[Essexboy]

Yes I would recommend that you empty that folder, it may be nothing but it is better to be safe than sorry

One final removal - how is the computer behaving now ?

Run TDSSKiller once more and when you get to the following item select delete :

\Device\Harddisk1\DR1 ( TDSS File System )

[Advertisements]

Thank you. I deleted the folder and ran aswMBR. It completed this time. I am not sure of how to copy it to my reply as the file created was a .dat file. I tried opening it up in notepad, but it just gave me some wierd characters. Should I run tdskiller again like you said or should I wait till you can see my aswMBR log?

[DZSlasher]

Thank you. I deleted the folder and ran aswMBR. It completed this time. I am not sure of how to copy it to my reply as the file created was a .dat file. I tried opening it up in notepad, but it just gave me some wierd characters. Should I run tdskiller again like you said or should I wait till you can see my aswMBR log?

[Essexboy]

Yes run TDSSKiller again to remove the file system remnants

Ensure that you save the log when completed

On completion of the scan click save log, save it to your desktop and post in your next reply

[DZSlasher]

When I ran tdsskiller again, I got two items. Locked file and TDSS File System. The Physical drive for the TDSS File System is Physical drive: \Device\Harddisk0\DR0. Am I supposed to delete the TDSS File System and skip the locked file? The location was a little different than your original post so I just wanted to make sure.

[Essexboy]

Yes delete the TDSSFile system. It is currently inert but it is not a good idea to leave it there

[DZSlasher]

Here is the log. When I click okay, avast popped up and said malware detected. It said the location was in the TDSSKiller_Quarantine folder. What should I do?

16:01:18.0136 1352 TDSS rootkit removing tool 2.7.20.0 Mar 9 2012 17:10:43
16:01:18.0413 1352 ============================================================
16:01:18.0413 1352 Current date / time: 2012/03/11 16:01:18.0413
16:01:18.0413 1352 SystemInfo:
16:01:18.0413 1352
16:01:18.0413 1352 OS Version: 6.1.7601 ServicePack: 1.0
16:01:18.0413 1352 Product type: Workstation
16:01:18.0413 1352 ComputerName: ARJUN-PC
16:01:18.0413 1352 UserName: Arjun
16:01:18.0413 1352 Windows directory: C:\Windows
16:01:18.0413 1352 System windows directory: C:\Windows
16:01:18.0414 1352 Running under WOW64
16:01:18.0414 1352 Processor architecture: Intel x64
16:01:18.0414 1352 Number of processors: 2
16:01:18.0414 1352 Page size: 0x1000
16:01:18.0414 1352 Boot type: Normal boot
16:01:18.0414 1352 ============================================================
16:01:19.0817 1352 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:01:19.0817 1352 Drive \Device\Harddisk1\DR1 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:01:19.0873 1352 \Device\Harddisk0\DR0:
16:01:19.0898 1352 MBR used
16:01:19.0898 1352 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x1B89D800
16:01:19.0898 1352 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1B89E000, BlocksNum 0x1927000
16:01:19.0898 1352 \Device\Harddisk1\DR1:
16:01:19.0899 1352 MBR used
16:01:19.0899 1352 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x1D1C4800
16:01:20.0387 1352 Initialize success
16:01:20.0387 1352 ============================================================
16:01:36.0748 3484 ============================================================
16:01:36.0748 3484 Scan started
16:01:36.0748 3484 Mode: Manual; SigCheck; TDLFS;
16:01:36.0748 3484 ============================================================
16:01:37.0916 3484 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
16:01:38.0087 3484 1394ohci - ok
16:01:38.0149 3484 Accelerometer (5c368f4b04ed2a923e6afca2d37baff5) C:\Windows\system32\DRIVERS\Accelerometer.sys
16:01:38.0193 3484 Accelerometer - ok
16:01:38.0255 3484 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
16:01:38.0275 3484 ACPI - ok
16:01:38.0319 3484 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
16:01:38.0405 3484 AcpiPmi - ok
16:01:38.0525 3484 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
16:01:38.0549 3484 adp94xx - ok
16:01:38.0617 3484 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
16:01:38.0637 3484 adpahci - ok
16:01:38.0667 3484 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
16:01:38.0685 3484 adpu320 - ok
16:01:38.0753 3484 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
16:01:38.0827 3484 AFD - ok
16:01:38.0894 3484 AgereSoftModem (98022774d9930ecbb292e70db7601df6) C:\Windows\system32\DRIVERS\agrsm64.sys
16:01:38.0994 3484 AgereSoftModem - ok
16:01:39.0042 3484 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
16:01:39.0056 3484 agp440 - ok
16:01:39.0136 3484 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
16:01:39.0150 3484 aliide - ok
16:01:39.0188 3484 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
16:01:39.0202 3484 amdide - ok
16:01:39.0246 3484 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
16:01:39.0304 3484 AmdK8 - ok
16:01:39.0773 3484 amdkmdag (9e3b4946f7e1bca0b763e19d81edbf2c) C:\Windows\system32\DRIVERS\atikmdag.sys
16:01:40.0209 3484 amdkmdag - ok
16:01:40.0327 3484 amdkmdap (b9e1c7b7f1865f99b16ff2e1bb94edb6) C:\Windows\system32\DRIVERS\atikmpag.sys
16:01:40.0378 3484 amdkmdap - ok
16:01:40.0436 3484 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
16:01:40.0478 3484 AmdPPM - ok
16:01:40.0523 3484 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
16:01:40.0539 3484 amdsata - ok
16:01:40.0557 3484 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
16:01:40.0574 3484 amdsbs - ok
16:01:40.0596 3484 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
16:01:40.0610 3484 amdxata - ok
16:01:40.0658 3484 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
16:01:40.0864 3484 AppID - ok
16:01:41.0007 3484 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
16:01:41.0023 3484 arc - ok
16:01:41.0063 3484 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
16:01:41.0079 3484 arcsas - ok
16:01:41.0157 3484 aswFsBlk (ce6d8bcc4787704ea4feeb92b0d0caf8) C:\Windows\system32\drivers\aswFsBlk.sys
16:01:41.0170 3484 aswFsBlk - ok
16:01:41.0220 3484 aswMonFlt (0debeb2e3fbd0bf5343125cce617f105) C:\Windows\system32\drivers\aswMonFlt.sys
16:01:41.0232 3484 aswMonFlt - ok
16:01:41.0305 3484 aswRdr (952edc2e81f85d1781958d4128bf59f8) C:\Windows\system32\drivers\aswRdr.sys
16:01:41.0317 3484 aswRdr - ok
16:01:41.0375 3484 aswSnx (dd383e2ac941c545a85ab72503da6c12) C:\Windows\system32\drivers\aswSnx.sys
16:01:41.0409 3484 aswSnx - ok
16:01:41.0455 3484 aswSP (ef5403fb8b2dcb791ec365fdf6040a4a) C:\Windows\system32\drivers\aswSP.sys
16:01:41.0473 3484 aswSP - ok
16:01:41.0524 3484 aswTdi (34165da5c6b30c0f9d61246bf8a28040) C:\Windows\system32\drivers\aswTdi.sys
16:01:41.0537 3484 aswTdi - ok
16:01:41.0570 3484 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
16:01:41.0735 3484 AsyncMac - ok
16:01:41.0770 3484 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
16:01:41.0783 3484 atapi - ok
16:01:41.0853 3484 AtiHDAudioService (2b3b05c0a7768bf033217eb8f33f9c35) C:\Windows\system32\drivers\AtihdW76.sys
16:01:41.0866 3484 AtiHDAudioService - ok
16:01:42.0130 3484 atikmdag (9e3b4946f7e1bca0b763e19d81edbf2c) C:\Windows\system32\DRIVERS\atikmdag.sys
16:01:42.0278 3484 atikmdag - ok
16:01:42.0392 3484 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
16:01:42.0460 3484 b06bdrv - ok
16:01:42.0492 3484 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
16:01:42.0544 3484 b57nd60a - ok
16:01:42.0665 3484 BCM43XX (fb4fda64f2e8552eaeb5986c3f34462c) C:\Windows\system32\DRIVERS\bcmwl664.sys
16:01:42.0771 3484 BCM43XX - ok
16:01:42.0829 3484 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
16:01:42.0889 3484 Beep - ok
16:01:42.0942 3484 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
16:01:42.0982 3484 blbdrive - ok
16:01:43.0054 3484 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
16:01:43.0120 3484 bowser - ok
16:01:43.0159 3484 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
16:01:43.0248 3484 BrFiltLo - ok
16:01:43.0265 3484 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
16:01:43.0284 3484 BrFiltUp - ok
16:01:43.0321 3484 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys
16:01:43.0380 3484 BridgeMP - ok
16:01:43.0440 3484 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
16:01:43.0488 3484 Brserid - ok
16:01:43.0513 3484 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
16:01:43.0552 3484 BrSerWdm - ok
16:01:43.0598 3484 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
16:01:43.0638 3484 BrUsbMdm - ok
16:01:43.0647 3484 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
16:01:43.0678 3484 BrUsbSer - ok
16:01:43.0729 3484 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys
16:01:43.0781 3484 BthEnum - ok
16:01:43.0833 3484 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
16:01:43.0876 3484 BTHMODEM - ok
16:01:43.0924 3484 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
16:01:43.0948 3484 BthPan - ok
16:01:44.0024 3484 BTHPORT (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys
16:01:44.0083 3484 BTHPORT - ok
16:01:44.0114 3484 BTHUSB (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys
16:01:44.0146 3484 BTHUSB - ok
16:01:44.0202 3484 btusbflt (2641a3fe3d7b0646308f33b67f3b5300) C:\Windows\system32\drivers\btusbflt.sys
16:01:44.0215 3484 btusbflt - ok
16:01:44.0228 3484 catchme - ok
16:01:44.0264 3484 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
16:01:44.0330 3484 cdfs - ok
16:01:44.0378 3484 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
16:01:44.0417 3484 cdrom - ok
16:01:44.0472 3484 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
16:01:44.0494 3484 circlass - ok
16:01:44.0541 3484 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
16:01:44.0562 3484 CLFS - ok
16:01:44.0643 3484 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
16:01:44.0679 3484 CmBatt - ok
16:01:44.0713 3484 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
16:01:44.0726 3484 cmdide - ok
16:01:44.0767 3484 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
16:01:44.0797 3484 CNG - ok
16:01:44.0840 3484 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
16:01:44.0853 3484 Compbatt - ok
16:01:44.0899 3484 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
16:01:44.0933 3484 CompositeBus - ok
16:01:45.0022 3484 cpuz133 (95c88d25e211a4d52a82c53e5d93e634) C:\Windows\system32\drivers\cpuz133_x64.sys
16:01:45.0034 3484 cpuz133 - ok
16:01:45.0068 3484 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
16:01:45.0082 3484 crcdisk - ok
16:01:45.0159 3484 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
16:01:45.0238 3484 CSC - ok
16:01:45.0296 3484 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
16:01:45.0355 3484 DfsC - ok
16:01:45.0391 3484 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
16:01:45.0452 3484 discache - ok
16:01:45.0493 3484 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
16:01:45.0509 3484 Disk - ok
16:01:45.0586 3484 Dot4 (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys
16:01:45.0627 3484 Dot4 - ok
16:01:45.0677 3484 Dot4Print (e9f5969233c5d89f3c35e3a66a52a361) C:\Windows\system32\DRIVERS\Dot4Prt.sys
16:01:45.0719 3484 Dot4Print - ok
16:01:45.0754 3484 dot4usb (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys
16:01:45.0791 3484 dot4usb - ok
16:01:45.0847 3484 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
16:01:45.0883 3484 drmkaud - ok
16:01:45.0970 3484 dtsoftbus01 (fb9bef3401ee5ecc2603311b9c64f44a) C:\Windows\system32\DRIVERS\dtsoftbus01.sys
16:01:45.0986 3484 dtsoftbus01 - ok
16:01:46.0061 3484 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
16:01:46.0104 3484 DXGKrnl - ok
16:01:46.0221 3484 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
16:01:46.0334 3484 ebdrv - ok
16:01:46.0377 3484 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
16:01:46.0402 3484 elxstor - ok
16:01:46.0443 3484 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
16:01:46.0481 3484 ErrDev - ok
16:01:46.0539 3484 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
16:01:46.0605 3484 exfat - ok
16:01:46.0637 3484 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
16:01:46.0706 3484 fastfat - ok
16:01:46.0749 3484 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
16:01:46.0788 3484 fdc - ok
16:01:46.0821 3484 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
16:01:46.0836 3484 FileInfo - ok
16:01:46.0862 3484 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
16:01:46.0924 3484 Filetrace - ok
16:01:46.0993 3484 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
16:01:47.0012 3484 flpydisk - ok
16:01:47.0067 3484 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
16:01:47.0086 3484 FltMgr - ok
16:01:47.0110 3484 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
16:01:47.0125 3484 FsDepends - ok
16:01:47.0134 3484 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
16:01:47.0148 3484 Fs_Rec - ok
16:01:47.0200 3484 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
16:01:47.0222 3484 fvevol - ok
16:01:47.0240 3484 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
16:01:47.0255 3484 gagp30kx - ok
16:01:47.0304 3484 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
16:01:47.0315 3484 GEARAspiWDM - ok
16:01:47.0395 3484 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
16:01:47.0425 3484 hcw85cir - ok
16:01:47.0466 3484 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
16:01:47.0509 3484 HdAudAddService - ok
16:01:47.0565 3484 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
16:01:47.0605 3484 HDAudBus - ok
16:01:47.0643 3484 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
16:01:47.0660 3484 HidBatt - ok
16:01:47.0671 3484 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
16:01:47.0717 3484 HidBth - ok
16:01:47.0748 3484 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
16:01:47.0783 3484 HidIr - ok
16:01:47.0835 3484 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
16:01:47.0870 3484 HidUsb - ok
16:01:47.0940 3484 hpdskflt (4e0bec0f78096ffd6d3314b497fc49d3) C:\Windows\system32\DRIVERS\hpdskflt.sys
16:01:47.0951 3484 hpdskflt - ok
16:01:48.0017 3484 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
16:01:48.0033 3484 HpSAMD - ok
16:01:48.0101 3484 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
16:01:48.0178 3484 HTTP - ok
16:01:48.0225 3484 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
16:01:48.0238 3484 hwpolicy - ok
16:01:48.0291 3484 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
16:01:48.0309 3484 i8042prt - ok
16:01:48.0362 3484 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
16:01:48.0385 3484 iaStorV - ok
16:01:48.0431 3484 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
16:01:48.0445 3484 iirsp - ok
16:01:48.0472 3484 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
16:01:48.0486 3484 intelide - ok
16:01:48.0516 3484 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
16:01:48.0555 3484 intelppm - ok
16:01:48.0606 3484 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:01:48.0669 3484 IpFilterDriver - ok
16:01:48.0709 3484 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
16:01:48.0748 3484 IPMIDRV - ok
16:01:48.0778 3484 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
16:01:48.0837 3484 IPNAT - ok
16:01:48.0895 3484 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
16:01:48.0989 3484 IRENUM - ok
16:01:49.0015 3484 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
16:01:49.0029 3484 isapnp - ok
16:01:49.0060 3484 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
16:01:49.0079 3484 iScsiPrt - ok
16:01:49.0121 3484 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
16:01:49.0135 3484 kbdclass - ok
16:01:49.0185 3484 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
16:01:49.0217 3484 kbdhid - ok
16:01:49.0272 3484 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
16:01:49.0287 3484 KSecDD - ok
16:01:49.0306 3484 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
16:01:49.0323 3484 KSecPkg - ok
16:01:49.0371 3484 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
16:01:49.0433 3484 ksthunk - ok
16:01:49.0519 3484 LEqdUsb (abfd2b5726f4cce49297ae48806cc594) C:\Windows\system32\DRIVERS\LEqdUsb.Sys
16:01:49.0534 3484 LEqdUsb - ok
16:01:49.0585 3484 LHidEqd (933f69cf9acd2498693bfcd7ed68e8d4) C:\Windows\system32\DRIVERS\LHidEqd.Sys
16:01:49.0598 3484 LHidEqd - ok
16:01:49.0708 3484 LHidFilt (1074c77a47835e03c15bf92452f9a750) C:\Windows\system32\DRIVERS\LHidFilt.Sys
16:01:49.0759 3484 LHidFilt - ok
16:01:49.0836 3484 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
16:01:49.0894 3484 lltdio - ok
16:01:49.0973 3484 LMIInfo - ok
16:01:50.0050 3484 lmimirr (413ecdcfad9a82804d3674c8d7eec24e) C:\Windows\system32\DRIVERS\lmimirr.sys
16:01:50.0063 3484 lmimirr - ok
16:01:50.0097 3484 LMIRfsClientNP - ok
16:01:50.0132 3484 LMIRfsDriver (c57d3faa50e6f395759ffb7c709bd944) C:\Windows\system32\drivers\LMIRfsDriver.sys
16:01:50.0145 3484 LMIRfsDriver - ok
16:01:50.0191 3484 LMouFilt (96999c364c649e2866a268f7420a304a) C:\Windows\system32\DRIVERS\LMouFilt.Sys
16:01:50.0204 3484 LMouFilt - ok
16:01:50.0256 3484 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
16:01:50.0273 3484 LSI_FC - ok
16:01:50.0293 3484 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
16:01:50.0309 3484 LSI_SAS - ok
16:01:50.0336 3484 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
16:01:50.0352 3484 LSI_SAS2 - ok
16:01:50.0364 3484 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
16:01:50.0382 3484 LSI_SCSI - ok
16:01:50.0417 3484 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
16:01:50.0482 3484 luafv - ok
16:01:50.0507 3484 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
16:01:50.0522 3484 megasas - ok
16:01:50.0554 3484 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
16:01:50.0574 3484 MegaSR - ok
16:01:50.0633 3484 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
16:01:50.0690 3484 Modem - ok
16:01:50.0731 3484 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
16:01:50.0770 3484 monitor - ok
16:01:50.0824 3484 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
16:01:50.0839 3484 mouclass - ok
16:01:50.0873 3484 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
16:01:50.0909 3484 mouhid - ok
16:01:50.0954 3484 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
16:01:50.0969 3484 mountmgr - ok
16:01:51.0014 3484 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
16:01:51.0030 3484 mpio - ok
16:01:51.0073 3484 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
16:01:51.0116 3484 mpsdrv - ok
16:01:51.0162 3484 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
16:01:51.0253 3484 MRxDAV - ok
16:01:51.0294 3484 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
16:01:51.0342 3484 mrxsmb - ok
16:01:51.0376 3484 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:01:51.0412 3484 mrxsmb10 - ok
16:01:51.0437 3484 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:01:51.0455 3484 mrxsmb20 - ok
16:01:51.0493 3484 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
16:01:51.0507 3484 msahci - ok
16:01:51.0550 3484 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
16:01:51.0568 3484 msdsm - ok
16:01:51.0637 3484 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
16:01:51.0679 3484 Msfs - ok
16:01:51.0705 3484 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
16:01:51.0765 3484 mshidkmdf - ok
16:01:51.0790 3484 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
16:01:51.0804 3484 msisadrv - ok
16:01:51.0857 3484 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
16:01:51.0914 3484 MSKSSRV - ok
16:01:51.0939 3484 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
16:01:51.0999 3484 MSPCLOCK - ok
16:01:52.0024 3484 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
16:01:52.0093 3484 MSPQM - ok
16:01:52.0147 3484 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
16:01:52.0170 3484 MsRPC - ok
16:01:52.0212 3484 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
16:01:52.0225 3484 mssmbios - ok
16:01:52.0288 3484 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
16:01:52.0341 3484 MSTEE - ok
16:01:52.0370 3484 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
16:01:52.0411 3484 MTConfig - ok
16:01:52.0443 3484 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
16:01:52.0458 3484 Mup - ok
16:01:52.0511 3484 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
16:01:52.0552 3484 NativeWifiP - ok
16:01:52.0622 3484 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
16:01:52.0666 3484 NDIS - ok
16:01:52.0697 3484 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
16:01:52.0739 3484 NdisCap - ok
16:01:52.0770 3484 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
16:01:52.0831 3484 NdisTapi - ok
16:01:52.0892 3484 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
16:01:52.0954 3484 Ndisuio - ok
16:01:53.0011 3484 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
16:01:53.0072 3484 NdisWan - ok
16:01:53.0117 3484 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
16:01:53.0179 3484 NDProxy - ok
16:01:53.0256 3484 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
16:01:53.0298 3484 NetBIOS - ok
16:01:53.0339 3484 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
16:01:53.0405 3484 NetBT - ok
16:01:53.0481 3484 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
16:01:53.0496 3484 nfrd960 - ok
16:01:53.0534 3484 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
16:01:53.0597 3484 Npfs - ok
16:01:53.0628 3484 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
16:01:53.0684 3484 nsiproxy - ok
16:01:53.0773 3484 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
16:01:53.0848 3484 Ntfs - ok
16:01:53.0865 3484 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
16:01:53.0920 3484 Null - ok
16:01:53.0966 3484 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
16:01:53.0982 3484 nvraid - ok
16:01:54.0009 3484 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
16:01:54.0026 3484 nvstor - ok
16:01:54.0075 3484 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
16:01:54.0091 3484 nv_agp - ok
16:01:54.0134 3484 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
16:01:54.0173 3484 ohci1394 - ok
16:01:54.0226 3484 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
16:01:54.0245 3484 Parport - ok
16:01:54.0285 3484 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
16:01:54.0300 3484 partmgr - ok
16:01:54.0338 3484 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
16:01:54.0355 3484 pci - ok
16:01:54.0381 3484 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
16:01:54.0395 3484 pciide - ok
16:01:54.0408 3484 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
16:01:54.0426 3484 pcmcia - ok
16:01:54.0447 3484 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
16:01:54.0461 3484 pcw - ok
16:01:54.0493 3484 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
16:01:54.0578 3484 PEAUTH - ok
16:01:54.0704 3484 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
16:01:54.0767 3484 PptpMiniport - ok
16:01:54.0822 3484 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
16:01:54.0859 3484 Processor - ok
16:01:54.0923 3484 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
16:01:54.0980 3484 Psched - ok
16:01:55.0038 3484 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
16:01:55.0111 3484 ql2300 - ok
16:01:55.0133 3484 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
16:01:55.0149 3484 ql40xx - ok
16:01:55.0170 3484 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
16:01:55.0209 3484 QWAVEdrv - ok
16:01:55.0219 3484 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
16:01:55.0262 3484 RasAcd - ok
16:01:55.0322 3484 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
16:01:55.0365 3484 RasAgileVpn - ok
16:01:55.0411 3484 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
16:01:55.0466 3484 Rasl2tp - ok
16:01:55.0494 3484 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
16:01:55.0556 3484 RasPppoe - ok
16:01:55.0595 3484 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
16:01:55.0652 3484 RasSstp - ok
16:01:55.0695 3484 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
16:01:55.0754 3484 rdbss - ok
16:01:55.0783 3484 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
16:01:55.0818 3484 rdpbus - ok
16:01:55.0844 3484 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
16:01:55.0906 3484 RDPCDD - ok
16:01:55.0954 3484 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
16:01:56.0000 3484 RDPDR - ok
16:01:56.0035 3484 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
16:01:56.0092 3484 RDPENCDD - ok
16:01:56.0126 3484 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
16:01:56.0170 3484 RDPREFMP - ok
16:01:56.0210 3484 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
16:01:56.0254 3484 RDPWD - ok
16:01:56.0311 3484 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
16:01:56.0330 3484 rdyboost - ok
16:01:56.0383 3484 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
16:01:56.0427 3484 RFCOMM - ok
16:01:56.0491 3484 RsFx0151 (c606c5f712a3761896ceffa4af6b1268) C:\Windows\system32\DRIVERS\RsFx0151.sys
16:01:56.0510 3484 RsFx0151 - ok
16:01:56.0577 3484 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
16:01:56.0637 3484 rspndr - ok
16:01:56.0678 3484 RTL8167 (abcb5a38a0d85bdf69b7877e1ad1eed5) C:\Windows\system32\DRIVERS\Rt64win7.sys
16:01:56.0724 3484 RTL8167 - ok
16:01:56.0759 3484 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
16:01:56.0808 3484 s3cap - ok
16:01:56.0832 3484 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
16:01:56.0848 3484 sbp2port - ok
16:01:56.0938 3484 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
16:01:56.0992 3484 scfilter - ok
16:01:57.0050 3484 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys
16:01:57.0090 3484 sdbus - ok
16:01:57.0146 3484 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
16:01:57.0210 3484 secdrv - ok
16:01:57.0243 3484 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
16:01:57.0261 3484 Serenum - ok
16:01:57.0283 3484 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
16:01:57.0302 3484 Serial - ok
16:01:57.0336 3484 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
16:01:57.0366 3484 sermouse - ok
16:01:57.0435 3484 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
16:01:57.0476 3484 sffdisk - ok
16:01:57.0500 3484 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
16:01:57.0531 3484 sffp_mmc - ok
16:01:57.0564 3484 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\DRIVERS\sffp_sd.sys
16:01:57.0600 3484 sffp_sd - ok
16:01:57.0645 3484 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
16:01:57.0683 3484 sfloppy - ok
16:01:57.0719 3484 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
16:01:57.0733 3484 SiSRaid2 - ok
16:01:57.0758 3484 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
16:01:57.0774 3484 SiSRaid4 - ok
16:01:57.0828 3484 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
16:01:57.0872 3484 Smb - ok
16:01:57.0908 3484 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
16:01:57.0921 3484 spldr - ok
16:01:58.0002 3484 sptd (602884696850c86434530790b110e8eb) C:\Windows\system32\Drivers\sptd.sys
16:01:58.0003 3484 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb
16:01:58.0005 3484 sptd ( LockedFile.Multi.Generic ) - warning
16:01:58.0005 3484 sptd - detected LockedFile.Multi.Generic (1)
16:01:58.0091 3484 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
16:01:58.0149 3484 srv - ok
16:01:58.0175 3484 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
16:01:58.0216 3484 srv2 - ok
16:01:58.0251 3484 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
16:01:58.0294 3484 srvnet - ok
16:01:58.0377 3484 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
16:01:58.0391 3484 stexstor - ok
16:01:58.0436 3484 STHDA (dffbc024dfc7bb05b2129e05cbc7a201) C:\Windows\system32\DRIVERS\stwrt64.sys
16:01:58.0514 3484 STHDA - ok
16:01:58.0553 3484 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
16:01:58.0568 3484 storflt - ok
16:01:58.0597 3484 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
16:01:58.0611 3484 storvsc - ok
16:01:58.0641 3484 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
16:01:58.0655 3484 swenum - ok
16:01:58.0721 3484 SynTP (3a706a967295e16511e40842b1a2761d) C:\Windows\system32\DRIVERS\SynTP.sys
16:01:58.0741 3484 SynTP - ok
16:01:58.0835 3484 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
16:01:58.0923 3484 Tcpip - ok
16:01:58.0984 3484 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
16:01:59.0028 3484 TCPIP6 - ok
16:01:59.0068 3484 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
16:01:59.0131 3484 tcpipreg - ok
16:01:59.0171 3484 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
16:01:59.0228 3484 TDPIPE - ok
16:01:59.0255 3484 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
16:01:59.0297 3484 TDTCP - ok
16:01:59.0344 3484 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
16:01:59.0390 3484 tdx - ok
16:01:59.0448 3484 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
16:01:59.0463 3484 TermDD - ok
16:01:59.0522 3484 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
16:01:59.0582 3484 tssecsrv - ok
16:01:59.0639 3484 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
16:01:59.0676 3484 TsUsbFlt - ok
16:01:59.0720 3484 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
16:01:59.0783 3484 tunnel - ok
16:01:59.0853 3484 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
16:01:59.0894 3484 uagp35 - ok
16:02:00.0041 3484 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
16:02:00.0088 3484 udfs - ok
16:02:00.0136 3484 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
16:02:00.0151 3484 uliagpkx - ok
16:02:00.0195 3484 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
16:02:00.0229 3484 umbus - ok
16:02:00.0260 3484 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
16:02:00.0297 3484 UmPass - ok
16:02:00.0368 3484 USBAAPL64 (fb251567f41bc61988b26731dec19e4b) C:\Windows\system32\Drivers\usbaapl64.sys
16:02:00.0418 3484 USBAAPL64 - ok
16:02:00.0454 3484 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
16:02:00.0476 3484 usbccgp - ok
16:02:00.0533 3484 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
16:02:00.0570 3484 usbcir - ok
16:02:00.0608 3484 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
16:02:00.0648 3484 usbehci - ok
16:02:00.0705 3484 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
16:02:00.0750 3484 usbhub - ok
16:02:00.0791 3484 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
16:02:00.0808 3484 usbohci - ok
16:02:00.0841 3484 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
16:02:00.0878 3484 usbprint - ok
16:02:00.0914 3484 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
16:02:00.0958 3484 usbscan - ok
16:02:00.0997 3484 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:02:01.0051 3484 USBSTOR - ok
16:02:01.0090 3484 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
16:02:01.0128 3484 usbuhci - ok
16:02:01.0181 3484 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
16:02:01.0205 3484 usbvideo - ok
16:02:01.0253 3484 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
16:02:01.0267 3484 vdrvroot - ok
16:02:01.0312 3484 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
16:02:01.0333 3484 vga - ok
16:02:01.0358 3484 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
16:02:01.0420 3484 VgaSave - ok
16:02:01.0446 3484 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
16:02:01.0465 3484 vhdmp - ok
16:02:01.0485 3484 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
16:02:01.0499 3484 viaide - ok
16:02:01.0530 3484 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
16:02:01.0548 3484 vmbus - ok
16:02:01.0568 3484 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
16:02:01.0599 3484 VMBusHID - ok
16:02:01.0623 3484 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
16:02:01.0638 3484 volmgr - ok
16:02:01.0682 3484 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
16:02:01.0704 3484 volmgrx - ok
16:02:01.0734 3484 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
16:02:01.0754 3484 volsnap - ok
16:02:01.0803 3484 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
16:02:01.0820 3484 vsmraid - ok
16:02:01.0852 3484 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
16:02:01.0894 3484 vwifibus - ok
16:02:01.0937 3484 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
16:02:01.0980 3484 vwififlt - ok
16:02:02.0003 3484 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
16:02:02.0025 3484 vwifimp - ok
16:02:02.0055 3484 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
16:02:02.0087 3484 WacomPen - ok
16:02:02.0135 3484 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
16:02:02.0200 3484 WANARP - ok
16:02:02.0227 3484 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
16:02:02.0269 3484 Wanarpv6 - ok
16:02:02.0311 3484 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
16:02:02.0325 3484 Wd - ok
16:02:02.0365 3484 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
16:02:02.0402 3484 Wdf01000 - ok
16:02:02.0454 3484 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
16:02:02.0497 3484 WfpLwf - ok
16:02:02.0508 3484 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
16:02:02.0522 3484 WIMMount - ok
16:02:02.0585 3484 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
16:02:02.0625 3484 WinUsb - ok
16:02:02.0679 3484 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
16:02:02.0697 3484 WmiAcpi - ok
16:02:02.0764 3484 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
16:02:02.0830 3484 ws2ifsl - ok
16:02:02.0883 3484 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
16:02:02.0944 3484 WudfPf - ok
16:02:02.0984 3484 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
16:02:03.0050 3484 WUDFRd - ok
16:02:03.0105 3484 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
16:02:03.0190 3484 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
16:02:03.0191 3484 \Device\Harddisk0\DR0 - detected TDSS File System (1)
16:02:03.0194 3484 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1
16:02:03.0582 3484 \Device\Harddisk1\DR1 - ok
16:02:03.0585 3484 Boot (0x1200) (6429d61e2bd621e495bd0ad135716036) \Device\Harddisk0\DR0\Partition0
16:02:03.0586 3484 \Device\Harddisk0\DR0\Partition0 - ok
16:02:03.0616 3484 Boot (0x1200) (21aa69a6aad05eb347b8847a52a538fa) \Device\Harddisk0\DR0\Partition1
16:02:03.0618 3484 \Device\Harddisk0\DR0\Partition1 - ok
16:02:03.0621 3484 Boot (0x1200) (031f00f14948ac9f90940e4c558620e8) \Device\Harddisk1\DR1\Partition0
16:02:03.0623 3484 \Device\Harddisk1\DR1\Partition0 - ok
16:02:03.0624 3484 ============================================================
16:02:03.0625 3484 Scan finished
16:02:03.0625 3484 ============================================================
16:02:03.0638 1588 Detected object count: 2
16:02:03.0638 1588 Actual detected object count: 2
16:14:32.0172 1588 sptd ( LockedFile.Multi.Generic ) - skipped by user
16:14:32.0172 1588 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
16:14:32.0221 1588 \Device\Harddisk0\DR0\TDLFS\cfg.ini - copied to quarantine
16:14:32.0224 1588 \Device\Harddisk0\DR0\TDLFS\mbr - copied to quarantine
16:14:32.0227 1588 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine
16:14:32.0230 1588 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine
16:14:39.0639 1588 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine
16:14:39.0703 1588 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine
16:14:39.0777 1588 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine
16:14:39.0878 1588 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine
16:14:40.0027 1588 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine
16:14:40.0105 1588 \Device\Harddisk0\DR0\TDLFS\bckfg.tmp - copied to quarantine
16:14:40.0106 1588 \Device\Harddisk0\DR0\TDLFS - deleted
16:14:40.0106 1588 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Delete

[Essexboy]

It is a quarantined file anyway - but let it move it to the chest

How is the computer behaving now ? Any funny things happening, can you access windows updates ?

[DZSlasher]

Everything seems to be running better. It does not take as long to load a webpage. I will keep track of it. I plan on running a full avast scan right now to see if the virus is still there. Is there a program that I can use to clean my Flash Drive to make sure that virus did not infect it?

[Essexboy]

For your Flash Drive I would recommend Panda Vaccinate full instructions are on the page

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :Commands
  [resethosts]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Remove ComboFix

• Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
• In the Run box, type in ComboFix /Uninstall (Notice the space between the "x" and "/") then click OK
  
  
  
• Follow the prompts on the screen
• A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

• Go to this site and click Do I have Java
• It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point

• Go to Control Panel and select System
• Select System
• On the left select System Protection and accept the warning if you get one
• Select System Protection Tab
• Select Create at the bottom
• Type in a name i.e. Clean
• Select Create

Now we can purge the infected ones

• GoStart > All programs > Accessories > system tools
• Right click Disc cleanup and select run as administrator
• Select Your main drive and accept the warning if you get one
• For a few moments the system will make some calculations
• Select the More Options tab
• In the System Restore and Shadow Backups select Clean up
• Select Delete on the pop up
• Select OK
• Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

Keep safe

[DZSlasher]

Thank you so much for your help. I really appreciate your help. I ran OTL and it removed all of the apps except for aswMBR. Can I manually delete it? Additionally, should I save the logs for the programs?

[Essexboy]

Just delete aswMBR form the desktop, there is no need to keep any of the logs.

Keep safe

[DZSlasher]

Hi Essexboy. Thank you for your helping me with my computer. It has been running well the last few day but I recently launched windows defender because the windows update for the definitions failed. When I launched windows defender, I found out that defender does not work. I looked at my msconfig and the windows defender was not there. I tried starting the service but I got Error 126: The specific module could not be found. I have tried finding a way to fix it on google but have had no luck. What should I do?

[Essexboy]

Lets have a look see

run farbar service scanner



Tick "All" options.
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

[DZSlasher]

My log:

Farbar Service Scanner Version: 01-03-2012
Ran by Arjun (administrator) on 15-03-2012 at 09:44:15
Running from "C:\Users\Arjun\Desktop"
Microsoft Windows 7 Professional Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend: "%ProgramFiles(x86)%\Windows Defender\mpsvc.dll".


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

[Essexboy]

Hmm FARBAR reports that is present and correct

Go Start > All Programs > Accessories
Right click command prompt and select run as Administrator
Copy/Paste the following command and hit enter

MpCmdRun.exe -RestoreDefaults

Then reboot and try again