:28.0515 7604 ACDaemon (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
18:48:28.0530 7604 ACDaemon - ok
18:48:28.0625 7604 ACPI (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
18:48:28.0678 7604 ACPI - ok
18:48:28.0755 7604 AcpiPmi (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
18:48:28.0760 7604 AcpiPmi - ok
18:48:29.0019 7604 AcPrfMgrSvc (deeccadbd25f65d65293a09721b3a447) C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe
18:48:29.0043 7604 AcPrfMgrSvc - ok
18:48:29.0119 7604 AcSvc (a7753804c6c66c9c80f4e29659fd721c) C:\Program Files\Lenovo\Access Connections\AcSvc.exe
18:48:29.0159 7604 AcSvc - ok
18:48:29.0355 7604 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
18:48:29.0357 7604 AdobeARMservice - ok
18:48:29.0426 7604 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
18:48:29.0476 7604 adp94xx - ok
18:48:29.0537 7604 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
18:48:29.0614 7604 adpahci - ok
18:48:29.0663 7604 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
18:48:29.0679 7604 adpu320 - ok
18:48:29.0734 7604 AeLookupSvc (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll
18:48:29.0737 7604 AeLookupSvc - ok
18:48:29.0818 7604 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\Windows\system32\drivers\Afc.sys
18:48:29.0821 7604 Afc - ok
18:48:29.0970 7604 AFD (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys
18:48:30.0019 7604 AFD - ok
18:48:30.0074 7604 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
18:48:30.0093 7604 agp440 - ok
18:48:30.0139 7604 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
18:48:30.0206 7604 aic78xx - ok
18:48:30.0263 7604 ALG (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe
18:48:30.0267 7604 ALG - ok
18:48:30.0315 7604 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
18:48:30.0318 7604 aliide - ok
18:48:30.0383 7604 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
18:48:30.0387 7604 amdagp - ok
18:48:30.0405 7604 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys
18:48:30.0409 7604 amdide - ok
18:48:30.0444 7604 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
18:48:30.0448 7604 AmdK8 - ok
18:48:30.0473 7604 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
18:48:30.0956 7604 AmdPPM - ok
18:48:31.0054 7604 amdsata (d320bf87125326f996d4904fe24300fc) C:\Windows\system32\drivers\amdsata.sys
18:48:31.0494 7604 amdsata - ok
18:48:31.0569 7604 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
18:48:31.0895 7604 amdsbs - ok
18:48:31.0932 7604 amdxata (46387fb17b086d16dea267d5be23a2f2) C:\Windows\system32\drivers\amdxata.sys
18:48:31.0935 7604 amdxata - ok
18:48:32.0103 7604 AMPPAL (99bbef4a68bf398ed647f4eeb8ff66d4) C:\Windows\system32\DRIVERS\AMPPAL.sys
18:48:32.0402 7604 AMPPAL - ok
18:48:32.0457 7604 AMPPALP (99bbef4a68bf398ed647f4eeb8ff66d4) C:\Windows\system32\DRIVERS\amppal.sys
18:48:32.0461 7604 AMPPALP - ok
18:48:32.0811 7604 AMPPALR3 (ef4022e9c59b20438c1304424d9441f4) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
18:48:32.0856 7604 AMPPALR3 - ok
18:48:32.0973 7604 AppID (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
18:48:32.0977 7604 AppID - ok
18:48:33.0048 7604 AppIDSvc (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll
18:48:33.0053 7604 AppIDSvc - ok
18:48:33.0101 7604 Appinfo (fb1959012294d6ad43e5304df65e3c26) C:\Windows\System32\appinfo.dll
18:48:33.0103 7604 Appinfo - ok
18:48:33.0496 7604 Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
18:48:33.0526 7604 Apple Mobile Device - ok
18:48:33.0736 7604 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
18:48:33.0741 7604 arc - ok
18:48:33.0761 7604 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
18:48:33.0766 7604 arcsas - ok
18:48:34.0206 7604 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
18:48:34.0326 7604 aspnet_state - ok
18:48:34.0357 7604 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
18:48:34.0360 7604 AsyncMac - ok
18:48:34.0470 7604 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
18:48:34.0474 7604 atapi - ok
18:48:34.0617 7604 AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
18:48:34.0692 7604 AudioEndpointBuilder - ok
18:48:34.0705 7604 Audiosrv (ce3b4e731638d2ef62fcb419be0d39f0) C:\Windows\System32\Audiosrv.dll
18:48:34.0711 7604 Audiosrv - ok
18:48:34.0861 7604 AVP (2718dc27571bd1e37813f5759d2dc118) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
18:48:34.0944 7604 AVP - ok
18:48:35.0064 7604 AxInstSV (6e30d02aac9cac84f421622e3a2f6178) C:\Windows\System32\AxInstSV.dll
18:48:35.0070 7604 AxInstSV - ok
18:48:35.0140 7604 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
18:48:35.0188 7604 b06bdrv - ok
18:48:35.0241 7604 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
18:48:35.0261 7604 b57nd60x - ok
18:48:35.0342 7604 BDESVC (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll
18:48:35.0347 7604 BDESVC - ok
18:48:35.0759 7604 BecHelperService (68bf3520fe759c91fd9182f36e585374) C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
18:48:35.0884 7604 BecHelperService - ok
18:48:36.0194 7604 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
18:48:36.0199 7604 Beep - ok
18:48:36.0311 7604 BFE (1e2bac209d184bb851e1a187d8a29136) C:\Windows\System32\bfe.dll
18:48:36.0321 7604 BFE - ok
18:48:36.0439 7604 BITS (e585445d5021971fae10393f0f1c3961) C:\Windows\system32\qmgr.dll
18:48:36.0648 7604 BITS - ok
18:48:36.0676 7604 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
18:48:36.0678 7604 blbdrive - ok
18:48:37.0035 7604 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe
18:48:37.0086 7604 Bonjour Service - ok
18:48:37.0144 7604 bowser (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
18:48:37.0149 7604 bowser - ok
18:48:37.0198 7604 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
18:48:37.0201 7604 BrFiltLo - ok
18:48:37.0235 7604 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
18:48:37.0236 7604 BrFiltUp - ok
18:48:37.0275 7604 BridgeMP (77361d72a04f18809d0efb6cceb74d4b) C:\Windows\system32\DRIVERS\bridge.sys
18:48:37.0278 7604 BridgeMP - ok
18:48:37.0351 7604 Browser (6e11f33d14d020f58d5e02e4d67dfa19) C:\Windows\System32\browser.dll
18:48:37.0353 7604 Browser - ok
18:48:37.0440 7604 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
18:48:37.0448 7604 Brserid - ok
18:48:37.0580 7604 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
18:48:37.0584 7604 BrSerWdm - ok
18:48:37.0641 7604 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
18:48:37.0644 7604 BrUsbMdm - ok
18:48:37.0656 7604 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
18:48:37.0659 7604 BrUsbSer - ok
18:48:37.0727 7604 BthEnum (2865a5c8e98c70c605f417908cebb3a4) C:\Windows\system32\drivers\BthEnum.sys
18:48:37.0730 7604 BthEnum - ok
18:48:37.0761 7604 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
18:48:37.0765 7604 BTHMODEM - ok
18:48:37.0812 7604 BthPan (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\Windows\system32\DRIVERS\bthpan.sys
18:48:37.0816 7604 BthPan - ok
18:48:38.0032 7604 BTHPORT (c2fbf6d271d9a94d839c416bf186ead9) C:\Windows\System32\Drivers\BTHport.sys
18:48:38.0041 7604 BTHPORT - ok
18:48:38.0130 7604 bthserv (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll
18:48:38.0133 7604 bthserv - ok
18:48:38.0615 7604 BTHSSecurityMgr (8893814133afdd17431e2682ede2dce9) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
18:48:38.0617 7604 BTHSSecurityMgr - ok
18:48:38.0652 7604 BTHUSB (c81e9413a25a439f436b1d4b6a0cf9e9) C:\Windows\System32\Drivers\BTHUSB.sys
18:48:38.0655 7604 BTHUSB - ok
18:48:38.0702 7604 btwaudio (d57d29132efe13a83133d9bd449e0cf1) C:\Windows\system32\drivers\btwaudio.sys
18:48:38.0705 7604 btwaudio - ok
18:48:38.0767 7604 btwavdt (d282c14a69357d0e1bafaecc2ca98c3a) C:\Windows\system32\DRIVERS\btwavdt.sys
18:48:38.0772 7604 btwavdt - ok
18:48:38.0920 7604 btwdins (f7434401ae320bb97903a3c1865242fb) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
18:48:38.0962 7604 btwdins - ok
18:48:38.0995 7604 btwl2cap (aafd7cb76ba61fbb08e302da208c974a) C:\Windows\system32\DRIVERS\btwl2cap.sys
18:48:38.0997 7604 btwl2cap - ok
18:48:39.0030 7604 btwrchid (02eb4d2b05967df2d32f29c84ab1fb17) C:\Windows\system32\DRIVERS\btwrchid.sys
18:48:39.0033 7604 btwrchid - ok
18:48:39.0321 7604 catchme - ok
18:48:39.0370 7604 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
18:48:39.0373 7604 cdfs - ok
18:48:39.0449 7604 cdrom (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\DRIVERS\cdrom.sys
18:48:39.0455 7604 cdrom - ok
18:48:39.0515 7604 CertPropSvc (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
18:48:39.0518 7604 CertPropSvc - ok
18:48:39.0552 7604 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
18:48:39.0554 7604 circlass - ok
18:48:39.0611 7604 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
18:48:39.0630 7604 CLFS - ok
18:48:39.0725 7604 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:48:39.0729 7604 clr_optimization_v2.0.50727_32 - ok
18:48:39.0891 7604 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:48:39.0984 7604 clr_optimization_v4.0.30319_32 - ok
18:48:40.0010 7604 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
18:48:40.0014 7604 CmBatt - ok
18:48:40.0055 7604 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
18:48:40.0058 7604 cmdide - ok
18:48:40.0125 7604 CNG (247b4ce2dab1160cd422d532d5241e1f) C:\Windows\system32\Drivers\cng.sys
18:48:40.0162 7604 CNG - ok
18:48:40.0207 7604 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
18:48:40.0210 7604 Compbatt - ok
18:48:40.0264 7604 CompositeBus (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys
18:48:40.0267 7604 CompositeBus - ok
18:48:40.0285 7604 COMSysApp - ok
18:48:40.0305 7604 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
18:48:40.0308 7604 crcdisk - ok
18:48:40.0379 7604 CryptSvc (06e771aa596b8761107ab57e99f128d7) C:\Windows\system32\cryptsvc.dll
18:48:40.0394 7604 CryptSvc - ok
18:48:40.0507 7604 DcomLaunch (7660f01d3b38aca1747e397d21d790af) C:\Windows\system32\rpcss.dll
18:48:40.0515 7604 DcomLaunch - ok
18:48:40.0607 7604 DDNIMSGService (696c496ddab0a608d02894e9d4f62980) C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe
18:48:40.0619 7604 DDNIMSGService - ok
18:48:40.0659 7604 DDNIService (a767a85632556477021d43259397b21a) C:\Program Files\DDNI\DIBS\DDNIService.exe
18:48:40.0719 7604 DDNIService - ok
18:48:40.0996 7604 defragsvc (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll
18:48:41.0051 7604 defragsvc - ok
18:48:41.0091 7604 DfsC (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
18:48:41.0094 7604 DfsC - ok
18:48:41.0185 7604 Dhcp (e9e01eb683c132f7fa27cd607b8a2b63) C:\Windows\system32\dhcpcore.dll
18:48:41.0226 7604 Dhcp - ok
18:48:41.0266 7604 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
18:48:41.0270 7604 discache - ok
18:48:41.0297 7604 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
18:48:41.0301 7604 Disk - ok
18:48:41.0352 7604 Dnscache (33ef4861f19a0736b11314aad9ae28d0) C:\Windows\System32\dnsrslvr.dll
18:48:41.0357 7604 Dnscache - ok
18:48:41.0431 7604 dot3svc (366ba8fb4b7bb7435e3b9eacb3843f67) C:\Windows\System32\dot3svc.dll
18:48:41.0439 7604 dot3svc - ok
18:48:41.0523 7604 Dot4 (b5e479eb83707dd698f66953e922042c) C:\Windows\system32\DRIVERS\Dot4.sys
18:48:41.0573 7604 Dot4 - ok
18:48:41.0644 7604 Dot4Print (caefd09b6a6249c53a67d55a9a9fcabf) C:\Windows\system32\DRIVERS\Dot4Prt.sys
18:48:42.0013 7604 Dot4Print - ok
18:48:42.0109 7604 dot4usb (cf491ff38d62143203c065260567e2f7) C:\Windows\system32\DRIVERS\dot4usb.sys
18:48:42.0116 7604 dot4usb - ok
18:48:42.0197 7604 DPS (8ec04ca86f1d68da9e11952eb85973d6) C:\Windows\system32\dps.dll
18:48:42.0257 7604 DPS - ok
18:48:42.0293 7604 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
18:48:42.0296 7604 drmkaud - ok
18:48:42.0464 7604 DXGKrnl (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
18:48:42.0536 7604 DXGKrnl - ok
18:48:42.0587 7604 EapHost (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll
18:48:42.0589 7604 EapHost - ok
18:48:43.0044 7604 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
18:48:43.0159 7604 ebdrv - ok
18:48:43.0468 7604 EFS (81951f51e318aecc2d68559e47485cc4) C:\Windows\System32\lsass.exe
18:48:43.0472 7604 EFS - ok
18:48:43.0622 7604 ehRecvr (a8c362018efc87beb013ee28f29c0863) C:\Windows\ehome\ehRecvr.exe
18:48:43.0646 7604 ehRecvr - ok
18:48:43.0750 7604 ehSched (d389bff34f80caede417bf9d1507996a) C:\Windows\ehome\ehsched.exe
18:48:43.0754 7604 ehSched - ok
18:48:43.0849 7604 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
18:48:44.0330 7604 elxstor - ok
18:48:44.0455 7604 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
18:48:44.0457 7604 ErrDev - ok
18:48:44.0616 7604 EventSystem (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll
18:48:44.0624 7604 EventSystem - ok
18:48:45.0178 7604 EvtEng (b6c691d8cae275ed9b2782e62626f36a) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
18:48:45.0199 7604 EvtEng - ok
18:48:45.0564 7604 ewusbmbb (026f6d48cc5293c7b8a696376618b9d2) C:\Windows\system32\DRIVERS\ewusbwwan.sys
18:48:45.0618 7604 ewusbmbb - ok
18:48:45.0760 7604 ew_hwusbdev (57c171ea22f0a7f068fcb0caedd1e8e7) C:\Windows\system32\DRIVERS\ew_hwusbdev.sys
18:48:45.0813 7604 ew_hwusbdev - ok
18:48:45.0835 7604 ew_usbenumfilter (61a973f60e94a551ba7b15f3460444fb) C:\Windows\system32\DRIVERS\ew_usbenumfilter.sys
18:48:45.0839 7604 ew_usbenumfilter - ok
18:48:45.0879 7604 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
18:48:45.0929 7604 exfat - ok
18:48:45.0980 7604 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
18:48:46.0027 7604 fastfat - ok
18:48:46.0264 7604 Fax (967ea5b213e9984cbe270205df37755b) C:\Windows\system32\fxssvc.exe
18:48:46.0289 7604 Fax - ok
18:48:46.0389 7604 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
18:48:46.0394 7604 fdc - ok
18:48:46.0427 7604 fdPHost (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll
18:48:46.0429 7604 fdPHost - ok
18:48:46.0446 7604 FDResPub (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll
18:48:46.0448 7604 FDResPub - ok
18:48:46.0462 7604 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
18:48:46.0465 7604 FileInfo - ok
18:48:46.0483 7604 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
18:48:46.0490 7604 Filetrace - ok
18:48:46.0511 7604 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
18:48:46.0889 7604 flpydisk - ok
18:48:46.0941 7604 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
18:48:46.0963 7604 FltMgr - ok
18:48:47.0214 7604 FontCache (b3a5ec6b6b6673db7e87c2bcdbddc074) C:\Windows\system32\FntCache.dll
18:48:47.0258 7604 FontCache - ok
18:48:47.0375 7604 FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
18:48:47.0378 7604 FontCache3.0.0.0 - ok
18:48:47.0435 7604 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
18:48:47.0438 7604 FsDepends - ok
18:48:47.0495 7604 fssfltr (b0082808a6856a252f7cdd939892ce50) C:\Windows\system32\DRIVERS\fssfltr.sys
18:48:47.0870 7604 fssfltr - ok
18:48:48.0202 7604 fsssvc (28ddeeec44e988657b732cf404d504cb) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
18:48:48.0269 7604 fsssvc - ok
18:48:48.0694 7604 Fs_Rec (7dae5ebcc80e45d3253f4923dc424d05) C:\Windows\system32\drivers\Fs_Rec.sys
18:48:48.0722 7604 Fs_Rec - ok
18:48:48.0830 7604 fvevol (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
18:48:48.0875 7604 fvevol - ok
18:48:48.0918 7604 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
18:48:48.0923 7604 gagp30kx - ok
18:48:49.0034 7604 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
18:48:49.0230 7604 GEARAspiWDM - ok
18:48:49.0315 7604 gpsvc (e897eaf5ed6ba41e081060c9b447a673) C:\Windows\System32\gpsvc.dll
18:48:49.0351 7604 gpsvc - ok
18:48:49.0503 7604 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
18:48:49.0564 7604 gupdate - ok
18:48:49.0572 7604 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
18:48:49.0574 7604 gupdatem - ok
18:48:49.0697 7604 gusvc (c1b577b2169900f4cf7190c39f085794) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
18:48:49.0744 7604 gusvc - ok
18:48:49.0775 7604 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
18:48:49.0779 7604 hcw85cir - ok
18:48:49.0896 7604 HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys
18:48:49.0947 7604 HdAudAddService - ok
18:48:49.0992 7604 HDAudBus (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys
18:48:50.0007 7604 HDAudBus - ok
18:48:50.0038 7604 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
18:48:50.0042 7604 HidBatt - ok
18:48:50.0079 7604 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
18:48:50.0084 7604 HidBth - ok
18:48:50.0128 7604 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
18:48:50.0131 7604 HidIr - ok
18:48:50.0160 7604 hidserv (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\System32\hidserv.dll
18:48:50.0164 7604 hidserv - ok
18:48:50.0224 7604 HidUsb (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\DRIVERS\hidusb.sys
18:48:50.0227 7604 HidUsb - ok
18:48:50.0334 7604 hkmsvc (196b4e3f4cccc24af836ce58facbb699) C:\Windows\system32\kmsvc.dll
18:48:50.0352 7604 hkmsvc - ok
18:48:50.0576 7604 HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\Windows\system32\ListSvc.dll
18:48:50.0582 7604 HomeGroupListener - ok
18:48:50.0664 7604 HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\Windows\system32\provsvc.dll
18:48:50.0724 7604 HomeGroupProvider - ok
18:48:51.0066 7604 hpqcxs08 (1dae5c46d42b02a6d5862e1482efb390) C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
18:48:51.0120 7604 hpqcxs08 - ok
18:48:51.0170 7604 hpqddsvc (99e8eef42fe2f4af29b08c3355dd7685) C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
18:48:51.0183 7604 hpqddsvc - ok
18:48:51.0300 7604 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
18:48:51.0305 7604 HpSAMD - ok
18:48:51.0447 7604 HTTP (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
18:48:51.0486 7604 HTTP - ok
18:48:51.0556 7604 huawei_enumerator (f44461e66f1b7dd267957fe9baa63ed0) C:\Windows\system32\DRIVERS\ew_jubusenum.sys
18:48:51.0559 7604 huawei_enumerator - ok
18:48:51.0682 7604 hwdatacard (f547f862b8907f1bcbd9b72a72a6449e) C:\Windows\system32\DRIVERS\ewusbmdm.sys
18:48:51.0741 7604 hwdatacard - ok
18:48:51.0793 7604 hwpolicy (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
18:48:51.0796 7604 hwpolicy - ok
18:48:51.0869 7604 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys
18:48:51.0873 7604 i8042prt - ok
18:48:51.0962 7604 IAANTMON (0e899d0db39617aa0b2f992e7e95b5eb) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
18:48:52.0009 7604 IAANTMON - ok
18:48:52.0060 7604 iaStor (01446278d4563b3013c92830ae6cbb26) C:\Windows\system32\DRIVERS\iaStor.sys
18:48:52.0063 7604 iaStor - ok
18:48:52.0154 7604 iaStorV (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys
18:48:52.0223 7604 iaStorV - ok
18:48:52.0357 7604 IBMPMDRV (fa3d0a6da7bb7968efe5c5bc267f0e55) C:\Windows\system32\DRIVERS\ibmpmdrv.sys
18:48:52.0375 7604 IBMPMDRV - ok
18:48:52.0447 7604 IBMPMSVC (495f184a29b80b51735bcee91d84fe8f) C:\Windows\system32\ibmpmsvc.exe
18:48:52.0450 7604 IBMPMSVC - ok
18:48:52.0657 7604 IDriverT (6f95324909b502e2651442c1548ab12f) C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
18:48:52.0662 7604 IDriverT - ok
18:48:53.0014 7604 idsvc (c521d7eb6497bb1af6afa89e322fb43c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
18:48:53.0090 7604 idsvc - ok
18:48:53.0848 7604 igfx (c7fee838fd0216ee0ad3d765ab4f40f4) C:\Windows\system32\DRIVERS\igdkmd32.sys
18:48:54.0721 7604 igfx - ok
18:48:55.0121 7604 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
18:48:55.0126 7604 iirsp - ok
18:48:55.0592 7604 IKEEXT (f95622f161474511b8d80d6b093aa610) C:\Windows\System32\ikeext.dll
18:48:55.0617 7604 IKEEXT - ok
18:48:56.0207 7604 IntcAzAudAddService (d991871aa47da7989540ac2c0f6ec533) C:\Windows\system32\drivers\RTKVHDA.sys
18:48:57.0124 7604 IntcAzAudAddService - ok
18:48:57.0423 7604 IntcHdmiAddService (264632ade8127b7baa2190cf6fad435b) C:\Windows\system32\drivers\IntcHdmi.sys
18:48:57.0486 7604 IntcHdmiAddService - ok
18:48:57.0772 7604 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
18:48:57.0826 7604 intelide - ok
18:48:57.0898 7604 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
18:48:57.0902 7604 intelppm - ok
18:48:58.0076 7604 IPBusEnum (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll
18:48:58.0080 7604 IPBusEnum - ok
18:48:58.0264 7604 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:48:58.0268 7604 IpFilterDriver - ok
18:48:58.0398 7604 iphlpsvc (4d65a07b795d6674312f879d09aa7663) C:\Windows\System32\iphlpsvc.dll
18:48:58.0428 7604 iphlpsvc - ok
18:48:58.0491 7604 IPMIDRV (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
18:48:58.0497 7604 IPMIDRV - ok
18:48:58.0553 7604 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
18:48:58.0558 7604 IPNAT - ok
18:48:58.0834 7604 iPod Service (49918803b661367023bf325cf602afdc) C:\Program Files\iPod\bin\iPodService.exe
18:48:58.0861 7604 iPod Service - ok
18:48:58.0935 7604 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
18:48:58.0938 7604 IRENUM - ok
18:48:59.0126 7604 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
18:48:59.0129 7604 isapnp - ok
18:48:59.0232 7604 iScsiPrt (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
18:48:59.0266 7604 iScsiPrt - ok
18:48:59.0318 7604 IviRegMgr (213822072085b5bbad9af30ab577d817) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
18:48:59.0321 7604 IviRegMgr - ok
18:48:59.0441 7604 ivusb (994ebb45c4b438e1f6ea0b958ae9b9a3) C:\Windows\system32\DRIVERS\ivusb.sys
18:48:59.0445 7604 ivusb - ok
18:48:59.0644 7604 JMCR (8bbe388234c79e51ebb091edbfa77ea7) C:\Windows\system32\DRIVERS\jmcr.sys
18:48:59.0717 7604 JMCR - ok
18:48:59.0812 7604 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys
18:48:59.0814 7604 kbdclass - ok
18:48:59.0888 7604 kbdhid (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys
18:48:59.0891 7604 kbdhid - ok
18:48:59.0975 7604 KeyIso (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
18:48:59.0977 7604 KeyIso - ok
18:49:00.0108 7604 KL1 (186b54479d98e48aee0e9ada4b3c4d31) C:\Windows\system32\DRIVERS\kl1.sys
18:49:00.0585 7604 KL1 - ok
18:49:00.0655 7604 kl2 (bf485bfba13c0ab116701fd9c55324d0) C:\Windows\system32\DRIVERS\kl2.sys
18:49:00.0902 7604 kl2 - ok
18:49:01.0036 7604 KLIF (af04d0ce7939324e9a605b159295706c) C:\Windows\system32\DRIVERS\klif.sys
18:49:01.0238 7604 KLIF - ok
18:49:01.0321 7604 KLIM6 (6295a19003f935ecc6ccbe9e2376427b) C:\Windows\system32\DRIVERS\klim6.sys
18:49:01.0625 7604 KLIM6 - ok
18:49:01.0674 7604 klmouflt (3de1771c135328420315e21dde229bba) C:\Windows\system32\DRIVERS\klmouflt.sys
18:49:01.0795 7604 klmouflt - ok
18:49:01.0835 7604 KSecDD (b7895b4182c0d16f6efadeb8081e8d36) C:\Windows\system32\Drivers\ksecdd.sys
18:49:01.0839 7604 KSecDD - ok
18:49:01.0901 7604 KSecPkg (d30159ac9237519fbc62c6ec247d2d46) C:\Windows\system32\Drivers\ksecpkg.sys
18:49:01.0915 7604 KSecPkg - ok
18:49:01.0971 7604 KtmRm (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll
18:49:02.0041 7604 KtmRm - ok
18:49:02.0130 7604 LanmanServer (d64af876d53eca3668bb97b51b4e70ab) C:\Windows\System32\srvsvc.dll
18:49:02.0180 7604 LanmanServer - ok
18:49:02.0245 7604 LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\Windows\System32\wkssvc.dll
18:49:02.0253 7604 LanmanWorkstation - ok
18:49:02.0453 7604 LENOVO.CAMMUTE (cab9c6c37fd0f9612b269349116504b6) C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
18:49:02.0455 7604 LENOVO.CAMMUTE - ok
18:49:02.0551 7604 LENOVO.MICMUTE (128158d8b1df639bf3e3fdbcbb64cdac) C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
18:49:02.0553 7604 LENOVO.MICMUTE - ok
18:49:02.0588 7604 lenovo.smi (9aac267a225f3caebb9e633f7eb16e4b) C:\Windows\system32\DRIVERS\smiif32.sys
18:49:02.0598 7604 lenovo.smi - ok
18:49:02.0699 7604 LENOVO.TPKNRSVC (04b5f7f44ccb2fab615c67ed0e6c8323) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
18:49:02.0701 7604 LENOVO.TPKNRSVC - ok
18:49:02.0751 7604 Lenovo.VIRTSCRLSVC (6f2cc57eb5836d2ac9bd37f3554d55f8) C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
18:49:02.0753 7604 Lenovo.VIRTSCRLSVC - ok
18:49:02.0842 7604 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
18:49:02.0845 7604 lltdio - ok
18:49:02.0882 7604 lltdsvc (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll
18:49:02.0938 7604 lltdsvc - ok
18:49:02.0964 7604 lmhosts (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll
18:49:03.0077 7604 lmhosts - ok
18:49:03.0141 7604 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
18:49:03.0146 7604 LSI_FC - ok
18:49:03.0182 7604 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
18:49:03.0186 7604 LSI_SAS - ok
18:49:03.0239 7604 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
18:49:03.0394 7604 LSI_SAS2 - ok
18:49:03.0433 7604 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
18:49:03.0571 7604 LSI_SCSI - ok
18:49:03.0625 7604 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
18:49:03.0628 7604 luafv - ok
18:49:03.0797 7604 massfilter (59a2783aba6019bed0c843c706e10a6a) C:\Windows\system32\drivers\massfilter.sys
18:49:03.0801 7604 massfilter - ok
18:49:03.0916 7604 MBAMProtector (6dfe7f2e8e8a337263aa5c92a215f161) C:\Windows\system32\drivers\mbam.sys
18:49:04.0089 7604 MBAMProtector - ok
18:49:04.0317 7604 MBAMService (43683e970f008c93c9429ef428147a54) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
18:49:04.0366 7604 MBAMService - ok
18:49:04.0466 7604 Mcx2Svc (bfb9ee8ee977efe85d1a3105abef6dd1) C:\Windows\system32\Mcx2Svc.dll
18:49:04.0473 7604 Mcx2Svc - ok
18:49:04.0603 7604 mdvrmng (4e10e84320a8ec1c12bd0d00973b22ab) C:\Windows\system32\drivers\mdvrmng.sys
18:49:04.0607 7604 mdvrmng - ok
18:49:04.0631 7604 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
18:49:04.0635 7604 megasas - ok
18:49:04.0715 7604 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
18:49:04.0773 7604 MegaSR - ok
18:49:04.0814 7604 MMCSS (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
18:49:04.0817 7604 MMCSS - ok
18:49:04.0879 7604 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
18:49:04.0883 7604 Modem - ok
18:49:04.0944 7604 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
18:49:04.0947 7604 monitor - ok
18:49:05.0007 7604 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
18:49:05.0011 7604 mouclass - ok
18:49:05.0115 7604 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
18:49:05.0118 7604 mouhid - ok
18:49:05.0187 7604 mountmgr (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
18:49:05.0191 7604 mountmgr - ok
18:49:05.0756 7604 MozillaMaintenance (46297fa8e30a6007f14118fc2b942fbc) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
18:49:05.0809 7604 MozillaMaintenance - ok
18:49:05.0872 7604 mpio (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
18:49:05.0899 7604 mpio - ok
18:49:05.0977 7604 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
18:49:06.0062 7604 mpsdrv - ok
18:49:06.0184 7604 MpsSvc (9835584e999d25004e1ee8e5f3e3b881) C:\Windows\system32\mpssvc.dll
18:49:06.0214 7604 MpsSvc - ok
18:49:06.0323 7604 MRxDAV (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
18:49:06.0325 7604 MRxDAV - ok
18:49:06.0460 7604 mrxsmb (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
18:49:06.0520 7604 mrxsmb - ok
18:49:06.0560 7604 mrxsmb10 (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:49:06.0588 7604 mrxsmb10 - ok
18:49:06.0651 7604 mrxsmb20 (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:49:06.0665 7604 mrxsmb20 - ok
18:49:06.0718 7604 msahci (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
18:49:06.0721 7604 msahci - ok
18:49:06.0771 7604 msdsm (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
18:49:06.0774 7604 msdsm - ok
18:49:06.0856 7604 MSDTC (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe
18:49:06.0863 7604 MSDTC - ok
18:49:06.0925 7604 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
18:49:06.0927 7604 Msfs - ok
18:49:06.0939 7604 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
18:49:06.0941 7604 mshidkmdf - ok
18:49:06.0981 7604 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
18:49:06.0983 7604 msisadrv - ok
18:49:07.0016 7604 MSiSCSI (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll
18:49:07.0032 7604 MSiSCSI - ok
18:49:07.0038 7604 msiserver - ok
18:49:07.0094 7604 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
18:49:07.0096 7604 MSKSSRV - ok
18:49:07.0110 7604 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
18:49:07.0112 7604 MSPCLOCK - ok
18:49:07.0119 7604 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
18:49:07.0123 7604 MSPQM - ok
18:49:07.0165 7604 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
18:49:07.0222 7604 MsRPC - ok
18:49:07.0291 7604 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys
18:49:07.0294 7604 mssmbios - ok
18:49:07.0324 7604 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
18:49:07.0326 7604 MSTEE - ok
18:49:07.0342 7604 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
18:49:07.0345 7604 MTConfig - ok
18:49:07.0355 7604 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
18:49:07.0358 7604 Mup - ok
18:49:07.0449 7604 napagent (61d57a5d7c6d9afe10e77dae6e1b445e) C:\Windows\system32\qagentRT.dll
18:49:07.0488 7604 napagent - ok
18:49:07.0546 7604 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
18:49:07.0599 7604 NativeWifiP - ok
18:49:07.0784 7604 NDIS (3723262737d90f58059ceda7373b0387) C:\Windows\system32\drivers\ndis.sys
18:49:07.0832 7604 NDIS - ok
18:49:07.0905 7604 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
18:49:07.0909 7604 NdisCap - ok
18:49:07.0949 7604 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
18:49:07.0953 7604 NdisTapi - ok
18:49:08.0007 7604 Ndisuio (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
18:49:08.0012 7604 Ndisuio - ok
18:49:08.0202 7604 NdisWan (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
18:49:08.0207 7604 NdisWan - ok
18:49:08.0293 7604 NDProxy (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
18:49:08.0297 7604 NDProxy - ok
18:49:08.0433 7604 Net Driver HPZ12 (510c138564486ff926a3f773205c63d1) C:\Windows\system32\HPZinw12.dll
18:49:08.0437 7604 Net Driver HPZ12 - ok
18:49:08.0479 7604 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
18:49:08.0482 7604 NetBIOS - ok
18:49:08.0616 7604 NetBT (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
18:49:08.0672 7604 NetBT - ok
18:49:08.0767 7604 Netlogon (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
18:49:08.0770 7604 Netlogon - ok
18:49:08.0823 7604 Netman (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll
18:49:08.0867 7604 Netman - ok
18:49:09.0121 7604 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
18:49:09.0306 7604 NetMsmqActivator - ok
18:49:09.0351 7604 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
18:49:09.0354 7604 NetPipeActivator - ok
18:49:09.0423 7604 netprofm (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll
18:49:09.0448 7604 netprofm - ok
18:49:09.0495 7604 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
18:49:09.0497 7604 NetTcpActivator - ok
18:49:09.0505 7604 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
18:49:09.0506 7604 NetTcpPortSharing - ok
18:49:10.0038 7604 netw5v32 (af1ae2e42b03395560b1cde03230205c) C:\Windows\system32\DRIVERS\netw5v32.sys
18:49:10.0398 7604 netw5v32 - ok
18:49:11.0644 7604 NETwNs32 (5c979c481981e04919ecbb3b88d54b34) C:\Windows\system32\DRIVERS\NETwNs32.sys
18:49:11.0986 7604 NETwNs32 - ok
18:49:12.0120 7604 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
18:49:12.0124 7604 nfrd960 - ok
18:49:12.0195 7604 NlaSvc (912084381d30d8b89ec4e293053f4710) C:\Windows\System32\nlasvc.dll
18:49:12.0216 7604 NlaSvc - ok
18:49:12.0236 7604 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
18:49:12.0239 7604 Npfs - ok
18:49:12.0284 7604 nsi (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll
18:49:12.0288 7604 nsi - ok
18:49:12.0309 7604 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
18:49:12.0311 7604 nsiproxy - ok
18:49:12.0462 7604 Ntfs (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys
18:49:12.0550 7604 Ntfs - ok
18:49:12.0578 7604 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
18:49:12.0600 7604 Null - ok
18:49:12.0654 7604 nvraid (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys
18:49:12.0661 7604 nvraid - ok
18:49:12.0734 7604 nvstor (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys
18:49:12.0781 7604 nvstor - ok
18:49:12.0816 7604 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
18:49:12.0834 7604 nv_agp - ok
18:49:12.0898 7604 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
18:49:12.0903 7604 ohci1394 - ok
18:49:13.0078 7604 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:49:13.0127 7604 ose - ok
18:49:13.0799 7604 osppsvc (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
18:49:13.0969 7604 osppsvc - ok
18:49:14.0212 7604 p2pimsvc (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
18:49:14.0355 7604 p2pimsvc - ok
18:49:14.0408 7604 p2psvc (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll
18:49:14.0445 7604 p2psvc - ok
18:49:14.0532 7604 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
18:49:14.0891 7604 Parport - ok
18:49:14.0968 7604 partmgr (3f34a1b4c5f6475f320c275e63afce9b) C:\Windows\system32\drivers\partmgr.sys
18:49:14.0973 7604 partmgr - ok
18:49:14.0998 7604 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
18:49:15.0001 7604 Parvdm - ok
18:49:15.0038 7604 PcaSvc (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll
18:49:15.0045 7604 PcaSvc - ok
18:49:15.0083 7604 PcdrNdisuio - ok
18:49:15.0146 7604 pci (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
18:49:15.0206 7604 pci - ok
18:49:15.0235 7604 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
18:49:15.0239 7604 pciide - ok
18:49:15.0286 7604 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
18:49:15.0346 7604 pcmcia - ok
18:49:15.0407 7604 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
18:49:15.0410 7604 pcw - ok
18:49:15.0501 7604 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
18:49:15.0540 7604 PEAUTH - ok
18:49:15.0835 7604 pla (414bba67a3ded1d28437eb66aeb8a720) C:\Windows\system32\pla.dll
18:49:15.0909 7604 pla - ok
18:49:16.0123 7604 PlugPlay (ec7bc28d207da09e79b3e9faf8b232ca) C:\Windows\system32\umpnpmgr.dll
18:49:16.0130 7604 PlugPlay - ok
18:49:16.0281 7604 Pml Driver HPZ12 (37e5e8ffbad35605daeec3224ea0e465) C:\Windows\system32\HPZipm12.dll
18:49:16.0285 7604 Pml Driver HPZ12 - ok
18:49:16.0329 7604 PNRPAutoReg (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll
18:49:16.0336 7604 PNRPAutoReg - ok
18:49:16.0381 7604 PNRPsvc (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
18:49:16.0386 7604 PNRPsvc - ok
18:49:16.0573 7604 PolicyAgent (53946b69ba0836bd95b03759530c81ec) C:\Windows\System32\ipsecsvc.dll
18:49:16.0598 7604 PolicyAgent - ok
18:49:16.0718 7604 Power (f87d30e72e03d579a5199ccb3831d6ea) C:\Windows\system32\umpo.dll
18:49:16.0739 7604 Power - ok
18:49:17.0082 7604 Power Manager DBC Service (ebf8a077be308c0c6d55d90f89a43547) C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
18:49:17.0086 7604 Power Manager DBC Service - ok
18:49:17.0210 7604 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
18:49:17.0215 7604 PptpMiniport - ok
18:49:17.0350 7604 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
18:49:17.0355 7604 Processor - ok
18:49:17.0625 7604 ProfSvc (cadefac453040e370a1bdff3973be00d) C:\Windows\system32\profsvc.dll
18:49:17.0674 7604 ProfSvc - ok
18:49:17.0859 7604 ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
18:49:17.0862 7604 ProtectedStorage - ok
18:49:17.0922 7604 psadd (72de205cd4006dc45b1401859c506679) C:\Windows\system32\DRIVERS\psadd.sys
18:49:19.0232 7604 psadd - ok
18:49:19.0348 7604 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
18:49:19.0351 7604 Psched - ok
18:49:19.0482 7604 PwmEWSvc (254de0e4fb8822ca9e5495dcac3bf11c) C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE
18:49:19.0507 7604 PwmEWSvc - ok
18:49:19.0580 7604 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\Windows\system32\Drivers\PxHelp20.sys
18:49:19.0663 7604 PxHelp20 - ok
18:49:19.0920 7604 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
18:49:20.0692 7604 ql2300 - ok
18:49:20.0900 7604 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
18:49:21.0123 7604 ql40xx - ok
18:49:21.0339 7604 QWAVE (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll
18:49:21.0384 7604 QWAVE - ok
18:49:21.0425 7604 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
18:49:21.0428 7604 QWAVEdrv - ok
18:49:21.0594 7604 RapiMgr (8f97d374ad1857e1eed85a79f29a1d3d) C:\Windows\WindowsMobile\rapimgr.dll
18:49:21.0640 7604 RapiMgr - ok
18:49:21.0711 7604 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
18:49:21.0714 7604 RasAcd - ok
18:49:21.0773 7604 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
18:49:21.0776 7604 RasAgileVpn - ok
18:49:21.0813 7604 RasAuto (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll
18:49:21.0818 7604 RasAuto - ok
18:49:21.0873 7604 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
18:49:21.0876 7604 Rasl2tp - ok
18:49:22.0108 7604 RasMan (cb9e04dc05eacf5b9a36ca276d475006) C:\Windows\System32\rasmans.dll
18:49:22.0138 7604 RasMan - ok
18:49:22.0185 7604 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
18:49:22.0482 7604 RasPppoe - ok
18:49:22.0571 7604 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
18:49:22.0575 7604 RasSstp - ok
18:49:22.0859 7604 rdbss (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
18:49:22.0936 7604 rdbss - ok
18:49:22.0972 7604 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
18:49:22.0975 7604 rdpbus - ok
18:49:23.0575 7604 RDPCDD (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
18:49:23.0580 7604 RDPCDD - ok
18:49:24.0427 7604 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
18:49:24.0598 7604 RDPENCDD - ok
18:49:24.0933 7604 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
18:49:25.0084 7604 RDPREFMP - ok
18:49:34.0148 7604 RDPWD (f031683e6d1fea157abb2ff260b51e61) C:\Windows\system32\drivers\RDPWD.sys
18:49:35.0953 7604 RDPWD - ok
18:49:36.0097 7604 rdyboost (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
18:49:36.0142 7604 rdyboost - ok
18:49:36.0266 7604 regi (001b4278407f4303efc902a2b16f2453) C:\Windows\system32\drivers\regi.sys
18:49:36.0279 7604 regi - ok
18:49:36.0884 7604 RegSrvc (6c47ac711f5fb55c5387a85d50ab4703) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
18:49:36.0955 7604 RegSrvc - ok
18:49:37.0041 7604 RemoteAccess (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll
18:49:37.0126 7604 RemoteAccess - ok
18:49:37.0273 7604 RemoteRegistry (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll
18:49:37.0383 7604 RemoteRegistry - ok
18:49:37.0440 7604 RFCOMM (cb928d9e6daf51879dd6ba8d02f01321) C:\Windows\system32\DRIVERS\rfcomm.sys
18:49:37.0489 7604 RFCOMM - ok
18:49:37.0624 7604 Roxio UPnP Renderer 10 (14a99fd851272c73b758546ef8f0e641) C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
18:49:37.0748 7604 Roxio UPnP Renderer 10 - ok
18:49:37.0808 7604 Roxio Upnp Server 10 (ba917f2f2bd5033e70823797c73cdfcb) C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe
18:49:37.0877 7604 Roxio Upnp Server 10 - ok
18:49:37.0997 7604 RoxLiveShare10 (8986d20cf294d794a79fb18ff697b68b) C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe
18:49:38.0127 7604 RoxLiveShare10 - ok
18:49:38.0470 7604 RoxMediaDB10 (d8c44229eb2495e774350529ed9be08d) C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
18:49:38.0561 7604 RoxMediaDB10 - ok
18:49:38.0658 7604 RoxWatch10 (53716357f4b3c99112cf0a21932c5688) C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe
18:49:38.0762 7604 RoxWatch10 - ok
18:49:39.0071 7604 RpcEptMapper (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll
18:49:39.0076 7604 RpcEptMapper - ok
18:49:39.0179 7604 RpcLocator (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe
18:49:39.0181 7604 RpcLocator - ok
18:49:39.0316 7604 RpcSs (7660f01d3b38aca1747e397d21d790af) C:\Windows\System32\rpcss.dll
18:49:39.0324 7604 RpcSs - ok
18:49:39.0809 7604 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
18:49:39.0814 7604 rspndr - ok
18:49:40.0009 7604 RTL8167 (5283b9a27ff230f2ff70d92451ff409a) C:\Windows\system32\DRIVERS\Rt86win7.sys
18:49:40.0230 7604 RTL8167 - ok
18:49:40.0308 7604 SamSs (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
18:49:40.0310 7604 SamSs - ok
18:49:40.0601 7604 SbieDrv (8fa4d399e5c063fd24a617767e49c7b6) C:\Program Files\Sandboxie\SbieDrv.sys
18:49:40.0708 7604 SbieDrv - ok
18:49:40.0929 7604 SbieSvc (bd4f118ae72edcfd435bf4e3937de737) C:\Program Files\Sandboxie\SbieSvc.exe
18:49:40.0931 7604 SbieSvc - ok
18:49:41.0069 7604 sbp2port (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
18:49:41.0762 7604 sbp2port - ok
18:49:41.0854 7604 SCardSvr (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll
18:49:41.0893 7604 SCardSvr - ok
18:49:42.0122 7604 scfilter (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
18:49:42.0125 7604 scfilter - ok
18:49:42.0717 7604 Schedule (a04bb13f8a72f8b6e8b4071723e4e336) C:\Windows\system32\schedsvc.dll
18:49:42.0741 7604 Schedule - ok
18:49:42.0848 7604 SCPolicySvc (319c6b309773d063541d01df8ac6f55f) C:\Windows\System32\certprop.dll
18:49:42.0850 7604 SCPolicySvc - ok
18:49:43.0040 7604 sdbus (0328be1c7f1cba23848179f8762e391c) C:\Windows\system32\drivers\sdbus.sys
18:49:43.0043 7604 sdbus - ok
18:49:43.0211 7604 SDRSVC (08236c4bce5edd0a0318a438af28e0f7) C:\Windows\System32\SDRSVC.dll
18:49:43.0238 7604 SDRSVC - ok
18:49:43.0293 7604 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
18:49:43.0297 7604 secdrv - ok
18:49:43.0413 7604 seclogon (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll
18:49:43.0419 7604 seclogon - ok
18:49:43.0446 7604 SENS (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\system32\sens.dll
18:49:43.0455 7604 SENS - ok
18:49:43.0822 7604 SensrSvc (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll
18:49:43.0827 7604 SensrSvc - ok
18:49:43.0970 7604 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
18:49:44.0504 7604 Serenum - ok
18:49:44.0611 7604 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
18:49:45.0564 7604 Serial - ok
18:49:46.0073 7604 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
18:49:46.0078 7604 sermouse - ok
18:49:46.0272 7604 SessionEnv (4ae380f39a0032eab7dd953030b26d28) C:\Windows\system32\sessenv.dll
18:49:46.0277 7604 SessionEnv - ok
18:49:46.0704 7604 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
18:49:46.0782 7604 sffdisk - ok
18:49:47.0103 7604 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
18:49:47.0107 7604 sffp_mmc - ok
18:49:47.0148 7604 sffp_sd (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
18:49:47.0151 7604 sffp_sd - ok
18:49:47.0300 7604 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
18:49:47.0393 7604 sfloppy - ok
18:49:47.0472 7604 SharedAccess (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll
18:49:47.0638 7604 SharedAccess - ok
18:49:47.0786 7604 ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\Windows\System32\shsvcs.dll
18:49:47.0814 7604 ShellHWDetection - ok
18:49:48.0206 7604 Shockprf (1624530d05155f4e5a4736531523bff5) C:\Windows\system32\DRIVERS\Apsx86.sys
18:49:48.0491 7604 Shockprf - ok
18:49:48.0789 7604 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
18:49:48.0793 7604 sisagp - ok
18:49:48.0884 7604 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
18:49:49.0047 7604 SiSRaid2 - ok
18:49:49.0132 7604 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
18:49:49.0136 7604 SiSRaid4 - ok
18:49:49.0857 7604 Skype C2C Service (2a99850c2a6edd6c6602e822c716edaf) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
18:49:49.0978 7604 Skype C2C Service - ok
18:49:50.0140 7604 SkypeUpdate (c70aebd3608ed9fcea2a1bae83567ffc) C:\Program Files\Skype\Updater\Updater.exe
18:49:50.0300 7604 SkypeUpdate - ok
18:49:50.0579 7604 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
18:49:50.0582 7604 Smb - ok
18:49:50.0634 7604 SNMPTRAP (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe
18:49:50.0641 7604 SNMPTRAP - ok
18:49:50.0686 7604 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
18:49:50.0690 7604 spldr - ok
18:49:50.0951 7604 Spooler (866a43013535dc8587c258e43579c764) C:\Windows\System32\spoolsv.exe
18:49:51.0102 7604 Spooler - ok
18:49:51.0720 7604 sppsvc (cf87a1de791347e75b98885214ced2b8) C:\Windows\system32\sppsvc.exe
18:49:51.0802 7604 sppsvc - ok
18:49:52.0222 7604 sppuinotify (b0180b20b065d89232a78a40fe56eaa6) C:\Windows\system32\sppuinotify.dll
18:49:52.0226 7604 sppuinotify - ok
18:49:52.0374 7604 srv (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
18:49:52.0433 7604 srv - ok
18:49:52.0475 7604 srv2 (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
18:49:52.0550 7604 srv2 - ok
18:49:52.0690 7604 SrvHsfHDA (e00fdfaff025e94f9821153750c35a6d) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
18:49:52.0899 7604 SrvHsfHDA - ok
18:49:53.0523 7604 SrvHsfV92 (ceb4e3b6890e1e42dca6694d9e59e1a0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
18:49:53.0630 7604 SrvHsfV92 - ok
18:49:53.0730 7604 SrvHsfWinac (bc0c7ea89194c299f051c24119000e17) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
18:49:54.0212 7604 SrvHsfWinac - ok
18:49:54.0453 7604 srvnet (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
18:49:54.0637 7604 srvnet - ok
18:49:54.0687 7604 SSDPSRV (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll
18:49:54.0712 7604 SSDPSRV - ok
18:49:54.0814 7604 SstpSvc (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll
18:49:54.0819 7604 SstpSvc - ok
18:49:55.0203 7604 stdriver (5c031c715e14f10dfc9395004f54ee21) C:\Windows\system32\DRIVERS\stdriver32.sys
18:49:55.0721 7604 stdriver - ok
18:49:55.0823 7604 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
18:49:55.0827 7604 stexstor - ok
18:49:56.0092 7604 StiSvc (e1fb3706030fb4578a0d72c2fc3689e4) C:\Windows\System32\wiaservc.dll
18:49:56.0110 7604 StiSvc - ok
18:49:56.0263 7604 stllssvr (ff5eb78af7dfb68c2fb363537aaf753e) C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
18:49:56.0267 7604 stllssvr - ok
18:49:56.0329 7604 SUService (6ea2f517373771cac5188e82617c9c0b) C:\Program Files\Lenovo\System Update\SUService.exe
18:49:56.0331 7604 SUService - ok
18:49:56.0507 7604 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys
18:49:56.0680 7604 swenum - ok
18:49:56.0802 7604 swprv (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll
18:49:56.0813 7604 swprv - ok
18:49:56.0886 7604 SynTP (d7dc30b8b41e7a913c3fccc0631e72ec) C:\Windows\system32\DRIVERS\SynTP.sys
18:49:56.0968 7604 SynTP - ok
18:49:57.0865 7604 SysMain (36650d618ca34c9d357dfd3d89b2c56f) C:\Windows\system32\sysmain.dll
18:49:57.0942 7604 SysMain - ok
18:49:58.0764 7604 TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\Windows\System32\TabSvc.dll
18:49:58.0795 7604 TabletInputService - ok
18:49:59.0118 7604 TapiSrv (613bf4820361543956909043a265c6ac) C:\Windows\System32\tapisrv.dll
18:49:59.0150 7604 TapiSrv - ok
18:49:59.0168 7604 TBS (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll
18:49:59.0173 7604 TBS - ok
18:49:59.0684 7604 Tcpip (7fa2e0f8b072bd04b77b421480b6cc22) C:\Windows\system32\drivers\tcpip.sys
18:49:59.0776 7604 Tcpip - ok
18:50:00.0266 7604 TCPIP6 (7fa2e0f8b072bd04b77b421480b6cc22) C:\Windows\system32\DRIVERS\tcpip.sys
18:50:00.0275 7604 TCPIP6 - ok
18:50:01.0474 7604 tcpipreg (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
18:50:01.0478 7604 tcpipreg - ok
18:50:01.0602 7604 TDPIPE (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
18:50:01.0606 7604 TDPIPE - ok
18:50:01.0823 7604 TDTCP (2c2c5afe7ee4f620d69c23c0617651a8) C:\Windows\system32\drivers\tdtcp.sys
18:50:01.0868 7604 TDTCP - ok
18:50:02.0348 7604 tdx (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
18:50:02.0499 7604 tdx - ok
18:50:02.0704 7604 TermDD (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys
18:50:02.0707 7604 TermDD - ok
18:50:02.0824 7604 TermService (382c804c92811be57829d8e550a900e2) C:\Windows\System32\termsrv.dll
18:50:02.0911 7604 TermService - ok
18:50:02.0999 7604 Themes (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll
18:50:03.0005 7604 Themes - ok
18:50:03.0829 7604 ThinkVantage Registry Monitor Service (39ac444e07fdbd8c2e8e291a65d515d3) C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
18:50:03.0876 7604 ThinkVantage Registry Monitor Service - ok
18:50:04.0189 7604 THREADORDER (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
18:50:04.0192 7604 THREADORDER - ok
18:50:04.0331 7604 TPDIGIMN (d2378fbbd668d9fe9b6b5e3139d506d3) C:\Windows\system32\DRIVERS\ApsHM86.sys
18:50:04.0333 7604 TPDIGIMN - ok
18:50:04.0441 7604 TPHDEXLGSVC (a34a1e6b5461273846d30f5898602a72) C:\Windows\system32\TPHDEXLG.exe
18:50:04.0446 7604 TPHDEXLGSVC - ok
18:50:04.0713 7604 TPHKLOAD (1dbf0267cebf80f0bd24dfe895367db5) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
18:50:04.0718 7604 TPHKLOAD - ok
18:50:04.0956 7604 TPHKSVC (cb0625c2f5b7c72c50c5ae34f8e8f7d0) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
18:50:04.0958 7604 TPHKSVC - ok
18:50:05.0044 7604 TPM (5ad05191dc8b444a7ba4d79b76c42a30) C:\Windows\system32\drivers\tpm.sys
18:50:05.0539 7604 TPM - ok
18:50:05.0628 7604 TPPWRIF (c16ec6a5390904d3971179553852025b) C:\Windows\system32\drivers\Tppwr32v.sys
18:50:05.0633 7604 TPPWRIF - ok
18:50:05.0702 7604 TrkWks (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll
18:50:05.0787 7604 TrkWks - ok
18:50:05.0913 7604 TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\Windows\servicing\TrustedInstaller.exe
18:50:05.0935 7604 TrustedInstaller - ok
18:50:06.0059 7604 tssecsrv (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
18:50:06.0062 7604 tssecsrv - ok
18:50:06.0141 7604 TsUsbFlt (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
18:50:06.0144 7604 TsUsbFlt - ok
18:50:06.0215 7604 tunnel (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
18:50:06.0219 7604 tunnel - ok
18:50:06.0760 7604 TVT Backup Service (a87be63239ffdc22f963e9bafefeb2c9) C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
18:50:07.0226 7604 TVT Backup Service - ok
18:50:09.0115 7604 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
18:50:09.0212 7604 uagp35 - ok
18:50:09.0310 7604 udfs (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
18:50:09.0330 7604 udfs - ok
18:50:09.0386 7604 UI0Detect (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe
18:50:09.0391 7604 UI0Detect - ok
18:50:09.0523 7604 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
18:50:09.0528 7604 uliagpkx - ok
18:50:09.0684 7604 umbus (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\DRIVERS\umbus.sys
18:50:09.0688 7604 umbus - ok
18:50:09.0804 7604 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
18:50:09.0821 7604 UmPass - ok
18:50:09.0934 7604 upnphost (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll
18:50:09.0954 7604 upnphost - ok
18:50:10.0064 7604 usbccgp (bd9c55d7023c5de374507acc7a14e2ac) C:\Windows\system32\DRIVERS\usbccgp.sys
18:50:10.0069 7604 usbccgp - ok
18:50:10.0289 7604 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
18:50:10.0742 7604 usbcir - ok
18:50:10.0841 7604 usbehci (f92de757e4b7ce9c07c5e65423f3ae3b) C:\Windows\system32\DRIVERS\usbehci.sys
18:50:10.0845 7604 usbehci - ok
18:50:11.0040 7604 usbhub (8dc94aec6a7e644a06135ae7506dc2e9) C:\Windows\system32\DRIVERS\usbhub.sys
18:50:11.0137 7604 usbhub - ok
18:50:11.0197 7604 usbohci (e185d44fac515a18d9deddc23c2cdf44) C:\Windows\system32\drivers\usbohci.sys
18:50:11.0202 7604 usbohci - ok
18:50:11.0280 7604 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
18:50:11.0282 7604 usbprint - ok
18:50:11.0357 7604 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys
18:50:11.0542 7604 usbscan - ok
18:50:11.0577 7604 USBSTOR (f991ab9cc6b908db552166768176896a) C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:50:11.0582 7604 USBSTOR - ok
18:50:11.0675 7604 usbuhci (68df884cf41cdada664beb01daf67e3d) C:\Windows\system32\DRIVERS\usbuhci.sys
18:50:11.0687 7604 usbuhci - ok
18:50:11.0792 7604 usbvideo (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\Windows\system32\Drivers\usbvideo.sys
18:50:11.0852 7604 usbvideo - ok
18:50:11.0882 7604 UxSms (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll
18:50:11.0890 7604 UxSms - ok
18:50:11.0959 7604 VaultSvc (81951f51e318aecc2d68559e47485cc4) C:\Windows\system32\lsass.exe
18:50:11.0961 7604 VaultSvc - ok
18:50:12.0062 7604 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
18:50:12.0065 7604 vdrvroot - ok
18:50:12.0196 7604 vds (c3cd30495687c2a2f66a65ca6fd89be9) C:\Windows\System32\vds.exe
18:50:12.0260 7604 vds - ok
18:50:12.0364 7604 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
18:50:12.0367 7604 vga - ok
18:50:12.0452 7604 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
18:50:12.0471 7604 VgaSave - ok
18:50:12.0561 7604 vhdmp (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
18:50:12.0598 7604 vhdmp - ok
18:50:12.0654 7604 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
18:50:12.0659 7604 viaagp - ok
18:50:12.0775 7604 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
18:50:12.0780 7604 ViaC7 - ok
18:50:12.0872 7604 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
18:50:12.0876 7604 viaide - ok
18:50:12.0943 7604 volmgr (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
18:50:12.0945 7604 volmgr - ok
18:50:13.0009 7604 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
18:50:13.0062 7604 volmgrx - ok
18:50:13.0177 7604 volsnap (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
18:50:13.0227 7604 volsnap - ok
18:50:13.0559 7604 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
18:50:13.0569 7604 vsmraid - ok
18:50:13.0747 7604 VSS (209a3b1901b83aeb8527ed211cce9e4c) C:\Windows\system32\vssvc.exe
18:50:13.0797 7604 VSS - ok
18:50:13.0837 7604 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys
18:50:13.0870 7604 vwifibus - ok
18:50:13.0967 7604 vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys
18:50:13.0970 7604 vwififlt - ok
18:50:14.0019 7604 vwifimp (a3f04cbea6c2a10e6cb01f8b47611882) C:\Windows\system32\DRIVERS\vwifimp.sys
18:50:14.0021 7604 vwifimp - ok
18:50:14.0083 7604 W32Time (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll
18:50:14.0159 7604 W32Time - ok
18:50:14.0233 7604 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
18:50:14.0465 7604 WacomPen - ok
18:50:14.0605 7604 WANARP (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
18:50:14.0608 7604 WANARP - ok
18:50:14.0614 7604 Wanarpv6 (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
18:50:14.0615 7604 Wanarpv6 - ok
18:50:14.0945 7604 WatAdminSvc (353a04c273ec58475d8633e75ccd5604) C:\Windows\system32\Wat\WatAdminSvc.exe
18:50:15.0081 7604 WatAdminSvc - ok
18:50:15.0766 7604 wbengine (691e3285e53dca558e1a84667f13e15a) C:\Windows\system32\wbengine.exe
18:50:15.0806 7604 wbengine - ok
18:50:15.0895 7604 WbioSrvc (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll
18:50:15.0950 7604 WbioSrvc - ok
18:50:16.0163 7604 WcesComm (59e19bd13c3bdb857646b9e436ba27f7) C:\Windows\WindowsMobile\wcescomm.dll
18:50:16.0170 7604 WcesComm - ok
18:50:16.0280 7604 wcncsvc (34eee0dfaadb4f691d6d5308a51315dc) C:\Windows\System32\wcncsvc.dll
18:50:16.0336 7604 wcncsvc - ok
18:50:16.0366 7604 WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll
18:50:16.0371 7604 WcsPlugInService - ok
18:50:16.0455 7604 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
18:50:16.0687 7604 Wd - ok
18:50:16.0838 7604 WDC_SAM (d6efaf429fd30c5df613d220e344cce7) C:\Windows\system32\DRIVERS\wdcsam.sys
18:50:16.0840 7604 WDC_SAM - ok
18:50:16.0920 7604 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
18:50:17.0068 7604 Wdf01000 - ok
18:50:17.0149 7604 WdiServiceHost (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
18:50:17.0167 7604 WdiServiceHost - ok
18:50:17.0176 7604 WdiSystemHost (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
18:50:17.0180 7604 WdiSystemHost - ok
18:50:17.0246 7604 WebClient (a9d880f97530d5b8fee278923349929d) C:\Windows\System32\webclnt.dll
18:50:17.0567 7604 WebClient - ok
18:50:17.0610 7604 Wecsvc (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll
18:50:17.0666 7604 Wecsvc - ok
18:50:17.0686 7604 wercplsupport (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll
18:50:17.0691 7604 wercplsupport - ok
18:50:18.0060 7604 WerSvc (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll
18:50:18.0069 7604 WerSvc - ok
18:50:18.0220 7604 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
18:50:18.0223 7604 WfpLwf - ok
18:50:18.0251 7604 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
18:50:18.0254 7604 WIMMount - ok
18:50:18.0420 7604 WinDefend (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll
18:50:18.0460 7604 WinDefend - ok
18:50:18.0595 7604 WinHttpAutoProxySvc - ok
18:50:18.0681 7604 Winmgmt (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll
18:50:18.0738 7604 Winmgmt - ok
18:50:19.0005 7604 WinRM (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\Windows\system32\WsmSvc.dll
18:50:19.0064 7604 WinRM - ok
18:50:19.0179 7604 WinUsb (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\DRIVERS\WinUsb.sys
18:50:19.0183 7604 WinUsb - ok
18:50:19.0392 7604 Wlansvc (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll
18:50:19.0436 7604 Wlansvc - ok
18:50:19.0529 7604 wlcrasvc (6067acef367e79914af628fa1e9b5330) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
18:50:19.0535 7604 wlcrasvc - ok
18:50:20.0117 7604 wlidsvc (fb01d4ae207b9efdbabfc55dc95c7e31) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
18:50:20.0192 7604 wlidsvc - ok
18:50:21.0421 7604 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
18:50:21.0423 7604 WmiAcpi - ok
18:50:21.0902 7604 wmiApSrv (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe
18:50:21.0919 7604 wmiApSrv - ok
18:50:22.0675 7604 WMPNetworkSvc (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe
18:50:22.0886 7604 WMPNetworkSvc - ok
18:50:22.0954 7604 WPCSvc (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll
18:50:22.0978 7604 WPCSvc - ok
18:50:23.0114 7604 WPDBusEnum (aa53356d60af47eacc85bc617a4f3f66) C:\Windows\system32\wpdbusenum.dll
18:50:23.0122 7604 WPDBusEnum - ok
18:50:23.0337 7604 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
18:50:23.0342 7604 ws2ifsl - ok
18:50:23.0403 7604 wscsvc (6f5d49efe0e7164e03ae773a3fe25340) C:\Windows\system32\wscsvc.dll
18:50:23.0409 7604 wscsvc - ok
18:50:23.0423 7604 WSearch - ok
18:50:23.0737 7604 wuauserv (fc3ec24fce372c89423e015a2ac1a31e) C:\Windows\system32\wuaueng.dll
18:50:23.0826 7604 wuauserv - ok
18:50:24.0076 7604 WudfPf (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
18:50:24.0081 7604 WudfPf - ok
18:50:24.0172 7604 WUDFRd (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys
18:50:24.0178 7604 WUDFRd - ok
18:50:24.0305 7604 wudfsvc (8d1e1e529a2c9e9b6a85b55a345f7629) C:\Windows\System32\WUDFSvc.dll
18:50:24.0310 7604 wudfsvc - ok
18:50:24.0376 7604 WwanSvc (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll
18:50:24.0430 7604 WwanSvc - ok
18:50:24.0613 7604 ZTEusbmdm6k (3862318f85be7a91957ada5e814ed58c) C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys
18:50:24.0637 7604 ZTEusbmdm6k - ok
18:50:24.0853 7604 ZTEusbnmea (3862318f85be7a91957ada5e814ed58c) C:\Windows\system32\DRIVERS\ZTEusbnmea.sys
18:50:24.0859 7604 ZTEusbnmea - ok
18:50:24.0987 7604 ZTEusbser6k (3862318f85be7a91957ada5e814ed58c) C:\Windows\system32\DRIVERS\ZTEusbser6k.sys
18:50:25.0018 7604 ZTEusbser6k - ok
18:50:25.0465 7604 MBR (0x1B8) (4d3df799f91f23bd025ce550100f7662) \Device\Harddisk0\DR0
18:50:25.0855 7604 \Device\Harddisk0\DR0 - ok
18:50:25.0865 7604 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1
18:50:25.0870 7604 \Device\Harddisk1\DR1 - ok
18:50:25.0957 7604 Boot (0x1200) (7635bf983df3cc02360fc8e48524f904) \Device\Harddisk0\DR0\Partition0
18:50:25.0959 7604 \Device\Harddisk0\DR0\Partition0 - ok
18:50:25.0979 7604 Boot (0x1200) (17ce923dca9191a13c32facbb91ef525) \Device\Harddisk0\DR0\Partition1
18:50:25.0980 7604 \Device\Harddisk0\DR0\Partition1 - ok
18:50:26.0031 7604 Boot (0x1200) (5e7c9dabe2a58d293862e5c989fc0522) \Device\Harddisk0\DR0\Partition2
18:50:26.0033 7604 \Device\Harddisk0\DR0\Partition2 - ok
18:50:26.0043 7604 Boot (0x1200) (f70f9ec4e31423b13d3542030d7c05b3) \Device\Harddisk1\DR1\Partition0
18:50:26.0045 7604 \Device\Harddisk1\DR1\Partition0 - ok
18:50:26.0048 7604 ============================================================
18:50:26.0049 7604 Scan finished
18:50:26.0049 7604 ============================================================
18:50:26.0073 7772 Detected object count: 0
18:50:26.0073 7772 Actual detected object count: 0

#12 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 23 July 2012 - 06:06 AM

My computer shuts itself down and reboot as I wake it up from sleeping mode

#13 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 23 July 2012 - 07:26 AM

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-07-23 18:59:08
-----------------------------
18:59:08.218 OS Version: Windows 6.1.7601 Service Pack 1
18:59:08.218 Number of processors: 2 586 0x170A
18:59:08.224 ComputerName: PHOENIX-THINK UserName: Phoenix
19:00:21.233 Initialize success
20:17:12.191 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
20:17:12.252 Disk 0 Vendor: WDC_WD32 14.0 Size: 305245MB BusType: 3
20:17:12.267 Disk 0 MBR read successfully
20:17:12.272 Disk 0 MBR scan
20:17:12.277 Disk 0 unknown MBR code
20:17:12.303 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 1200 MB offset 2048
20:17:12.324 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 293543 MB offset 2459648
20:17:12.365 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 10500 MB offset 603635712
20:17:12.376 Disk 0 scanning sectors +625140400
20:17:12.463 Disk 0 scanning C:\Windows\system32\drivers
20:17:35.573 Service scanning
20:17:49.203 Service KL1 C:\Windows\system32\DRIVERS\kl1.sys **LOCKED** 5
20:17:49.364 Service kl2 C:\Windows\system32\DRIVERS\kl2.sys **LOCKED** 5
20:17:49.506 Service KLIM6 C:\Windows\system32\DRIVERS\klim6.sys **LOCKED** 5
20:17:49.903 Service klmouflt C:\Windows\system32\DRIVERS\klmouflt.sys **LOCKED** 5
20:18:10.020 Modules scanning
20:18:25.946 Disk 0 trace - called modules:
20:18:25.983 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys
20:18:25.990 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87104170]
20:18:25.997 3 CLASSPNP.SYS[89bbe59e] -> nt!IofCallDriver -> [0x86341928]
20:18:26.003 5 ACPI.sys[842953d4] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x862d8028]
20:18:26.012 Scan finished successfully
20:21:40.453 Disk 0 MBR has been saved successfully to "C:\Users\Phoenix\Desktop\Log\MBR.dat"
20:21:40.466 The log file has been saved successfully to "C:\Users\Phoenix\Desktop\Log\aswMBR 23072012.txt"

#14 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:42 AM

Posted 23 July 2012 - 12:57 PM

Greetings

My computer shuts itself down and reboot as I wake it up from sleeping mode - this does not sound like a malware problem - it does not sound like anything i have heard of before

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe
Posted Image
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following

  • report from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now after running the script?

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#15 phoenix1206

phoenix1206
  • Topic Starter

  • Members
  • 80 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 24 July 2012 - 10:33 AM

ComboFix 12-07-21.01 - Phoenix 24.07.2012 21:45:51.8.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.950.852.1033.18.1913.1041 [GMT 8:00]
執行位置: c:\users\Phoenix\Desktop\ComboFix.exe
Command switches used :: c:\users\Phoenix\Desktop\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( 2012-06-24 至 2012-07-24 的新的檔案 )))))))))))))))))))))))))))))))
.
.
2012-07-24 14:01 . 2012-07-24 14:01 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-07-24 14:01 . 2012-07-24 14:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-24 06:37 . 2012-06-29 08:44 6891424 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{54D4675B-9833-4660-B3DD-A558270E0EC8}\mpengine.dll
2012-07-23 08:47 . 2012-07-24 14:01 -------- d-----w- c:\users\Phoenix\AppData\Local\temp
2012-07-19 14:38 . 2012-07-19 14:38 -------- d-----w- C:\CDisplay
2012-07-17 08:53 . 2012-07-17 08:57 -------- d-----w- c:\windows\WindowsMobile
2012-07-11 08:34 . 2012-07-11 08:35 -------- d-----w- c:\users\Phoenix\AppData\Local\Facebook
2012-07-11 07:13 . 2012-07-11 07:13 -------- d-----w- c:\users\Phoenix\AppData\Roaming\fltk.org
2012-07-11 07:13 . 2012-07-11 07:13 -------- d-----w- c:\programdata\fltk.org
2012-07-11 06:26 . 2012-07-11 06:49 -------- d-----w- C:\Octave
2012-07-11 04:06 . 2012-06-12 02:40 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-07-11 03:59 . 2012-06-06 05:05 143360 ----a-w- c:\program files\Common Files\System\ado\msjro.dll
2012-07-11 03:59 . 2012-06-06 05:05 372736 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2012-07-11 03:59 . 2012-06-06 05:05 57344 ----a-w- c:\program files\Common Files\System\ado\msador15.dll
2012-07-11 03:59 . 2012-06-06 05:05 352256 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2012-07-11 03:59 . 2012-06-06 05:05 212992 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2012-07-11 03:59 . 2012-06-06 05:05 1019904 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-07-11 03:59 . 2012-06-06 05:03 805376 ----a-w- c:\windows\system32\cdosys.dll
2012-07-11 03:59 . 2012-06-06 05:05 1390080 ----a-w- c:\windows\system32\msxml6.dll
2012-07-11 03:59 . 2012-06-06 05:05 1236992 ----a-w- c:\windows\system32\msxml3.dll
2012-07-11 03:59 . 2010-06-26 03:24 2048 ----a-w- c:\windows\system32\msxml3r.dll
2012-07-11 03:59 . 2012-06-02 04:45 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-07-11 03:59 . 2012-06-02 04:40 369336 ----a-w- c:\windows\system32\drivers\cng.sys
2012-07-11 03:58 . 2012-06-02 04:40 225280 ----a-w- c:\windows\system32\schannel.dll
2012-07-11 03:58 . 2012-06-02 04:39 219136 ----a-w- c:\windows\system32\ncrypt.dll
2012-07-11 03:58 . 2012-06-02 04:45 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-07-09 03:58 . 2012-07-09 03:58 -------- d-----w- c:\users\Phoenix\AppData\Local\Macromedia
2012-07-02 18:57 . 2012-07-02 18:57 -------- d-----w- c:\program files\GetData
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三個月內被修改的檔案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-17 10:17 . 2012-03-31 09:54 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-17 10:17 . 2011-10-12 16:11 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-03 05:46 . 2012-06-17 10:55 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-17 11:57 . 2012-06-17 11:57 388096 ----a-r- c:\users\Phoenix\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-06-17 10:50 . 2012-06-17 10:52 772592 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-06-17 10:50 . 2012-01-04 04:11 687600 ----a-w- c:\windows\system32\deployJava1.dll
2012-06-02 22:19 . 2012-06-22 19:15 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-22 19:15 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-22 19:15 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-22 19:15 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-22 19:15 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:12 . 2012-06-22 19:15 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12 . 2012-06-22 19:15 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 14:19 . 2012-06-22 19:14 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 14:12 . 2012-06-22 19:14 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-05-31 04:25 . 2011-09-27 07:33 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-05-04 09:59 . 2012-06-12 19:42 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-05-01 04:44 . 2012-06-12 19:42 164352 ----a-w- c:\windows\system32\profsvc.dll
2012-04-28 03:17 . 2012-06-12 19:42 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-26 04:45 . 2012-06-12 19:42 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 04:45 . 2012-06-12 19:42 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 04:41 . 2012-06-12 19:42 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-07-22 07:55 . 2011-09-23 16:13 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( 重要登入點 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白與合法缺省登錄將不會被顯示
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-06-05 17344176]
"Spotify Web Helper"="c:\users\Phoenix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-07-11 1192664]
"chromium"="c:\users\Phoenix\AppData\Local\Google\Chrome\Application\chrome.exe" [2012-07-10 1250328]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-05-31 466704]
"Spotify"="c:\users\Phoenix\AppData\Roaming\Spotify\spotify.exe" [2012-07-11 7609560]
"Facebook Update"="c:\users\Phoenix\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-10 7612960]
"TpShocks"="TpShocks.exe" [2011-03-29 337256]
"PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2011-11-30 1322048]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-04-22 1725736]
"AcWin7Hlpr"="c:\program files\Lenovo\Access Connections\AcTBenabler.exe" [2011-04-14 31592]
"LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2010-07-27 62312]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-08 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-08 151064]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-24 202296]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2012-04-15 374368]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
.
c:\users\Phoenix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Facebook Messenger.lnk - c:\users\Phoenix\AppData\Local\Facebook\Messenger\2.1.4587.0\FacebookMessenger.exe [2012-7-23 241584]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2009-7-2 795936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 gupdate;Google更新 服務 (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [x]
R2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [x]
R2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AMPPALP;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys [x]
R3 gupdatem;Google更新 服務 (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.EXE [x]
R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files\ThinkPad\Utilities\PWMEWSVC.EXE [x]
R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [x]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [x]
R4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM86.sys [x]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiif32.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 AMPPALR3;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 BecHelperService;BecHelperService;c:\program files\3 Mobile Broadband\3Connect\BecHelperService.exe [x]
S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 DDNIMSGService;DDNIMSGService;c:\program files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe [x]
S2 DDNIService;DDNIService;c:\program files\DDNI\DIBS\DDNIService.exe [x]
S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [x]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [x]
S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [x]
S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [x]
S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [x]
S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [x]
S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys [x]
S3 AMPPAL;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]
S3 NETwNs32;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETwNs32.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 stdriver;Sound Tap Upper Class Filter Driver v2.0.0.0;c:\windows\system32\DRIVERS\stdriver32.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 44690890
*Deregistered* - 44690890
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
計劃任務 文件夾 裡的內容
.
2012-07-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000Core.job
- c:\users\Phoenix\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11 03:22]
.
2012-07-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000UA.job
- c:\users\Phoenix\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11 03:22]
.
2012-07-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 09:43]
.
2012-07-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-26 09:43]
.
2012-07-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000Core.job
- c:\users\Phoenix\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-23 17:47]
.
2012-07-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3474256839-2419737990-2262214654-1000UA.job
- c:\users\Phoenix\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-23 17:47]
.
2012-07-05 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:54]
.
2012-07-24 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:54]
.
.
------- 而外的掃描 -------
.
uStart Page = hxxp://lenovo.msn.com
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyServer = 172.16.0.3:8881
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
IE: 新增到卡巴斯基廣告橫幅防護清單 - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
LSP: c:\program files\YouKu\common\ikutm.dll
TCP: DhcpNameServer = 192.168.8.1
TCP: Interfaces\{2CC802FF-9E18-4E17-ADBC-E203C71F3944}: NameServer = 172.30.139.17 172.31.139.17
FF - ProfilePath - c:\users\Phoenix\AppData\Roaming\Mozilla\Firefox\Profiles\dr9oautu.default\
FF - prefs.js: network.proxy.ftp - 172.16.0.3
FF - prefs.js: network.proxy.ftp_port - 8881
FF - prefs.js: network.proxy.http - 172.16.0.3
FF - prefs.js: network.proxy.http_port - 8881
FF - prefs.js: network.proxy.socks - 172.16.0.3
FF - prefs.js: network.proxy.socks_port - 8881
FF - prefs.js: network.proxy.ssl - 172.16.0.3
FF - prefs.js: network.proxy.ssl_port - 8881
FF - prefs.js: network.proxy.type - 4
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*魯 
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*魯 OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.3GP\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.ASF\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.AVI\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DAT\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.DVIX\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.FLV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.M4V\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MKV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MOV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MP4\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MPEG\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.MPG\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.RM\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.RMVB\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_USERS\S-1-5-21-3474256839-2419737990-2262214654-1000_Classes\SystemFileAssociations\.WMV\Shell\?i*K*u* *~NDY菧?D?S\Command]
@="\"c:\\Program Files\\YouKu\\iku2\\iku.exe\" iku://|upload|file=%1|"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- 運行進程下的動態鏈接庫 ---------------------
.
- - - - - - - > 'Explorer.exe'(6600)
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\program files\ThinkPad\Bluetooth Software\btmmhook.dll
c:\program files\Lenovo\Access Connections\ACDeskBand.dll
c:\program files\Lenovo\Access Connections\AcLocSettings.dll
c:\program files\Lenovo\Access Connections\AcCryptHlpr.dll
c:\program files\Lenovo\Access Connections\ACHelper.dll
c:\program files\Lenovo\Access Connections\AcSvcStub.dll
c:\program files\ThinkPad\Utilities\PWMTR32V.DLL
c:\progra~1\ThinkPad\UTILIT~1\US\PWMRT32V.DLL
c:\progra~1\ThinkPad\UTILIT~1\PWMIF32V.DLL
.
完成時間: 2012-07-24 22:04:46
ComboFix-quarantined-files.txt 2012-07-24 14:04
ComboFix2.txt 2012-07-23 08:47
.
Pre-Run: 89,017,241,600 bytes free
Post-Run: 89,102,725,120 bytes free
.
- - End Of File - - A546EB8999A6684D0E76BE764876D37A




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users