19:30:50.0703 5936 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:18 19:30:52.0734 5936 ============================================================ 19:30:52.0734 5936 Current date / time: 2012/05/13 19:30:52.0734 19:30:52.0734 5936 SystemInfo: 19:30:52.0734 5936 19:30:52.0734 5936 OS Version: 5.1.2600 ServicePack: 3.0 19:30:52.0734 5936 Product type: Workstation 19:30:52.0734 5936 ComputerName: LIVINGROOM 19:30:52.0734 5936 UserName: joe brewen 19:30:52.0734 5936 Windows directory: C:\WINDOWS 19:30:52.0734 5936 System windows directory: C:\WINDOWS 19:30:52.0734 5936 Processor architecture: Intel x86 19:30:52.0734 5936 Number of processors: 2 19:30:52.0734 5936 Page size: 0x1000 19:30:52.0734 5936 Boot type: Normal boot 19:30:52.0734 5936 ============================================================ 19:30:54.0234 5936 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050 19:30:54.0234 5936 ============================================================ 19:30:54.0234 5936 \Device\Harddisk0\DR0: 19:30:54.0234 5936 MBR partitions: 19:30:54.0234 5936 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1203EBBF 19:30:54.0234 5936 ============================================================ 19:30:54.0312 5936 C: <-> \Device\Harddisk0\DR0\Partition0 19:30:54.0312 5936 ============================================================ 19:30:54.0312 5936 Initialize success 19:30:54.0312 5936 ============================================================ 19:31:24.0531 2980 ============================================================ 19:31:24.0546 2980 Scan started 19:31:24.0546 2980 Mode: Manual; SigCheck; TDLFS; 19:31:24.0546 2980 ============================================================ 19:31:26.0093 2980 Abiosdsk - ok 19:31:26.0109 2980 abp480n5 - ok 19:31:26.0187 2980 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 19:31:26.0953 2980 ACPI - ok 19:31:27.0000 2980 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys 19:31:27.0312 2980 ACPIEC - ok 19:31:27.0343 2980 adpu160m - ok 19:31:27.0546 2980 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 19:31:27.0968 2980 aec - ok 19:31:28.0015 2980 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys 19:31:28.0203 2980 AFD - ok 19:31:28.0218 2980 AFGMp50 - ok 19:31:28.0218 2980 AFGSp50 - ok 19:31:28.0234 2980 Aha154x - ok 19:31:28.0250 2980 aic78u2 - ok 19:31:28.0250 2980 aic78xx - ok 19:31:28.0296 2980 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll 19:31:28.0578 2980 Alerter - ok 19:31:28.0593 2980 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe 19:31:28.0734 2980 ALG - ok 19:31:28.0750 2980 AliIde - ok 19:31:29.0000 2980 Ambfilt (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys 19:31:29.0265 2980 Ambfilt - ok 19:31:29.0375 2980 amsint - ok 19:31:29.0500 2980 Amsp (feb0b5022c012a4a68dabcb711faff03) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe 19:31:30.0234 2980 Amsp - ok 19:31:30.0250 2980 AmUStor - ok 19:31:30.0359 2980 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 19:31:30.0546 2980 Apple Mobile Device - ok 19:31:30.0562 2980 AppMgmt - ok 19:31:30.0687 2980 AR5416 (e0ee769d14128014965e03b433f5f46e) C:\WINDOWS\system32\DRIVERS\athw.sys 19:31:30.0906 2980 AR5416 - ok 19:31:31.0125 2980 asc - ok 19:31:31.0140 2980 asc3350p - ok 19:31:31.0140 2980 asc3550 - ok 19:31:31.0234 2980 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 19:31:31.0312 2980 aspnet_state - ok 19:31:31.0359 2980 AsUpIO (e67493490466b5f04b58c22d2590e8ca) C:\WINDOWS\system32\drivers\AsUpIO.sys 19:31:31.0375 2980 AsUpIO - ok 19:31:31.0421 2980 AsusACPI (12415a4b61ded200fe9932b47a35fa42) C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys 19:31:31.0500 2980 AsusACPI - ok 19:31:31.0562 2980 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 19:31:31.0843 2980 AsyncMac - ok 19:31:32.0031 2980 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 19:31:32.0281 2980 atapi - ok 19:31:32.0296 2980 Atdisk - ok 19:31:32.0312 2980 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 19:31:32.0578 2980 Atmarpc - ok 19:31:32.0609 2980 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll 19:31:32.0875 2980 AudioSrv - ok 19:31:32.0906 2980 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 19:31:33.0156 2980 audstub - ok 19:31:33.0312 2980 BackupService (68b86dd9d455a6a8de6d13c84fb5ce31) C:\Documents and Settings\joe brewen\Application Data\HP SimpleSave Application\uUACTokenSvc.exe 19:31:33.0531 2980 BackupService - ok 19:31:33.0562 2980 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 19:31:33.0812 2980 Beep - ok 19:31:33.0875 2980 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll 19:31:34.0203 2980 BITS - ok 19:31:34.0343 2980 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe 19:31:34.0406 2980 Bonjour Service - ok 19:31:34.0468 2980 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll 19:31:34.0718 2980 Browser - ok 19:31:34.0734 2980 btaudio - ok 19:31:34.0734 2980 BTDriver - ok 19:31:34.0750 2980 BTWDNDIS - ok 19:31:34.0765 2980 btwhid - ok 19:31:34.0765 2980 BTWUSB - ok 19:31:34.0781 2980 catchme - ok 19:31:34.0953 2980 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 19:31:35.0218 2980 cbidf2k - ok 19:31:35.0328 2980 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 19:31:35.0687 2980 CCDECODE - ok 19:31:35.0703 2980 cd20xrnt - ok 19:31:35.0906 2980 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 19:31:36.0156 2980 Cdaudio - ok 19:31:36.0203 2980 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 19:31:36.0718 2980 Cdfs - ok 19:31:36.0781 2980 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 19:31:37.0093 2980 Cdrom - ok 19:31:37.0093 2980 Changer - ok 19:31:37.0281 2980 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe 19:31:37.0531 2980 CiSvc - ok 19:31:37.0546 2980 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe 19:31:37.0812 2980 ClipSrv - ok 19:31:37.0890 2980 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 19:31:37.0984 2980 clr_optimization_v2.0.50727_32 - ok 19:31:38.0031 2980 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys 19:31:38.0281 2980 CmBatt - ok 19:31:38.0281 2980 CmdIde - ok 19:31:38.0312 2980 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys 19:31:38.0562 2980 Compbatt - ok 19:31:38.0562 2980 COMSysApp - ok 19:31:38.0578 2980 Cpqarray - ok 19:31:38.0640 2980 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll 19:31:38.0890 2980 CryptSvc - ok 19:31:38.0906 2980 dac2w2k - ok 19:31:38.0921 2980 dac960nt - ok 19:31:39.0140 2980 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 19:31:39.0312 2980 DcomLaunch - ok 19:31:39.0359 2980 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll 19:31:39.0671 2980 Dhcp - ok 19:31:39.0750 2980 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 19:31:40.0171 2980 Disk - ok 19:31:40.0187 2980 dmadmin - ok 19:31:40.0343 2980 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 19:31:40.0765 2980 dmboot - ok 19:31:40.0828 2980 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 19:31:41.0109 2980 dmio - ok 19:31:41.0125 2980 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 19:31:41.0375 2980 dmload - ok 19:31:41.0406 2980 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll 19:31:41.0687 2980 dmserver - ok 19:31:41.0734 2980 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 19:31:42.0000 2980 DMusic - ok 19:31:42.0046 2980 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll 19:31:42.0140 2980 Dnscache - ok 19:31:42.0203 2980 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll 19:31:42.0468 2980 Dot3svc - ok 19:31:42.0484 2980 dpti2o - ok 19:31:42.0515 2980 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 19:31:42.0781 2980 drmkaud - ok 19:31:42.0796 2980 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll 19:31:43.0093 2980 EapHost - ok 19:31:43.0109 2980 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll 19:31:43.0375 2980 ERSvc - ok 19:31:43.0406 2980 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 19:31:43.0453 2980 Eventlog - ok 19:31:43.0515 2980 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll 19:31:43.0593 2980 EventSystem - ok 19:31:43.0640 2980 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 19:31:43.0937 2980 Fastfat - ok 19:31:43.0968 2980 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 19:31:44.0062 2980 FastUserSwitchingCompatibility - ok 19:31:44.0125 2980 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys 19:31:44.0406 2980 Fdc - ok 19:31:44.0593 2980 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 19:31:44.0875 2980 Fips - ok 19:31:44.0921 2980 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 19:31:45.0250 2980 Flpydisk - ok 19:31:45.0453 2980 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 19:31:45.0875 2980 FltMgr - ok 19:31:46.0125 2980 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 19:31:46.0156 2980 FontCache3.0.0.0 - ok 19:31:46.0218 2980 fssfltr (960f5e5e4e1f720465311ac68a99c2df) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys 19:31:46.0250 2980 fssfltr - ok 19:31:46.0468 2980 fsssvc (9b1622ebeb31b3411b13382ffcb8737d) C:\Program Files\Windows Live\Family Safety\fsssvc.exe 19:31:46.0593 2980 fsssvc - ok 19:31:46.0640 2980 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 19:31:46.0984 2980 Fs_Rec - ok 19:31:47.0265 2980 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 19:31:47.0531 2980 Ftdisk - ok 19:31:47.0578 2980 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 19:31:47.0609 2980 GEARAspiWDM - ok 19:31:47.0640 2980 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 19:31:47.0906 2980 Gpc - ok 19:31:47.0953 2980 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 19:31:48.0250 2980 HDAudBus - ok 19:31:48.0437 2980 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 19:31:48.0687 2980 helpsvc - ok 19:31:48.0718 2980 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll 19:31:49.0000 2980 HidServ - ok 19:31:49.0046 2980 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 19:31:49.0296 2980 HidUsb - ok 19:31:49.0359 2980 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll 19:31:49.0625 2980 hkmsvc - ok 19:31:49.0625 2980 hpn - ok 19:31:49.0765 2980 hpqcxs08 (5da42d24712e00728cea2342a65009b2) C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll 19:31:50.0671 2980 hpqcxs08 - ok 19:31:50.0718 2980 hpqddsvc (d86a39bf100069444d026d22d9a6e555) C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll 19:31:50.0781 2980 hpqddsvc - ok 19:31:50.0859 2980 HPSLPSVC (9d23402d305869844bc6004a05cc74ba) C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL 19:31:50.0984 2980 HPSLPSVC - ok 19:31:51.0031 2980 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys 19:31:51.0437 2980 HPZid412 - ok 19:31:51.0484 2980 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 19:31:51.0609 2980 HPZipr12 - ok 19:31:51.0640 2980 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys 19:31:51.0828 2980 HPZius12 - ok 19:31:51.0890 2980 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 19:31:52.0000 2980 HTTP - ok 19:31:52.0062 2980 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll 19:31:52.0359 2980 HTTPFilter - ok 19:31:52.0390 2980 i2omgmt - ok 19:31:52.0406 2980 i2omp - ok 19:31:52.0468 2980 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 19:31:52.0750 2980 i8042prt - ok 19:31:53.0156 2980 ialm (0f68e2ec713f132ffb19e45415b09679) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 19:31:53.0875 2980 ialm - ok 19:31:54.0078 2980 iaStor (8ef427c54497c5f8a7a645990e4278c7) C:\WINDOWS\system32\drivers\iaStor.sys 19:31:54.0156 2980 iaStor - ok 19:31:54.0265 2980 IconixService (17a5bc4732b7fe2437809ca1f63efe8b) C:\Program Files\Common Files\eMail ID\IconixService.exe 19:31:54.0781 2980 IconixService - ok 19:31:55.0015 2980 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 19:31:55.0125 2980 idsvc - ok 19:31:55.0328 2980 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 19:31:55.0609 2980 Imapi - ok 19:31:55.0703 2980 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe 19:31:55.0968 2980 ImapiService - ok 19:31:55.0984 2980 ini910u - ok 19:31:56.0437 2980 IntcAzAudAddService (9037c8bd3e896d7f2803a171fdeaeef4) C:\WINDOWS\system32\drivers\RtkHDAud.sys 19:31:56.0906 2980 IntcAzAudAddService - ok 19:31:57.0125 2980 IntelIde - ok 19:31:57.0156 2980 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 19:31:57.0390 2980 intelppm - ok 19:31:57.0781 2980 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 19:31:58.0046 2980 Ip6Fw - ok 19:31:58.0062 2980 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 19:31:58.0312 2980 IpFilterDriver - ok 19:31:58.0328 2980 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 19:31:58.0593 2980 IpInIp - ok 19:31:58.0625 2980 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 19:31:58.0984 2980 IpNat - ok 19:31:59.0437 2980 iPod Service (57edb35ea2feca88f8b17c0c095c9a56) C:\Program Files\iPod\bin\iPodService.exe 19:31:59.0843 2980 iPod Service - ok 19:31:59.0890 2980 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 19:32:00.0281 2980 IPSec - ok 19:32:00.0437 2980 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 19:32:00.0609 2980 IRENUM - ok 19:32:00.0656 2980 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 19:32:00.0921 2980 isapnp - ok 19:32:01.0078 2980 JavaQuickStarterService (9dba73c2f1e76ec4cb837e67c5743596) C:\Program Files\Java\jre6\bin\jqs.exe 19:32:01.0140 2980 JavaQuickStarterService - ok 19:32:01.0171 2980 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 19:32:01.0500 2980 Kbdclass - ok 19:32:01.0687 2980 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 19:32:02.0062 2980 kmixer - ok 19:32:02.0218 2980 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 19:32:02.0375 2980 KSecDD - ok 19:32:02.0421 2980 L1c (6c8658587e91ea25b0fd2e71781ad228) C:\WINDOWS\system32\DRIVERS\l1c51x86.sys 19:32:02.0500 2980 L1c - ok 19:32:02.0562 2980 LanmanServer (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll 19:32:02.0640 2980 LanmanServer - ok 19:32:02.0812 2980 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll 19:32:02.0968 2980 lanmanworkstation - ok 19:32:02.0984 2980 lbrtfdc - ok 19:32:03.0062 2980 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll 19:32:03.0468 2980 LmHosts - ok 19:32:03.0515 2980 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll 19:32:03.0921 2980 Messenger - ok 19:32:03.0968 2980 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 19:32:04.0406 2980 mnmdd - ok 19:32:04.0468 2980 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe 19:32:04.0750 2980 mnmsrvc - ok 19:32:04.0812 2980 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 19:32:05.0109 2980 Modem - ok 19:32:05.0281 2980 Monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys 19:32:05.0546 2980 Monfilt - ok 19:32:05.0578 2980 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 19:32:05.0875 2980 Mouclass - ok 19:32:06.0078 2980 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 19:32:06.0359 2980 mouhid - ok 19:32:06.0406 2980 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 19:32:06.0656 2980 MountMgr - ok 19:32:06.0734 2980 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe 19:32:06.0875 2980 MozillaMaintenance - ok 19:32:06.0890 2980 mraid35x - ok 19:32:06.0953 2980 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 19:32:07.0203 2980 MRxDAV - ok 19:32:07.0296 2980 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 19:32:07.0437 2980 MRxSmb - ok 19:32:07.0500 2980 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe 19:32:07.0812 2980 MSDTC - ok 19:32:07.0953 2980 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 19:32:08.0312 2980 Msfs - ok 19:32:08.0312 2980 MSIServer - ok 19:32:08.0375 2980 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 19:32:08.0687 2980 MSKSSRV - ok 19:32:08.0718 2980 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 19:32:09.0015 2980 MSPCLOCK - ok 19:32:09.0031 2980 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 19:32:09.0390 2980 MSPQM - ok 19:32:09.0437 2980 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 19:32:09.0796 2980 mssmbios - ok 19:32:09.0921 2980 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys 19:32:10.0296 2980 MSTEE - ok 19:32:10.0390 2980 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 19:32:10.0484 2980 Mup - ok 19:32:10.0546 2980 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 19:32:10.0921 2980 NABTSFEC - ok 19:32:11.0062 2980 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll 19:32:11.0359 2980 napagent - ok 19:32:11.0468 2980 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 19:32:11.0718 2980 NDIS - ok 19:32:11.0750 2980 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 19:32:12.0000 2980 NdisIP - ok 19:32:12.0062 2980 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 19:32:12.0109 2980 NdisTapi - ok 19:32:12.0156 2980 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 19:32:12.0437 2980 Ndisuio - ok 19:32:12.0609 2980 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 19:32:12.0953 2980 NdisWan - ok 19:32:13.0109 2980 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 19:32:13.0156 2980 NDProxy - ok 19:32:13.0203 2980 Net Driver HPZ12 (69c503c004f49aee8b8e3067cc047ba7) C:\WINDOWS\system32\HPZinw12.dll 19:32:13.0328 2980 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning 19:32:13.0328 2980 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1) 19:32:13.0390 2980 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 19:32:13.0718 2980 NetBIOS - ok 19:32:13.0781 2980 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 19:32:14.0046 2980 NetBT - ok 19:32:14.0093 2980 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 19:32:14.0343 2980 NetDDE - ok 19:32:14.0359 2980 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 19:32:14.0593 2980 NetDDEdsdm - ok 19:32:14.0625 2980 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 19:32:14.0906 2980 Netlogon - ok 19:32:14.0968 2980 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll 19:32:15.0250 2980 Netman - ok 19:32:15.0359 2980 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 19:32:15.0406 2980 NetTcpPortSharing - ok 19:32:15.0500 2980 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll 19:32:15.0562 2980 Nla - ok 19:32:15.0593 2980 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 19:32:15.0859 2980 Npfs - ok 19:32:15.0921 2980 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 19:32:16.0281 2980 Ntfs - ok 19:32:16.0296 2980 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 19:32:16.0546 2980 NtLmSsp - ok 19:32:16.0593 2980 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll 19:32:16.0906 2980 NtmsSvc - ok 19:32:16.0953 2980 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 19:32:17.0218 2980 Null - ok 19:32:17.0250 2980 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 19:32:17.0500 2980 NwlnkFlt - ok 19:32:17.0515 2980 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 19:32:17.0765 2980 NwlnkFwd - ok 19:32:18.0015 2980 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 19:32:18.0093 2980 odserv - ok 19:32:18.0140 2980 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 19:32:18.0187 2980 ose - ok 19:32:18.0234 2980 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys 19:32:18.0546 2980 Parport - ok 19:32:18.0593 2980 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 19:32:18.0843 2980 PartMgr - ok 19:32:18.0890 2980 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 19:32:19.0156 2980 ParVdm - ok 19:32:19.0203 2980 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 19:32:19.0468 2980 PCI - ok 19:32:19.0484 2980 PCIDump - ok 19:32:19.0500 2980 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 19:32:19.0765 2980 PCIIde - ok 19:32:19.0828 2980 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 19:32:20.0078 2980 Pcmcia - ok 19:32:20.0093 2980 PDCOMP - ok 19:32:20.0109 2980 PDFRAME - ok 19:32:20.0125 2980 PDRELI - ok 19:32:20.0125 2980 PDRFRAME - ok 19:32:20.0140 2980 perc2 - ok 19:32:20.0156 2980 perc2hib - ok 19:32:20.0250 2980 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 19:32:20.0312 2980 PlugPlay - ok 19:32:20.0359 2980 Pml Driver HPZ12 (12b4549d515cb26bb8d375038017ca65) C:\WINDOWS\system32\HPZipm12.dll 19:32:20.0453 2980 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning 19:32:20.0453 2980 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1) 19:32:20.0500 2980 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 19:32:20.0734 2980 PolicyAgent - ok 19:32:20.0796 2980 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 19:32:21.0078 2980 PptpMiniport - ok 19:32:21.0093 2980 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 19:32:21.0328 2980 ProtectedStorage - ok 19:32:21.0343 2980 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 19:32:21.0718 2980 PSched - ok 19:32:21.0765 2980 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 19:32:22.0093 2980 Ptilink - ok 19:32:22.0218 2980 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys 19:32:22.0250 2980 PxHelp20 - ok 19:32:22.0250 2980 ql1080 - ok 19:32:22.0265 2980 Ql10wnt - ok 19:32:22.0281 2980 ql12160 - ok 19:32:22.0296 2980 ql1240 - ok 19:32:22.0312 2980 ql1280 - ok 19:32:22.0359 2980 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 19:32:22.0609 2980 RasAcd - ok 19:32:22.0656 2980 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll 19:32:22.0968 2980 RasAuto - ok 19:32:23.0015 2980 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 19:32:23.0250 2980 Rasl2tp - ok 19:32:23.0296 2980 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll 19:32:23.0562 2980 RasMan - ok 19:32:23.0593 2980 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 19:32:23.0828 2980 RasPppoe - ok 19:32:23.0890 2980 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 19:32:24.0125 2980 Raspti - ok 19:32:24.0171 2980 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 19:32:24.0406 2980 Rdbss - ok 19:32:24.0453 2980 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 19:32:24.0703 2980 RDPCDD - ok 19:32:24.0953 2980 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys 19:32:25.0000 2980 RDPWD - ok 19:32:25.0046 2980 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe 19:32:25.0312 2980 RDSessMgr - ok 19:32:25.0375 2980 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 19:32:25.0687 2980 redbook - ok 19:32:25.0734 2980 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll 19:32:26.0000 2980 RemoteAccess - ok 19:32:26.0046 2980 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe 19:32:26.0281 2980 RpcLocator - ok 19:32:26.0468 2980 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\System32\rpcss.dll 19:32:26.0531 2980 RpcSs - ok 19:32:26.0578 2980 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe 19:32:26.0843 2980 RSVP - ok 19:32:27.0109 2980 RT80x86 (97b59ce2cfbb0884a16ddd8f1781812b) C:\WINDOWS\system32\DRIVERS\RT2860.sys 19:32:27.0281 2980 RT80x86 - ok 19:32:27.0406 2980 RUBotted (1f17555989477b993b6ab2d2f67ee7f5) C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe 19:32:27.0640 2980 RUBotted - ok 19:32:27.0796 2980 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 19:32:28.0093 2980 SamSs - ok 19:32:28.0140 2980 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe 19:32:28.0390 2980 SCardSvr - ok 19:32:28.0437 2980 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll 19:32:28.0687 2980 Schedule - ok 19:32:28.0765 2980 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 19:32:28.0937 2980 Secdrv - ok 19:32:28.0968 2980 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll 19:32:29.0203 2980 seclogon - ok 19:32:29.0218 2980 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll 19:32:29.0453 2980 SENS - ok 19:32:29.0484 2980 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys 19:32:29.0718 2980 Serial - ok 19:32:29.0765 2980 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 19:32:30.0031 2980 Sfloppy - ok 19:32:30.0093 2980 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll 19:32:30.0375 2980 SharedAccess - ok 19:32:30.0421 2980 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 19:32:30.0484 2980 ShellHWDetection - ok 19:32:30.0500 2980 Simbad - ok 19:32:31.0140 2980 Skype C2C Service (192d93ee7ae6a3c599c96cd8d736e914) C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe 19:32:33.0250 2980 Skype C2C Service - ok 19:32:33.0359 2980 SkypeUpdate (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files\Skype\Updater\Updater.exe 19:32:34.0312 2980 SkypeUpdate - ok 19:32:34.0531 2980 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys 19:32:34.0781 2980 SLIP - ok 19:32:34.0937 2980 SNP2UVC (473f35e2a378b854731e67c377a3bea7) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys 19:32:35.0265 2980 SNP2UVC - ok 19:32:35.0453 2980 Sparrow - ok 19:32:35.0515 2980 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 19:32:35.0828 2980 splitter - ok 19:32:36.0031 2980 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe 19:32:36.0109 2980 Spooler - ok 19:32:36.0156 2980 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 19:32:36.0281 2980 sr - ok 19:32:36.0343 2980 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll 19:32:36.0500 2980 srservice - ok 19:32:36.0562 2980 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 19:32:36.0656 2980 Srv - ok 19:32:36.0703 2980 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll 19:32:36.0828 2980 SSDPSRV - ok 19:32:36.0875 2980 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys 19:32:37.0093 2980 StillCam - ok 19:32:37.0140 2980 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll 19:32:37.0406 2980 stisvc - ok 19:32:37.0468 2980 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 19:32:37.0734 2980 streamip - ok 19:32:37.0781 2980 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 19:32:38.0015 2980 swenum - ok 19:32:38.0046 2980 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 19:32:38.0296 2980 swmidi - ok 19:32:38.0296 2980 SwPrv - ok 19:32:38.0312 2980 symc810 - ok 19:32:38.0328 2980 symc8xx - ok 19:32:38.0593 2980 SymIM (c6db9f873b09c63f5cb1de10c08bf6f9) C:\WINDOWS\system32\DRIVERS\SymIM.sys 19:32:38.0640 2980 SymIM - ok 19:32:38.0656 2980 SymIMMP (c6db9f873b09c63f5cb1de10c08bf6f9) C:\WINDOWS\system32\DRIVERS\SymIM.sys 19:32:38.0687 2980 SymIMMP - ok 19:32:38.0703 2980 sym_hi - ok 19:32:38.0718 2980 sym_u3 - ok 19:32:38.0781 2980 SynTP (8e25a1dbb8527b2074af9b682f818768) C:\WINDOWS\system32\DRIVERS\SynTP.sys 19:32:38.0828 2980 SynTP - ok 19:32:38.0890 2980 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 19:32:39.0218 2980 sysaudio - ok 19:32:39.0406 2980 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe 19:32:39.0750 2980 SysmonLog - ok 19:32:39.0796 2980 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll 19:32:40.0171 2980 TapiSrv - ok 19:32:40.0234 2980 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 19:32:40.0312 2980 Tcpip - ok 19:32:40.0359 2980 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 19:32:40.0609 2980 TDPIPE - ok 19:32:40.0656 2980 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 19:32:40.0953 2980 TDTCP - ok 19:32:40.0984 2980 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 19:32:41.0218 2980 TermDD - ok 19:32:41.0265 2980 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll 19:32:41.0531 2980 TermService - ok 19:32:41.0593 2980 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 19:32:41.0640 2980 Themes - ok 19:32:41.0687 2980 tmactmon (e8e528896ff2595cfada88749cd72ef8) C:\WINDOWS\system32\DRIVERS\tmactmon.sys 19:32:41.0781 2980 tmactmon - ok 19:32:41.0859 2980 tmcomm (1837512d4aab862bd297a2ef035fba14) C:\WINDOWS\system32\DRIVERS\tmcomm.sys 19:32:41.0984 2980 tmcomm - ok 19:32:42.0015 2980 tmevtmgr (dbac510d1c7cc66b7a78eb2264f3072e) C:\WINDOWS\system32\DRIVERS\tmevtmgr.sys 19:32:42.0156 2980 tmevtmgr - ok 19:32:42.0218 2980 TMPassthru (690acb48dac04e44a3d5e7654ca3260d) C:\WINDOWS\system32\DRIVERS\TMPassthru.sys 19:32:42.0265 2980 TMPassthru - ok 19:32:42.0281 2980 TMPassthruMP (690acb48dac04e44a3d5e7654ca3260d) C:\WINDOWS\system32\DRIVERS\TMPassthru.sys 19:32:42.0343 2980 TMPassthruMP - ok 19:32:42.0421 2980 tmtdi (a6e20b094a8d3e3f46d10bbe7e1ebb82) C:\WINDOWS\system32\DRIVERS\tmtdi.sys 19:32:42.0468 2980 tmtdi - ok 19:32:42.0484 2980 TosIde - ok 19:32:42.0562 2980 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll 19:32:42.0875 2980 TrkWks - ok 19:32:42.0953 2980 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 19:32:43.0203 2980 Udfs - ok 19:32:43.0218 2980 ultra - ok 19:32:43.0296 2980 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 19:32:43.0578 2980 Update - ok 19:32:43.0625 2980 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll 19:32:43.0765 2980 upnphost - ok 19:32:43.0796 2980 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe 19:32:44.0046 2980 UPS - ok 19:32:44.0093 2980 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\WINDOWS\system32\Drivers\usbaapl.sys 19:32:44.0125 2980 USBAAPL ( UnsignedFile.Multi.Generic ) - warning 19:32:44.0125 2980 USBAAPL - detected UnsignedFile.Multi.Generic (1) 19:32:44.0171 2980 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys 19:32:44.0390 2980 usbaudio - ok 19:32:44.0453 2980 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 19:32:44.0703 2980 usbccgp - ok 19:32:44.0750 2980 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 19:32:44.0968 2980 usbehci - ok 19:32:45.0015 2980 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 19:32:45.0250 2980 usbhub - ok 19:32:45.0296 2980 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 19:32:45.0656 2980 usbprint - ok 19:32:45.0687 2980 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 19:32:46.0046 2980 usbscan - ok 19:32:46.0109 2980 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 19:32:46.0437 2980 usbstor - ok 19:32:46.0484 2980 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 19:32:46.0734 2980 usbuhci - ok 19:32:46.0781 2980 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys 19:32:47.0015 2980 usbvideo - ok 19:32:47.0062 2980 uvclf (c019889035cdc1a06f2febc93cbb6897) C:\WINDOWS\system32\DRIVERS\uvclf.sys 19:32:47.0140 2980 uvclf - ok 19:32:47.0187 2980 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 19:32:47.0421 2980 VgaSave - ok 19:32:47.0421 2980 ViaIde - ok 19:32:47.0484 2980 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 19:32:47.0750 2980 VolSnap - ok 19:32:47.0984 2980 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe 19:32:48.0109 2980 VSS - ok 19:32:48.0156 2980 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll 19:32:48.0453 2980 W32Time - ok 19:32:48.0500 2980 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 19:32:48.0875 2980 Wanarp - ok 19:32:48.0984 2980 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys 19:32:49.0062 2980 Wdf01000 - ok 19:32:49.0078 2980 WDICA - ok 19:32:49.0203 2980 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 19:32:49.0453 2980 wdmaud - ok 19:32:49.0484 2980 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll 19:32:49.0765 2980 WebClient - ok 19:32:50.0000 2980 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll 19:32:50.0234 2980 winmgmt - ok 19:32:50.0515 2980 wlidsvc (5144ae67d60ec653f97ddf3feed29e77) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 19:32:50.0750 2980 wlidsvc - ok 19:32:50.0921 2980 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll 19:32:51.0046 2980 WmdmPmSN - ok 19:32:51.0109 2980 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe 19:32:51.0359 2980 WmiApSrv - ok 19:32:51.0546 2980 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe 19:32:51.0750 2980 WMPNetworkSvc - ok 19:32:51.0828 2980 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys 19:32:51.0875 2980 WpdUsb - ok 19:32:51.0906 2980 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 19:32:52.0156 2980 WS2IFSL - ok 19:32:52.0203 2980 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll 19:32:52.0437 2980 wscsvc - ok 19:32:52.0500 2980 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 19:32:52.0750 2980 WSTCODEC - ok 19:32:52.0781 2980 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll 19:32:53.0031 2980 wuauserv - ok 19:32:53.0078 2980 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 19:32:53.0156 2980 WudfPf - ok 19:32:53.0203 2980 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 19:32:53.0218 2980 WudfRd - ok 19:32:53.0250 2980 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll 19:32:53.0296 2980 WudfSvc - ok 19:32:53.0484 2980 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll 19:32:53.0875 2980 WZCSVC - ok 19:32:54.0062 2980 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll 19:32:54.0296 2980 xmlprov - ok 19:32:54.0656 2980 XoftSpyService (547df50f6ab868184b7c1936ae1f527e) C:\Program Files\Common Files\XoftSpySE\6\xoftspyservice.exe 19:32:54.0921 2980 XoftSpyService - ok 19:32:54.0937 2980 xpsec - ok 19:32:55.0000 2980 MBR (0x1B8) (f381baacfc1778337c007982b0c32d82) \Device\Harddisk0\DR0 19:32:55.0000 2980 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - infected 19:32:55.0000 2980 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Sinowal.b (0) 19:32:55.0140 2980 Boot (0x1200) (8d0c98acf07e1c09bdefee5ebdfb8ca2) \Device\Harddisk0\DR0\Partition0 19:32:55.0140 2980 \Device\Harddisk0\DR0\Partition0 - ok 19:32:55.0156 2980 ============================================================ 19:32:55.0156 2980 Scan finished 19:32:55.0156 2980 ============================================================ 19:32:55.0281 4616 Detected object count: 4 19:32:55.0281 4616 Actual detected object count: 4 19:34:03.0375 4616 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user 19:34:03.0375 4616 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 19:34:03.0375 4616 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user 19:34:03.0375 4616 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 19:34:03.0390 4616 USBAAPL ( UnsignedFile.Multi.Generic ) - skipped by user 19:34:03.0390 4616 USBAAPL ( UnsignedFile.Multi.Generic ) - User select action: Skip 19:34:04.0328 4616 \Device\Harddisk0\DR0\# - copied to quarantine 19:34:04.0406 4616 \Device\Harddisk0\DR0 - copied to quarantine 19:34:04.0609 4616 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - will be cured on reboot 19:34:04.0625 4616 \Device\Harddisk0\DR0 - ok 19:34:04.0625 4616 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - User select action: Cure 19:34:06.0734 3980 Deinitialize success