[CompCav]

Now that you are in normal mode delete your current copy of Combofix and TDSSKiller.

I want you to do these runs in normal mode with the video like it is.

Download and Install Combofix

Download ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop * IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. This infection will require a reboot to correct so make sure these are turned off and will not turn back on at reboot. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
• Accept the disclaimer and allow to update if it asks
  
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
  
  
• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
  
• Click on Yes, to continue scanning for malware.
  
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" for further review.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions


Step 2.

Download the latest version of TDSSKiller from here and save it to your Desktop.

• Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
  
  
  
• Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
  
  
  
• Click the Start Scan button.
  
  
  
• If a suspicious object is detected, the default action will be Skip, click on Continue.
  
  
  
• If malicious objects are found, they will show in the Scan results and offer three (3) options.
• Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
  
  
  
• Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  
• Get the report by selecting Reports
  
  

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.


Step 3.

Please post:

ComboFix.txt
TDSSKiller log

Update me on your computer issues.

[Advertisements]

The resolution is very bad. I can't change it. So i rebooted, but normal Windows won't open. I'll have to go back to safe mode. Sorry.

Edited by DragonFromWales, 27 May 2012 - 01:15 PM.

[DragonFromWales]

The resolution is very bad. I can't change it. So i rebooted, but normal Windows won't open. I'll have to go back to safe mode. Sorry.

Edited by DragonFromWales, 27 May 2012 - 01:15 PM.

[DragonFromWales]

wrong thread

Edited by DragonFromWales, 27 May 2012 - 01:29 PM.

[DragonFromWales]

The resolution is very bad. I can't change it. So i rebooted, but normal Windows won't open. I'll have to go back to safe mode. Sorry. What now?

[CompCav]

We need to do a memory check.

http://www.geekstogo...sing-memtest86/
The guide is comprehensive with images.

If you get evidence of a bad memory stick remove all but one and test them one at a time for 8 full cycles.

[DragonFromWales]

Did 8 full cycles with both sticks. No errors.

[CompCav]

Please do run the tools requested in Post #46.

Make sure you delete the current versions of those tools off your desktop if they are still there and then begin!

[DragonFromWales]

ComboFix 12-06-01.02 - Administrator 31/12/2002 23:38:33.1.1 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.991.732 [GMT 0:00]
Running from: c:\documents and settings\Administrator\My Documents\Downloads\ComboFix.exe
AV: TalkTalk Security 9.01 *Enabled/Updated* {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: TalkTalk Security 9.01 *Enabled* {D4747503-0346-49EB-9262-997542F79BF4}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\All Users\Application Data\QTSBandwidthCache
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\Erin\WINDOWS
c:\documents and settings\Guest\WINDOWS
c:\documents and settings\Robin.PRIF\Application Data\1&1
c:\documents and settings\Robin.PRIF\WINDOWS
c:\program files\Search Settings
c:\program files\Search Settings\kb127\SearchSettings.dll
c:\program files\Search Settings\kb127\SearchSettingsRes409.dll
c:\program files\Search Settings\SearchSettings.exe
c:\windows\apppatch\apploc.exe
c:\windows\system32\65.dll
c:\windows\system32\atmlib44.exe
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\OggDSuninst.exe
c:\windows\system32\SNDALRT.log
c:\windows\system32\SNDCON.log
c:\windows\system32\SNDDBG.log
c:\windows\system32\SNDFW.log
c:\windows\system32\SNDIDS.log
c:\windows\system32\SNDSYS.log
c:\windows\system32\xvfv.dll
.
Infected copy of c:\windows\system32\msgsvc.dll was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\msgsvc.dll
.
Infected copy of c:\windows\system32\mqbkup.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\mqbkup.exe
.
Infected copy of c:\windows\system32\mqsvc.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\mqsvc.exe
.
Infected copy of c:\windows\system32\mqtgsvc.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\mqtgsvc.exe
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_EPSONSTATUSAGENT2
-------\Service_EPSONStatusAgent2
.
.
((((((((((((((((((((((((( Files Created from 2002-11-28 to 2002-12-31 )))))))))))))))))))))))))))))))
.
.
2012-05-28 09:59 . 2012-05-28 10:18 -------- d-----w- C:\Erase604.tmp
2012-05-24 04:15 . 2012-05-24 04:15 -------- d-----w- C:\_OTL
2012-01-30 09:42 . 2012-01-30 09:43 -------- d-----w- C:\e4c5f7d2fca106d54790b0f436
2012-01-24 14:59 . 2012-05-20 10:06 -------- d-----w- C:\dros dro
2012-01-24 14:59 . 2012-05-06 08:32 -------- d-----w- C:\teulu
2011-03-09 19:30 . 2012-05-21 15:57 -------- d-----w- C:\LLuniaur teulu
2008-08-04 09:19 . 2008-08-04 09:19 -------- d-----w- C:\NotesSQL
2008-01-13 16:09 . 2009-01-10 05:41 -------- d-----w- C:\MLBEE
2008-01-11 17:24 . 2008-01-11 17:24 -------- d-----w- C:\CanonMF
2008-01-11 17:02 . 2008-01-11 17:02 -------- d-----w- C:\3e69f417ff73acd432fc6c5d13303a
2006-02-16 16:35 . 2006-02-17 09:41 -------- d-----w- C:\RecoveryBin
2005-07-27 08:22 . 2005-08-25 08:37 -------- d-----w- C:\My MP3s
2005-07-21 12:40 . 2005-07-21 12:40 -------- d-----w- C:\My Media
2005-07-11 11:19 . 2005-07-11 11:19 -------- d-----r- C:\MSOCache
2005-05-26 12:48 . 2008-05-03 15:40 -------- d-----w- C:\EPSON
2004-07-04 18:40 . 2004-07-04 18:40 -------- d-----w- C:\adaptec
2004-06-03 11:00 . 2004-06-03 11:00 -------- d-----w- C:\unzipped
2004-05-14 11:27 . 2003-01-23 21:15 229888 ----a-w- C:\fhexdump.dll
2004-05-14 08:32 . 2004-05-14 08:32 56 --sh--w- C:\redir.sys
2004-05-13 13:10 . 2008-05-27 08:05 -------- d-----w- C:\Virus remover
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-11 13:12 . 2008-02-17 09:56 1862272 ----a-w- c:\windows\system32\win32k.sys
2012-03-01 11:01 . 2004-02-06 17:05 916992 ----a-w- c:\windows\system32\wininet.dll
2012-02-29 14:10 . 2003-11-09 02:41 177664 ----a-w- c:\windows\system32\wintrust.dll
2011-11-25 21:57 . 2003-11-09 02:41 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-16 14:21 . 2004-08-06 07:32 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-01 09:07 . 2012-04-04 16:49 1461992 ----a-w- c:\windows\system32\wdfcoinstaller01009.dll
2011-10-18 11:13 . 2002-11-26 14:15 186880 ----a-w- c:\windows\system32\encdec.dll
2011-10-14 14:47 . 2003-11-09 02:41 176128 ----a-w- c:\windows\system32\winmm.dll
2011-09-26 11:41 . 2008-07-29 19:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-03-04 06:37 . 2003-11-09 02:41 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-02-17 12:32 . 2012-01-29 14:22 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2011-02-09 13:53 . 2002-11-26 14:15 270848 ----a-w- c:\windows\system32\sbe.dll
2010-08-27 08:02 . 2003-11-09 02:41 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2008-02-17 09:56 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-06-14 14:31 . 2003-11-09 03:51 744448 ----a-w- c:\windows\pchealth\HelpCtr\Binaries\helpsvc.exe
2010-04-16 15:36 . 2003-11-09 02:41 406016 ----a-w- c:\windows\system32\usp10.dll
2010-01-29 14:43 . 2002-07-22 15:24 307260 ----a-w- c:\windows\system32\l3codeca.acm
2009-11-27 16:07 . 2001-08-17 22:36 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2001-08-17 22:36 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-21 15:51 . 2003-11-09 02:40 471552 ----a-w- c:\windows\apppatch\aclayers.dll
2009-10-21 05:38 . 2004-08-04 07:56 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-08-26 08:00 . 2003-11-09 02:41 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-06 19:24 . 2008-01-11 16:57 21728 ----a-w- c:\windows\system32\wucltui.dll.mui
2009-08-06 19:24 . 2004-08-13 07:33 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 19:24 . 2004-08-13 07:33 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 19:24 . 2008-01-11 16:57 15072 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2009-08-06 19:24 . 2005-05-26 03:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 19:24 . 2004-08-13 07:33 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 19:24 . 2004-08-13 07:33 217816 ----a-w- c:\windows\system32\wuaucpl.cpl
2009-08-06 19:24 . 2008-01-11 16:57 15064 ----a-w- c:\windows\system32\wuapi.dll.mui
2009-08-06 19:24 . 2003-11-09 03:50 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 19:24 . 2008-01-11 16:57 17632 ----a-w- c:\windows\system32\wuaueng.dll.mui
2009-08-06 19:23 . 2004-08-13 07:33 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 19:23 . 2003-11-09 03:50 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-07-13 23:43 . 2004-05-24 13:51 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-06-25 08:25 . 2003-11-09 02:41 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-12 12:31 . 2003-11-09 02:41 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2003-11-09 02:41 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 06:14 . 2008-02-17 09:56 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-04-01 23:02 . 2004-05-13 23:53 604160 ----a-w- c:\windows\system32\wmspdmod.dll
2009-03-08 04:30 . 2003-11-09 02:41 66560 ----a-w- c:\windows\system32\tdc.ocx
2008-07-29 21:10 . 2008-07-29 21:10 26112 ----a-w- c:\windows\system32\TsWpfWrp.exe
2008-07-06 12:06 . 2012-01-30 09:42 575488 ------w- c:\windows\system32\xpsshhdr.dll
2008-07-06 12:06 . 2012-01-30 09:42 1676288 ------w- c:\windows\system32\xpssvcs.dll
2008-06-24 18:12 . 2006-10-18 21:47 295936 ----a-w- c:\windows\system32\wmpeffects.dll
2008-06-18 05:03 . 2004-05-13 23:53 938496 ----a-w- c:\windows\system32\WMNetmgr.dll
2008-05-30 13:19 . 2008-07-25 21:58 507400 -c--a-w- c:\windows\system32\XAudio2_1.dll
2008-05-30 13:18 . 2008-07-25 21:58 238088 -c--a-w- c:\windows\system32\xactengine3_1.dll
2008-05-30 13:17 . 2008-07-25 21:58 65032 -c--a-w- c:\windows\system32\XAPOFX1_0.dll
2008-05-30 13:17 . 2008-07-25 21:58 25608 -c--a-w- c:\windows\system32\X3DAudio1_4.dll
2008-05-09 23:23 . 2003-11-09 02:41 135168 ----a-w- c:\windows\system32\wshom.ocx
2008-05-09 10:53 . 2003-11-09 02:41 90112 ----a-w- c:\windows\system32\wshext.dll
2008-05-08 11:24 . 2003-11-09 02:41 155648 ----a-w- c:\windows\system32\wscript.exe
2008-04-14 00:13 . 2003-11-09 02:41 12168 ----a-w- c:\windows\system32\tsddd.dll
2008-04-14 00:12 . 2008-02-17 09:56 146432 ----a-w- c:\windows\system32\winspool.drv
2008-04-14 00:12 . 2003-11-09 04:10 23552 ----a-w- c:\windows\system32\wdmaud.drv
2008-04-14 00:12 . 2003-11-09 02:41 206848 ----a-w- c:\windows\system32\unimdm.tsp
2008-04-14 00:12 . 2002-08-29 03:41 294912 ----a-w- c:\windows\system32\msh263.drv
2008-04-14 00:12 . 2003-11-09 02:41 679936 ----a-w- c:\windows\system32\sstext3d.scr
2008-04-14 00:12 . 2003-11-09 02:41 610304 ----a-w- c:\windows\system32\sspipes.scr
2008-04-14 00:12 . 2003-11-09 02:41 14336 ----a-w- c:\windows\system32\ssstars.scr
2008-04-14 00:12 . 2003-11-09 02:41 47104 ----a-w- c:\windows\system32\ssmypics.scr
2008-04-14 00:12 . 2003-11-09 02:41 20992 ----a-w- c:\windows\system32\ssmarque.scr
2008-04-14 00:12 . 2003-11-09 02:41 18944 ----a-w- c:\windows\system32\ssmyst.scr
2008-04-14 00:12 . 2004-08-04 07:56 239616 ----a-w- c:\windows\system32\wstrenderer.ax
2008-04-14 00:12 . 2004-08-04 07:56 164352 ----a-w- c:\windows\system32\wstpager.ax
2008-04-14 00:12 . 2003-11-09 02:41 393216 ----a-w- c:\windows\system32\ssflwbox.scr
2008-04-14 00:12 . 2003-11-09 02:41 19968 ----a-w- c:\windows\system32\ssbezier.scr
2008-04-14 00:12 . 2003-11-09 02:41 704512 ----a-w- c:\windows\system32\ss3dfo.scr
2008-04-14 00:12 . 2004-08-04 07:56 53248 ----a-w- c:\windows\system32\vbicodec.ax
2008-04-14 00:12 . 2004-08-04 07:56 28672 ----a-w- c:\windows\system32\vidcap.ax
2008-04-14 00:12 . 2003-11-09 14:15 30208 ----a-w- c:\windows\system32\vbisurf.ax
2008-04-14 00:12 . 2003-11-09 02:41 278559 ----a-w- c:\windows\system32\wmv8ds32.ax
2008-04-14 00:12 . 2003-11-09 02:41 258048 ----a-w- c:\windows\system32\wmvds32.ax
2008-04-14 00:12 . 2003-11-09 02:41 12800 ----a-w- c:\windows\system32\tree.com
2008-04-14 00:12 . 2002-11-14 11:58 154624 ----a-w- c:\windows\system32\ivfsrc.ax
2008-04-14 00:12 . 2002-11-14 11:58 848384 ----a-w- c:\windows\system32\ir41_32.ax
2008-04-14 00:12 . 2002-11-14 11:58 199680 ----a-w- c:\windows\system32\iac25_32.ax
2008-04-14 00:12 . 2008-02-17 09:56 300544 ----a-w- c:\windows\system32\sysdm.cpl
2008-04-14 00:12 . 2004-08-04 07:56 148480 ----a-w- c:\windows\system32\wscui.cpl
2008-04-14 00:12 . 2004-08-04 07:56 13824 ----a-w- c:\windows\system32\wscntfy.exe
2008-04-14 00:12 . 2003-11-09 02:41 30720 ----a-w- c:\windows\system32\xcopy.exe
2008-04-14 00:12 . 2003-11-09 02:41 11264 ----a-w- c:\windows\system32\wpnpinst.exe
2008-04-14 00:12 . 2003-11-09 02:41 94208 ----a-w- c:\windows\system32\timedate.cpl
2008-04-14 00:12 . 2003-11-09 02:41 32256 ----a-w- c:\windows\system32\wpabaln.exe
2008-04-14 00:12 . 2003-11-09 02:41 5632 ----a-w- c:\windows\system32\winver.exe
2008-04-14 00:12 . 2003-11-09 02:41 507904 ----a-w- c:\windows\system32\winlogon.exe
2008-04-14 00:12 . 2003-11-09 02:41 65024 ----a-w- c:\windows\system32\wextract.exe
2008-04-14 00:12 . 2003-11-09 02:41 433664 ----a-w- c:\windows\system32\wiaacmgr.exe
2008-04-14 00:12 . 2008-02-17 09:56 26112 ----a-w- c:\windows\system32\userinit.exe
2008-04-14 00:12 . 2006-03-17 00:38 28672 ----a-w- c:\windows\system32\verclsid.exe
2008-04-14 00:12 . 2003-11-09 03:52 150528 ----a-w- c:\windows\pchealth\UploadLB\Binaries\uploadm.exe
2008-04-14 00:12 . 2003-11-09 02:41 289792 ----a-w- c:\windows\system32\vssvc.exe
2008-04-14 00:12 . 2003-11-09 02:41 50176 ----a-w- c:\windows\system32\utilman.exe
2008-04-14 00:12 . 2003-11-09 02:41 18432 ----a-w- c:\windows\system32\ups.exe
2008-04-14 00:12 . 2003-11-09 02:41 16896 ----a-w- c:\windows\system32\upnpcont.exe
2008-04-14 00:12 . 2003-11-09 02:41 73216 ----a-w- c:\windows\system32\tlntsvr.exe
2008-04-14 00:12 . 2003-11-09 02:41 259584 ----a-w- c:\windows\system32\tracerpt.exe
2008-04-14 00:12 . 2003-11-09 02:41 12288 ----a-w- c:\windows\system32\tracert.exe
2008-04-14 00:12 . 2003-11-09 02:40 347136 ----a-w- c:\windows\system32\tourstart.exe
2012-05-03 19:39 . 2012-01-29 14:04 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"SoundMan"="SOUNDMAN.EXE" [2003-06-10 55296]
"F-Secure Manager"="c:\program files\TalkTalk\Security\Common\FSM32.EXE" [2009-08-05 199264]
"F-Secure TNB"="c:\program files\TalkTalk\Security\FSGUI\TNBUtil.exe" [2009-08-05 2349664]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2012-04-03 160840]
"iolo Startup"="c:\program files\iolo\Common\Lib\ioloLManager.exe" [2012-04-17 938680]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"ALUAlert"="c:\program files\Symantec\LiveUpdate\ALUNotify.exe" [BU]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]
.
c:\documents and settings\Erin\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\Robin.PRIF\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2012-5-20 333088]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0autocheck smrgdf c:\documents and settings\Robin.PRIF\Application Data\iolo\\06.\0?Ò?\0]\0Software\Adobe\Acrobat Reader\10.0\RememberedViews\cNoCategoryFiles\c12\cViewDef\cTopLeftView\0l\0?Ò?\0]\0Software\Adobe\Acrobat Reader\10.0\RememberedViews\cNoCategoryFiles\c12\cViewDef\cTopLeftView\0

\0???\0g\0Offline pages are Web pages that are stored on your computer so you can view them without being connected to the Internet. If you delete these pages now, you can still view your favorites offline later by synchronizing them. Your personalized settings for Web pages will be left intact.\0unt
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearchWHSE
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinMem
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-11-04 10:30 413696 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Scan Buttons]
2006-01-12 18:21 221184 -c--a-w- c:\program files\EPSON\Creativity Suite\PageManager\Pmsb.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"InvisibleBrowsing"=
"Nokia Tray Application"=c:\program files\Common Files\Nokia\Tools\NclTray.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"<NO NAME>"=
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\RemoteAdminSettings]
"RemoteAddresses"= *
"Enabled"= 1 (0x1)
.
R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [29/01/2012 14:21 44184]
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [29/01/2012 14:21 82120]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23/08/2006 12:52 716272]
R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [19/03/2012 12:21 1047336]
S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\TalkTalk\Security\HIPS\drivers\fshs.sys [29/01/2012 14:19 68064]
S2 bsaspi32;bsaspi32; [x]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [30/01/2012 16:02 135664]
S2 PVM Service;PVM Service;c:\program files\RingThree\bin\PvmService.exe [08/11/2007 01:02 294912]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [05/04/2012 07:20 257696]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\TalkTalk\Security\Anti-Virus\minifilter\fsgk.sys [29/01/2012 14:18 148632]
S3 FSORSPClient;F-Secure ORSP Client;c:\program files\TalkTalk\Security\ORSP Client\fsorsp.exe [29/01/2012 14:19 61088]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [30/01/2012 16:02 135664]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [03/05/2012 19:40 129976]
S3 SNCT511;PC Camera (6005 CIF);c:\windows\system32\drivers\snct511.sys [13/07/2005 15:55 234368]
S3 Z302Mic;Vimicro Z302 Mic Audio Filter Driver;c:\windows\system32\drivers\UsbMicfilt.sys [07/07/2005 10:04 22571]
S3 ZSMC302;PCL-W310;c:\windows\system32\drivers\usbvm302.sys [07/07/2005 10:04 93962]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\TalkTalk\Security\Anti-Virus\win2k\fsfilter.sys [29/01/2012 14:18 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\TalkTalk\Security\Anti-Virus\win2k\fsrec.sys [29/01/2012 14:18 25184]
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 20:33]
.
2012-05-20 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
2012-05-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-30 16:02]
.
2012-05-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-30 16:02]
.
2004-05-25 c:\windows\Tasks\new.job
- c:\windows\system32\ntbackup.exe [2003-11-09 00:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.boyns.net/
uInternet Settings,ProxyServer = 10.10.10.10:3128
LSP: c:\program files\TalkTalk\Security\FSPS\program\FSLSP.DLL
Trusted Zone: contentmatch.net\ny
TCP: DhcpNameServer = 192.168.1.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {C1BAC744-8F0B-11D0-89E7-00C0A8295197} - hxxp://www.nwales-traffic.co.uk/files/activex/camera.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dewj4bc4.default\
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{0D84EF14-ED8E-475F-96D4-2123F65D701B} - (no file)
HKLM-RunOnce-SMRequiresRestart - (no file)
AddRemove-OggDS - c:\windows\system32\OggDSuninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2002-12-31 23:53
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{057AFF8E-18BB-3F80-364CCC2831522BE6}\{99AD5AFA-2676-F639-545B2C570527D246}\{9515C81F-50C9-6ACD-17AF77618A15A8EB}*]
"63AUOURV1X6YIYB2ELIFO4LTRC1"=hex:01,00,01,00,00,00,00,00,87,da,ad,38,2b,26,f8,
c3,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EA0A4278-51A3-7709-84DDEF02950ADF94}\{11936336-4B9A-79DD-A94F2AD208D83E94}\{0A7B61F5-80AE-3EB6-867F93DE000E0517}*]
"63AUOURV1X6YIYB2ELIFO4LTRC1"=hex:01,00,01,00,00,00,00,00,87,da,ad,38,2b,26,f8,
c3,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(632)
c:\windows\system32\l3codeca.acm
c:\windows\system32\DivXa32.acm
c:\windows\system32\imc32.acm
c:\windows\system32\LameACM.acm
c:\windows\system32\IEFRAME.dll
c:\windows\system32\ac3filter.acm
c:\windows\system32\l3codecp.acm
.
- - - - - - - > 'explorer.exe'(1916)
c:\windows\system32\WININET.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\iolo\System Mechanic\SystemGuardAlerter.exe
.
**************************************************************************
.
Completion time: 2003-01-01 00:03:53 - machine was rebooted
ComboFix-quarantined-files.txt 2003-01-01 00:03
ComboFix2.txt 2012-05-23 19:55
.
Pre-Run: 38,850,121,728 bytes free
Post-Run: 38,805,917,696 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - E8A343347FAC309EEF6E76FA4CC36222

[DragonFromWales]

02:53:44.0015 1972 TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
02:53:44.0343 1972 ============================================================
02:53:44.0343 1972 Current date / time: 2003/01/01 02:53:44.0343
02:53:44.0343 1972 SystemInfo:
02:53:44.0343 1972
02:53:44.0343 1972 OS Version: 5.1.2600 ServicePack: 3.0
02:53:44.0343 1972 Product type: Workstation
02:53:44.0343 1972 ComputerName: PRIF
02:53:44.0343 1972 UserName: Administrator
02:53:44.0343 1972 Windows directory: C:\WINDOWS
02:53:44.0343 1972 System windows directory: C:\WINDOWS
02:53:44.0343 1972 Processor architecture: Intel x86
02:53:44.0343 1972 Number of processors: 1
02:53:44.0343 1972 Page size: 0x1000
02:53:44.0343 1972 Boot type: Safe boot with network
02:53:44.0343 1972 ============================================================
02:53:46.0031 1972 Drive \Device\Harddisk0\DR0 - Size: 0x1C9FEF0000 (114.50 Gb), SectorSize: 0x200, Cylinders: 0x3A62, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
02:53:46.0031 1972 Drive \Device\Harddisk1\DR2 - Size: 0x1E100000 (0.47 Gb), SectorSize: 0x200, Cylinders: 0x3D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
02:53:46.0031 1972 ============================================================
02:53:46.0031 1972 \Device\Harddisk0\DR0:
02:53:46.0031 1972 MBR partitions:
02:53:46.0031 1972 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xE4FBFA3
02:53:46.0031 1972 \Device\Harddisk1\DR2:
02:53:46.0031 1972 MBR partitions:
02:53:46.0031 1972 \Device\Harddisk1\DR2\Partition0: MBR, Type 0x6, StartLBA 0x20, BlocksNum 0xF07E0
02:53:46.0031 1972 ============================================================
02:53:46.0078 1972 C: <-> \Device\Harddisk0\DR0\Partition0
02:53:46.0078 1972 ============================================================
02:53:46.0078 1972 Initialize success
02:53:46.0078 1972 ============================================================
02:53:52.0281 1536 ============================================================
02:53:52.0281 1536 Scan started
02:53:52.0281 1536 Mode: Manual; SigCheck; TDLFS;
02:53:52.0281 1536 ============================================================
02:53:53.0265 1536 61883 (914a9709fc3bf419ad2f85547f2a4832) C:\WINDOWS\system32\DRIVERS\61883.sys
02:53:53.0562 1536 61883 - ok
02:53:53.0578 1536 Abiosdsk - ok
02:53:53.0593 1536 abp480n5 - ok
02:53:53.0640 1536 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
02:53:53.0796 1536 ACPI - ok
02:53:53.0828 1536 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
02:53:54.0015 1536 ACPIEC - ok
02:53:54.0109 1536 AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
02:53:54.0125 1536 AdobeFlashPlayerUpdateSvc - ok
02:53:54.0156 1536 adpu160m - ok
02:53:54.0203 1536 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
02:53:54.0390 1536 aec - ok
02:53:54.0437 1536 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
02:53:54.0468 1536 AFD - ok
02:53:54.0500 1536 Aha154x - ok
02:53:54.0515 1536 aic78u2 - ok
02:53:54.0546 1536 aic78xx - ok
02:53:54.0640 1536 ALCXWDM (02d94d2d336d3de8c5e8fe04a62d552d) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
02:53:54.0734 1536 ALCXWDM - ok
02:53:54.0781 1536 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll
02:53:54.0968 1536 Alerter - ok
02:53:55.0000 1536 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe
02:53:55.0203 1536 ALG - ok
02:53:55.0218 1536 AliIde - ok
02:53:55.0265 1536 AmdK7 (8fce268cdbdd83b23419d1f35f42c7b1) C:\WINDOWS\system32\DRIVERS\amdk7.sys
02:53:55.0406 1536 AmdK7 - ok
02:53:55.0437 1536 amsint - ok
02:53:55.0500 1536 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll
02:53:55.0671 1536 AppMgmt - ok
02:53:55.0734 1536 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
02:53:55.0890 1536 Arp1394 - ok
02:53:55.0921 1536 asc - ok
02:53:55.0953 1536 asc3350p - ok
02:53:55.0984 1536 asc3550 - ok
02:53:56.0078 1536 Aspi32 (b979979ab8027f7f53fb16ec4229b7db) C:\WINDOWS\system32\drivers\aspi32.sys
02:53:56.0093 1536 Aspi32 ( UnsignedFile.Multi.Generic ) - warning
02:53:56.0093 1536 Aspi32 - detected UnsignedFile.Multi.Generic (1)
02:53:56.0187 1536 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
02:53:56.0203 1536 aspnet_state - ok
02:53:56.0234 1536 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
02:53:56.0406 1536 AsyncMac - ok
02:53:56.0453 1536 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
02:53:56.0625 1536 atapi - ok
02:53:56.0656 1536 Atdisk - ok
02:53:56.0703 1536 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
02:53:56.0890 1536 Atmarpc - ok
02:53:56.0937 1536 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll
02:53:57.0109 1536 AudioSrv - ok
02:53:57.0156 1536 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
02:53:57.0375 1536 audstub - ok
02:53:57.0421 1536 Avc (f8e6956a614f15a0860474c5e2a7de6b) C:\WINDOWS\system32\DRIVERS\avc.sys
02:53:57.0609 1536 Avc - ok
02:53:57.0671 1536 basic2 (1b9c81ab9a456eabd9f8335f04b5f495) C:\WINDOWS\system32\DRIVERS\HSF_BSC2.sys
02:53:57.0875 1536 basic2 - ok
02:53:57.0953 1536 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
02:53:58.0171 1536 Beep - ok
02:53:58.0234 1536 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll
02:53:58.0421 1536 BITS - ok
02:53:58.0453 1536 Brother XP spl Service (d3facb34fff5db91adb70987838f8ba7) C:\WINDOWS\System32\brsvc01a.exe
02:53:58.0484 1536 Brother XP spl Service - ok
02:53:58.0546 1536 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll
02:53:58.0703 1536 Browser - ok
02:53:58.0765 1536 BrPar (2fe6d5be0629f706197b30c0aa05de30) C:\WINDOWS\System32\drivers\BrPar.sys
02:53:58.0765 1536 BrPar ( UnsignedFile.Multi.Generic ) - warning
02:53:58.0765 1536 BrPar - detected UnsignedFile.Multi.Generic (1)
02:53:58.0796 1536 bsaspi32 - ok
02:53:58.0843 1536 BthEnum (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys
02:53:59.0031 1536 BthEnum - ok
02:53:59.0062 1536 BthPan (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys
02:53:59.0203 1536 BthPan - ok
02:53:59.0265 1536 BTHPORT (662bfd909447dd9cc15b1a1c366583b4) C:\WINDOWS\system32\Drivers\BTHport.sys
02:53:59.0312 1536 BTHPORT - ok
02:53:59.0343 1536 BthServ (f4c43c66471b87996d95db7a3a664a37) C:\WINDOWS\System32\bthserv.dll
02:53:59.0515 1536 BthServ - ok
02:53:59.0828 1536 BTHUSB (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys
02:54:00.0031 1536 BTHUSB - ok
02:54:00.0031 1536 catchme - ok
02:54:00.0062 1536 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
02:54:00.0281 1536 cbidf2k - ok
02:54:00.0312 1536 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
02:54:00.0500 1536 CCDECODE - ok
02:54:00.0500 1536 cd20xrnt - ok
02:54:00.0546 1536 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
02:54:00.0765 1536 Cdaudio - ok
02:54:00.0796 1536 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
02:54:00.0968 1536 Cdfs - ok
02:54:01.0031 1536 cdrbsvsd (c1ec76f0af2c4f748eb2c907fb345c48) C:\WINDOWS\system32\drivers\cdrbsvsd.sys
02:54:01.0031 1536 cdrbsvsd ( UnsignedFile.Multi.Generic ) - warning
02:54:01.0031 1536 cdrbsvsd - detected UnsignedFile.Multi.Generic (1)
02:54:01.0062 1536 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
02:54:01.0234 1536 Cdrom - ok
02:54:01.0250 1536 Changer - ok
02:54:01.0296 1536 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe
02:54:01.0468 1536 CiSvc - ok
02:54:01.0500 1536 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe
02:54:01.0671 1536 ClipSrv - ok
02:54:01.0765 1536 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
02:54:01.0781 1536 clr_optimization_v2.0.50727_32 - ok
02:54:01.0796 1536 CmdIde - ok
02:54:01.0796 1536 COMSysApp - ok
02:54:01.0828 1536 Cpqarray - ok
02:54:02.0015 1536 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll
02:54:02.0187 1536 CryptSvc - ok
02:54:02.0203 1536 dac2w2k - ok
02:54:02.0218 1536 dac960nt - ok
02:54:02.0250 1536 DCamUSBSQTECH (100ff3d9e16afb3163bd6f9aaaab7c55) C:\WINDOWS\system32\Drivers\SQcaptur.sys
02:54:02.0281 1536 DCamUSBSQTECH ( UnsignedFile.Multi.Generic ) - warning
02:54:02.0296 1536 DCamUSBSQTECH - detected UnsignedFile.Multi.Generic (1)
02:54:02.0343 1536 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll
02:54:02.0453 1536 DcomLaunch - ok
02:54:02.0484 1536 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll
02:54:02.0640 1536 Dhcp - ok
02:54:02.0687 1536 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
02:54:02.0843 1536 Disk - ok
02:54:02.0906 1536 DLABOIOM (a14524d3f130a57163e0b3e057fc85d5) C:\WINDOWS\system32\DLA\DLABOIOM.SYS
02:54:02.0921 1536 DLABOIOM ( UnsignedFile.Multi.Generic ) - warning
02:54:02.0921 1536 DLABOIOM - detected UnsignedFile.Multi.Generic (1)
02:54:02.0953 1536 DLACDBHM (7581407a6a3c56860ae31e6e423fe824) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS
02:54:02.0968 1536 DLACDBHM ( UnsignedFile.Multi.Generic ) - warning
02:54:02.0968 1536 DLACDBHM - detected UnsignedFile.Multi.Generic (1)
02:54:03.0000 1536 DLADResN (7c4cdf8a684b63d7482e0bf7440dc3b5) C:\WINDOWS\system32\DLA\DLADResN.SYS
02:54:03.0015 1536 DLADResN ( UnsignedFile.Multi.Generic ) - warning
02:54:03.0015 1536 DLADResN - detected UnsignedFile.Multi.Generic (1)
02:54:03.0031 1536 DLAIFS_M (97bca2aac06a9fea56615b4b15bdb9b8) C:\WINDOWS\system32\DLA\DLAIFS_M.SYS
02:54:03.0046 1536 DLAIFS_M ( UnsignedFile.Multi.Generic ) - warning
02:54:03.0046 1536 DLAIFS_M - detected UnsignedFile.Multi.Generic (1)
02:54:03.0062 1536 DLAOPIOM (be8d558cf749424f0de612813f7c6725) C:\WINDOWS\system32\DLA\DLAOPIOM.SYS
02:54:03.0078 1536 DLAOPIOM ( UnsignedFile.Multi.Generic ) - warning
02:54:03.0078 1536 DLAOPIOM - detected UnsignedFile.Multi.Generic (1)
02:54:03.0109 1536 DLAPoolM (7e5277cb45dc5e2a86af8ce093c7ef31) C:\WINDOWS\system32\DLA\DLAPoolM.SYS
02:54:03.0109 1536 DLAPoolM ( UnsignedFile.Multi.Generic ) - warning
02:54:03.0109 1536 DLAPoolM - detected UnsignedFile.Multi.Generic (1)
02:54:03.0140 1536 DLARTL_N (693dfd92d41a3d270053cd97834e4960) C:\WINDOWS\system32\Drivers\DLARTL_N.SYS
02:54:03.0156 1536 DLARTL_N ( UnsignedFile.Multi.Generic ) - warning
02:54:03.0156 1536 DLARTL_N - detected UnsignedFile.Multi.Generic (1)
02:54:03.0281 1536 DLAUDFAM (d886b6d02b51e5bd61b8a571a16d5ca2) C:\WINDOWS\system32\DLA\DLAUDFAM.SYS
02:54:03.0296 1536 DLAUDFAM ( UnsignedFile.Multi.Generic ) - warning
02:54:03.0296 1536 DLAUDFAM - detected UnsignedFile.Multi.Generic (1)
02:54:03.0375 1536 DLAUDF_M (2c0ecf7a9d5162d87c64e2ae868b5039) C:\WINDOWS\system32\DLA\DLAUDF_M.SYS
02:54:03.0390 1536 DLAUDF_M ( UnsignedFile.Multi.Generic ) - warning
02:54:03.0390 1536 DLAUDF_M - detected UnsignedFile.Multi.Generic (1)
02:54:03.0390 1536 dmadmin - ok
02:54:03.0453 1536 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
02:54:03.0609 1536 dmboot - ok
02:54:03.0656 1536 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
02:54:03.0828 1536 dmio - ok
02:54:03.0875 1536 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
02:54:04.0062 1536 dmload - ok
02:54:04.0093 1536 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll
02:54:04.0250 1536 dmserver - ok
02:54:04.0281 1536 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
02:54:04.0437 1536 DMusic - ok
02:54:04.0468 1536 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll
02:54:04.0515 1536 Dnscache - ok
02:54:04.0562 1536 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll
02:54:04.0703 1536 Dot3svc - ok
02:54:04.0718 1536 dpti2o - ok
02:54:04.0734 1536 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
02:54:04.0890 1536 drmkaud - ok
02:54:04.0937 1536 DRVMCDB (73623d89faef4d1aa600edee8b490bc5) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS
02:54:04.0953 1536 DRVMCDB ( UnsignedFile.Multi.Generic ) - warning
02:54:04.0953 1536 DRVMCDB - detected UnsignedFile.Multi.Generic (1)
02:54:04.0968 1536 DRVNDDM (2aeee1600d0f14ba535f90a1f4411b54) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS
02:54:04.0984 1536 DRVNDDM ( UnsignedFile.Multi.Generic ) - warning
02:54:04.0984 1536 DRVNDDM - detected UnsignedFile.Multi.Generic (1)
02:54:05.0015 1536 dtscsi (12aca694b50ea53563c1e7c99e7bb27d) C:\WINDOWS\System32\Drivers\dtscsi.sys
02:54:05.0046 1536 dtscsi - ok
02:54:05.0093 1536 DVD-RAM_Service (77c4901986fc7a83e853b300e80d234b) C:\WINDOWS\System32\DVDRAMSV.exe
02:54:05.0109 1536 DVD-RAM_Service ( UnsignedFile.Multi.Generic ) - warning
02:54:05.0109 1536 DVD-RAM_Service - detected UnsignedFile.Multi.Generic (1)
02:54:05.0140 1536 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll
02:54:05.0296 1536 EapHost - ok
02:54:05.0406 1536 eeCtrl (47ce4e650d91dc095a2fddb15631a78a) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
02:54:05.0437 1536 eeCtrl - ok
02:54:05.0546 1536 EpsonBidirectionalService (a0fb385b6281d694f8930c2ef85c453e) C:\Program Files\Common Files\EPSON\eEBAPI\eEBSVC.exe
02:54:05.0562 1536 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - warning
02:54:05.0562 1536 EpsonBidirectionalService - detected UnsignedFile.Multi.Generic (1)
02:54:05.0593 1536 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll
02:54:05.0734 1536 ERSvc - ok
02:54:05.0765 1536 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
02:54:05.0828 1536 Eventlog - ok
02:54:05.0859 1536 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\System32\es.dll
02:54:05.0937 1536 EventSystem - ok
02:54:06.0031 1536 F-Secure Filter (d4980588ed87f8bb16be43ddd0fbd5fe) C:\Program Files\TalkTalk\Security\Anti-Virus\Win2K\FSfilter.sys
02:54:06.0046 1536 F-Secure Filter - ok
02:54:06.0078 1536 F-Secure Gatekeeper (29d12e1e45d93b45d2598e2663bbeff4) C:\Program Files\TalkTalk\Security\Anti-Virus\minifilter\fsgk.sys
02:54:06.0093 1536 F-Secure Gatekeeper - ok
02:54:06.0125 1536 F-Secure Gatekeeper Handler Starter (a9be66e05254b20df82e0f7cddeca7dd) C:\Program Files\TalkTalk\Security\Anti-Virus\fsgk32st.exe
02:54:06.0140 1536 F-Secure Gatekeeper Handler Starter - ok
02:54:06.0171 1536 F-Secure HIPS (f5aca65237c7511d5803cdc5e7003d75) C:\Program Files\TalkTalk\Security\HIPS\drivers\fshs.sys
02:54:06.0187 1536 F-Secure HIPS - ok
02:54:06.0203 1536 F-Secure Recognizer (6ce1195511533c9359f91a9e63792f5e) C:\Program Files\TalkTalk\Security\Anti-Virus\Win2K\FSrec.sys
02:54:06.0218 1536 F-Secure Recognizer - ok
02:54:06.0296 1536 FA312 (aa855fb8a866281aacb393c1feab91ae) C:\WINDOWS\system32\DRIVERS\FA312nd5.sys
02:54:06.0640 1536 FA312 - ok
02:54:06.0703 1536 Fallback (c823debe2548656549f84a875d65237b) C:\WINDOWS\system32\DRIVERS\HSF_FALL.sys
02:54:06.0937 1536 Fallback - ok
02:54:06.0984 1536 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
02:54:07.0109 1536 Fastfat - ok
02:54:07.0156 1536 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
02:54:07.0187 1536 FastUserSwitchingCompatibility - ok
02:54:07.0203 1536 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
02:54:07.0484 1536 Fdc - ok
02:54:07.0500 1536 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
02:54:07.0718 1536 FETNDIS - ok
02:54:07.0765 1536 FETNDISB (693f6de7a06225ad242ffcacfe70800b) C:\WINDOWS\system32\DRIVERS\fetnd5b.sys
02:54:07.0796 1536 FETNDISB - ok
02:54:07.0812 1536 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
02:54:07.0953 1536 Fips - ok
02:54:07.0968 1536 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
02:54:08.0140 1536 Flpydisk - ok
02:54:08.0171 1536 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
02:54:08.0312 1536 FltMgr - ok
02:54:08.0406 1536 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
02:54:08.0421 1536 FontCache3.0.0.0 - ok
02:54:08.0453 1536 fsbts (1d2de58a837e6909f98ca35103d10739) C:\WINDOWS\system32\Drivers\fsbts.sys
02:54:08.0468 1536 fsbts - ok
02:54:08.0609 1536 FSDFWD (8e0bf7478cc3baed48282adbc97adafb) C:\Program Files\TalkTalk\Security\FWES\Program\fsdfwd.exe
02:54:08.0640 1536 FSDFWD - ok
02:54:08.0687 1536 FSFW (aca3910a53a057b8c3a6ebf4ef788c7c) C:\WINDOWS\system32\drivers\fsdfw.sys
02:54:08.0703 1536 FSFW - ok
02:54:08.0750 1536 Fsks (6483414841d4cab6c3b4db2ac6edd70b) C:\WINDOWS\system32\DRIVERS\HSF_FSKS.sys
02:54:08.0968 1536 Fsks - ok
02:54:09.0031 1536 FSMA (392e85687a902239c01baddf212b1a36) C:\Program Files\TalkTalk\Security\Common\FSMA32.EXE
02:54:09.0046 1536 FSMA - ok
02:54:09.0078 1536 FSORSPClient (42aef6a385354aca65fc210ce7ce4d7c) C:\Program Files\TalkTalk\Security\ORSP Client\fsorsp.exe
02:54:09.0093 1536 FSORSPClient - ok
02:54:09.0140 1536 FsVga (455f778ee14368468560bd7cb8c854d0) C:\WINDOWS\system32\DRIVERS\fsvga.sys
02:54:09.0343 1536 FsVga - ok
02:54:09.0390 1536 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
02:54:09.0609 1536 Fs_Rec - ok
02:54:09.0671 1536 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
02:54:09.0906 1536 Ftdisk - ok
02:54:09.0953 1536 GEARAspiWDM (ab8a6a87d9d7255c3884d5b9541a6e80) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
02:54:09.0953 1536 GEARAspiWDM - ok
02:54:09.0968 1536 GMSIPCI - ok
02:54:09.0984 1536 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
02:54:10.0125 1536 Gpc - ok
02:54:10.0187 1536 gupdate (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe
02:54:10.0203 1536 gupdate - ok
02:54:10.0203 1536 gupdatem (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe
02:54:10.0234 1536 gupdatem - ok
02:54:10.0296 1536 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
02:54:10.0312 1536 gusvc - ok
02:54:10.0375 1536 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
02:54:10.0515 1536 helpsvc - ok
02:54:10.0531 1536 HidServ - ok
02:54:10.0562 1536 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
02:54:10.0718 1536 HidUsb - ok
02:54:10.0750 1536 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll
02:54:10.0890 1536 hkmsvc - ok
02:54:10.0906 1536 hpn - ok
02:54:10.0953 1536 HSFHWBS2 (376a3060770e356158e326a0a6983eb0) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
02:54:10.0968 1536 HSFHWBS2 ( UnsignedFile.Multi.Generic ) - warning
02:54:10.0968 1536 HSFHWBS2 - detected UnsignedFile.Multi.Generic (1)
02:54:11.0031 1536 HSF_DP (78ea911be6dcfb8d9a98a72550ec6c69) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
02:54:11.0109 1536 HSF_DP ( UnsignedFile.Multi.Generic ) - warning
02:54:11.0109 1536 HSF_DP - detected UnsignedFile.Multi.Generic (1)
02:54:11.0156 1536 hsf_msft (74e379857d4c0dfb56de2d19b8f4c434) C:\WINDOWS\system32\DRIVERS\HSF_MSFT.sys
02:54:11.0406 1536 hsf_msft - ok
02:54:11.0453 1536 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
02:54:11.0468 1536 HTTP - ok
02:54:11.0500 1536 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll
02:54:11.0640 1536 HTTPFilter - ok
02:54:11.0656 1536 i2omgmt - ok
02:54:11.0656 1536 i2omp - ok
02:54:11.0687 1536 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
02:54:11.0828 1536 i8042prt - ok
02:54:11.0968 1536 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
02:54:11.0984 1536 IDriverT ( UnsignedFile.Multi.Generic ) - warning
02:54:11.0984 1536 IDriverT - detected UnsignedFile.Multi.Generic (1)
02:54:12.0109 1536 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
02:54:12.0140 1536 idsvc - ok
02:54:12.0187 1536 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
02:54:12.0328 1536 Imapi - ok
02:54:12.0421 1536 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe
02:54:12.0578 1536 ImapiService - ok
02:54:12.0593 1536 ini910u - ok
02:54:12.0609 1536 IntelIde - ok
02:54:12.0765 1536 ioloSystemService (440a02fa25be8dccd2103d820036eda1) C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
02:54:12.0812 1536 ioloSystemService - ok
02:54:12.0859 1536 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
02:54:13.0000 1536 Ip6Fw - ok
02:54:13.0015 1536 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
02:54:13.0265 1536 IpFilterDriver - ok
02:54:13.0312 1536 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
02:54:13.0484 1536 IpInIp - ok
02:54:13.0515 1536 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
02:54:13.0656 1536 IpNat - ok
02:54:13.0687 1536 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
02:54:13.0828 1536 IPSec - ok
02:54:13.0859 1536 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
02:54:14.0000 1536 IRENUM - ok
02:54:14.0031 1536 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
02:54:14.0171 1536 isapnp - ok
02:54:14.0296 1536 JavaQuickStarterService (9aa67569d5257462e230767510b0c815) C:\Program Files\Java\jre6\bin\jqs.exe
02:54:14.0312 1536 JavaQuickStarterService - ok
02:54:14.0312 1536 JiaoCap - ok
02:54:14.0406 1536 K56 (9c5e3fdbfcc30cf71a49ca178b9ad442) C:\WINDOWS\system32\DRIVERS\HSF_K56K.sys
02:54:14.0734 1536 K56 - ok
02:54:14.0765 1536 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
02:54:14.0953 1536 Kbdclass - ok
02:54:15.0000 1536 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
02:54:15.0140 1536 kmixer - ok
02:54:15.0171 1536 KMWDFILTER (566c5fd480fdbce3ba5cf9fbcffaea9a) C:\WINDOWS\system32\DRIVERS\KMWDFILTER.sys
02:54:15.0187 1536 KMWDFILTER - ok
02:54:15.0218 1536 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
02:54:15.0250 1536 KSecDD - ok
02:54:15.0281 1536 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll
02:54:15.0312 1536 lanmanserver - ok
02:54:15.0343 1536 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll
02:54:15.0375 1536 lanmanworkstation - ok
02:54:15.0390 1536 lbrtfdc - ok
02:54:15.0421 1536 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll
02:54:15.0562 1536 LmHosts - ok
02:54:15.0578 1536 LVUSBSta - ok
02:54:15.0625 1536 MagicTune (f627e9da4d3d8dc05a15b68944302f14) C:\WINDOWS\system32\drivers\MTiCtwl.sys
02:54:15.0640 1536 MagicTune ( UnsignedFile.Multi.Generic ) - warning
02:54:15.0640 1536 MagicTune - detected UnsignedFile.Multi.Generic (1)
02:54:15.0671 1536 mcdbus (f922b609524cf1ed66a1a109f3ce014f) C:\WINDOWS\system32\DRIVERS\mcdbus.sys
02:54:15.0687 1536 mcdbus ( UnsignedFile.Multi.Generic ) - warning
02:54:15.0687 1536 mcdbus - detected UnsignedFile.Multi.Generic (1)
02:54:15.0828 1536 MDM (11f714f85530a2bd134074dc30e99fca) C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
02:54:15.0843 1536 MDM - ok
02:54:15.0906 1536 mdmxsdk (29174d3d90ee4244fda6355a859691be) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
02:54:15.0906 1536 mdmxsdk ( UnsignedFile.Multi.Generic ) - warning
02:54:15.0906 1536 mdmxsdk - detected UnsignedFile.Multi.Generic (1)
02:54:15.0953 1536 meiudf (766a1d242f4390ddf1243084898a20c9) C:\WINDOWS\system32\Drivers\meiudf.sys
02:54:15.0968 1536 meiudf ( UnsignedFile.Multi.Generic ) - warning
02:54:15.0968 1536 meiudf - detected UnsignedFile.Multi.Generic (1)
02:54:16.0000 1536 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll
02:54:16.0140 1536 Messenger - ok
02:54:16.0203 1536 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
02:54:16.0437 1536 mnmdd - ok
02:54:16.0468 1536 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\System32\mnmsrvc.exe
02:54:16.0609 1536 mnmsrvc - ok
02:54:16.0640 1536 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
02:54:16.0781 1536 Modem - ok
02:54:16.0812 1536 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
02:54:17.0046 1536 MODEMCSA - ok
02:54:17.0062 1536 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
02:54:17.0203 1536 Mouclass - ok
02:54:17.0234 1536 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
02:54:17.0484 1536 mouhid - ok
02:54:17.0500 1536 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
02:54:17.0625 1536 MountMgr - ok
02:54:17.0671 1536 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
02:54:17.0687 1536 MozillaMaintenance - ok
02:54:17.0703 1536 mraid35x - ok
02:54:17.0734 1536 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
02:54:17.0875 1536 MRxDAV - ok
02:54:17.0921 1536 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
02:54:17.0984 1536 MRxSmb - ok
02:54:18.0031 1536 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\System32\msdtc.exe
02:54:18.0156 1536 MSDTC - ok
02:54:18.0187 1536 MSDV (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys
02:54:18.0328 1536 MSDV - ok
02:54:18.0359 1536 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
02:54:18.0500 1536 Msfs - ok
02:54:18.0500 1536 MSIServer - ok
02:54:18.0531 1536 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
02:54:18.0687 1536 MSKSSRV - ok
02:54:18.0687 1536 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
02:54:18.0828 1536 MSPCLOCK - ok
02:54:18.0843 1536 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
02:54:18.0984 1536 MSPQM - ok
02:54:19.0015 1536 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
02:54:19.0140 1536 mssmbios - ok
02:54:19.0187 1536 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
02:54:19.0312 1536 MSTEE - ok
02:54:19.0406 1536 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
02:54:19.0437 1536 Mup - ok
02:54:19.0500 1536 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
02:54:19.0640 1536 NABTSFEC - ok
02:54:19.0703 1536 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll
02:54:19.0828 1536 napagent - ok
02:54:19.0875 1536 NCPro (f627e9da4d3d8dc05a15b68944302f14) C:\WINDOWS\system32\drivers\MTictwl.sys
02:54:19.0875 1536 NCPro ( UnsignedFile.Multi.Generic ) - warning
02:54:19.0875 1536 NCPro - detected UnsignedFile.Multi.Generic (1)
02:54:19.0906 1536 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
02:54:20.0046 1536 NDIS - ok
02:54:20.0078 1536 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
02:54:20.0234 1536 NdisIP - ok
02:54:20.0250 1536 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
02:54:20.0281 1536 NdisTapi - ok
02:54:20.0296 1536 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
02:54:20.0437 1536 Ndisuio - ok
02:54:20.0468 1536 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
02:54:20.0609 1536 NdisWan - ok
02:54:20.0640 1536 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
02:54:20.0656 1536 NDProxy - ok
02:54:20.0703 1536 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
02:54:20.0828 1536 NetBIOS - ok
02:54:20.0859 1536 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
02:54:21.0015 1536 NetBT - ok
02:54:21.0046 1536 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
02:54:21.0187 1536 NetDDE - ok
02:54:21.0203 1536 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
02:54:21.0328 1536 NetDDEdsdm - ok
02:54:21.0359 1536 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
02:54:21.0500 1536 Netlogon - ok
02:54:21.0531 1536 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll
02:54:21.0671 1536 Netman - ok
02:54:21.0765 1536 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
02:54:21.0781 1536 NetTcpPortSharing - ok
02:54:21.0796 1536 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
02:54:21.0937 1536 NIC1394 - ok
02:54:21.0984 1536 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll
02:54:22.0046 1536 Nla - ok
02:54:22.0093 1536 nmwcd (f6c40e0a565ee3ce5aeeb325e10054f2) C:\WINDOWS\system32\drivers\ccdcmb.sys
02:54:22.0187 1536 nmwcd - ok
02:54:22.0218 1536 nmwcdc (2a394e9e1fa3565e4b2fea470ffe4d6b) C:\WINDOWS\system32\drivers\ccdcmbo.sys
02:54:22.0312 1536 nmwcdc - ok
02:54:22.0343 1536 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
02:54:22.0484 1536 Npfs - ok
02:54:22.0531 1536 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
02:54:22.0718 1536 Ntfs - ok
02:54:22.0750 1536 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\System32\lsass.exe
02:54:22.0875 1536 NtLmSsp - ok
02:54:22.0921 1536 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll
02:54:23.0109 1536 NtmsSvc - ok
02:54:23.0140 1536 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
02:54:23.0375 1536 Null - ok
02:54:23.0406 1536 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
02:54:23.0625 1536 NwlnkFlt - ok
02:54:23.0625 1536 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
02:54:23.0875 1536 NwlnkFwd - ok
02:54:23.0968 1536 odserv (e54aa592a65f317390eee386a8821692) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
02:54:24.0000 1536 odserv - ok
02:54:24.0031 1536 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
02:54:24.0171 1536 ohci1394 - ok
02:54:24.0218 1536 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
02:54:24.0234 1536 ose - ok
02:54:24.0296 1536 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
02:54:24.0437 1536 Parport - ok
02:54:24.0453 1536 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
02:54:24.0578 1536 PartMgr - ok
02:54:24.0625 1536 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
02:54:24.0843 1536 ParVdm - ok
02:54:24.0890 1536 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
02:54:24.0906 1536 pccsmcfd - ok
02:54:24.0953 1536 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
02:54:25.0078 1536 PCI - ok
02:54:25.0093 1536 PCIDump - ok
02:54:25.0109 1536 PCIIde - ok
02:54:25.0140 1536 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
02:54:25.0281 1536 Pcmcia - ok
02:54:25.0281 1536 PDCOMP - ok
02:54:25.0296 1536 PDFRAME - ok
02:54:25.0312 1536 PDRELI - ok
02:54:25.0328 1536 PDRFRAME - ok
02:54:25.0343 1536 perc2 - ok
02:54:25.0343 1536 perc2hib - ok
02:54:25.0375 1536 PID_0928 - ok
02:54:25.0406 1536 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
02:54:25.0453 1536 PlugPlay - ok
02:54:25.0500 1536 Point32 (3b6973d60bde757c53bb76842d31318e) C:\WINDOWS\system32\DRIVERS\point32.sys
02:54:25.0515 1536 Point32 - ok
02:54:25.0546 1536 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
02:54:25.0671 1536 PolicyAgent - ok
02:54:25.0703 1536 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
02:54:25.0843 1536 PptpMiniport - ok
02:54:25.0859 1536 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
02:54:26.0000 1536 Processor - ok
02:54:26.0015 1536 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
02:54:26.0156 1536 ProtectedStorage - ok
02:54:26.0171 1536 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
02:54:26.0312 1536 PSched - ok
02:54:26.0359 1536 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
02:54:26.0578 1536 Ptilink - ok
02:54:26.0640 1536 PVM Service (5cdccdeb28ad6d9004d2d670e8ce3f26) C:\Program Files\RingThree\bin\pvmservice.exe
02:54:26.0656 1536 PVM Service ( UnsignedFile.Multi.Generic ) - warning
02:54:26.0656 1536 PVM Service - detected UnsignedFile.Multi.Generic (1)
02:54:26.0703 1536 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
02:54:26.0718 1536 PxHelp20 - ok
02:54:26.0718 1536 ql1080 - ok
02:54:26.0734 1536 Ql10wnt - ok
02:54:26.0750 1536 ql12160 - ok
02:54:26.0765 1536 ql1240 - ok
02:54:26.0781 1536 ql1280 - ok
02:54:26.0828 1536 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
02:54:27.0015 1536 RasAcd - ok
02:54:27.0062 1536 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll
02:54:27.0203 1536 RasAuto - ok
02:54:27.0218 1536 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
02:54:27.0359 1536 Rasl2tp - ok
02:54:27.0406 1536 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll
02:54:27.0531 1536 RasMan - ok
02:54:27.0546 1536 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
02:54:27.0687 1536 RasPppoe - ok
02:54:27.0734 1536 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
02:54:27.0921 1536 Raspti - ok
02:54:27.0953 1536 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
02:54:28.0078 1536 Rdbss - ok
02:54:28.0125 1536 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
02:54:28.0312 1536 RDPCDD - ok
02:54:28.0343 1536 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
02:54:28.0468 1536 rdpdr - ok
02:54:28.0531 1536 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
02:54:28.0546 1536 RDPWD - ok
02:54:28.0593 1536 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe
02:54:28.0734 1536 RDSessMgr - ok
02:54:28.0765 1536 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
02:54:28.0890 1536 redbook - ok
02:54:28.0906 1536 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll
02:54:29.0046 1536 RemoteAccess - ok
02:54:29.0093 1536 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll
02:54:29.0234 1536 RemoteRegistry - ok
02:54:29.0265 1536 RFCOMM (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys
02:54:29.0390 1536 RFCOMM - ok
02:54:29.0437 1536 Rksample (bb7549bd94d1aac3599c7606c50c48a0) C:\WINDOWS\system32\DRIVERS\HSF_SAMP.sys
02:54:29.0656 1536 Rksample - ok
02:54:29.0687 1536 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\System32\locator.exe
02:54:29.0828 1536 RpcLocator - ok
02:54:29.0859 1536 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\System32\rpcss.dll
02:54:29.0921 1536 RpcSs - ok
02:54:29.0953 1536 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\System32\rsvp.exe
02:54:30.0171 1536 RSVP - ok
02:54:30.0203 1536 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
02:54:30.0328 1536 SamSs - ok
02:54:30.0359 1536 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe
02:54:30.0500 1536 SCardSvr - ok
02:54:30.0546 1536 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll
02:54:30.0671 1536 Schedule - ok
02:54:30.0703 1536 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
02:54:30.0843 1536 Secdrv - ok
02:54:30.0875 1536 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll
02:54:31.0015 1536 seclogon - ok
02:54:31.0031 1536 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll
02:54:31.0171 1536 SENS - ok
02:54:31.0218 1536 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
02:54:31.0343 1536 serenum - ok
02:54:31.0375 1536 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
02:54:31.0515 1536 Serial - ok
02:54:31.0656 1536 ServiceLayer (f31e9531af225ca25350d5e87e999b31) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
02:54:31.0687 1536 ServiceLayer - ok
02:54:31.0718 1536 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
02:54:31.0843 1536 Sfloppy - ok
02:54:31.0890 1536 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll
02:54:32.0078 1536 SharedAccess - ok
02:54:32.0109 1536 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
02:54:32.0125 1536 ShellHWDetection - ok
02:54:32.0125 1536 Simbad - ok
02:54:32.0171 1536 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
02:54:32.0296 1536 SLIP - ok
02:54:32.0328 1536 SNCT511 (d0646a58b5d1252d9b1d0bfb86bd1c06) C:\WINDOWS\system32\DRIVERS\snct511.sys
02:54:32.0359 1536 SNCT511 ( UnsignedFile.Multi.Generic ) - warning
02:54:32.0359 1536 SNCT511 - detected UnsignedFile.Multi.Generic (1)
02:54:32.0437 1536 SoftFax (d9e8e0ce154a2f6430d9efabdf730867) C:\WINDOWS\system32\DRIVERS\HSF_FAXX.sys
02:54:32.0656 1536 SoftFax - ok
02:54:32.0687 1536 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
02:54:32.0906 1536 SONYPVU1 - ok
02:54:32.0906 1536 Sparrow - ok
02:54:32.0937 1536 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
02:54:33.0078 1536 splitter - ok
02:54:33.0125 1536 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
02:54:33.0140 1536 Spooler - ok
02:54:33.0187 1536 sptd (7f1b7c4d446cd3f926af45b8c48bd593) C:\WINDOWS\system32\Drivers\sptd.sys
02:54:33.0187 1536 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 7f1b7c4d446cd3f926af45b8c48bd593
02:54:33.0203 1536 sptd ( LockedFile.Multi.Generic ) - warning
02:54:33.0203 1536 sptd - detected LockedFile.Multi.Generic (1)
02:54:33.0218 1536 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
02:54:33.0343 1536 sr - ok
02:54:33.0406 1536 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll
02:54:33.0546 1536 srservice - ok
02:54:33.0593 1536 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
02:54:33.0640 1536 Srv - ok
02:54:33.0687 1536 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll
02:54:33.0828 1536 SSDPSRV - ok
02:54:33.0859 1536 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll
02:54:34.0046 1536 stisvc - ok
02:54:34.0093 1536 StreamDispatcher (5e2d5b8d8032fb05f9525a3ccfbb0600) C:\WINDOWS\system32\DRIVERS\strmdisp.sys
02:54:34.0109 1536 StreamDispatcher ( UnsignedFile.Multi.Generic ) - warning
02:54:34.0109 1536 StreamDispatcher - detected UnsignedFile.Multi.Generic (1)
02:54:34.0140 1536 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
02:54:34.0296 1536 streamip - ok
02:54:34.0328 1536 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
02:54:34.0468 1536 swenum - ok
02:54:34.0484 1536 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
02:54:34.0625 1536 swmidi - ok
02:54:34.0640 1536 SwPrv - ok
02:54:34.0656 1536 symc810 - ok
02:54:34.0671 1536 symc8xx - ok
02:54:34.0687 1536 sym_hi - ok
02:54:34.0687 1536 sym_u3 - ok
02:54:34.0734 1536 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
02:54:34.0859 1536 sysaudio - ok
02:54:34.0906 1536 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe
02:54:35.0046 1536 SysmonLog - ok
02:54:35.0078 1536 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll
02:54:35.0234 1536 TapiSrv - ok
02:54:35.0265 1536 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
02:54:35.0328 1536 Tcpip - ok
02:54:35.0375 1536 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
02:54:35.0500 1536 TDPIPE - ok
02:54:35.0515 1536 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
02:54:35.0656 1536 TDTCP - ok
02:54:35.0671 1536 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
02:54:35.0812 1536 TermDD - ok
02:54:35.0859 1536 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll
02:54:35.0984 1536 TermService - ok
02:54:36.0015 1536 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
02:54:36.0031 1536 Themes - ok
02:54:36.0062 1536 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\System32\tlntsvr.exe
02:54:36.0218 1536 TlntSvr - ok
02:54:36.0265 1536 Tones (8021a499db46b2961c285168671cb9af) C:\WINDOWS\system32\DRIVERS\HSF_TONE.sys
02:54:36.0515 1536 Tones - ok
02:54:36.0531 1536 TosIde - ok
02:54:36.0578 1536 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll
02:54:36.0718 1536 TrkWks - ok
02:54:36.0750 1536 TVICHW32 (e266683fc95abdec17cd378564e1b54b) C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS
02:54:36.0765 1536 TVICHW32 ( UnsignedFile.Multi.Generic ) - warning
02:54:36.0765 1536 TVICHW32 - detected UnsignedFile.Multi.Generic (1)
02:54:36.0796 1536 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
02:54:36.0937 1536 Udfs - ok
02:54:36.0953 1536 ultra - ok
02:54:37.0000 1536 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
02:54:37.0171 1536 Update - ok
02:54:37.0218 1536 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll
02:54:37.0406 1536 upnphost - ok
02:54:37.0453 1536 upperdev (47f5f9d837d80ffd5882a14db9da0a67) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
02:54:37.0546 1536 upperdev - ok
02:54:37.0593 1536 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe
02:54:37.0734 1536 UPS - ok
02:54:37.0750 1536 USBAAPL - ok
02:54:37.0781 1536 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
02:54:37.0921 1536 usbaudio - ok
02:54:37.0953 1536 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
02:54:38.0093 1536 usbccgp - ok
02:54:38.0125 1536 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
02:54:38.0281 1536 usbehci - ok
02:54:38.0328 1536 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
02:54:38.0515 1536 usbhub - ok
02:54:38.0531 1536 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
02:54:38.0671 1536 usbprint - ok
02:54:38.0687 1536 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
02:54:38.0828 1536 usbscan - ok
02:54:38.0843 1536 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\drivers\usbser.sys
02:54:38.0984 1536 usbser - ok
02:54:39.0015 1536 UsbserFilt (e44f0d17be0908b58dcc99ccb99c6c32) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
02:54:39.0109 1536 UsbserFilt - ok
02:54:39.0140 1536 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
02:54:39.0312 1536 USBSTOR - ok
02:54:39.0343 1536 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
02:54:39.0515 1536 usbuhci - ok
02:54:39.0562 1536 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
02:54:39.0718 1536 usbvideo - ok
02:54:39.0796 1536 V124 (269c0ade94b90029b12497747be408cb) C:\WINDOWS\system32\DRIVERS\HSF_V124.sys
02:54:40.0062 1536 V124 - ok
02:54:40.0093 1536 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
02:54:40.0234 1536 VgaSave - ok
02:54:40.0421 1536 viaagp1 (0e3e3fae3a0a58b8d936a8e841a17d16) C:\WINDOWS\system32\DRIVERS\viaagp1.sys
02:54:40.0437 1536 viaagp1 - ok
02:54:40.0484 1536 viagfx (3bcc43e2225851e0aef2a8c27ce420ea) C:\WINDOWS\system32\DRIVERS\vtmini.sys
02:54:40.0500 1536 viagfx - ok
02:54:40.0531 1536 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
02:54:40.0671 1536 ViaIde - ok
02:54:40.0703 1536 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
02:54:40.0875 1536 VolSnap - ok
02:54:40.0937 1536 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe
02:54:41.0093 1536 VSS - ok
02:54:41.0140 1536 vulfnths (16409c468ceee99b6b129fcaa5c0f206) C:\WINDOWS\System32\Drivers\vulfnth.sys
02:54:41.0140 1536 vulfnths ( UnsignedFile.Multi.Generic ) - warning
02:54:41.0140 1536 vulfnths - detected UnsignedFile.Multi.Generic (1)
02:54:41.0156 1536 vulfntrs (541447e05eddd1164a5ea925778b209d) C:\WINDOWS\System32\Drivers\vulfntr.sys
02:54:41.0171 1536 vulfntrs ( UnsignedFile.Multi.Generic ) - warning
02:54:41.0171 1536 vulfntrs - detected UnsignedFile.Multi.Generic (1)
02:54:41.0203 1536 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll
02:54:41.0343 1536 W32Time - ok
02:54:41.0390 1536 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
02:54:41.0531 1536 Wanarp - ok
02:54:41.0593 1536 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
02:54:41.0640 1536 Wdf01000 - ok
02:54:41.0640 1536 WDICA - ok
02:54:41.0687 1536 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
02:54:41.0828 1536 wdmaud - ok
02:54:41.0875 1536 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll
02:54:42.0000 1536 WebClient - ok
02:54:42.0062 1536 winachsf (ee6ce0a6b5fda622160dddd8a2ca0032) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
02:54:42.0093 1536 winachsf ( UnsignedFile.Multi.Generic ) - warning
02:54:42.0093 1536 winachsf - detected UnsignedFile.Multi.Generic (1)
02:54:42.0171 1536 WinDefend (f45dd1e1365d857dd08bc23563370d0e) C:\Program Files\Windows Defender\MsMpEng.exe
02:54:42.0171 1536 WinDefend - ok
02:54:42.0296 1536 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll
02:54:42.0421 1536 winmgmt - ok
02:54:42.0500 1536 WLSetupSvc (94a85e956a065e23e0010a6a7826243b) C:\Program Files\Windows Live\installer\WLSetupSvc.exe
02:54:42.0531 1536 WLSetupSvc - ok
02:54:42.0578 1536 WMDM PMSP Service (668056d5c3c11ab7d266819a96b964e8) C:\WINDOWS\system32\MsPMSPSv.exe
02:54:42.0593 1536 WMDM PMSP Service ( UnsignedFile.Multi.Generic ) - warning
02:54:42.0593 1536 WMDM PMSP Service - detected UnsignedFile.Multi.Generic (1)
02:54:42.0625 1536 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\mspmsnsv.dll
02:54:42.0656 1536 WmdmPmSN - ok
02:54:42.0703 1536 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll
02:54:42.0796 1536 Wmi - ok
02:54:42.0843 1536 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\System32\wbem\wmiapsrv.exe
02:54:42.0984 1536 WmiApSrv - ok
02:54:43.0078 1536 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe
02:54:43.0140 1536 WMPNetworkSvc - ok
02:54:43.0171 1536 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
02:54:43.0187 1536 WpdUsb - ok
02:54:43.0234 1536 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
02:54:43.0437 1536 WS2IFSL - ok
02:54:43.0484 1536 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll
02:54:43.0625 1536 wscsvc - ok
02:54:43.0656 1536 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
02:54:43.0781 1536 WSTCODEC - ok
02:54:43.0812 1536 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll
02:54:43.0953 1536 wuauserv - ok
02:54:43.0984 1536 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
02:54:44.0015 1536 WudfPf - ok
02:54:44.0046 1536 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
02:54:44.0062 1536 WudfRd - ok
02:54:44.0078 1536 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
02:54:44.0109 1536 WudfSvc - ok
02:54:44.0171 1536 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll
02:54:44.0406 1536 WZCSVC - ok
02:54:44.0453 1536 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll
02:54:44.0609 1536 xmlprov - ok
02:54:44.0640 1536 Z302Mic (4ae48a210e3b773462a9939304e788f1) C:\WINDOWS\system32\drivers\UsbMicfilt.sys
02:54:44.0656 1536 Z302Mic - ok
02:54:44.0687 1536 ZSMC302 (3c482e427f0e62a29ac839398831e2bc) C:\WINDOWS\system32\Drivers\usbvm302.sys
02:54:44.0718 1536 ZSMC302 - ok
02:54:44.0781 1536 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
02:54:45.0265 1536 \Device\Harddisk0\DR0 - ok
02:54:45.0265 1536 MBR (0x1B8) (973e9ba32fdbb305c552ed3e1ebf0686) \Device\Harddisk1\DR2
02:54:45.0375 1536 \Device\Harddisk1\DR2 - ok
02:54:45.0390 1536 Boot (0x1200) (3f36e2be40eeeb770b9d00c7dcad72e3) \Device\Harddisk0\DR0\Partition0
02:54:45.0390 1536 \Device\Harddisk0\DR0\Partition0 - ok
02:54:45.0406 1536 Boot (0x1200) (4a988549e01e91e610309337d16dd8df) \Device\Harddisk1\DR2\Partition0
02:54:45.0406 1536 \Device\Harddisk1\DR2\Partition0 - ok
02:54:45.0406 1536 ============================================================
02:54:45.0406 1536 Scan finished
02:54:45.0406 1536 ============================================================
02:54:45.0531 0388 Detected object count: 34
02:54:45.0531 0388 Actual detected object count: 34
02:54:56.0625 0388 Aspi32 ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0625 0388 Aspi32 ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0625 0388 BrPar ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0625 0388 BrPar ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0640 0388 cdrbsvsd ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0640 0388 cdrbsvsd ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0656 0388 DCamUSBSQTECH ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0656 0388 DCamUSBSQTECH ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0656 0388 DLABOIOM ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0656 0388 DLABOIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0671 0388 DLACDBHM ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0671 0388 DLACDBHM ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0687 0388 DLADResN ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0687 0388 DLADResN ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0687 0388 DLAIFS_M ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0687 0388 DLAIFS_M ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0703 0388 DLAOPIOM ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0703 0388 DLAOPIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0703 0388 DLAPoolM ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0703 0388 DLAPoolM ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0718 0388 DLARTL_N ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0718 0388 DLARTL_N ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0734 0388 DLAUDFAM ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0734 0388 DLAUDFAM ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0734 0388 DLAUDF_M ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0734 0388 DLAUDF_M ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0750 0388 DRVMCDB ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0750 0388 DRVMCDB ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0765 0388 DRVNDDM ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0765 0388 DRVNDDM ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0765 0388 DVD-RAM_Service ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0765 0388 DVD-RAM_Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0781 0388 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0781 0388 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0796 0388 HSFHWBS2 ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0796 0388 HSFHWBS2 ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0796 0388 HSF_DP ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0796 0388 HSF_DP ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0812 0388 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0812 0388 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0828 0388 MagicTune ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0828 0388 MagicTune ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0828 0388 mcdbus ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0828 0388 mcdbus ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0843 0388 mdmxsdk ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0843 0388 mdmxsdk ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0843 0388 meiudf ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0843 0388 meiudf ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0859 0388 NCPro ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0859 0388 NCPro ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0875 0388 PVM Service ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0875 0388 PVM Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0875 0388 SNCT511 ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0875 0388 SNCT511 ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0875 0388 sptd ( LockedFile.Multi.Generic ) - skipped by user
02:54:56.0875 0388 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
02:54:56.0890 0388 StreamDispatcher ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0890 0388 StreamDispatcher ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0906 0388 TVICHW32 ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0906 0388 TVICHW32 ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0906 0388 vulfnths ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0906 0388 vulfnths ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0921 0388 vulfntrs ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0921 0388 vulfntrs ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0937 0388 winachsf ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0937 0388 winachsf ( UnsignedFile.Multi.Generic ) - User select action: Skip
02:54:56.0937 0388 WMDM PMSP Service ( UnsignedFile.Multi.Generic ) - skipped by user
02:54:56.0937 0388 WMDM PMSP Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

[DragonFromWales]

Rebooted into Normal mode. It starts up good but the freezes on the message: "Window is starting up..."
Seems to work ok in safe Mode.

[CompCav]

Redo the clean boot with only your antivirus still allowed and do not do Select /BASEVIDEO

Then reboot and see how it does.

CompCav

[DragonFromWales]

Sorry, I don't understand: "do not do Select /BASEVIDEO". Where is this found?

[CompCav]

OOps my bad please go to post #44 and do the clean boot but do not select /BASEVIDEO

[DragonFromWales]

we're getting there! the "Use Modified BOOT.INI " is GREYED out; can't select it. The "Use Original BOOT.INI" is selected.

[CompCav]

That is fine try to clean boot with the original boot.ini