Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Trojan.happili [Solved]

Started by Rtermite , Nov 09 2012 11:36 AM

This topic is locked

#1
Rtermite

Posted 09 November 2012 - 11:36 AM

Member

Member
16 posts

Trojan.happili keeps reappearing on my system. I running Windows XP pro service pk 3 and using Norton Security Suite V 5.2.2.3 and Malwarebytes V1.65 and still it keeps coming back. Am I missing something when I just let these programs quarantine the file and then delete it?

#2
gringo_pr

Posted 09 November 2012 - 12:09 PM

Trusted Helper

Malware Removal
7,268 posts

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I need to get some reports to get a base to start from so I need you to run these programs first.

-DeFogger-

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.
The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.

-Security Check-

Download Security Check by screen317 from here.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-Download DDS-

Please download DDS from one of the links below and save it to your desktop:

Download DDS and save it to your desktop

Link1
Link2
Link3
- Double-Click on dds.scr and a command window will appear. This is normal.
- Shortly after two logs will appear:
- DDS.txt
- Attach.txt
A window will open instructing you save & post the logs
Save the logs to a convenient place such as your desktop
Copy the contents of both logs & post in your next reply

information and logs

In your next post I need the following

both reports from DDS
report from security check
let me know of any problems you may have had

Gringo

#3
Rtermite

Posted 09 November 2012 - 05:25 PM

Member

Topic Starter
Member
16 posts

Only problem I had was (click on the Watch Topic Button) as I already was watching just hadn't been back on computer yet so didn't get E-mail.
I D/L and ran programs as you asked and here are logs;

CHECKUP.TXT

Results of screen317's Security Check version 0.99.54
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
Norton Security Suite
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.65.1.1000
Java™ 6 Update 31
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Reader X 10.1.2 Adobe Reader out of Date!
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive J:: 0%
````````````````````End of Log``````````````````````

ATTACH.TXT
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-07.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 4/17/2009 9:20:07 PM
System Uptime: 11/8/2012 8:55:40 PM (22 hours ago)
.
Motherboard: ASUSTeK Computer Inc. | | P4C800-E
Processor: Intel® Pentium® 4 CPU 3.00GHz | CPU 1 | 2998/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 149 GiB total, 33.014 GiB free.
D: is Removable
E: is Removable
F: is Removable
G: is Removable
H: is CDROM (UDF)
I: is CDROM (CDFS)
J: is FIXED (NTFS) - 466 GiB total, 140.943 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Multimedia Audio Controller
Device ID: PCI\VEN_8086&DEV_24D5&SUBSYS_80F31043&REV_02\3&267A616A&0&FD
Manufacturer:
Name: Multimedia Audio Controller
PNP Device ID: PCI\VEN_8086&DEV_24D5&SUBSYS_80F31043&REV_02\3&267A616A&0&FD
Service:
.
==== System Restore Points ===================
.
RP819: 8/12/2012 11:03:42 AM - System Checkpoint
RP820: 8/13/2012 5:02:32 PM - System Checkpoint
RP821: 8/14/2012 5:02:59 PM - System Checkpoint
RP822: 8/16/2012 4:48:41 PM - System Checkpoint
RP823: 8/17/2012 5:44:36 AM - Software Distribution Service 3.0
RP824: 8/18/2012 8:14:04 PM - System Checkpoint
RP825: 8/21/2012 7:12:22 PM - System Checkpoint
RP826: 8/23/2012 5:20:27 PM - System Checkpoint
RP827: 8/23/2012 6:23:38 PM - Norton Security Suite Registry
RP828: 8/24/2012 8:29:25 PM - System Checkpoint
RP829: 8/25/2012 11:07:48 PM - System Checkpoint
RP830: 8/27/2012 7:24:49 PM - System Checkpoint
RP831: 8/29/2012 8:32:29 AM - System Checkpoint
RP832: 8/30/2012 8:22:00 PM - System Checkpoint
RP833: 9/1/2012 2:51:57 PM - System Checkpoint
RP834: 9/2/2012 3:03:55 PM - System Checkpoint
RP835: 9/3/2012 4:08:43 PM - System Checkpoint
RP836: 9/4/2012 6:08:19 PM - System Checkpoint
RP837: 9/6/2012 8:06:08 PM - System Checkpoint
RP838: 9/8/2012 10:18:01 AM - System Checkpoint
RP839: 9/9/2012 12:07:16 PM - System Checkpoint
RP840: 9/10/2012 5:14:38 PM - System Checkpoint
RP841: 9/11/2012 5:36:49 PM - System Checkpoint
RP842: 9/12/2012 10:32:20 AM - Software Distribution Service 3.0
RP843: 9/13/2012 1:36:24 PM - System Checkpoint
RP844: 9/15/2012 7:46:43 AM - System Checkpoint
RP845: 9/16/2012 12:24:13 PM - System Checkpoint
RP846: 9/17/2012 6:14:21 PM - System Checkpoint
RP847: 9/19/2012 8:52:16 PM - System Checkpoint
RP848: 9/21/2012 5:48:37 PM - Software Distribution Service 3.0
RP849: 9/22/2012 9:42:55 PM - System Checkpoint
RP850: 9/23/2012 8:39:00 AM - Norton Security Suite Registry
RP851: 9/24/2012 5:21:51 PM - System Checkpoint
RP852: 9/25/2012 6:18:55 PM - System Checkpoint
RP853: 9/27/2012 8:11:48 PM - System Checkpoint
RP854: 9/28/2012 8:32:09 PM - System Checkpoint
RP855: 9/30/2012 9:38:12 PM - System Checkpoint
RP856: 10/2/2012 5:52:05 PM - System Checkpoint
RP857: 10/4/2012 6:14:47 PM - System Checkpoint
RP858: 10/5/2012 6:29:21 PM - System Checkpoint
RP859: 10/6/2012 7:13:09 PM - System Checkpoint
RP860: 10/8/2012 9:14:25 PM - System Checkpoint
RP861: 10/9/2012 10:53:44 PM - System Checkpoint
RP862: 10/10/2012 11:17:09 AM - Software Distribution Service 3.0
RP863: 10/11/2012 6:35:21 PM - System Checkpoint
RP864: 10/13/2012 4:54:09 PM - System Checkpoint
RP865: 10/15/2012 4:59:52 PM - System Checkpoint
RP866: 10/16/2012 6:13:28 PM - System Checkpoint
RP867: 10/18/2012 6:34:04 PM - System Checkpoint
RP868: 10/19/2012 7:17:54 PM - System Checkpoint
RP869: 10/20/2012 1:02:35 PM - Removed Garmin Lifetime Updater
RP870: 10/21/2012 2:19:14 PM - System Checkpoint
RP871: 10/22/2012 5:58:54 PM - System Checkpoint
RP872: 10/23/2012 6:15:57 PM - System Checkpoint
RP873: 10/23/2012 6:21:24 PM - Norton Security Suite Registry
RP874: 10/25/2012 10:59:34 AM - System Checkpoint
RP875: 10/26/2012 2:48:11 PM - System Checkpoint
RP876: 10/27/2012 3:54:22 PM - System Checkpoint
RP877: 10/28/2012 3:57:24 PM - System Checkpoint
RP878: 10/29/2012 8:00:44 PM - System Checkpoint
RP879: 10/31/2012 3:24:03 PM - System Checkpoint
RP880: 11/1/2012 8:16:27 PM - System Checkpoint
RP881: 11/3/2012 4:29:54 PM - System Checkpoint
RP882: 11/4/2012 4:08:41 PM - System Checkpoint
RP883: 11/5/2012 9:36:50 PM - System Checkpoint
RP884: 11/7/2012 11:11:15 AM - System Checkpoint
RP885: 11/8/2012 4:04:19 PM - System Checkpoint
RP886: 11/9/2012 5:38:15 PM - System Checkpoint
.
==== Installed Programs ======================
.
7-Zip 4.65
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader X (10.1.2)
Any Video Converter 2.7.5
AnyDVD
Apple Application Support
Apple Software Update
Audacity 1.2.6
BurnAware Free 5.0.1
Call of Duty® 4 - Modern Warfare™
Canon Camera WIA Driver
Canon EOS 20D WIA Driver
Canon Utilities EOS Capture 1.2
Canon Utilities EOS Viewer Utility 1.2
Canon Utilities PhotoStitch 3.1
CloneCD
CloneDVD2
Corel WordPerfect Suite 8
Creative Audio Console
Crystal Reports Basic Runtime for Visual Studio 2008
ELCSoft
EOS Capture 1.2
EOS Viewer Utility 1.2.1
FastStone Image Viewer 4.6
Garmin BaseCamp
Garmin City Navigator North America NT 2010.40
Garmin City Navigator NorthAmerica NT 2013.30 Update
Garmin Communicator Plugin
Garmin USB Drivers
Garmin WebUpdater
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB2756822)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Innova OBD PC-Link
Intel® PRO Network Adapters and Drivers
Java Auto Updater
Java™ 6 Update 31
Lernout & Hauspie TruVoice American English TTS Engine
Logitech MouseWare 9.79
Malwarebytes Anti-Malware version 1.65.1.1000
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft IntelliType Pro 2.2
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works 2003 Setup Launcher
Microsoft Works 7.0
Move Media Player
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
Norton Security Suite
NVIDIA Control Panel 295.73
NVIDIA Graphics Driver 295.73
NVIDIA Install Application
NVIDIA nView 136.18
NVIDIA nView Desktop Manager
NVIDIA Update 1.7.11
NVIDIA Update Components
OBD-PC Link
OGA Notifier 2.0.0048.0
PhotoStitch
QuickTime
Ricochet Xtreme
Samsung ML-2850 Series
Samsung New PC Studio
SAMSUNG USB Driver for Mobile Phones
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2724197)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Sid Meier's Pirates!
Silent Hunter III
Smart Defrag 2
SSA Benefit Calculator
The Keyed CD Edition of The LogixPro Simulator
Ulead CD & DVD PictureShow 4
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687407) 32-Bit Edition
Update for Windows Internet Explorer 8 (KB972636)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2718704)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
USB2.0 CARD READER Icons and Drivers
VERITAS RecordNow DX
VERITAS RecordNow DX Update Manager
VLC media player 2.0.3
WebFldrs XP
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows XP Service Pack 3
Works Suite OS Pack
XML Paper Specification Shared Components Pack 1.0
.
==== Event Viewer Messages From Past Week ========
.
11/3/2012 7:25:25 PM, error: Service Control Manager [7000] - The SSPORT service failed to start due to the following error: The system cannot find the file specified.
11/3/2012 7:25:25 PM, error: Service Control Manager [7000] - The DgiVecp service failed to start due to the following error: The system cannot find the file specified.
11/3/2012 7:24:46 PM, error: Print [23] - Printer Corel Barista failed to initialize because a suitable Corel Barista driver could not be found.
.
==== End Of File ===========================

DDS.TXT
DDS (Ver_2012-11-07.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702
Run by Robert Hotte at 18:06:28 on 2012-11-09
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.773 [GMT -5:00]
.
AV: Norton Security Suite *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Enabled*
.
============== Running Processes ================
.
J:\WINDOWS\system32\spoolsv.exe
J:\Program Files\Creative\Shared Files\CTAudSvc.exe
J:\WINDOWS\system32\FsUsbExService.Exe
J:\java\jre6\bin\jqs.exe
J:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe
J:\WINDOWS\system32\nvsvc32.exe
J:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
J:\WINDOWS\Explorer.EXE
J:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe
J:\Smart Defrag 2\SmartDefrag.exe
J:\WINDOWS\system32\CTHELPER.EXE
J:\Microsoft Office\Office12\GrooveMonitor.exe
J:\Program Files\Microsoft Hardware\Keyboard\type32.exe
J:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
J:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
J:\Logitech\MouseWare\system\em_exec.exe
J:\CloneCD\CloneCDTray.exe
J:\WINDOWS\System32\alg.exe
J:\WINDOWS\system32\RunDLL32.exe
J:\Program Files\Common Files\Java\Java Update\jusched.exe
J:\WINDOWS\system32\rundll32.exe
J:\WINDOWS\system32\ctfmon.exe
J:\samsung new pc studio\NPSAgent.exe
J:\AnyDVD\AnyDVDtray.exe
J:\WINDOWS\system32\rundll32.exe
J:\Program Files\Common Files\Java\Java Update\jucheck.exe
J:\Malwarebytes' Anti-Malware\mbamscheduler.exe
J:\Malwarebytes' Anti-Malware\mbamservice.exe
J:\Malwarebytes' Anti-Malware\mbamgui.exe
J:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
J:\WINDOWS\system32\wbem\wmiprvse.exe
J:\WINDOWS\system32\wbem\wmiprvse.exe
J:\WINDOWS\System32\svchost.exe -k netsvcs
J:\WINDOWS\System32\svchost.exe -k NetworkService
J:\WINDOWS\System32\svchost.exe -k LocalService
J:\WINDOWS\System32\svchost.exe -k LocalService
J:\WINDOWS\System32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://registration.excite.com/excitereg/login.jsp
uProxyOverride = localhost
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - j:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - j:\program files\norton security suite\engine\5.2.2.3\coieplg.dll
BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - j:\program files\norton security suite\engine\5.2.2.3\ips\ipsbho.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - j:\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - j:\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - j:\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - j:\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - j:\program files\norton security suite\engine\5.2.2.3\coieplg.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - <orphaned>
uRun: [ctfmon.exe] j:\windows\system32\ctfmon.exe
uRun: [AutoStartNPSAgent] j:\samsung new pc studio\NPSAgent.exe
uRun: [AnyDVD] j:\anydvd\AnyDVDtray.exe
uRun: [Apple Computer] rundll32.exe "j:\documents and settings\robert hotte\local settings\application data\garmin_corp\apple computer\nakuey.dll",DllRegisterServerW
mRun: [CTHelper] CTHELPER.EXE
mRun: [GrooveMonitor] "j:\microsoft office\office12\GrooveMonitor.exe"
mRun: [IntelliType] "j:\program files\microsoft hardware\keyboard\type32.exe"
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [Samsung PanelMgr] j:\windows\samsung\panelmgr\SSMMgr.exe /autorun
mRun: [Ulead AutoDetector v2] j:\program files\common files\ulead systems\autodetector\monitor.exe
mRun: [StorageGuard] "j:\program files\veritas software\update manager\sgtray.exe" /r
mRun: [Seticon] c:\program files\icons\Seticon.exe
mRun: [NPSStartup] <no file>
dRun: [Apple Computer] rundll32.exe "j:\documents and settings\robert hotte\local settings\application data\garmin_corp\apple computer\nakuey.dll",DllRegisterServerW
StartupFolder: j:\docume~1\robert~1\startm~1\programs\startup\wkcalrem.lnk - j:\program files\common files\microsoft shared\works shared\WkCalRem.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: E&xport to Microsoft Excel - j:\micros~1\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - j:\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - j:\program files\messenger\msmsgs.exe
DPF: DirectAnimation Java Classes - file://j:\windows\java\classes\dajava.cab
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.3.0/GarminAxControl_32.CAB
DPF: Microsoft XML Parser for Java - file://j:\windows\java\classes\xmldso.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240022564453
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1243549532296
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{C5890517-7F57-4AEE-8479-20F22B40A93D} : DHCPNameServer = 75.75.75.75 75.75.76.76
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - j:\microsoft office\office12\GrooveSystemServices.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - j:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - j:\microsoft office\office12\GrooveShellExtensions.dll
.
============= SERVICES / DRIVERS ===============
.
R0 SmartDefragDriver;SmartDefragDriver;j:\windows\system32\drivers\SmartDefragDriver.sys [2012-10-17 14776]
R0 SymDS;Symantec Data Store;j:\windows\system32\drivers\n360\0502020.003\symds.sys [2012-7-16 340088]
R0 SymEFA;Symantec Extended File Attributes;j:\windows\system32\drivers\n360\0502020.003\symefa.sys [2012-7-16 744568]
R1 BHDrvx86;BHDrvx86;j:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\bashdefs\20121030.002\BHDrvx86.sys [2012-11-5 995488]
R1 mfehidk;McAfee Inc. mfehidk;j:\windows\system32\drivers\mfehidk.sys [2009-4-17 214664]
R1 SymIRON;Symantec Iron Driver;j:\windows\system32\drivers\n360\0502020.003\ironx86.sys [2012-7-16 136312]
R2 FsUsbExService;FsUsbExService;j:\windows\system32\FsUsbExService.Exe [2010-8-13 238952]
R2 MBAMScheduler;MBAMScheduler;j:\malwarebytes' anti-malware\mbamscheduler.exe [2012-10-31 399432]
R2 MBAMService;MBAMService;j:\malwarebytes' anti-malware\mbamservice.exe [2009-4-17 676936]
R2 N360;Norton Security Suite;j:\program files\norton security suite\engine\5.2.2.3\ccsvchst.exe [2012-7-16 130008]
R3 COMMONFX.SYS;COMMONFX.SYS;j:\windows\system32\drivers\COMMONFX.sys [2009-3-4 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;j:\windows\system32\drivers\CTAUDFX.sys [2009-3-4 555032]
R3 ctgame;Game Port;j:\windows\system32\drivers\ctgame.sys [2009-3-4 18840]
R3 CTSBLFX.SYS;CTSBLFX.SYS;j:\windows\system32\drivers\CTSBLFX.sys [2009-3-4 566296]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;j:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2012-8-9 106656]
R3 FsUsbExDisk;FsUsbExDisk;j:\windows\system32\FsUsbExDisk.Sys [2010-8-13 36608]
R3 IDSxpx86;IDSxpx86;j:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\ipsdefs\20121109.001\IDSXpx86.sys [2012-11-9 373728]
R3 MBAMProtector;MBAMProtector;j:\windows\system32\drivers\mbam.sys [2009-4-17 22856]
R3 NAVENG;NAVENG;j:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\virusdefs\20121109.004\NAVENG.SYS [2012-11-9 92704]
R3 NAVEX15;NAVEX15;j:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\virusdefs\20121109.004\NAVEX15.SYS [2012-11-9 1601184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;j:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 SSPORT;SSPORT;\??\j:\windows\system32\drivers\ssport.sys --> j:\windows\system32\drivers\SSPORT.sys [?]
S3 COMMONFX;COMMONFX;j:\windows\system32\drivers\COMMONFX.sys [2009-3-4 99352]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;j:\program files\common files\creative labs shared\service\CTAELicensing.exe [2009-4-17 79360]
S3 CTAUDFX;CTAUDFX;j:\windows\system32\drivers\CTAUDFX.sys [2009-3-4 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;j:\windows\system32\drivers\CTERFXFX.sys [2009-3-4 100888]
S3 CTERFXFX;CTERFXFX;j:\windows\system32\drivers\CTERFXFX.sys [2009-3-4 100888]
S3 CTSBLFX;CTSBLFX;j:\windows\system32\drivers\CTSBLFX.sys [2009-3-4 566296]
S3 mfeavfk;McAfee Inc. mfeavfk;j:\windows\system32\drivers\mfeavfk.sys [2009-4-17 79816]
S3 mfebopk;McAfee Inc. mfebopk;j:\windows\system32\drivers\mfebopk.sys [2009-4-17 35272]
S3 mferkdk;McAfee Inc. mferkdk;j:\windows\system32\drivers\mferkdk.sys [2009-4-17 34248]
S3 mfesmfk;McAfee Inc. mfesmfk;j:\windows\system32\drivers\mfesmfk.sys [2009-4-17 40552]
S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);j:\windows\system32\drivers\sscebus.sys [2010-8-13 98560]
S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;j:\windows\system32\drivers\sscemdfl.sys [2010-8-13 14848]
S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;j:\windows\system32\drivers\sscemdm.sys [2010-8-13 123648]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;j:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== File Associations ===============
.
ShellExec: QPW.EXE: open=j:\suite8\programs\QPW.EXE
ShellExec: QPW.EXE: print=j:\suite8\programs\QPW.EXE
.
=============== Created Last 30 ================
.
2012-11-07 01:36:35 -------- d-----w- j:\documents and settings\robert hotte\application data\Tific
2012-11-03 19:28:44 -------- d-----w- j:\documents and settings\robert hotte\application data\System
2012-10-20 20:09:00 -------- d-----w- J:\VLC
2012-10-18 00:45:46 29528 ----a-w- j:\windows\system32\SmartDefragBootTime.exe
2012-10-18 00:44:38 14776 ----a-w- j:\windows\system32\drivers\SmartDefragDriver.sys
.
==================== Find3M ====================
.
2012-09-29 23:54:26 22856 ----a-w- j:\windows\system32\drivers\mbam.sys
2012-08-28 15:14:53 916992 ----a-w- j:\windows\system32\wininet.dll
2012-08-28 15:14:53 43520 ----a-w- j:\windows\system32\licmgr10.dll
2012-08-28 15:14:52 1469440 ------w- j:\windows\system32\inetcpl.cpl
2012-08-28 12:07:15 385024 ----a-w- j:\windows\system32\html.iec
2012-08-26 12:56:17 121248 ----a-w- j:\windows\system32\drivers\AnyDVD.sys
2012-08-24 13:53:22 177664 ----a-w- j:\windows\system32\wintrust.dll
2012-08-21 13:33:26 2148864 ----a-w- j:\windows\system32\ntoskrnl.exe
2012-08-21 12:58:09 2027520 ----a-w- j:\windows\system32\ntkrnlpa.exe
.
============= FINISH: 18:07:17.15 ===============

#4
gringo_pr

Posted 09 November 2012 - 08:51 PM

Trusted Helper

Malware Removal
7,268 posts

Hello

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller or from here
Quit all programs that you may have started.
Please disconnect any USB or external drives from the computer before you run this scan!
For Vista or Windows 7, right-click and select "Run as Administrator to start"
For Windows XP, double-click to start.
Wait until Prescan has finished ...
Then Click on "Scan" button
Wait until the Status box shows "Scan Finished"
click on "delete"
Wait until the Status box shows "Deleting Finished"
Click on "Report" and copy/paste the content of the Notepad into your next reply.
The log should be found in RKreport[1].txt on your Desktop
Exit/Close RogueKiller+

Gringo

#5
gringo_pr

Posted 11 November 2012 - 10:13 PM

Trusted Helper

Malware Removal
7,268 posts

Greetings

I have not heard from you in a couple of days so I am coming by to check on you to see if you are having problems or you just need some more time.

Also to remind you that it is very important that we finish the process completely so as to not get reinfected. I will let you know when we are complete and I will ask to remove our tools

Gringo

#6
Rtermite

Posted 12 November 2012 - 07:25 AM

Member

Topic Starter
Member
16 posts

Sorry for delay,
In-laws came in for the weekend and was tied up with them. Am D/L programs and will run them now. Sorry for delay, will post logs in a short time. Thanks for your patience. Will check back in later in day as they are leaving today.

#7
gringo_pr

Posted 12 November 2012 - 07:38 AM

Trusted Helper

Malware Removal
7,268 posts

no problem

gringo

#8
Rtermite

Posted 12 November 2012 - 08:22 AM

Member

Topic Starter
Member
16 posts

Here's the logs.

Had to run RougeKiller twice as forgot to quit Norton Security Suite before starting it and it shut it down. Included both logs.

AdwCleaner[S1].txt

# AdwCleaner v2.007 - Logfile created 11/12/2012 at 08:31:09
# Updated 06/11/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Robert Hotte - BOBSCOMPUTER
# Boot Mode : Normal
# Running from : J:\Documents and Settings\Robert Hotte\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

Folder Deleted : J:\Documents and Settings\All Users\Application Data\InstallMate
Folder Deleted : J:\Documents and Settings\All Users\Application Data\Premium
Folder Deleted : J:\Documents and Settings\All Users\Application Data\Trymedia

***** [Registry] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Deleted : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Deleted : HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Deleted : HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[S1].txt - [1359 octets] - [12/11/2012 08:31:09]

########## EOF - J:\AdwCleaner[S1].txt - [1419 octets] ##########

RKreport[1]_S_11122012_02d0855.txt

RogueKiller V8.2.3 [11/07/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Website: http://tigzy.geeksto...roguekiller.php
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Robert Hotte [Admin rights]
Mode : Scan -- Date : 11/12/2012 08:55:15

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH][DLL] rundll32.exe -- J:\WINDOWS\system32\rundll32.exe : J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll -> KILLED [TermProc]

¤¤¤ Registry Entries : 19 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> FOUND
[RUN][SUSP PATH] HKUS\.DEFAULT[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-19[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-19[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-19_Classes[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-19_Classes[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-20[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-20[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-20_Classes[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-20_Classes[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-507921405-1682526488-725345543-1004[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-507921405-1682526488-725345543-1004_Classes[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-507921405-1682526488-725345543-1004_Classes[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-507921405-1682526488-725345543-1007[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-507921405-1682526488-725345543-1007[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-18[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[RUN][BLACKLIST DLL] [ON_C:LocalService]HKCU[...]\Run : wiresegura (Rundll32.exe "I:\WINDOWS\system32\voyuwuzo.dll",s) -> FOUND
[RUN][BLACKLIST DLL] [ON_C:NetworkService]HKCU[...]\Run : wiresegura (Rundll32.exe "I:\WINDOWS\system32\voyuwuzo.dll",s) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤
SSDT[12] : NtAlertResumeThread @ 0x80637C26 -> HOOKED (Unknown @ 0x89638BE8)
SSDT[13] : NtAlertThread @ 0x80592C38 -> HOOKED (Unknown @ 0x89638CA8)
SSDT[17] : NtAllocateVirtualMemory @ 0x80570BC5 -> HOOKED (Unknown @ 0x89637BC8)
SSDT[19] : NtAssignProcessToJobObject @ 0x805E0F71 -> HOOKED (Unknown @ 0x89686828)
SSDT[31] : NtConnectPort @ 0x80590E5B -> HOOKED (Unknown @ 0x896BC6F8)
SSDT[43] : NtCreateMutant @ 0x80584095 -> HOOKED (Unknown @ 0x89638998)
SSDT[52] : NtCreateSymbolicLinkObject @ 0x805DFACA -> HOOKED (Unknown @ 0x89686688)
SSDT[53] : NtCreateThread @ 0x80584D41 -> HOOKED (Unknown @ 0x89653168)
SSDT[57] : NtDebugActiveProcess @ 0x80663261 -> HOOKED (Unknown @ 0x896868E8)
SSDT[68] : NtDuplicateObject @ 0x8057F195 -> HOOKED (Unknown @ 0x89938EA0)
SSDT[83] : NtFreeVirtualMemory @ 0x805710BF -> HOOKED (Unknown @ 0x89616778)
SSDT[89] : NtImpersonateAnonymousToken @ 0x8059AD05 -> HOOKED (Unknown @ 0x89638A68)
SSDT[91] : NtImpersonateThread @ 0x805876C2 -> HOOKED (Unknown @ 0x89638B28)
SSDT[97] : NtLoadDriver @ 0x805AF89E -> HOOKED (Unknown @ 0x896C9440)
SSDT[108] : NtMapViewOfSection @ 0x8057AC29 -> HOOKED (Unknown @ 0x895F2BA8)
SSDT[114] : NtOpenEvent @ 0x80589D69 -> HOOKED (Unknown @ 0x896388D8)
SSDT[122] : NtOpenProcess @ 0x8057F942 -> HOOKED (Unknown @ 0x897761A8)
SSDT[123] : NtOpenProcessToken @ 0x805784F6 -> HOOKED (Unknown @ 0x896451D0)
SSDT[125] : NtOpenSection @ 0x8057919E -> HOOKED (Unknown @ 0x89638758)
SSDT[128] : NtOpenThread @ 0x805E4817 -> HOOKED (Unknown @ 0x89BD3330)
SSDT[137] : NtProtectVirtualMemory @ 0x8057F573 -> HOOKED (Unknown @ 0x89686758)
SSDT[206] : NtResumeThread @ 0x805853B8 -> HOOKED (Unknown @ 0x89638D68)
SSDT[213] : NtSetContextThread @ 0x8063628D -> HOOKED (Unknown @ 0x89639C18)
SSDT[228] : NtSetInformationProcess @ 0x80574B1F -> HOOKED (Unknown @ 0x895F2A90)
SSDT[240] : NtSetSystemInformation @ 0x805B14D0 -> HOOKED (Unknown @ 0x89686BD0)
SSDT[253] : NtSuspendProcess @ 0x80637B6B -> HOOKED (Unknown @ 0x89638818)
SSDT[254] : NtSuspendThread @ 0x80637A87 -> HOOKED (Unknown @ 0x895F1768)
SSDT[257] : NtTerminateProcess @ 0x8058E8B9 -> HOOKED (Unknown @ 0x89637AE8)
SSDT[258] : NtTerminateThread @ 0x8058496E -> HOOKED (Unknown @ 0x895F67F0)
SSDT[267] : NtUnmapViewOfSection @ 0x8057A7B1 -> HOOKED (Unknown @ 0x895F81D0)
SSDT[277] : NtWriteVirtualMemory @ 0x805875F7 -> HOOKED (Unknown @ 0x8963D7F8)
S_SSDT[307] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x895F6858)
S_SSDT[383] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x88EA3F58)
S_SSDT[414] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x88EA3EE0)
S_SSDT[416] : NtUserGetKeyState -> HOOKED (Unknown @ 0x88EA3FD0)
S_SSDT[428] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x8964BC88)
S_SSDT[460] : NtUserMessageCall -> HOOKED (Unknown @ 0x89666A60)
S_SSDT[475] : NtUserPostMessage -> HOOKED (Unknown @ 0x88F189D8)
S_SSDT[476] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x896329E8)
S_SSDT[549] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x8964BB48)
S_SSDT[552] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x88EA44D8)
IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED ([MAJOR] sfsync02.sys @ 0xF7717D60)

¤¤¤ Extern Hives: ¤¤¤
-> C:\windows\system32\config\SOFTWARE
-> C:\Documents and Settings\All Users\NTUSER.DAT
-> C:\Documents and Settings\Default User\NTUSER.DAT
-> C:\Documents and Settings\LocalService\NTUSER.DAT
-> C:\Documents and Settings\NetworkService\NTUSER.DAT
-> C:\Documents and Settings\Robert Hotte\NTUSER.DAT

¤¤¤ HOSTS File: ¤¤¤
--> J:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD1600JB-00EVA0 +++++
--- User ---
[MBR] 158d737e7587d66859655b1576c5595a
[BSP] 916dec536806afca437dc9bf0d9a5083 : Windows XP MBR Code
Partition table:
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 152617 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: ST3500320AS +++++
--- User ---
[MBR] 74cb2e609ce1d336195708263c77ed78
[BSP] 36b8385c976f574dcad65a9e669a24f1 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476929 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1]_S_11122012_02d0855.txt >>
RKreport[1]_S_11122012_02d0855.txt

RKreport[2]_D_11122012_02d0856.txt[/b]

RogueKiller V8.2.3 [11/07/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Website: http://tigzy.geeksto...roguekiller.php
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Robert Hotte [Admin rights]
Mode : Remove -- Date : 11/12/2012 08:56:26

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH][DLL] rundll32.exe -- J:\WINDOWS\system32\rundll32.exe : J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll -> KILLED [TermProc]

¤¤¤ Registry Entries : 17 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> DELETED
[RUN][SUSP PATH] HKUS\.DEFAULT[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-19[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-19[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-19_Classes[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-19_Classes[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-20[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-20[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-20_Classes[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-20_Classes[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-21-507921405-1682526488-725345543-1004_Classes[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-21-507921405-1682526488-725345543-1004_Classes[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-21-507921405-1682526488-725345543-1007[...]\Run : GARMIN_Corp (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\ID Vault\GARMIN_Corp\oioadkh.dll",iTunesHelperMainEntryPointW) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-21-507921405-1682526488-725345543-1007[...]\Run : Apple Computer (rundll32.exe "J:\Documents and Settings\Robert Hotte\Local Settings\Application Data\GARMIN_Corp\Apple Computer\nakuey.dll",DllRegisterServerW) -> DELETED
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[RUN][BLACKLIST DLL] [ON_C:LocalService]HKCU[...]\Run : wiresegura (Rundll32.exe "I:\WINDOWS\system32\voyuwuzo.dll",s) -> DELETED
[RUN][BLACKLIST DLL] [ON_C:NetworkService]HKCU[...]\Run : wiresegura (Rundll32.exe "I:\WINDOWS\system32\voyuwuzo.dll",s) -> DELETED

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤
SSDT[12] : NtAlertResumeThread @ 0x80637C26 -> HOOKED (Unknown @ 0x89638BE8)
SSDT[13] : NtAlertThread @ 0x80592C38 -> HOOKED (Unknown @ 0x89638CA8)
SSDT[17] : NtAllocateVirtualMemory @ 0x80570BC5 -> HOOKED (Unknown @ 0x89637BC8)
SSDT[19] : NtAssignProcessToJobObject @ 0x805E0F71 -> HOOKED (Unknown @ 0x89686828)
SSDT[31] : NtConnectPort @ 0x80590E5B -> HOOKED (Unknown @ 0x896BC6F8)
SSDT[43] : NtCreateMutant @ 0x80584095 -> HOOKED (Unknown @ 0x89638998)
SSDT[52] : NtCreateSymbolicLinkObject @ 0x805DFACA -> HOOKED (Unknown @ 0x89686688)
SSDT[53] : NtCreateThread @ 0x80584D41 -> HOOKED (Unknown @ 0x89653168)
SSDT[57] : NtDebugActiveProcess @ 0x80663261 -> HOOKED (Unknown @ 0x896868E8)
SSDT[68] : NtDuplicateObject @ 0x8057F195 -> HOOKED (Unknown @ 0x89938EA0)
SSDT[83] : NtFreeVirtualMemory @ 0x805710BF -> HOOKED (Unknown @ 0x89616778)
SSDT[89] : NtImpersonateAnonymousToken @ 0x8059AD05 -> HOOKED (Unknown @ 0x89638A68)
SSDT[91] : NtImpersonateThread @ 0x805876C2 -> HOOKED (Unknown @ 0x89638B28)
SSDT[97] : NtLoadDriver @ 0x805AF89E -> HOOKED (Unknown @ 0x896C9440)
SSDT[108] : NtMapViewOfSection @ 0x8057AC29 -> HOOKED (Unknown @ 0x895F2BA8)
SSDT[114] : NtOpenEvent @ 0x80589D69 -> HOOKED (Unknown @ 0x896388D8)
SSDT[122] : NtOpenProcess @ 0x8057F942 -> HOOKED (Unknown @ 0x897761A8)
SSDT[123] : NtOpenProcessToken @ 0x805784F6 -> HOOKED (Unknown @ 0x896451D0)
SSDT[125] : NtOpenSection @ 0x8057919E -> HOOKED (Unknown @ 0x89638758)
SSDT[128] : NtOpenThread @ 0x805E4817 -> HOOKED (Unknown @ 0x89BD3330)
SSDT[137] : NtProtectVirtualMemory @ 0x8057F573 -> HOOKED (Unknown @ 0x89686758)
SSDT[206] : NtResumeThread @ 0x805853B8 -> HOOKED (Unknown @ 0x89638D68)
SSDT[213] : NtSetContextThread @ 0x8063628D -> HOOKED (Unknown @ 0x89639C18)
SSDT[228] : NtSetInformationProcess @ 0x80574B1F -> HOOKED (Unknown @ 0x895F2A90)
SSDT[240] : NtSetSystemInformation @ 0x805B14D0 -> HOOKED (Unknown @ 0x89686BD0)
SSDT[253] : NtSuspendProcess @ 0x80637B6B -> HOOKED (Unknown @ 0x89638818)
SSDT[254] : NtSuspendThread @ 0x80637A87 -> HOOKED (Unknown @ 0x895F1768)
SSDT[257] : NtTerminateProcess @ 0x8058E8B9 -> HOOKED (Unknown @ 0x89637AE8)
SSDT[258] : NtTerminateThread @ 0x8058496E -> HOOKED (Unknown @ 0x895F67F0)
SSDT[267] : NtUnmapViewOfSection @ 0x8057A7B1 -> HOOKED (Unknown @ 0x895F81D0)
SSDT[277] : NtWriteVirtualMemory @ 0x805875F7 -> HOOKED (Unknown @ 0x8963D7F8)
S_SSDT[307] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x895F6858)
S_SSDT[383] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x88EA3F58)
S_SSDT[414] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x88EA3EE0)
S_SSDT[416] : NtUserGetKeyState -> HOOKED (Unknown @ 0x88EA3FD0)
S_SSDT[428] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x8964BC88)
S_SSDT[460] : NtUserMessageCall -> HOOKED (Unknown @ 0x89666A60)
S_SSDT[475] : NtUserPostMessage -> HOOKED (Unknown @ 0x88F189D8)
S_SSDT[476] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x896329E8)
S_SSDT[549] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x8964BB48)
S_SSDT[552] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x88EA44D8)
IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED ([MAJOR] sfsync02.sys @ 0xF7717D60)

¤¤¤ Extern Hives: ¤¤¤
-> C:\windows\system32\config\SOFTWARE
-> C:\Documents and Settings\All Users\NTUSER.DAT
-> C:\Documents and Settings\Default User\NTUSER.DAT
-> C:\Documents and Settings\LocalService\NTUSER.DAT
-> C:\Documents and Settings\NetworkService\NTUSER.DAT
-> C:\Documents and Settings\Robert Hotte\NTUSER.DAT

¤¤¤ HOSTS File: ¤¤¤
--> J:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD1600JB-00EVA0 +++++
--- User ---
[MBR] 158d737e7587d66859655b1576c5595a
[BSP] 916dec536806afca437dc9bf0d9a5083 : Windows XP MBR Code
Partition table:
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 152617 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: ST3500320AS +++++
--- User ---
[MBR] 74cb2e609ce1d336195708263c77ed78
[BSP] 36b8385c976f574dcad65a9e669a24f1 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476929 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[2]_D_11122012_02d0856.txt >>
RKreport[1]_S_11122012_02d0855.txt ; RKreport[2]_D_11122012_02d0856.txt

Quick question as not sure of answer. By untrained eye ( mine ;-} ) looks like most Registry Entries corrupted were program from garmin to update maps on gps. Does that mean that program was bad or was it just host to Malware?

#9
gringo_pr

Posted 12 November 2012 - 10:10 AM

Trusted Helper

Malware Removal
7,268 posts

Hello

The malware was using its folders to hide in

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

#10
Rtermite

Posted 12 November 2012 - 01:28 PM

Member

Topic Starter
Member
16 posts

I ran into problems trying to run ComboFix. Tried 3 times to run it after turning off Norton & Malwarebytes; first time it installed Recovery Console then opened the autoscan dos window,scanning for infected files. Stated "completed Stage_1, 2, ect thru Stage_50" with 6A, 19B & 32A stages being only extra ones, stated "deleteing files", rebooted went thru extra step in rebooting of asking; Please select the operation system to start: (This was new)it paused for second or and choose MS Windows XP Pro went to my logon screen and restarted windows, about totally finished start-up and up popped Microsoft System recoved from serious error then once acknowledged it finished booting but no report created (nothing new created on desktop and no window opened). Second and third tried was exactly same except didn't ask to install Recovery Console those times as installed it first try. Turned Norton and Malwarebyte back on rebooted again and Malwarebytes found Garmin\nakuey.dll trying to start again. Only real differenceI noticed was Recovery Console screen now comes up during boot. I tried to look for log file in ComboFix folder and looks exactly like "My Computer" folder.

#11
gringo_pr

Posted 12 November 2012 - 01:42 PM

Trusted Helper

Malware Removal
7,268 posts

Hello

Ok lets try this, I want you to run combofix in safe mode but it is very important that when combofix reboots the computer for you to direct it back into safe mode so it can finish the scan.

Boot into Safe Mode

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

after combofix has finished its scan please post the report back here.

Gringo

#12
Rtermite

Posted 12 November 2012 - 02:54 PM

Member

Topic Starter
Member
16 posts

Ok seems to have worked. Went into safe mode and ran combo-fix. It ran and deleted some files and created a log file without ever rebooting. Just to make sure I followed your directions as best as I could I rebooted computer my self and directed it back into safe mode. Nothing more happened. I rebooted again in reg mode and enabled Norton & Malwarebytes.

Here's Log file

ComboFix.txt

ComboFix 12-11-12.02 - Robert Hotte 11/12/2012 15:06:43.4.2 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1653 [GMT -5:00]
Running from: j:\documents and settings\Robert Hotte\Desktop\ComboFix.exe
AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
j:\documents and settings\Robert Hotte\WINDOWS
j:\windows\EventSystem.log
j:\windows\F52545ABC664EB52.log
j:\windows\Readme.txt
j:\windows\system32\ctl3d32.dll.tmp
j:\windows\system32\dllcache\wmpvis.dll
j:\windows\winhelp.ini
.
.
((((((((((((((((((((((((( Files Created from 2012-10-12 to 2012-11-12 )))))))))))))))))))))))))))))))
.
.
2012-11-08 22:48 . 2012-11-08 22:48 -------- d-----w- j:\documents and settings\LocalService\Application Data\Malwarebytes
2012-11-07 01:36 . 2012-11-07 01:36 -------- d-----w- j:\documents and settings\Robert Hotte\Application Data\Tific
2012-11-03 19:28 . 2012-11-03 23:23 -------- d-----w- j:\documents and settings\Robert Hotte\Application Data\System
2012-10-20 20:09 . 2012-10-20 20:09 -------- d-----w- J:\VLC
2012-10-18 00:45 . 2012-05-08 22:35 29528 ----a-w- j:\windows\system32\SmartDefragBootTime.exe
2012-10-18 00:44 . 2010-11-26 22:02 14776 ----a-w- j:\windows\system32\drivers\SmartDefragDriver.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-29 23:54 . 2009-04-18 01:37 22856 ----a-w- j:\windows\system32\drivers\mbam.sys
2012-08-28 15:14 . 2002-08-29 12:00 916992 ----a-w- j:\windows\system32\wininet.dll
2012-08-28 15:14 . 2002-08-29 12:00 43520 ----a-w- j:\windows\system32\licmgr10.dll
2012-08-28 15:14 . 2002-08-29 12:00 1469440 ------w- j:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2009-04-18 01:31 385024 ----a-w- j:\windows\system32\html.iec
2012-08-26 12:56 . 2012-08-26 12:56 121248 ----a-w- j:\windows\system32\drivers\AnyDVD.sys
2012-08-24 13:53 . 2002-08-29 12:00 177664 ----a-w- j:\windows\system32\wintrust.dll
2012-08-21 13:33 . 2002-08-29 12:00 2148864 ----a-w- j:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2002-08-29 01:04 2027520 ----a-w- j:\windows\system32\ntkrnlpa.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AutoStartNPSAgent"="j:\samsung new pc studio\NPSAgent.exe" [2010-07-04 95576]
"AnyDVD"="j:\anydvd\AnyDVDtray.exe" [2012-08-29 6315680]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2009-03-04 19456]
"GrooveMonitor"="j:\microsoft office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"IntelliType"="j:\program files\Microsoft Hardware\Keyboard\type32.exe" [2002-03-22 94208]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 19968]
"Samsung PanelMgr"="j:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-08-19 536576]
"StorageGuard"="j:\program files\VERITAS Software\Update Manager\sgtray.exe" [2002-06-18 155648]
"CloneCDTray"="j:\clonecd\CloneCDTray.exe" [2009-01-29 57344]
"NvCplDaemon"="j:\windows\system32\NvCpl.dll" [2012-02-10 15494464]
"NvMediaCenter"="NvMCTray.dll" [2012-02-10 108352]
"nwiz"="j:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-02-10 1634112]
"SunJavaUpdateSched"="j:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Adobe ARM"="j:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="j:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="j:\quicktime\qttask.exe" [2012-04-19 421888]
.
j:\documents and settings\Robert Hotte\Start Menu\Programs\Startup\
WKCALREM.LNK - j:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2002-7-10 24651]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SmartDefragBootTime.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"j:\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"j:\\Microsoft Office\\Office12\\GROOVE.EXE"=
"j:\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"j:\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"j:\\samsung new pc studio\\npsasvr.exe"=
"j:\\samsung new pc studio\\npsvsvr.exe"=
"j:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
"j:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
R0 SmartDefragDriver;SmartDefragDriver;j:\windows\system32\drivers\SmartDefragDriver.sys [10/17/2012 7:44 PM 14776]
R0 SymDS;Symantec Data Store;j:\windows\system32\drivers\N360\0502020.003\symds.sys [7/16/2012 4:59 PM 340088]
R0 SymEFA;Symantec Extended File Attributes;j:\windows\system32\drivers\N360\0502020.003\symefa.sys [7/16/2012 4:59 PM 744568]
S1 BHDrvx86;BHDrvx86;j:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20121030.002\BHDrvx86.sys [11/5/2012 12:20 PM 995488]
S1 SymIRON;Symantec Iron Driver;j:\windows\system32\drivers\N360\0502020.003\ironx86.sys [7/16/2012 4:59 PM 136312]
S2 FsUsbExService;FsUsbExService;j:\windows\system32\FsUsbExService.Exe [8/13/2010 2:37 PM 238952]
S2 MBAMScheduler;MBAMScheduler;j:\malwarebytes' anti-malware\mbamscheduler.exe [10/31/2012 5:35 PM 399432]
S2 MBAMService;MBAMService;j:\malwarebytes' anti-malware\mbamservice.exe [4/17/2009 8:37 PM 676936]
S2 N360;Norton Security Suite;j:\program files\Norton Security Suite\Engine\5.2.2.3\ccsvchst.exe [7/16/2012 4:59 PM 130008]
S2 SSPORT;SSPORT;\??\j:\windows\system32\Drivers\SSPORT.sys --> j:\windows\system32\Drivers\SSPORT.sys [?]
S3 COMMONFX.SYS;COMMONFX.SYS;j:\windows\system32\drivers\COMMONFX.sys [3/4/2009 1:42 PM 99352]
S3 COMMONFX;COMMONFX;j:\windows\system32\drivers\COMMONFX.sys [3/4/2009 1:42 PM 99352]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;j:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [4/17/2009 10:23 PM 79360]
S3 CTAUDFX.SYS;CTAUDFX.SYS;j:\windows\system32\drivers\CTAUDFX.sys [3/4/2009 1:42 PM 555032]
S3 CTAUDFX;CTAUDFX;j:\windows\system32\drivers\CTAUDFX.sys [3/4/2009 1:42 PM 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;j:\windows\system32\drivers\CTERFXFX.sys [3/4/2009 1:42 PM 100888]
S3 CTERFXFX;CTERFXFX;j:\windows\system32\drivers\CTERFXFX.sys [3/4/2009 1:42 PM 100888]
S3 ctgame;Game Port;j:\windows\system32\drivers\ctgame.sys [3/4/2009 1:45 PM 18840]
S3 CTSBLFX.SYS;CTSBLFX.SYS;j:\windows\system32\drivers\CTSBLFX.sys [3/4/2009 1:42 PM 566296]
S3 CTSBLFX;CTSBLFX;j:\windows\system32\drivers\CTSBLFX.sys [3/4/2009 1:42 PM 566296]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;j:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/9/2012 2:57 PM 106656]
S3 FsUsbExDisk;FsUsbExDisk;j:\windows\system32\FsUsbExDisk.Sys [8/13/2010 2:37 PM 36608]
S3 IDSxpx86;IDSxpx86;j:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20121109.001\IDSXpx86.sys [11/9/2012 5:28 PM 373728]
S3 MBAMProtector;MBAMProtector;j:\windows\system32\drivers\mbam.sys [4/17/2009 8:37 PM 22856]
S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);j:\windows\system32\drivers\sscebus.sys [8/13/2010 2:38 PM 98560]
S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;j:\windows\system32\drivers\sscemdfl.sys [8/13/2010 2:38 PM 14848]
S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;j:\windows\system32\drivers\sscemdm.sys [8/13/2010 2:38 PM 123648]
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-12 j:\windows\Tasks\SmartDefragUpdate.job
- j:\smart defrag 2\AutoUpdate.exe [2012-10-18 15:06]
.
2012-11-12 j:\windows\Tasks\SmartDefrag_Startup.job
- j:\smart defrag 2\SmartDefrag.exe [2012-06-28 15:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://registration.excite.com/excitereg/login.jsp
uInternet Settings,ProxyOverride = localhost
IE: E&xport to Microsoft Excel - j:\micros~1\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://j:\windows\Java\classes\dajava.cab
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.3.0/GarminAxControl_32.CAB
DPF: Microsoft XML Parser for Java - file://j:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-Seticon - c:\program files\Icons\Seticon.exe
HKLM-Run-NPSStartup - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-01_Simmental - j:\usb drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - j:\usb drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - j:\usb drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - j:\usb drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - j:\usb drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - j:\usb drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - j:\usb drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - j:\usb drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - j:\usb drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - j:\usb drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - j:\usb drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - j:\usb drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - j:\usb drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - j:\usb drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - j:\usb drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - j:\usb drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - j:\usb drivers\22_WiBro_WiMAX\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-12 15:18
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"j:\program files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe\" /s \"N360\" /m \"j:\program files\Norton Security Suite\Engine\5.2.2.3\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-507921405-1682526488-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
Completion time: 2012-11-12 15:22:02
ComboFix-quarantined-files.txt 2012-11-12 20:22
.
Pre-Run: 154,004,541,440 bytes free
Post-Run: 153,994,780,672 bytes free
.
- - End Of File - - C17041D2793C05142EBAB775D87E951F

#13
gringo_pr

Posted 12 November 2012 - 02:59 PM

Trusted Helper

Malware Removal
7,268 posts

Greetings

Good Job!! I need to know how the computer is doing now.

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.

Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo

#14
Rtermite

Posted 12 November 2012 - 03:28 PM

Member

Topic Starter
Member
16 posts

Quick question for you. I was running TDSSKiller and it found Rootkit.Boot.Pihar.c,default action was Cure so clicked Continue and after few minutes came back with message of " can't cure MBR, write standard boot code? " I passed up on that option and it exited, I created log here it is. Should I let it write stardard boot code or how should I proceed?

TDSSKiller log

16:10:08.0515 3956 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
16:10:09.0203 3956 ============================================================
16:10:09.0203 3956 Current date / time: 2012/11/12 16:10:09.0203
16:10:09.0203 3956 SystemInfo:
16:10:09.0203 3956
16:10:09.0203 3956 OS Version: 5.1.2600 ServicePack: 3.0
16:10:09.0203 3956 Product type: Workstation
16:10:09.0203 3956 ComputerName: BOBSCOMPUTER
16:10:09.0203 3956 UserName: Robert Hotte
16:10:09.0203 3956 Windows directory: J:\WINDOWS
16:10:09.0203 3956 System windows directory: J:\WINDOWS
16:10:09.0203 3956 Processor architecture: Intel x86
16:10:09.0203 3956 Number of processors: 2
16:10:09.0203 3956 Page size: 0x1000
16:10:09.0203 3956 Boot type: Normal boot
16:10:09.0203 3956 ============================================================
16:10:11.0328 3956 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
16:10:11.0328 3956 Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
16:10:11.0359 3956 ============================================================
16:10:11.0359 3956 \Device\Harddisk0\DR0:
16:10:11.0359 3956 MBR partitions:
16:10:11.0359 3956 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A14BC1
16:10:11.0359 3956 \Device\Harddisk1\DR1:
16:10:11.0359 3956 MBR partitions:
16:10:11.0359 3956 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A380D41
16:10:11.0359 3956 ============================================================
16:10:11.0375 3956 C: <-> \Device\Harddisk0\DR0\Partition1
16:10:11.0406 3956 J: <-> \Device\Harddisk1\DR1\Partition1
16:10:11.0406 3956 ============================================================
16:10:11.0406 3956 Initialize success
16:10:11.0406 3956 ============================================================
16:10:31.0265 3792 ============================================================
16:10:31.0265 3792 Scan started
16:10:31.0265 3792 Mode: Manual;
16:10:31.0265 3792 ============================================================
16:10:31.0500 3792 ================ Scan system memory ========================
16:10:31.0500 3792 System memory - ok
16:10:31.0500 3792 ================ Scan services =============================
16:10:31.0593 3792 Abiosdsk - ok
16:10:31.0593 3792 abp480n5 - ok
16:10:31.0671 3792 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI J:\WINDOWS\system32\DRIVERS\ACPI.sys
16:10:31.0687 3792 ACPI - ok
16:10:31.0734 3792 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC J:\WINDOWS\system32\drivers\ACPIEC.sys
16:10:31.0734 3792 ACPIEC - ok
16:10:31.0750 3792 adpu160m - ok
16:10:31.0781 3792 [ 8BED39E3C35D6A489438B8141717A557 ] aec J:\WINDOWS\system32\drivers\aec.sys
16:10:31.0781 3792 aec - ok
16:10:31.0812 3792 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD J:\WINDOWS\System32\drivers\afd.sys
16:10:31.0812 3792 AFD - ok
16:10:31.0828 3792 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 J:\WINDOWS\system32\DRIVERS\agp440.sys
16:10:31.0828 3792 agp440 - ok
16:10:31.0828 3792 Aha154x - ok
16:10:31.0843 3792 aic78u2 - ok
16:10:31.0859 3792 aic78xx - ok
16:10:31.0906 3792 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter J:\WINDOWS\system32\alrsvc.dll
16:10:31.0906 3792 Alerter - ok
16:10:31.0937 3792 [ 8C515081584A38AA007909CD02020B3D ] ALG J:\WINDOWS\System32\alg.exe
16:10:31.0937 3792 ALG - ok
16:10:31.0953 3792 AliIde - ok
16:10:31.0953 3792 amsint - ok
16:10:32.0000 3792 [ 8D3A55F7B7BE6B374479E5195F477226 ] AnyDVD J:\WINDOWS\system32\Drivers\AnyDVD.sys
16:10:32.0015 3792 AnyDVD - ok
16:10:32.0062 3792 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt J:\WINDOWS\System32\appmgmts.dll
16:10:32.0062 3792 AppMgmt - ok
16:10:32.0093 3792 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 J:\WINDOWS\system32\DRIVERS\arp1394.sys
16:10:32.0093 3792 Arp1394 - ok
16:10:32.0109 3792 asc - ok
16:10:32.0109 3792 asc3350p - ok
16:10:32.0125 3792 asc3550 - ok
16:10:32.0218 3792 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state J:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
16:10:32.0250 3792 aspnet_state - ok
16:10:32.0281 3792 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac J:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:10:32.0281 3792 AsyncMac - ok
16:10:32.0281 3792 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi J:\WINDOWS\system32\DRIVERS\atapi.sys
16:10:32.0296 3792 atapi - ok
16:10:32.0296 3792 Atdisk - ok
16:10:32.0312 3792 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc J:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:10:32.0328 3792 Atmarpc - ok
16:10:32.0359 3792 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv J:\WINDOWS\System32\audiosrv.dll
16:10:32.0359 3792 AudioSrv - ok
16:10:32.0390 3792 [ D9F724AA26C010A217C97606B160ED68 ] audstub J:\WINDOWS\system32\DRIVERS\audstub.sys
16:10:32.0390 3792 audstub - ok
16:10:32.0437 3792 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep J:\WINDOWS\system32\drivers\Beep.sys
16:10:32.0437 3792 Beep - ok
16:10:32.0578 3792 [ 684B12018A54ADC1F856372EC5762B48 ] BHDrvx86 J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20121030.002\BHDrvx86.sys
16:10:32.0578 3792 BHDrvx86 - ok
16:10:32.0640 3792 [ 574738F61FCA2935F5265DC4E5691314 ] BITS J:\WINDOWS\system32\qmgr.dll
16:10:32.0765 3792 BITS - ok
16:10:32.0796 3792 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser J:\WINDOWS\System32\browser.dll
16:10:32.0796 3792 Browser - ok
16:10:32.0843 3792 catchme - ok
16:10:32.0890 3792 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k J:\WINDOWS\system32\drivers\cbidf2k.sys
16:10:32.0890 3792 cbidf2k - ok
16:10:32.0906 3792 cd20xrnt - ok
16:10:32.0921 3792 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio J:\WINDOWS\system32\drivers\Cdaudio.sys
16:10:32.0921 3792 Cdaudio - ok
16:10:32.0937 3792 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs J:\WINDOWS\system32\drivers\Cdfs.sys
16:10:32.0937 3792 Cdfs - ok
16:10:32.0968 3792 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom J:\WINDOWS\system32\DRIVERS\cdrom.sys
16:10:32.0984 3792 Cdrom - ok
16:10:32.0984 3792 Changer - ok
16:10:33.0031 3792 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc J:\WINDOWS\system32\cisvc.exe
16:10:33.0031 3792 CiSvc - ok
16:10:33.0078 3792 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv J:\WINDOWS\system32\clipsrv.exe
16:10:33.0093 3792 ClipSrv - ok
16:10:33.0109 3792 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 J:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:10:33.0125 3792 clr_optimization_v2.0.50727_32 - ok
16:10:33.0187 3792 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 J:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:10:33.0187 3792 clr_optimization_v4.0.30319_32 - ok
16:10:33.0187 3792 CmdIde - ok
16:10:33.0218 3792 [ 22F8692FD3E017EAD334945B3199B0E3 ] COMMONFX J:\WINDOWS\system32\drivers\COMMONFX.SYS
16:10:33.0234 3792 COMMONFX - ok
16:10:33.0265 3792 [ 22F8692FD3E017EAD334945B3199B0E3 ] COMMONFX.SYS J:\WINDOWS\System32\drivers\COMMONFX.SYS
16:10:33.0265 3792 COMMONFX.SYS - ok
16:10:33.0265 3792 COMSysApp - ok
16:10:33.0281 3792 Cpqarray - ok
16:10:33.0328 3792 [ C0EAD9F8AB83D41FF07303C75589C2B8 ] Creative Audio Engine Licensing Service J:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
16:10:33.0343 3792 Creative Audio Engine Licensing Service - ok
16:10:33.0390 3792 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc J:\WINDOWS\System32\cryptsvc.dll
16:10:33.0390 3792 CryptSvc - ok
16:10:33.0453 3792 [ AA7E939BC07965A807C6AC2F1D4D22B7 ] ctac32k J:\WINDOWS\system32\drivers\ctac32k.sys
16:10:33.0484 3792 ctac32k - ok
16:10:33.0515 3792 [ 79E7ABBF928D8A8002EBBA0985905DC1 ] ctaud2k J:\WINDOWS\system32\drivers\ctaud2k.sys
16:10:33.0531 3792 ctaud2k - ok
16:10:33.0562 3792 [ 6D98048890B44191E0DAED4639A9F18C ] CTAUDFX J:\WINDOWS\system32\drivers\CTAUDFX.SYS
16:10:33.0593 3792 CTAUDFX - ok
16:10:33.0625 3792 [ 6D98048890B44191E0DAED4639A9F18C ] CTAUDFX.SYS J:\WINDOWS\System32\drivers\CTAUDFX.SYS
16:10:33.0640 3792 CTAUDFX.SYS - ok
16:10:33.0718 3792 [ 645EC8749BBBA7E991A72BFAC2E14AA7 ] CTAudSvcService J:\Program Files\Creative\Shared Files\CTAudSvc.exe
16:10:33.0718 3792 CTAudSvcService - ok
16:10:33.0750 3792 [ A216C8698C4406A031AF6F867AFE4F92 ] ctdvda2k J:\WINDOWS\system32\drivers\ctdvda2k.sys
16:10:36.0453 3792 ctdvda2k - ok
16:10:36.0484 3792 [ 5192225E2ADFD36D0FC7D61B8E0BAE87 ] CTERFXFX J:\WINDOWS\system32\drivers\CTERFXFX.SYS
16:10:36.0500 3792 CTERFXFX - ok
16:10:36.0500 3792 [ 5192225E2ADFD36D0FC7D61B8E0BAE87 ] CTERFXFX.SYS J:\WINDOWS\System32\drivers\CTERFXFX.SYS
16:10:36.0515 3792 CTERFXFX.SYS - ok
16:10:36.0546 3792 [ B13DF6FF4547A7629413B20262DA385A ] ctgame J:\WINDOWS\system32\DRIVERS\ctgame.sys
16:10:36.0546 3792 ctgame - ok
16:10:36.0578 3792 [ CE3395B054B641E454C8861020FF1D82 ] ctprxy2k J:\WINDOWS\system32\drivers\ctprxy2k.sys
16:10:36.0593 3792 ctprxy2k - ok
16:10:36.0625 3792 [ 8750C640D3068861117FA9166B8AECDE ] CTSBLFX J:\WINDOWS\system32\drivers\CTSBLFX.SYS
16:10:36.0640 3792 CTSBLFX - ok
16:10:36.0703 3792 [ 8750C640D3068861117FA9166B8AECDE ] CTSBLFX.SYS J:\WINDOWS\System32\drivers\CTSBLFX.SYS
16:10:36.0703 3792 CTSBLFX.SYS - ok
16:10:36.0734 3792 [ 01B9017D05D82B6FBCD5CECCE93F3AA7 ] ctsfm2k J:\WINDOWS\system32\drivers\ctsfm2k.sys
16:10:36.0828 3792 ctsfm2k - ok
16:10:36.0828 3792 dac2w2k - ok
16:10:36.0843 3792 dac960nt - ok
16:10:36.0906 3792 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch J:\WINDOWS\system32\rpcss.dll
16:10:36.0906 3792 DcomLaunch - ok
16:10:36.0921 3792 DgiVecp - ok
16:10:36.0937 3792 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp J:\WINDOWS\System32\dhcpcsvc.dll
16:10:36.0937 3792 Dhcp - ok
16:10:37.0000 3792 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk J:\WINDOWS\system32\DRIVERS\disk.sys
16:10:37.0000 3792 Disk - ok
16:10:37.0015 3792 dmadmin - ok
16:10:37.0046 3792 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot J:\WINDOWS\system32\drivers\dmboot.sys
16:10:37.0078 3792 dmboot - ok
16:10:37.0140 3792 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio J:\WINDOWS\system32\drivers\dmio.sys
16:10:37.0140 3792 dmio - ok
16:10:37.0171 3792 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload J:\WINDOWS\system32\drivers\dmload.sys
16:10:37.0187 3792 dmload - ok
16:10:37.0187 3792 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver J:\WINDOWS\System32\dmserver.dll
16:10:37.0187 3792 dmserver - ok
16:10:37.0218 3792 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic J:\WINDOWS\system32\drivers\DMusic.sys
16:10:37.0218 3792 DMusic - ok
16:10:37.0250 3792 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache J:\WINDOWS\System32\dnsrslvr.dll
16:10:37.0250 3792 Dnscache - ok
16:10:37.0296 3792 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc J:\WINDOWS\System32\dot3svc.dll
16:10:37.0296 3792 Dot3svc - ok
16:10:37.0312 3792 dpti2o - ok
16:10:37.0343 3792 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud J:\WINDOWS\system32\drivers\drmkaud.sys
16:10:37.0343 3792 drmkaud - ok
16:10:37.0359 3792 [ 2476936F4994E9084CCFE75ED4F6226A ] E1000 J:\WINDOWS\system32\DRIVERS\e1000325.sys
16:10:37.0375 3792 E1000 - ok
16:10:37.0406 3792 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost J:\WINDOWS\System32\eapsvc.dll
16:10:37.0406 3792 EapHost - ok
16:10:37.0453 3792 [ 85B8B4032A895A746D46A288A9B30DED ] eeCtrl J:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
16:10:37.0453 3792 eeCtrl - ok
16:10:37.0500 3792 [ CE37E3D51912E59C80C6D84337C0B4CD ] ElbyCDFL J:\WINDOWS\system32\Drivers\ElbyCDFL.sys
16:10:37.0500 3792 ElbyCDFL - ok
16:10:37.0546 3792 [ D71233D7CCC2E64F8715A20428D5A33B ] ElbyCDIO J:\WINDOWS\system32\Drivers\ElbyCDIO.sys
16:10:37.0546 3792 ElbyCDIO - ok
16:10:37.0578 3792 [ 71B09041642DE925E6150EB525DCC3BF ] emupia J:\WINDOWS\system32\drivers\emupia2k.sys
16:10:37.0593 3792 emupia - ok
16:10:37.0625 3792 [ B5A8A04A6E5B4E86B95B1553AA918F5F ] EraserUtilRebootDrv J:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
16:10:37.0625 3792 EraserUtilRebootDrv - ok
16:10:37.0671 3792 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc J:\WINDOWS\System32\ersvc.dll
16:10:37.0671 3792 ERSvc - ok
16:10:37.0718 3792 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog J:\WINDOWS\system32\services.exe
16:10:37.0734 3792 Eventlog - ok
16:10:37.0781 3792 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem J:\WINDOWS\System32\es.dll
16:10:37.0781 3792 EventSystem - ok
16:10:37.0796 3792 [ 38D332A6D56AF32635675F132548343E ] Fastfat J:\WINDOWS\system32\drivers\Fastfat.sys
16:10:37.0796 3792 Fastfat - ok
16:10:37.0843 3792 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility J:\WINDOWS\System32\shsvcs.dll
16:10:37.0843 3792 FastUserSwitchingCompatibility - ok
16:10:37.0859 3792 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc J:\WINDOWS\system32\DRIVERS\fdc.sys
16:10:37.0859 3792 Fdc - ok
16:10:37.0906 3792 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips J:\WINDOWS\system32\drivers\Fips.sys
16:10:37.0906 3792 Fips - ok
16:10:37.0921 3792 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk J:\WINDOWS\system32\DRIVERS\flpydisk.sys
16:10:37.0921 3792 Flpydisk - ok
16:10:37.0953 3792 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr J:\WINDOWS\system32\drivers\fltmgr.sys
16:10:37.0953 3792 FltMgr - ok
16:10:38.0046 3792 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 j:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
16:10:38.0062 3792 FontCache3.0.0.0 - ok
16:10:38.0093 3792 [ CBE5F69A5E5B918225F420BA748F3742 ] FsUsbExDisk J:\WINDOWS\system32\FsUsbExDisk.SYS
16:10:38.0093 3792 FsUsbExDisk - ok
16:10:38.0109 3792 [ 96633419F4A1E37ACB89B45EBCCFE001 ] FsUsbExService J:\WINDOWS\system32\FsUsbExService.Exe
16:10:38.0125 3792 FsUsbExService - ok
16:10:38.0140 3792 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec J:\WINDOWS\system32\drivers\Fs_Rec.sys
16:10:38.0140 3792 Fs_Rec - ok
16:10:38.0171 3792 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk J:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:10:38.0187 3792 Ftdisk - ok
16:10:38.0203 3792 [ 72FE2BEA6863D4EB93442A1C4FB5CA48 ] GcKernel J:\WINDOWS\system32\DRIVERS\GcKernel.sys
16:10:38.0218 3792 GcKernel - ok
16:10:38.0250 3792 [ 5AE3A887ECE5BBB72CFAB273C2FD1CFA ] GEARAspiWDM J:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
16:10:38.0250 3792 GEARAspiWDM - ok
16:10:38.0296 3792 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc J:\WINDOWS\system32\DRIVERS\msgpc.sys
16:10:38.0312 3792 Gpc - ok
16:10:38.0343 3792 [ 2E37C43FB534F1D85DCF552D5B2AF9BA ] ha10kx2k J:\WINDOWS\system32\drivers\ha10kx2k.sys
16:10:38.0375 3792 ha10kx2k - ok
16:10:38.0390 3792 [ 607B73DC2A69A98C7F10B5702D947319 ] hap16v2k J:\WINDOWS\system32\drivers\hap16v2k.sys
16:10:38.0406 3792 hap16v2k - ok
16:10:38.0437 3792 [ F674EEAA2D1ED14606AEDFED65C34893 ] hap17v2k J:\WINDOWS\system32\drivers\hap17v2k.sys
16:10:38.0453 3792 hap17v2k - ok
16:10:38.0562 3792 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc J:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
16:10:38.0562 3792 helpsvc - ok
16:10:38.0562 3792 HidServ - ok
16:10:38.0640 3792 [ BD205320308FB41C88A4049A2D1764B4 ] HIDSwvd J:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
16:10:38.0703 3792 HIDSwvd - ok
16:10:38.0703 3792 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb J:\WINDOWS\system32\DRIVERS\hidusb.sys
16:10:38.0718 3792 hidusb - ok
16:10:38.0750 3792 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc J:\WINDOWS\System32\kmsvc.dll
16:10:38.0765 3792 hkmsvc - ok
16:10:38.0765 3792 hpn - ok
16:10:38.0812 3792 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP J:\WINDOWS\system32\Drivers\HTTP.sys
16:10:38.0812 3792 HTTP - ok
16:10:38.0859 3792 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter J:\WINDOWS\System32\w3ssl.dll
16:10:38.0875 3792 HTTPFilter - ok
16:10:38.0875 3792 i2omgmt - ok
16:10:38.0890 3792 i2omp - ok
16:10:38.0921 3792 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt J:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:10:38.0937 3792 i8042prt - ok
16:10:38.0984 3792 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc J:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:10:39.0015 3792 idsvc - ok
16:10:39.0125 3792 [ C19BF2A07BE972A110220DF6B1E89D14 ] IDSxpx86 J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20121109.001\IDSxpx86.sys
16:10:39.0125 3792 IDSxpx86 - ok
16:10:39.0156 3792 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi J:\WINDOWS\system32\DRIVERS\imapi.sys
16:10:39.0156 3792 Imapi - ok
16:10:39.0187 3792 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService J:\WINDOWS\system32\imapi.exe
16:10:39.0187 3792 ImapiService - ok
16:10:39.0187 3792 ini910u - ok
16:10:39.0203 3792 IntelIde - ok
16:10:39.0234 3792 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm J:\WINDOWS\system32\DRIVERS\intelppm.sys
16:10:39.0234 3792 intelppm - ok
16:10:39.0250 3792 [ 3BB22519A194418D5FEC05D800A19AD0 ] ip6fw J:\WINDOWS\system32\drivers\ip6fw.sys
16:10:39.0250 3792 ip6fw - ok
16:10:39.0265 3792 IPFilter - ok
16:10:39.0296 3792 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver J:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:10:39.0296 3792 IpFilterDriver - ok
16:10:39.0312 3792 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp J:\WINDOWS\system32\DRIVERS\ipinip.sys
16:10:39.0312 3792 IpInIp - ok
16:10:39.0343 3792 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat J:\WINDOWS\system32\DRIVERS\ipnat.sys
16:10:39.0343 3792 IpNat - ok
16:10:39.0375 3792 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec J:\WINDOWS\system32\DRIVERS\ipsec.sys
16:10:39.0375 3792 IPSec - ok
16:10:39.0390 3792 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM J:\WINDOWS\system32\DRIVERS\irenum.sys
16:10:39.0406 3792 IRENUM - ok
16:10:39.0406 3792 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp J:\WINDOWS\system32\DRIVERS\isapnp.sys
16:10:39.0421 3792 isapnp - ok
16:10:39.0500 3792 [ 0A5709543986843D37A92290B7838340 ] JavaQuickStarterService J:\java\jre6\bin\jqs.exe
16:10:39.0515 3792 JavaQuickStarterService - ok
16:10:39.0578 3792 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass J:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:10:39.0609 3792 Kbdclass - ok
16:10:39.0625 3792 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid J:\WINDOWS\system32\DRIVERS\kbdhid.sys
16:10:39.0625 3792 kbdhid - ok
16:10:39.0687 3792 [ 692BCF44383D056AED41B045A323D378 ] kmixer J:\WINDOWS\system32\drivers\kmixer.sys
16:10:39.0687 3792 kmixer - ok
16:10:39.0734 3792 [ B467646C54CC746128904E1654C750C1 ] KSecDD J:\WINDOWS\system32\drivers\KSecDD.sys
16:10:39.0734 3792 KSecDD - ok
16:10:39.0781 3792 [ 4103DBB6CAA85E40D271C1AD12BBF776 ] L8042pr2 J:\WINDOWS\system32\DRIVERS\L8042pr2.Sys
16:10:39.0781 3792 L8042pr2 - ok
16:10:39.0796 3792 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver J:\WINDOWS\System32\srvsvc.dll
16:10:39.0796 3792 lanmanserver - ok
16:10:39.0843 3792 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation J:\WINDOWS\System32\wkssvc.dll
16:10:39.0843 3792 lanmanworkstation - ok
16:10:39.0843 3792 lbrtfdc - ok
16:10:39.0890 3792 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts J:\WINDOWS\System32\lmhsvc.dll
16:10:39.0890 3792 LmHosts - ok
16:10:39.0921 3792 [ B666F835C18974F392A387C6E863072F ] LMouFlt2 J:\WINDOWS\system32\DRIVERS\LMouFlt2.Sys
16:10:39.0921 3792 LMouFlt2 - ok
16:10:39.0968 3792 [ 500D089CE760D83DA2B6CBA681AA9949 ] MBAMProtector J:\WINDOWS\system32\drivers\mbam.sys
16:10:39.0968 3792 MBAMProtector - ok
16:10:40.0031 3792 [ 85B16A92B117A5A800032ECD904B86DB ] MBAMScheduler J:\Malwarebytes' Anti-Malware\mbamscheduler.exe
16:10:40.0031 3792 MBAMScheduler - ok
16:10:40.0062 3792 [ 20E2469DB709FC675E655CEAA11BE312 ] MBAMService J:\Malwarebytes' Anti-Malware\mbamservice.exe
16:10:40.0078 3792 MBAMService - ok
16:10:40.0093 3792 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger J:\WINDOWS\System32\msgsvc.dll
16:10:40.0109 3792 Messenger - ok
16:10:40.0156 3792 [ BAFDD5E28BAEA99D7F4772AF2F5EC7EE ] mfeavfk J:\WINDOWS\system32\drivers\mfeavfk.sys
16:10:40.0156 3792 mfeavfk - ok
16:10:40.0171 3792 [ 1D003E3056A43D881597D6763E83B943 ] mfebopk J:\WINDOWS\system32\drivers\mfebopk.sys
16:10:40.0171 3792 mfebopk - ok
16:10:40.0218 3792 [ 3F138A1C8A0659F329F242D1E389B2CF ] mfehidk J:\WINDOWS\system32\drivers\mfehidk.sys
16:10:40.0218 3792 mfehidk - ok
16:10:40.0250 3792 [ 41FE2F288E05A6C8AB85DD56770FFBAD ] mferkdk J:\WINDOWS\system32\drivers\mferkdk.sys
16:10:40.0250 3792 mferkdk - ok
16:10:40.0281 3792 [ 096B52EA918AA909BA5903D79E129005 ] mfesmfk J:\WINDOWS\system32\drivers\mfesmfk.sys
16:10:40.0281 3792 mfesmfk - ok
16:10:40.0359 3792 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service J:\Microsoft Office\Office12\GrooveAuditService.exe
16:10:40.0421 3792 Microsoft Office Groove Audit Service - ok
16:10:40.0484 3792 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd J:\WINDOWS\system32\drivers\mnmdd.sys
16:10:40.0484 3792 mnmdd - ok
16:10:40.0500 3792 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc J:\WINDOWS\System32\mnmsrvc.exe
16:10:40.0500 3792 mnmsrvc - ok
16:10:40.0515 3792 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem J:\WINDOWS\system32\drivers\Modem.sys
16:10:40.0515 3792 Modem - ok
16:10:40.0531 3792 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass J:\WINDOWS\system32\DRIVERS\mouclass.sys
16:10:40.0546 3792 Mouclass - ok
16:10:40.0578 3792 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr J:\WINDOWS\system32\drivers\MountMgr.sys
16:10:40.0609 3792 MountMgr - ok
16:10:40.0625 3792 mraid35x - ok
16:10:40.0640 3792 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV J:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:10:40.0640 3792 MRxDAV - ok
16:10:40.0671 3792 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb J:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:10:40.0671 3792 MRxSmb - ok
16:10:40.0703 3792 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC J:\WINDOWS\System32\msdtc.exe
16:10:40.0703 3792 MSDTC - ok
16:10:40.0734 3792 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs J:\WINDOWS\system32\drivers\Msfs.sys
16:10:40.0734 3792 Msfs - ok
16:10:40.0734 3792 MSIServer - ok
16:10:40.0765 3792 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV J:\WINDOWS\system32\drivers\MSKSSRV.sys
16:10:40.0781 3792 MSKSSRV - ok
16:10:40.0812 3792 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK J:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:10:40.0812 3792 MSPCLOCK - ok
16:10:40.0828 3792 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM J:\WINDOWS\system32\drivers\MSPQM.sys
16:10:40.0828 3792 MSPQM - ok
16:10:40.0859 3792 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios J:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:10:40.0859 3792 mssmbios - ok
16:10:40.0890 3792 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup J:\WINDOWS\system32\drivers\Mup.sys
16:10:40.0937 3792 Mup - ok
16:10:40.0984 3792 [ E78A365CC3E0FBFC018A33DCE01909F8 ] N360 J:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe
16:10:40.0984 3792 N360 - ok
16:10:41.0046 3792 [ 0102140028FAD045756796E1C685D695 ] napagent J:\WINDOWS\System32\qagentrt.dll
16:10:41.0062 3792 napagent - ok
16:10:41.0156 3792 [ 8E4C77AD9BB279900C00F870CC0C674B ] NAVENG J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20121111.008\NAVENG.SYS
16:10:41.0156 3792 NAVENG - ok
16:10:41.0203 3792 [ 826F699B69E88A3920C70F344DD42D88 ] NAVEX15 J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20121111.008\NAVEX15.SYS
16:10:41.0218 3792 NAVEX15 - ok
16:10:41.0250 3792 [ 1DF7F42665C94B825322FAE71721130D ] NDIS J:\WINDOWS\system32\drivers\NDIS.sys
16:10:41.0281 3792 NDIS - ok
16:10:41.0328 3792 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi J:\WINDOWS\system32\DRIVERS\ndistapi.sys
16:10:41.0328 3792 NdisTapi - ok
16:10:41.0375 3792 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio J:\WINDOWS\system32\DRIVERS\ndisuio.sys
16:10:41.0390 3792 Ndisuio - ok
16:10:41.0406 3792 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan J:\WINDOWS\system32\DRIVERS\ndiswan.sys
16:10:41.0406 3792 NdisWan - ok
16:10:41.0421 3792 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy J:\WINDOWS\system32\drivers\NDProxy.sys
16:10:41.0437 3792 NDProxy - ok
16:10:41.0437 3792 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS J:\WINDOWS\system32\DRIVERS\netbios.sys
16:10:41.0437 3792 NetBIOS - ok
16:10:41.0484 3792 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT J:\WINDOWS\system32\DRIVERS\netbt.sys
16:10:41.0484 3792 NetBT - ok
16:10:41.0515 3792 [ B857BA82860D7FF85AE29B095645563B ] NetDDE J:\WINDOWS\system32\netdde.exe
16:10:41.0515 3792 NetDDE - ok
16:10:41.0531 3792 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm J:\WINDOWS\system32\netdde.exe
16:10:41.0531 3792 NetDDEdsdm - ok
16:10:41.0562 3792 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon J:\WINDOWS\system32\lsass.exe
16:10:41.0562 3792 Netlogon - ok
16:10:41.0593 3792 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman J:\WINDOWS\System32\netman.dll
16:10:41.0609 3792 Netman - ok
16:10:41.0656 3792 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing J:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:10:41.0656 3792 NetTcpPortSharing - ok
16:10:41.0687 3792 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 J:\WINDOWS\system32\DRIVERS\nic1394.sys
16:10:41.0687 3792 NIC1394 - ok
16:10:41.0750 3792 [ 943337D786A56729263071623BBB9DE5 ] Nla J:\WINDOWS\System32\mswsock.dll
16:10:41.0750 3792 Nla - ok
16:10:41.0765 3792 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs J:\WINDOWS\system32\drivers\Npfs.sys
16:10:41.0765 3792 Npfs - ok
16:10:41.0828 3792 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs J:\WINDOWS\system32\drivers\Ntfs.sys
16:10:41.0859 3792 Ntfs - ok
16:10:41.0875 3792 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp J:\WINDOWS\System32\lsass.exe
16:10:41.0890 3792 NtLmSsp - ok
16:10:41.0921 3792 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc J:\WINDOWS\system32\ntmssvc.dll
16:10:41.0937 3792 NtmsSvc - ok
16:10:41.0953 3792 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null J:\WINDOWS\system32\drivers\Null.sys
16:10:41.0968 3792 Null - ok
16:10:42.0296 3792 [ 0DC79B60CEDC3A8854C27B3C6E4B3414 ] nv J:\WINDOWS\system32\DRIVERS\nv4_mini.sys
16:10:42.0671 3792 nv - ok
16:10:42.0718 3792 [ 971B4344ABA9B79ED0E9D0BB2A5283C1 ] NVSvc J:\WINDOWS\system32\nvsvc32.exe
16:10:42.0734 3792 NVSvc - ok
16:10:42.0828 3792 [ 4CDE6D8E0A07DCE9E568F58A5DC8086C ] nvUpdatusService J:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
16:10:42.0859 3792 nvUpdatusService - ok
16:10:42.0906 3792 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt J:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
16:10:42.0906 3792 NwlnkFlt - ok
16:10:42.0921 3792 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd J:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
16:10:42.0937 3792 NwlnkFwd - ok
16:10:42.0984 3792 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv J:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
16:10:43.0046 3792 odserv - ok
16:10:43.0062 3792 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 J:\WINDOWS\system32\DRIVERS\ohci1394.sys
16:10:43.0062 3792 ohci1394 - ok
16:10:43.0109 3792 [ 5A432A042DAE460ABE7199B758E8606C ] ose J:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:10:43.0125 3792 ose - ok
16:10:43.0140 3792 [ E852A590216F0DA2B94DF5A937585554 ] ossrv J:\WINDOWS\system32\drivers\ctoss2k.sys
16:10:43.0156 3792 ossrv - ok
16:10:43.0203 3792 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport J:\WINDOWS\system32\DRIVERS\parport.sys
16:10:43.0218 3792 Parport - ok
16:10:43.0218 3792 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr J:\WINDOWS\system32\drivers\PartMgr.sys
16:10:43.0218 3792 PartMgr - ok
16:10:43.0281 3792 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm J:\WINDOWS\system32\drivers\ParVdm.sys
16:10:43.0281 3792 ParVdm - ok
16:10:43.0296 3792 [ A219903CCF74233761D92BEF471A07B1 ] PCI J:\WINDOWS\system32\DRIVERS\pci.sys
16:10:43.0296 3792 PCI - ok
16:10:43.0296 3792 PCIDump - ok
16:10:43.0312 3792 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde J:\WINDOWS\system32\DRIVERS\pciide.sys
16:10:43.0312 3792 PCIIde - ok
16:10:43.0375 3792 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia J:\WINDOWS\system32\drivers\Pcmcia.sys
16:10:43.0375 3792 Pcmcia - ok
16:10:43.0390 3792 PDCOMP - ok
16:10:43.0390 3792 PDFRAME - ok
16:10:43.0406 3792 PDRELI - ok
16:10:43.0406 3792 PDRFRAME - ok
16:10:43.0421 3792 perc2 - ok
16:10:43.0421 3792 perc2hib - ok
16:10:43.0468 3792 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay J:\WINDOWS\system32\services.exe
16:10:43.0468 3792 PlugPlay - ok
16:10:43.0484 3792 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent J:\WINDOWS\system32\lsass.exe
16:10:43.0484 3792 PolicyAgent - ok
16:10:43.0531 3792 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport J:\WINDOWS\system32\DRIVERS\raspptp.sys
16:10:43.0531 3792 PptpMiniport - ok
16:10:43.0546 3792 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor J:\WINDOWS\system32\DRIVERS\processr.sys
16:10:43.0546 3792 Processor - ok
16:10:43.0562 3792 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage J:\WINDOWS\system32\lsass.exe
16:10:43.0562 3792 ProtectedStorage - ok
16:10:43.0562 3792 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched J:\WINDOWS\system32\DRIVERS\psched.sys
16:10:43.0578 3792 PSched - ok
16:10:43.0609 3792 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink J:\WINDOWS\system32\DRIVERS\ptilink.sys
16:10:43.0625 3792 Ptilink - ok
16:10:43.0656 3792 [ FAA729E2E2FD3AFB8DF7A45DE8769CC3 ] PxHelp20 J:\WINDOWS\system32\DRIVERS\PxHelp20.sys
16:10:43.0656 3792 PxHelp20 - ok
16:10:43.0671 3792 ql1080 - ok
16:10:43.0687 3792 Ql10wnt - ok
16:10:43.0687 3792 ql12160 - ok
16:10:43.0703 3792 ql1240 - ok
16:10:43.0703 3792 ql1280 - ok
16:10:43.0750 3792 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd J:\WINDOWS\system32\DRIVERS\rasacd.sys
16:10:43.0750 3792 RasAcd - ok
16:10:43.0765 3792 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto J:\WINDOWS\System32\rasauto.dll
16:10:43.0765 3792 RasAuto - ok
16:10:43.0796 3792 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp J:\WINDOWS\system32\DRIVERS\rasl2tp.sys
16:10:43.0796 3792 Rasl2tp - ok
16:10:43.0828 3792 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan J:\WINDOWS\System32\rasmans.dll
16:10:43.0828 3792 RasMan - ok
16:10:43.0843 3792 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe J:\WINDOWS\system32\DRIVERS\raspppoe.sys
16:10:43.0843 3792 RasPppoe - ok
16:10:43.0875 3792 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti J:\WINDOWS\system32\DRIVERS\raspti.sys
16:10:43.0875 3792 Raspti - ok
16:10:43.0921 3792 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss J:\WINDOWS\system32\DRIVERS\rdbss.sys
16:10:43.0921 3792 Rdbss - ok
16:10:43.0937 3792 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD J:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:10:43.0937 3792 RDPCDD - ok
16:10:43.0968 3792 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr J:\WINDOWS\system32\DRIVERS\rdpdr.sys
16:10:43.0984 3792 rdpdr - ok
16:10:44.0015 3792 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD J:\WINDOWS\system32\drivers\RDPWD.sys
16:10:44.0031 3792 RDPWD - ok
16:10:44.0062 3792 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr J:\WINDOWS\system32\sessmgr.exe
16:10:44.0062 3792 RDSessMgr - ok
16:10:44.0109 3792 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook J:\WINDOWS\system32\DRIVERS\redbook.sys
16:10:44.0109 3792 redbook - ok
16:10:44.0140 3792 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess J:\WINDOWS\System32\mprdim.dll
16:10:44.0140 3792 RemoteAccess - ok
16:10:44.0187 3792 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry J:\WINDOWS\system32\regsvc.dll
16:10:44.0187 3792 RemoteRegistry - ok
16:10:44.0203 3792 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator J:\WINDOWS\System32\locator.exe
16:10:44.0203 3792 RpcLocator - ok
16:10:44.0250 3792 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs J:\WINDOWS\System32\rpcss.dll
16:10:44.0250 3792 RpcSs - ok
16:10:44.0312 3792 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP J:\WINDOWS\System32\rsvp.exe
16:10:44.0312 3792 RSVP - ok
16:10:44.0328 3792 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs J:\WINDOWS\system32\lsass.exe
16:10:44.0328 3792 SamSs - ok
16:10:44.0343 3792 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr J:\WINDOWS\System32\SCardSvr.exe
16:10:44.0359 3792 SCardSvr - ok
16:10:44.0406 3792 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule J:\WINDOWS\system32\schedsvc.dll
16:10:44.0406 3792 Schedule - ok
16:10:44.0468 3792 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv J:\WINDOWS\system32\DRIVERS\secdrv.sys
16:10:44.0468 3792 Secdrv - ok
16:10:44.0531 3792 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon J:\WINDOWS\System32\seclogon.dll
16:10:44.0531 3792 seclogon - ok
16:10:44.0562 3792 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS J:\WINDOWS\system32\sens.dll
16:10:44.0562 3792 SENS - ok
16:10:44.0578 3792 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum J:\WINDOWS\system32\DRIVERS\serenum.sys
16:10:44.0593 3792 serenum - ok
16:10:44.0593 3792 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial J:\WINDOWS\system32\DRIVERS\serial.sys
16:10:44.0609 3792 Serial - ok
16:10:44.0671 3792 [ 00DE597B81B381053CB5B21A7F20E365 ] sfdrv01 J:\WINDOWS\system32\drivers\sfdrv01.sys
16:10:44.0671 3792 sfdrv01 - ok
16:10:44.0687 3792 [ 64B9AB76F1B16EB059CB6CDD906C067A ] sfhlp02 J:\WINDOWS\system32\drivers\sfhlp02.sys
16:10:44.0687 3792 sfhlp02 - ok
16:10:44.0734 3792 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy J:\WINDOWS\system32\drivers\Sfloppy.sys
16:10:44.0734 3792 Sfloppy - ok
16:10:44.0750 3792 [ 798D918D8F20380008277CE3CE5319D1 ] sfsync02 J:\WINDOWS\system32\drivers\sfsync02.sys
16:10:44.0750 3792 sfsync02 - ok
16:10:44.0765 3792 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess J:\WINDOWS\System32\ipnathlp.dll
16:10:44.0781 3792 SharedAccess - ok
16:10:44.0796 3792 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection J:\WINDOWS\System32\shsvcs.dll
16:10:44.0812 3792 ShellHWDetection - ok
16:10:44.0812 3792 Simbad - ok
16:10:44.0843 3792 [ 14BB60A4F1C5291217A05D5728C403E6 ] SmartDefragDriver J:\WINDOWS\system32\Drivers\SmartDefragDriver.sys
16:10:44.0859 3792 SmartDefragDriver - ok
16:10:44.0875 3792 Sparrow - ok
16:10:44.0906 3792 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter J:\WINDOWS\system32\drivers\splitter.sys
16:10:44.0906 3792 splitter - ok
16:10:44.0921 3792 [ 60784F891563FB1B767F70117FC2428F ] Spooler J:\WINDOWS\system32\spoolsv.exe
16:10:44.0937 3792 Spooler - ok
16:10:44.0953 3792 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr J:\WINDOWS\system32\DRIVERS\sr.sys
16:10:44.0968 3792 sr - ok
16:10:45.0015 3792 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice J:\WINDOWS\system32\srsvc.dll
16:10:45.0015 3792 srservice - ok
16:10:45.0093 3792 [ 83726CF02ECED69138948083E06B6EAC ] SRTSP J:\WINDOWS\System32\Drivers\N360\0502020.003\SRTSP.SYS
16:10:45.0109 3792 SRTSP - ok
16:10:45.0125 3792 [ 4E7EAB2E5615D39CF1F1DF9C71E5E225 ] SRTSPX J:\WINDOWS\system32\drivers\N360\0502020.003\SRTSPX.SYS
16:10:45.0140 3792 SRTSPX - ok
16:10:45.0171 3792 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv J:\WINDOWS\system32\DRIVERS\srv.sys
16:10:45.0171 3792 Srv - ok
16:10:45.0218 3792 [ B2063CE662AF3AB20045121A5B716DF6 ] sscebus J:\WINDOWS\system32\DRIVERS\sscebus.sys
16:10:45.0218 3792 sscebus - ok
16:10:45.0234 3792 [ 66799DC0AFE3DCAF8368CAE17394A762 ] sscemdfl J:\WINDOWS\system32\DRIVERS\sscemdfl.sys
16:10:45.0234 3792 sscemdfl - ok
16:10:45.0265 3792 [ CBF03FFC08F8DB547BAB2F79AA663D16 ] sscemdm J:\WINDOWS\system32\DRIVERS\sscemdm.sys
16:10:45.0265 3792 sscemdm - ok
16:10:45.0312 3792 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV J:\WINDOWS\System32\ssdpsrv.dll
16:10:45.0312 3792 SSDPSRV - ok
16:10:45.0328 3792 SSPORT - ok
16:10:45.0359 3792 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc J:\WINDOWS\system32\wiaservc.dll
16:10:45.0359 3792 stisvc - ok
16:10:45.0406 3792 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum J:\WINDOWS\system32\DRIVERS\swenum.sys
16:10:45.0421 3792 swenum - ok
16:10:45.0437 3792 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi J:\WINDOWS\system32\drivers\swmidi.sys
16:10:45.0437 3792 swmidi - ok
16:10:45.0437 3792 SwPrv - ok
16:10:45.0453 3792 symc810 - ok
16:10:45.0468 3792 symc8xx - ok
16:10:45.0500 3792 [ 9BBEB8C6258E72D62E7560E6667AAD39 ] SymDS J:\WINDOWS\system32\drivers\N360\0502020.003\SYMDS.SYS
16:10:45.0531 3792 SymDS - ok
16:10:45.0562 3792 [ D5C02629C02A820A7E71BCA3D44294A3 ] SymEFA J:\WINDOWS\system32\drivers\N360\0502020.003\SYMEFA.SYS
16:10:45.0625 3792 SymEFA - ok
16:10:45.0656 3792 [ AB33C3B196197CA467CBDDA717860DBA ] SymEvent J:\WINDOWS\system32\Drivers\SYMEVENT.SYS
16:10:45.0671 3792 SymEvent - ok
16:10:45.0687 3792 SYMFW - ok
16:10:45.0703 3792 SYMIDS - ok
16:10:45.0750 3792 [ A73399804D5D4A8B20BA60FCF70C9F1F ] SymIRON J:\WINDOWS\system32\drivers\N360\0502020.003\Ironx86.SYS
16:10:45.0750 3792 SymIRON - ok
16:10:45.0750 3792 SYMNDIS - ok
16:10:45.0796 3792 [ 336CACE58F0359D5CBB1AE6B8A2FB205 ] SYMTDI J:\WINDOWS\System32\Drivers\N360\0502020.003\SYMTDI.SYS
16:10:45.0796 3792 SYMTDI - ok
16:10:45.0796 3792 sym_hi - ok
16:10:45.0812 3792 sym_u3 - ok
16:10:45.0828 3792 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio J:\WINDOWS\system32\drivers\sysaudio.sys
16:10:45.0828 3792 sysaudio - ok
16:10:45.0859 3792 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog J:\WINDOWS\system32\smlogsvc.exe
16:10:45.0859 3792 SysmonLog - ok
16:10:45.0890 3792 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv J:\WINDOWS\System32\tapisrv.dll
16:10:45.0906 3792 TapiSrv - ok
16:10:45.0953 3792 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip J:\WINDOWS\system32\DRIVERS\tcpip.sys
16:10:45.0968 3792 Tcpip - ok
16:10:46.0015 3792 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE J:\WINDOWS\system32\drivers\TDPIPE.sys
16:10:46.0015 3792 TDPIPE - ok
16:10:46.0031 3792 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP J:\WINDOWS\system32\drivers\TDTCP.sys
16:10:46.0031 3792 TDTCP - ok
16:10:46.0078 3792 [ 88155247177638048422893737429D9E ] TermDD J:\WINDOWS\system32\DRIVERS\termdd.sys
16:10:46.0078 3792 TermDD - ok
16:10:46.0109 3792 [ FF3477C03BE7201C294C35F684B3479F ] TermService J:\WINDOWS\System32\termsrv.dll
16:10:46.0125 3792 TermService - ok
16:10:46.0140 3792 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes J:\WINDOWS\System32\shsvcs.dll
16:10:46.0140 3792 Themes - ok
16:10:46.0203 3792 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr J:\WINDOWS\System32\tlntsvr.exe
16:10:46.0203 3792 TlntSvr - ok
16:10:46.0218 3792 TosIde - ok
16:10:46.0234 3792 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks J:\WINDOWS\system32\trkwks.dll
16:10:46.0234 3792 TrkWks - ok
16:10:46.0250 3792 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs J:\WINDOWS\system32\drivers\Udfs.sys
16:10:46.0250 3792 Udfs - ok
16:10:46.0265 3792 ultra - ok
16:10:46.0281 3792 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update J:\WINDOWS\system32\DRIVERS\update.sys
16:10:46.0296 3792 Update - ok
16:10:46.0328 3792 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost J:\WINDOWS\System32\upnphost.dll
16:10:46.0343 3792 upnphost - ok
16:10:46.0359 3792 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS J:\WINDOWS\System32\ups.exe
16:10:46.0359 3792 UPS - ok
16:10:46.0406 3792 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp J:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:10:46.0406 3792 usbccgp - ok
16:10:46.0437 3792 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci J:\WINDOWS\system32\DRIVERS\usbehci.sys
16:10:46.0437 3792 usbehci - ok
16:10:46.0468 3792 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub J:\WINDOWS\system32\DRIVERS\usbhub.sys
16:10:46.0484 3792 usbhub - ok
16:10:46.0500 3792 [ A717C8721046828520C9EDF31288FC00 ] usbprint J:\WINDOWS\system32\DRIVERS\usbprint.sys
16:10:46.0500 3792 usbprint - ok
16:10:46.0546 3792 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan J:\WINDOWS\system32\DRIVERS\usbscan.sys
16:10:46.0546 3792 usbscan - ok
16:10:46.0578 3792 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor J:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:10:46.0625 3792 usbstor - ok
16:10:46.0656 3792 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci J:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:10:46.0656 3792 usbuhci - ok
16:10:46.0703 3792 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave J:\WINDOWS\System32\drivers\vga.sys
16:10:46.0703 3792 VgaSave - ok
16:10:46.0703 3792 ViaIde - ok
16:10:46.0765 3792 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap J:\WINDOWS\system32\drivers\VolSnap.sys
16:10:46.0765 3792 VolSnap - ok
16:10:46.0796 3792 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS J:\WINDOWS\System32\vssvc.exe
16:10:46.0812 3792 VSS - ok
16:10:46.0843 3792 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time J:\WINDOWS\system32\w32time.dll
16:10:46.0843 3792 W32Time - ok
16:10:46.0906 3792 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp J:\WINDOWS\system32\DRIVERS\wanarp.sys
16:10:46.0906 3792 Wanarp - ok
16:10:46.0906 3792 WDICA - ok
16:10:46.0921 3792 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud J:\WINDOWS\system32\drivers\wdmaud.sys
16:10:46.0921 3792 wdmaud - ok
16:10:46.0953 3792 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient J:\WINDOWS\System32\webclnt.dll
16:10:46.0968 3792 WebClient - ok
16:10:47.0046 3792 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt J:\WINDOWS\system32\wbem\WMIsvc.dll
16:10:47.0062 3792 winmgmt - ok
16:10:47.0093 3792 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN J:\WINDOWS\system32\MsPMSNSv.dll
16:10:47.0093 3792 WmdmPmSN - ok
16:10:47.0140 3792 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi J:\WINDOWS\System32\advapi32.dll
16:10:47.0140 3792 Wmi - ok
16:10:47.0171 3792 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv J:\WINDOWS\System32\wbem\wmiapsrv.exe
16:10:47.0187 3792 WmiApSrv - ok
16:10:47.0265 3792 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc J:\Program Files\Windows Media Player\WMPNetwk.exe
16:10:47.0328 3792 WMPNetworkSvc - ok
16:10:47.0406 3792 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 J:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
16:10:47.0453 3792 WPFFontCache_v0400 - ok
16:10:47.0500 3792 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL J:\WINDOWS\System32\drivers\ws2ifsl.sys
16:10:47.0500 3792 WS2IFSL - ok
16:10:47.0531 3792 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc J:\WINDOWS\system32\wscsvc.dll
16:10:47.0546 3792 wscsvc - ok
16:10:47.0578 3792 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv J:\WINDOWS\system32\wuauserv.dll
16:10:47.0609 3792 wuauserv - ok
16:10:47.0640 3792 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf J:\WINDOWS\system32\DRIVERS\WudfPf.sys
16:10:47.0656 3792 WudfPf - ok
16:10:47.0671 3792 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd J:\WINDOWS\system32\DRIVERS\wudfrd.sys
16:10:47.0687 3792 WudfRd - ok
16:10:47.0734 3792 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc J:\WINDOWS\System32\WUDFSvc.dll
16:10:47.0750 3792 WudfSvc - ok
16:10:47.0859 3792 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC J:\WINDOWS\System32\wzcsvc.dll
16:10:47.0859 3792 WZCSVC - ok
16:10:47.0906 3792 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov J:\WINDOWS\System32\xmlprov.dll
16:10:47.0953 3792 xmlprov - ok
16:10:47.0968 3792 ================ Scan global ===============================
16:10:47.0984 3792 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] J:\WINDOWS\system32\basesrv.dll
16:10:48.0015 3792 [ 8C7DCA4B158BF16894120786A7A5F366 ] J:\WINDOWS\system32\winsrv.dll
16:10:48.0031 3792 [ 8C7DCA4B158BF16894120786A7A5F366 ] J:\WINDOWS\system32\winsrv.dll
16:10:48.0046 3792 [ 65DF52F5B8B6E9BBD183505225C37315 ] J:\WINDOWS\system32\services.exe
16:10:48.0062 3792 [Global] - ok
16:10:48.0062 3792 ================ Scan MBR ==================================
16:10:48.0078 3792 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
16:10:48.0109 3792 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected
16:10:48.0109 3792 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)
16:10:48.0140 3792 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
16:10:48.0359 3792 \Device\Harddisk1\DR1 - ok
16:10:48.0359 3792 ================ Scan VBR ==================================
16:10:48.0359 3792 [ 04CA63503D47E2FE5A8F9E87718B99DD ] \Device\Harddisk0\DR0\Partition1
16:10:48.0359 3792 \Device\Harddisk0\DR0\Partition1 - ok
16:10:48.0375 3792 [ EDC5DFF516ECCC241E9F9A05B4F23BA3 ] \Device\Harddisk1\DR1\Partition1
16:10:48.0375 3792 \Device\Harddisk1\DR1\Partition1 - ok
16:10:48.0375 3792 ============================================================
16:10:48.0375 3792 Scan finished
16:10:48.0375 3792 ============================================================
16:10:48.0390 2360 Detected object count: 1
16:10:48.0390 2360 Actual detected object count: 1
16:11:29.0953 2360 \Device\Harddisk0\DR0\# - copied to quarantine
16:11:29.0953 2360 \Device\Harddisk0\DR0 - copied to quarantine
16:11:30.0000 2360 \Device\Harddisk0\DR0 - processing error
16:11:57.0375 2360 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure
16:13:06.0250 1212 ============================================================
16:13:06.0250 1212 Scan started
16:13:06.0250 1212 Mode: Manual;
16:13:06.0250 1212 ============================================================
16:13:06.0750 1212 ================ Scan system memory ========================
16:13:06.0750 1212 System memory - ok
16:13:06.0750 1212 ================ Scan services =============================
16:13:06.0843 1212 Abiosdsk - ok
16:13:06.0843 1212 abp480n5 - ok
16:13:06.0906 1212 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI J:\WINDOWS\system32\DRIVERS\ACPI.sys
16:13:06.0906 1212 ACPI - ok
16:13:06.0953 1212 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC J:\WINDOWS\system32\drivers\ACPIEC.sys
16:13:06.0953 1212 ACPIEC - ok
16:13:06.0968 1212 adpu160m - ok
16:13:07.0031 1212 [ 8BED39E3C35D6A489438B8141717A557 ] aec J:\WINDOWS\system32\drivers\aec.sys
16:13:07.0031 1212 aec - ok
16:13:07.0062 1212 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD J:\WINDOWS\System32\drivers\afd.sys
16:13:07.0078 1212 AFD - ok
16:13:07.0109 1212 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 J:\WINDOWS\system32\DRIVERS\agp440.sys
16:13:07.0109 1212 agp440 - ok
16:13:07.0109 1212 Aha154x - ok
16:13:07.0125 1212 aic78u2 - ok
16:13:07.0125 1212 aic78xx - ok
16:13:07.0156 1212 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter J:\WINDOWS\system32\alrsvc.dll
16:13:07.0156 1212 Alerter - ok
16:13:07.0171 1212 [ 8C515081584A38AA007909CD02020B3D ] ALG J:\WINDOWS\System32\alg.exe
16:13:07.0171 1212 ALG - ok
16:13:07.0187 1212 AliIde - ok
16:13:07.0187 1212 amsint - ok
16:13:07.0250 1212 [ 8D3A55F7B7BE6B374479E5195F477226 ] AnyDVD J:\WINDOWS\system32\Drivers\AnyDVD.sys
16:13:07.0250 1212 AnyDVD - ok
16:13:07.0296 1212 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt J:\WINDOWS\System32\appmgmts.dll
16:13:07.0296 1212 AppMgmt - ok
16:13:07.0312 1212 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 J:\WINDOWS\system32\DRIVERS\arp1394.sys
16:13:07.0312 1212 Arp1394 - ok
16:13:07.0328 1212 asc - ok
16:13:07.0328 1212 asc3350p - ok
16:13:07.0343 1212 asc3550 - ok
16:13:07.0437 1212 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state J:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
16:13:07.0437 1212 aspnet_state - ok
16:13:07.0484 1212 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac J:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:13:07.0484 1212 AsyncMac - ok
16:13:07.0484 1212 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi J:\WINDOWS\system32\DRIVERS\atapi.sys
16:13:07.0500 1212 atapi - ok
16:13:07.0515 1212 Atdisk - ok
16:13:07.0531 1212 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc J:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:13:07.0531 1212 Atmarpc - ok
16:13:07.0562 1212 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv J:\WINDOWS\System32\audiosrv.dll
16:13:07.0562 1212 AudioSrv - ok
16:13:07.0578 1212 [ D9F724AA26C010A217C97606B160ED68 ] audstub J:\WINDOWS\system32\DRIVERS\audstub.sys
16:13:07.0578 1212 audstub - ok
16:13:07.0625 1212 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep J:\WINDOWS\system32\drivers\Beep.sys
16:13:07.0625 1212 Beep - ok
16:13:07.0812 1212 [ 684B12018A54ADC1F856372EC5762B48 ] BHDrvx86 J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20121030.002\BHDrvx86.sys
16:13:07.0812 1212 BHDrvx86 - ok
16:13:07.0843 1212 [ 574738F61FCA2935F5265DC4E5691314 ] BITS J:\WINDOWS\system32\qmgr.dll
16:13:07.0843 1212 BITS - ok
16:13:07.0875 1212 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser J:\WINDOWS\System32\browser.dll
16:13:07.0890 1212 Browser - ok
16:13:07.0921 1212 catchme - ok
16:13:07.0968 1212 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k J:\WINDOWS\system32\drivers\cbidf2k.sys
16:13:07.0968 1212 cbidf2k - ok
16:13:07.0984 1212 cd20xrnt - ok
16:13:08.0031 1212 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio J:\WINDOWS\system32\drivers\Cdaudio.sys
16:13:08.0031 1212 Cdaudio - ok
16:13:08.0046 1212 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs J:\WINDOWS\system32\drivers\Cdfs.sys
16:13:08.0046 1212 Cdfs - ok
16:13:08.0062 1212 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom J:\WINDOWS\system32\DRIVERS\cdrom.sys
16:13:08.0062 1212 Cdrom - ok
16:13:08.0078 1212 Changer - ok
16:13:08.0093 1212 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc J:\WINDOWS\system32\cisvc.exe
16:13:08.0093 1212 CiSvc - ok
16:13:08.0109 1212 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv J:\WINDOWS\system32\clipsrv.exe
16:13:08.0109 1212 ClipSrv - ok
16:13:08.0125 1212 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 J:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:13:08.0125 1212 clr_optimization_v2.0.50727_32 - ok
16:13:08.0187 1212 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 J:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:13:08.0187 1212 clr_optimization_v4.0.30319_32 - ok
16:13:08.0187 1212 CmdIde - ok
16:13:08.0218 1212 [ 22F8692FD3E017EAD334945B3199B0E3 ] COMMONFX J:\WINDOWS\system32\drivers\COMMONFX.SYS
16:13:08.0218 1212 COMMONFX - ok
16:13:08.0234 1212 [ 22F8692FD3E017EAD334945B3199B0E3 ] COMMONFX.SYS J:\WINDOWS\System32\drivers\COMMONFX.SYS
16:13:08.0234 1212 COMMONFX.SYS - ok
16:13:08.0250 1212 COMSysApp - ok
16:13:08.0250 1212 Cpqarray - ok
16:13:08.0296 1212 [ C0EAD9F8AB83D41FF07303C75589C2B8 ] Creative Audio Engine Licensing Service J:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
16:13:08.0296 1212 Creative Audio Engine Licensing Service - ok
16:13:08.0328 1212 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc J:\WINDOWS\System32\cryptsvc.dll
16:13:08.0328 1212 CryptSvc - ok
16:13:08.0375 1212 [ AA7E939BC07965A807C6AC2F1D4D22B7 ] ctac32k J:\WINDOWS\system32\drivers\ctac32k.sys
16:13:08.0390 1212 ctac32k - ok
16:13:08.0421 1212 [ 79E7ABBF928D8A8002EBBA0985905DC1 ] ctaud2k J:\WINDOWS\system32\drivers\ctaud2k.sys
16:13:08.0421 1212 ctaud2k - ok
16:13:08.0468 1212 [ 6D98048890B44191E0DAED4639A9F18C ] CTAUDFX J:\WINDOWS\system32\drivers\CTAUDFX.SYS
16:13:08.0468 1212 CTAUDFX - ok
16:13:08.0500 1212 [ 6D98048890B44191E0DAED4639A9F18C ] CTAUDFX.SYS J:\WINDOWS\System32\drivers\CTAUDFX.SYS
16:13:08.0500 1212 CTAUDFX.SYS - ok
16:13:08.0531 1212 [ 645EC8749BBBA7E991A72BFAC2E14AA7 ] CTAudSvcService J:\Program Files\Creative\Shared Files\CTAudSvc.exe
16:13:08.0546 1212 CTAudSvcService - ok
16:13:08.0578 1212 [ A216C8698C4406A031AF6F867AFE4F92 ] ctdvda2k J:\WINDOWS\system32\drivers\ctdvda2k.sys
16:13:08.0578 1212 ctdvda2k - ok
16:13:08.0609 1212 [ 5192225E2ADFD36D0FC7D61B8E0BAE87 ] CTERFXFX J:\WINDOWS\system32\drivers\CTERFXFX.SYS
16:13:08.0609 1212 CTERFXFX - ok
16:13:08.0625 1212 [ 5192225E2ADFD36D0FC7D61B8E0BAE87 ] CTERFXFX.SYS J:\WINDOWS\System32\drivers\CTERFXFX.SYS
16:13:08.0625 1212 CTERFXFX.SYS - ok
16:13:08.0656 1212 [ B13DF6FF4547A7629413B20262DA385A ] ctgame J:\WINDOWS\system32\DRIVERS\ctgame.sys
16:13:08.0656 1212 ctgame - ok
16:13:08.0671 1212 [ CE3395B054B641E454C8861020FF1D82 ] ctprxy2k J:\WINDOWS\system32\drivers\ctprxy2k.sys
16:13:08.0671 1212 ctprxy2k - ok
16:13:08.0718 1212 [ 8750C640D3068861117FA9166B8AECDE ] CTSBLFX J:\WINDOWS\system32\drivers\CTSBLFX.SYS
16:13:08.0734 1212 CTSBLFX - ok
16:13:08.0765 1212 [ 8750C640D3068861117FA9166B8AECDE ] CTSBLFX.SYS J:\WINDOWS\System32\drivers\CTSBLFX.SYS
16:13:08.0765 1212 CTSBLFX.SYS - ok
16:13:08.0781 1212 [ 01B9017D05D82B6FBCD5CECCE93F3AA7 ] ctsfm2k J:\WINDOWS\system32\drivers\ctsfm2k.sys
16:13:08.0796 1212 ctsfm2k - ok
16:13:08.0796 1212 dac2w2k - ok
16:13:08.0812 1212 dac960nt - ok
16:13:08.0875 1212 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch J:\WINDOWS\system32\rpcss.dll
16:13:08.0875 1212 DcomLaunch - ok
16:13:08.0890 1212 DgiVecp - ok
16:13:08.0906 1212 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp J:\WINDOWS\System32\dhcpcsvc.dll
16:13:08.0906 1212 Dhcp - ok
16:13:08.0937 1212 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk J:\WINDOWS\system32\DRIVERS\disk.sys
16:13:08.0937 1212 Disk - ok
16:13:08.0953 1212 dmadmin - ok
16:13:09.0000 1212 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot J:\WINDOWS\system32\drivers\dmboot.sys
16:13:09.0000 1212 dmboot - ok
16:13:09.0031 1212 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio J:\WINDOWS\system32\drivers\dmio.sys
16:13:09.0031 1212 dmio - ok
16:13:09.0031 1212 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload J:\WINDOWS\system32\drivers\dmload.sys
16:13:09.0031 1212 dmload - ok
16:13:09.0046 1212 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver J:\WINDOWS\System32\dmserver.dll
16:13:09.0046 1212 dmserver - ok
16:13:09.0078 1212 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic J:\WINDOWS\system32\drivers\DMusic.sys
16:13:09.0078 1212 DMusic - ok
16:13:09.0109 1212 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache J:\WINDOWS\System32\dnsrslvr.dll
16:13:09.0109 1212 Dnscache - ok
16:13:09.0156 1212 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc J:\WINDOWS\System32\dot3svc.dll
16:13:09.0156 1212 Dot3svc - ok
16:13:09.0156 1212 dpti2o - ok
16:13:09.0187 1212 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud J:\WINDOWS\system32\drivers\drmkaud.sys
16:13:09.0187 1212 drmkaud - ok
16:13:09.0218 1212 [ 2476936F4994E9084CCFE75ED4F6226A ] E1000 J:\WINDOWS\system32\DRIVERS\e1000325.sys
16:13:09.0218 1212 E1000 - ok
16:13:09.0265 1212 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost J:\WINDOWS\System32\eapsvc.dll
16:13:09.0265 1212 EapHost - ok
16:13:09.0312 1212 [ 85B8B4032A895A746D46A288A9B30DED ] eeCtrl J:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
16:13:09.0312 1212 eeCtrl - ok
16:13:09.0343 1212 [ CE37E3D51912E59C80C6D84337C0B4CD ] ElbyCDFL J:\WINDOWS\system32\Drivers\ElbyCDFL.sys
16:13:09.0343 1212 ElbyCDFL - ok
16:13:09.0390 1212 [ D71233D7CCC2E64F8715A20428D5A33B ] ElbyCDIO J:\WINDOWS\system32\Drivers\ElbyCDIO.sys
16:13:09.0390 1212 ElbyCDIO - ok
16:13:09.0406 1212 [ 71B09041642DE925E6150EB525DCC3BF ] emupia J:\WINDOWS\system32\drivers\emupia2k.sys
16:13:09.0406 1212 emupia - ok
16:13:09.0437 1212 [ B5A8A04A6E5B4E86B95B1553AA918F5F ] EraserUtilRebootDrv J:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
16:13:09.0437 1212 EraserUtilRebootDrv - ok
16:13:09.0468 1212 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc J:\WINDOWS\System32\ersvc.dll
16:13:09.0468 1212 ERSvc - ok
16:13:09.0531 1212 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog J:\WINDOWS\system32\services.exe
16:13:09.0531 1212 Eventlog - ok
16:13:09.0578 1212 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem J:\WINDOWS\System32\es.dll
16:13:09.0578 1212 EventSystem - ok
16:13:09.0593 1212 [ 38D332A6D56AF32635675F132548343E ] Fastfat J:\WINDOWS\system32\drivers\Fastfat.sys
16:13:09.0593 1212 Fastfat - ok
16:13:09.0625 1212 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility J:\WINDOWS\System32\shsvcs.dll
16:13:09.0640 1212 FastUserSwitchingCompatibility - ok
16:13:09.0656 1212 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc J:\WINDOWS\system32\DRIVERS\fdc.sys
16:13:09.0656 1212 Fdc - ok
16:13:09.0734 1212 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips J:\WINDOWS\system32\drivers\Fips.sys
16:13:09.0734 1212 Fips - ok
16:13:09.0750 1212 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk J:\WINDOWS\system32\DRIVERS\flpydisk.sys
16:13:09.0750 1212 Flpydisk - ok
16:13:09.0765 1212 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr J:\WINDOWS\system32\drivers\fltmgr.sys
16:13:09.0765 1212 FltMgr - ok
16:13:09.0843 1212 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 j:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
16:13:09.0843 1212 FontCache3.0.0.0 - ok
16:13:09.0890 1212 [ CBE5F69A5E5B918225F420BA748F3742 ] FsUsbExDisk J:\WINDOWS\system32\FsUsbExDisk.SYS
16:13:09.0890 1212 FsUsbExDisk - ok
16:13:09.0906 1212 [ 96633419F4A1E37ACB89B45EBCCFE001 ] FsUsbExService J:\WINDOWS\system32\FsUsbExService.Exe
16:13:09.0906 1212 FsUsbExService - ok
16:13:09.0937 1212 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec J:\WINDOWS\system32\drivers\Fs_Rec.sys
16:13:09.0937 1212 Fs_Rec - ok
16:13:09.0968 1212 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk J:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:13:09.0968 1212 Ftdisk - ok
16:13:10.0015 1212 [ 72FE2BEA6863D4EB93442A1C4FB5CA48 ] GcKernel J:\WINDOWS\system32\DRIVERS\GcKernel.sys
16:13:10.0015 1212 GcKernel - ok
16:13:10.0046 1212 [ 5AE3A887ECE5BBB72CFAB273C2FD1CFA ] GEARAspiWDM J:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
16:13:10.0046 1212 GEARAspiWDM - ok
16:13:10.0093 1212 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc J:\WINDOWS\system32\DRIVERS\msgpc.sys
16:13:10.0093 1212 Gpc - ok
16:13:10.0125 1212 [ 2E37C43FB534F1D85DCF552D5B2AF9BA ] ha10kx2k J:\WINDOWS\system32\drivers\ha10kx2k.sys
16:13:10.0140 1212 ha10kx2k - ok
16:13:10.0156 1212 [ 607B73DC2A69A98C7F10B5702D947319 ] hap16v2k J:\WINDOWS\system32\drivers\hap16v2k.sys
16:13:10.0156 1212 hap16v2k - ok
16:13:10.0171 1212 [ F674EEAA2D1ED14606AEDFED65C34893 ] hap17v2k J:\WINDOWS\system32\drivers\hap17v2k.sys
16:13:10.0171 1212 hap17v2k - ok
16:13:10.0281 1212 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc J:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
16:13:10.0281 1212 helpsvc - ok
16:13:10.0296 1212 HidServ - ok
16:13:10.0343 1212 [ BD205320308FB41C88A4049A2D1764B4 ] HIDSwvd J:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
16:13:10.0343 1212 HIDSwvd - ok
16:13:10.0359 1212 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb J:\WINDOWS\system32\DRIVERS\hidusb.sys
16:13:10.0359 1212 hidusb - ok
16:13:10.0390 1212 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc J:\WINDOWS\System32\kmsvc.dll
16:13:10.0406 1212 hkmsvc - ok
16:13:10.0406 1212 hpn - ok
16:13:10.0453 1212 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP J:\WINDOWS\system32\Drivers\HTTP.sys
16:13:10.0468 1212 HTTP - ok
16:13:10.0500 1212 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter J:\WINDOWS\System32\w3ssl.dll
16:13:10.0515 1212 HTTPFilter - ok
16:13:10.0515 1212 i2omgmt - ok
16:13:10.0531 1212 i2omp - ok
16:13:10.0562 1212 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt J:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:13:10.0562 1212 i8042prt - ok
16:13:10.0625 1212 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc J:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:13:10.0625 1212 idsvc - ok
16:13:10.0796 1212 [ C19BF2A07BE972A110220DF6B1E89D14 ] IDSxpx86 J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20121109.001\IDSxpx86.sys
16:13:10.0796 1212 IDSxpx86 - ok
16:13:10.0812 1212 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi J:\WINDOWS\system32\DRIVERS\imapi.sys
16:13:10.0812 1212 Imapi - ok
16:13:10.0859 1212 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService J:\WINDOWS\system32\imapi.exe
16:13:10.0859 1212 ImapiService - ok
16:13:10.0875 1212 ini910u - ok
16:13:10.0890 1212 IntelIde - ok
16:13:10.0921 1212 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm J:\WINDOWS\system32\DRIVERS\intelppm.sys
16:13:10.0921 1212 intelppm - ok
16:13:10.0953 1212 [ 3BB22519A194418D5FEC05D800A19AD0 ] ip6fw J:\WINDOWS\system32\drivers\ip6fw.sys
16:13:10.0953 1212 ip6fw - ok
16:13:10.0953 1212 IPFilter - ok
16:13:11.0000 1212 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver J:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:13:11.0000 1212 IpFilterDriver - ok
16:13:11.0015 1212 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp J:\WINDOWS\system32\DRIVERS\ipinip.sys
16:13:11.0015 1212 IpInIp - ok
16:13:11.0046 1212 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat J:\WINDOWS\system32\DRIVERS\ipnat.sys
16:13:11.0046 1212 IpNat - ok
16:13:11.0078 1212 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec J:\WINDOWS\system32\DRIVERS\ipsec.sys
16:13:11.0078 1212 IPSec - ok
16:13:11.0093 1212 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM J:\WINDOWS\system32\DRIVERS\irenum.sys
16:13:11.0093 1212 IRENUM - ok
16:13:11.0109 1212 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp J:\WINDOWS\system32\DRIVERS\isapnp.sys
16:13:11.0109 1212 isapnp - ok
16:13:11.0171 1212 [ 0A5709543986843D37A92290B7838340 ] JavaQuickStarterService J:\java\jre6\bin\jqs.exe
16:13:11.0171 1212 JavaQuickStarterService - ok
16:13:11.0187 1212 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass J:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:13:11.0187 1212 Kbdclass - ok
16:13:11.0218 1212 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid J:\WINDOWS\system32\DRIVERS\kbdhid.sys
16:13:11.0218 1212 kbdhid - ok
16:13:11.0250 1212 [ 692BCF44383D056AED41B045A323D378 ] kmixer J:\WINDOWS\system32\drivers\kmixer.sys
16:13:11.0250 1212 kmixer - ok
16:13:11.0265 1212 [ B467646C54CC746128904E1654C750C1 ] KSecDD J:\WINDOWS\system32\drivers\KSecDD.sys
16:13:11.0281 1212 KSecDD - ok
16:13:11.0312 1212 [ 4103DBB6CAA85E40D271C1AD12BBF776 ] L8042pr2 J:\WINDOWS\system32\DRIVERS\L8042pr2.Sys
16:13:11.0312 1212 L8042pr2 - ok
16:13:11.0328 1212 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver J:\WINDOWS\System32\srvsvc.dll
16:13:11.0328 1212 lanmanserver - ok
16:13:11.0375 1212 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation J:\WINDOWS\System32\wkssvc.dll
16:13:11.0375 1212 lanmanworkstation - ok
16:13:11.0375 1212 lbrtfdc - ok
16:13:11.0421 1212 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts J:\WINDOWS\System32\lmhsvc.dll
16:13:11.0421 1212 LmHosts - ok
16:13:11.0453 1212 [ B666F835C18974F392A387C6E863072F ] LMouFlt2 J:\WINDOWS\system32\DRIVERS\LMouFlt2.Sys
16:13:11.0453 1212 LMouFlt2 - ok
16:13:11.0484 1212 [ 500D089CE760D83DA2B6CBA681AA9949 ] MBAMProtector J:\WINDOWS\system32\drivers\mbam.sys
16:13:11.0484 1212 MBAMProtector - ok
16:13:11.0546 1212 [ 85B16A92B117A5A800032ECD904B86DB ] MBAMScheduler J:\Malwarebytes' Anti-Malware\mbamscheduler.exe
16:13:11.0546 1212 MBAMScheduler - ok
16:13:11.0593 1212 [ 20E2469DB709FC675E655CEAA11BE312 ] MBAMService J:\Malwarebytes' Anti-Malware\mbamservice.exe
16:13:11.0593 1212 MBAMService - ok
16:13:11.0609 1212 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger J:\WINDOWS\System32\msgsvc.dll
16:13:11.0609 1212 Messenger - ok
16:13:11.0656 1212 [ BAFDD5E28BAEA99D7F4772AF2F5EC7EE ] mfeavfk J:\WINDOWS\system32\drivers\mfeavfk.sys
16:13:11.0656 1212 mfeavfk - ok
16:13:11.0687 1212 [ 1D003E3056A43D881597D6763E83B943 ] mfebopk J:\WINDOWS\system32\drivers\mfebopk.sys
16:13:11.0687 1212 mfebopk - ok
16:13:11.0750 1212 [ 3F138A1C8A0659F329F242D1E389B2CF ] mfehidk J:\WINDOWS\system32\drivers\mfehidk.sys
16:13:11.0750 1212 mfehidk - ok
16:13:11.0781 1212 [ 41FE2F288E05A6C8AB85DD56770FFBAD ] mferkdk J:\WINDOWS\system32\drivers\mferkdk.sys
16:13:11.0781 1212 mferkdk - ok
16:13:11.0812 1212 [ 096B52EA918AA909BA5903D79E129005 ] mfesmfk J:\WINDOWS\system32\drivers\mfesmfk.sys
16:13:11.0812 1212 mfesmfk - ok
16:13:11.0890 1212 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service J:\Microsoft Office\Office12\GrooveAuditService.exe
16:13:11.0890 1212 Microsoft Office Groove Audit Service - ok
16:13:11.0921 1212 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd J:\WINDOWS\system32\drivers\mnmdd.sys
16:13:11.0937 1212 mnmdd - ok
16:13:11.0968 1212 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc J:\WINDOWS\System32\mnmsrvc.exe
16:13:11.0968 1212 mnmsrvc - ok
16:13:11.0984 1212 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem J:\WINDOWS\system32\drivers\Modem.sys
16:13:12.0000 1212 Modem - ok
16:13:12.0015 1212 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass J:\WINDOWS\system32\DRIVERS\mouclass.sys
16:13:12.0015 1212 Mouclass - ok
16:13:12.0031 1212 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr J:\WINDOWS\system32\drivers\MountMgr.sys
16:13:12.0031 1212 MountMgr - ok
16:13:12.0031 1212 mraid35x - ok
16:13:12.0046 1212 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV J:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:13:12.0046 1212 MRxDAV - ok
16:13:12.0078 1212 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb J:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:13:12.0093 1212 MRxSmb - ok
16:13:12.0125 1212 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC J:\WINDOWS\System32\msdtc.exe
16:13:12.0125 1212 MSDTC - ok
16:13:12.0156 1212 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs J:\WINDOWS\system32\drivers\Msfs.sys
16:13:12.0156 1212 Msfs - ok
16:13:12.0156 1212 MSIServer - ok
16:13:12.0187 1212 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV J:\WINDOWS\system32\drivers\MSKSSRV.sys
16:13:12.0187 1212 MSKSSRV - ok
16:13:12.0234 1212 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK J:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:13:12.0234 1212 MSPCLOCK - ok
16:13:12.0250 1212 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM J:\WINDOWS\system32\drivers\MSPQM.sys
16:13:12.0250 1212 MSPQM - ok
16:13:12.0281 1212 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios J:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:13:12.0281 1212 mssmbios - ok
16:13:12.0296 1212 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup J:\WINDOWS\system32\drivers\Mup.sys
16:13:12.0296 1212 Mup - ok
16:13:12.0343 1212 [ E78A365CC3E0FBFC018A33DCE01909F8 ] N360 J:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe
16:13:12.0343 1212 N360 - ok
16:13:12.0406 1212 [ 0102140028FAD045756796E1C685D695 ] napagent J:\WINDOWS\System32\qagentrt.dll
16:13:12.0406 1212 napagent - ok
16:13:12.0500 1212 [ 8E4C77AD9BB279900C00F870CC0C674B ] NAVENG J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20121111.008\NAVENG.SYS
16:13:12.0500 1212 NAVENG - ok
16:13:12.0546 1212 [ 826F699B69E88A3920C70F344DD42D88 ] NAVEX15 J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20121111.008\NAVEX15.SYS
16:13:12.0562 1212 NAVEX15 - ok
16:13:12.0593 1212 [ 1DF7F42665C94B825322FAE71721130D ] NDIS J:\WINDOWS\system32\drivers\NDIS.sys
16:13:12.0593 1212 NDIS - ok
16:13:12.0625 1212 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi J:\WINDOWS\system32\DRIVERS\ndistapi.sys
16:13:12.0640 1212 NdisTapi - ok
16:13:12.0671 1212 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio J:\WINDOWS\system32\DRIVERS\ndisuio.sys
16:13:12.0671 1212 Ndisuio - ok
16:13:12.0718 1212 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan J:\WINDOWS\system32\DRIVERS\ndiswan.sys
16:13:12.0718 1212 NdisWan - ok
16:13:12.0750 1212 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy J:\WINDOWS\system32\drivers\NDProxy.sys
16:13:12.0750 1212 NDProxy - ok
16:13:12.0765 1212 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS J:\WINDOWS\system32\DRIVERS\netbios.sys
16:13:12.0765 1212 NetBIOS - ok
16:13:12.0796 1212 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT J:\WINDOWS\system32\DRIVERS\netbt.sys
16:13:12.0812 1212 NetBT - ok
16:13:12.0828 1212 [ B857BA82860D7FF85AE29B095645563B ] NetDDE J:\WINDOWS\system32\netdde.exe
16:13:12.0828 1212 NetDDE - ok
16:13:12.0843 1212 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm J:\WINDOWS\system32\netdde.exe
16:13:12.0843 1212 NetDDEdsdm - ok
16:13:12.0859 1212 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon J:\WINDOWS\system32\lsass.exe
16:13:12.0875 1212 Netlogon - ok
16:13:12.0890 1212 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman J:\WINDOWS\System32\netman.dll
16:13:12.0906 1212 Netman - ok
16:13:12.0937 1212 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing J:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:13:12.0937 1212 NetTcpPortSharing - ok
16:13:12.0968 1212 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 J:\WINDOWS\system32\DRIVERS\nic1394.sys
16:13:12.0968 1212 NIC1394 - ok
16:13:13.0015 1212 [ 943337D786A56729263071623BBB9DE5 ] Nla J:\WINDOWS\System32\mswsock.dll
16:13:13.0015 1212 Nla - ok
16:13:13.0031 1212 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs J:\WINDOWS\system32\drivers\Npfs.sys
16:13:13.0031 1212 Npfs - ok
16:13:13.0062 1212 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs J:\WINDOWS\system32\drivers\Ntfs.sys
16:13:13.0078 1212 Ntfs - ok
16:13:13.0093 1212 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp J:\WINDOWS\System32\lsass.exe
16:13:13.0093 1212 NtLmSsp - ok
16:13:13.0125 1212 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc J:\WINDOWS\system32\ntmssvc.dll
16:13:13.0125 1212 NtmsSvc - ok
16:13:13.0156 1212 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null J:\WINDOWS\system32\drivers\Null.sys
16:13:13.0156 1212 Null - ok
16:13:13.0484 1212 [ 0DC79B60CEDC3A8854C27B3C6E4B3414 ] nv J:\WINDOWS\system32\DRIVERS\nv4_mini.sys
16:13:13.0578 1212 nv - ok
16:13:13.0640 1212 [ 971B4344ABA9B79ED0E9D0BB2A5283C1 ] NVSvc J:\WINDOWS\system32\nvsvc32.exe
16:13:13.0640 1212 NVSvc - ok
16:13:13.0796 1212 [ 4CDE6D8E0A07DCE9E568F58A5DC8086C ] nvUpdatusService J:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
16:13:13.0812 1212 nvUpdatusService - ok
16:13:13.0859 1212 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt J:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
16:13:13.0859 1212 NwlnkFlt - ok
16:13:13.0890 1212 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd J:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
16:13:13.0890 1212 NwlnkFwd - ok
16:13:13.0937 1212 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv J:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
16:13:13.0937 1212 odserv - ok
16:13:13.0953 1212 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 J:\WINDOWS\system32\DRIVERS\ohci1394.sys
16:13:13.0953 1212 ohci1394 - ok
16:13:14.0000 1212 [ 5A432A042DAE460ABE7199B758E8606C ] ose J:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:13:14.0000 1212 ose - ok
16:13:14.0046 1212 [ E852A590216F0DA2B94DF5A937585554 ] ossrv J:\WINDOWS\system32\drivers\ctoss2k.sys
16:13:14.0046 1212 ossrv - ok
16:13:14.0093 1212 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport J:\WINDOWS\system32\DRIVERS\parport.sys
16:13:14.0093 1212 Parport - ok
16:13:14.0109 1212 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr J:\WINDOWS\system32\drivers\PartMgr.sys
16:13:14.0109 1212 PartMgr - ok
16:13:14.0171 1212 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm J:\WINDOWS\system32\drivers\ParVdm.sys
16:13:14.0171 1212 ParVdm - ok
16:13:14.0171 1212 [ A219903CCF74233761D92BEF471A07B1 ] PCI J:\WINDOWS\system32\DRIVERS\pci.sys
16:13:14.0171 1212 PCI - ok
16:13:14.0187 1212 PCIDump - ok
16:13:14.0187 1212 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde J:\WINDOWS\system32\DRIVERS\pciide.sys
16:13:14.0187 1212 PCIIde - ok
16:13:14.0250 1212 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia J:\WINDOWS\system32\drivers\Pcmcia.sys
16:13:14.0250 1212 Pcmcia - ok
16:13:14.0265 1212 PDCOMP - ok
16:13:14.0265 1212 PDFRAME - ok
16:13:14.0281 1212 PDRELI - ok
16:13:14.0281 1212 PDRFRAME - ok
16:13:14.0296 1212 perc2 - ok
16:13:14.0296 1212 perc2hib - ok
16:13:14.0343 1212 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay J:\WINDOWS\system32\services.exe
16:13:14.0343 1212 PlugPlay - ok
16:13:14.0359 1212 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent J:\WINDOWS\system32\lsass.exe
16:13:14.0359 1212 PolicyAgent - ok
16:13:14.0390 1212 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport J:\WINDOWS\system32\DRIVERS\raspptp.sys
16:13:14.0390 1212 PptpMiniport - ok
16:13:14.0406 1212 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor J:\WINDOWS\system32\DRIVERS\processr.sys
16:13:14.0406 1212 Processor - ok
16:13:14.0421 1212 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage J:\WINDOWS\system32\lsass.exe
16:13:14.0421 1212 ProtectedStorage - ok
16:13:14.0437 1212 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched J:\WINDOWS\system32\DRIVERS\psched.sys
16:13:14.0437 1212 PSched - ok
16:13:14.0484 1212 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink J:\WINDOWS\system32\DRIVERS\ptilink.sys
16:13:14.0484 1212 Ptilink - ok
16:13:14.0515 1212 [ FAA729E2E2FD3AFB8DF7A45DE8769CC3 ] PxHelp20 J:\WINDOWS\system32\DRIVERS\PxHelp20.sys
16:13:14.0515 1212 PxHelp20 - ok
16:13:14.0515 1212 ql1080 - ok
16:13:14.0531 1212 Ql10wnt - ok
16:13:14.0546 1212 ql12160 - ok
16:13:14.0546 1212 ql1240 - ok
16:13:14.0562 1212 ql1280 - ok
16:13:14.0578 1212 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd J:\WINDOWS\system32\DRIVERS\rasacd.sys
16:13:14.0578 1212 RasAcd - ok
16:13:14.0593 1212 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto J:\WINDOWS\System32\rasauto.dll
16:13:14.0609 1212 RasAuto - ok
16:13:14.0625 1212 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp J:\WINDOWS\system32\DRIVERS\rasl2tp.sys
16:13:14.0625 1212 Rasl2tp - ok
16:13:14.0656 1212 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan J:\WINDOWS\System32\rasmans.dll
16:13:14.0671 1212 RasMan - ok
16:13:14.0703 1212 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe J:\WINDOWS\system32\DRIVERS\raspppoe.sys
16:13:14.0703 1212 RasPppoe - ok
16:13:14.0718 1212 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti J:\WINDOWS\system32\DRIVERS\raspti.sys
16:13:14.0734 1212 Raspti - ok
16:13:14.0765 1212 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss J:\WINDOWS\system32\DRIVERS\rdbss.sys
16:13:14.0765 1212 Rdbss - ok
16:13:14.0796 1212 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD J:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:13:14.0796 1212 RDPCDD - ok
16:13:14.0812 1212 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr J:\WINDOWS\system32\DRIVERS\rdpdr.sys
16:13:14.0812 1212 rdpdr - ok
16:13:14.0859 1212 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD J:\WINDOWS\system32\drivers\RDPWD.sys
16:13:14.0859 1212 RDPWD - ok
16:13:14.0890 1212 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr J:\WINDOWS\system32\sessmgr.exe
16:13:14.0890 1212 RDSessMgr - ok
16:13:14.0906 1212 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook J:\WINDOWS\system32\DRIVERS\redbook.sys
16:13:14.0921 1212 redbook - ok
16:13:14.0953 1212 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess J:\WINDOWS\System32\mprdim.dll
16:13:14.0953 1212 RemoteAccess - ok
16:13:14.0984 1212 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry J:\WINDOWS\system32\regsvc.dll
16:13:14.0984 1212 RemoteRegistry - ok
16:13:15.0000 1212 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator J:\WINDOWS\System32\locator.exe
16:13:15.0000 1212 RpcLocator - ok
16:13:15.0031 1212 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs J:\WINDOWS\System32\rpcss.dll
16:13:15.0046 1212 RpcSs - ok
16:13:15.0093 1212 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP J:\WINDOWS\System32\rsvp.exe
16:13:15.0093 1212 RSVP - ok
16:13:15.0109 1212 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs J:\WINDOWS\system32\lsass.exe
16:13:15.0109 1212 SamSs - ok
16:13:15.0125 1212 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr J:\WINDOWS\System32\SCardSvr.exe
16:13:15.0125 1212 SCardSvr - ok
16:13:15.0156 1212 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule J:\WINDOWS\system32\schedsvc.dll
16:13:15.0156 1212 Schedule - ok
16:13:15.0203 1212 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv J:\WINDOWS\system32\DRIVERS\secdrv.sys
16:13:15.0203 1212 Secdrv - ok
16:13:15.0218 1212 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon J:\WINDOWS\System32\seclogon.dll
16:13:15.0234 1212 seclogon - ok
16:13:15.0250 1212 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS J:\WINDOWS\system32\sens.dll
16:13:15.0250 1212 SENS - ok
16:13:15.0265 1212 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum J:\WINDOWS\system32\DRIVERS\serenum.sys
16:13:15.0265 1212 serenum - ok
16:13:15.0296 1212 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial J:\WINDOWS\system32\DRIVERS\serial.sys
16:13:15.0296 1212 Serial - ok
16:13:15.0375 1212 [ 00DE597B81B381053CB5B21A7F20E365 ] sfdrv01 J:\WINDOWS\system32\drivers\sfdrv01.sys
16:13:15.0375 1212 sfdrv01 - ok
16:13:15.0375 1212 [ 64B9AB76F1B16EB059CB6CDD906C067A ] sfhlp02 J:\WINDOWS\system32\drivers\sfhlp02.sys
16:13:15.0375 1212 sfhlp02 - ok
16:13:15.0421 1212 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy J:\WINDOWS\system32\drivers\Sfloppy.sys
16:13:15.0421 1212 Sfloppy - ok
16:13:15.0437 1212 [ 798D918D8F20380008277CE3CE5319D1 ] sfsync02 J:\WINDOWS\system32\drivers\sfsync02.sys
16:13:15.0437 1212 sfsync02 - ok
16:13:15.0468 1212 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess J:\WINDOWS\System32\ipnathlp.dll
16:13:15.0468 1212 SharedAccess - ok
16:13:15.0484 1212 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection J:\WINDOWS\System32\shsvcs.dll
16:13:15.0484 1212 ShellHWDetection - ok
16:13:15.0500 1212 Simbad - ok
16:13:15.0531 1212 [ 14BB60A4F1C5291217A05D5728C403E6 ] SmartDefragDriver J:\WINDOWS\system32\Drivers\SmartDefragDriver.sys
16:13:15.0531 1212 SmartDefragDriver - ok
16:13:15.0546 1212 Sparrow - ok
16:13:15.0562 1212 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter J:\WINDOWS\system32\drivers\splitter.sys
16:13:15.0562 1212 splitter - ok
16:13:15.0593 1212 [ 60784F891563FB1B767F70117FC2428F ] Spooler J:\WINDOWS\system32\spoolsv.exe
16:13:15.0593 1212 Spooler - ok
16:13:15.0609 1212 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr J:\WINDOWS\system32\DRIVERS\sr.sys
16:13:15.0609 1212 sr - ok
16:13:15.0640 1212 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice J:\WINDOWS\system32\srsvc.dll
16:13:15.0640 1212 srservice - ok
16:13:15.0750 1212 [ 83726CF02ECED69138948083E06B6EAC ] SRTSP J:\WINDOWS\System32\Drivers\N360\0502020.003\SRTSP.SYS
16:13:15.0750 1212 SRTSP - ok
16:13:15.0781 1212 [ 4E7EAB2E5615D39CF1F1DF9C71E5E225 ] SRTSPX J:\WINDOWS\system32\drivers\N360\0502020.003\SRTSPX.SYS
16:13:15.0781 1212 SRTSPX - ok
16:13:15.0796 1212 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv J:\WINDOWS\system32\DRIVERS\srv.sys
16:13:15.0796 1212 Srv - ok
16:13:15.0828 1212 [ B2063CE662AF3AB20045121A5B716DF6 ] sscebus J:\WINDOWS\system32\DRIVERS\sscebus.sys
16:13:15.0828 1212 sscebus - ok
16:13:15.0843 1212 [ 66799DC0AFE3DCAF8368CAE17394A762 ] sscemdfl J:\WINDOWS\system32\DRIVERS\sscemdfl.sys
16:13:15.0843 1212 sscemdfl - ok
16:13:15.0875 1212 [ CBF03FFC08F8DB547BAB2F79AA663D16 ] sscemdm J:\WINDOWS\system32\DRIVERS\sscemdm.sys
16:13:15.0875 1212 sscemdm - ok
16:13:15.0906 1212 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV J:\WINDOWS\System32\ssdpsrv.dll
16:13:15.0906 1212 SSDPSRV - ok
16:13:15.0921 1212 SSPORT - ok
16:13:15.0937 1212 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc J:\WINDOWS\system32\wiaservc.dll
16:13:15.0953 1212 stisvc - ok
16:13:16.0000 1212 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum J:\WINDOWS\system32\DRIVERS\swenum.sys
16:13:16.0000 1212 swenum - ok
16:13:16.0031 1212 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi J:\WINDOWS\system32\drivers\swmidi.sys
16:13:16.0031 1212 swmidi - ok
16:13:16.0046 1212 SwPrv - ok
16:13:16.0062 1212 symc810 - ok
16:13:16.0062 1212 symc8xx - ok
16:13:16.0093 1212 [ 9BBEB8C6258E72D62E7560E6667AAD39 ] SymDS J:\WINDOWS\system32\drivers\N360\0502020.003\SYMDS.SYS
16:13:16.0093 1212 SymDS - ok
16:13:16.0140 1212 [ D5C02629C02A820A7E71BCA3D44294A3 ] SymEFA J:\WINDOWS\system32\drivers\N360\0502020.003\SYMEFA.SYS
16:13:16.0140 1212 SymEFA - ok
16:13:16.0171 1212 [ AB33C3B196197CA467CBDDA717860DBA ] SymEvent J:\WINDOWS\system32\Drivers\SYMEVENT.SYS
16:13:16.0171 1212 SymEvent - ok
16:13:16.0171 1212 SYMFW - ok
16:13:16.0187 1212 SYMIDS - ok
16:13:16.0234 1212 [ A73399804D5D4A8B20BA60FCF70C9F1F ] SymIRON J:\WINDOWS\system32\drivers\N360\0502020.003\Ironx86.SYS
16:13:16.0234 1212 SymIRON - ok
16:13:16.0250 1212 SYMNDIS - ok
16:13:16.0265 1212 [ 336CACE58F0359D5CBB1AE6B8A2FB205 ] SYMTDI J:\WINDOWS\System32\Drivers\N360\0502020.003\SYMTDI.SYS
16:13:16.0265 1212 SYMTDI - ok
16:13:16.0281 1212 sym_hi - ok
16:13:16.0281 1212 sym_u3 - ok
16:13:16.0312 1212 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio J:\WINDOWS\system32\drivers\sysaudio.sys
16:13:16.0312 1212 sysaudio - ok
16:13:16.0328 1212 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog J:\WINDOWS\system32\smlogsvc.exe
16:13:16.0328 1212 SysmonLog - ok
16:13:16.0359 1212 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv J:\WINDOWS\System32\tapisrv.dll
16:13:16.0375 1212 TapiSrv - ok
16:13:16.0421 1212 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip J:\WINDOWS\system32\DRIVERS\tcpip.sys
16:13:16.0437 1212 Tcpip - ok
16:13:16.0484 1212 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE J:\WINDOWS\system32\drivers\TDPIPE.sys
16:13:16.0484 1212 TDPIPE - ok
16:13:16.0500 1212 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP J:\WINDOWS\system32\drivers\TDTCP.sys
16:13:16.0500 1212 TDTCP - ok
16:13:16.0546 1212 [ 88155247177638048422893737429D9E ] TermDD J:\WINDOWS\system32\DRIVERS\termdd.sys
16:13:16.0546 1212 TermDD - ok
16:13:16.0578 1212 [ FF3477C03BE7201C294C35F684B3479F ] TermService J:\WINDOWS\System32\termsrv.dll
16:13:16.0578 1212 TermService - ok
16:13:16.0609 1212 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes J:\WINDOWS\System32\shsvcs.dll
16:13:16.0609 1212 Themes - ok
16:13:16.0656 1212 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr J:\WINDOWS\System32\tlntsvr.exe
16:13:16.0656 1212 TlntSvr - ok
16:13:16.0671 1212 TosIde - ok
16:13:16.0718 1212 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks J:\WINDOWS\system32\trkwks.dll
16:13:16.0718 1212 TrkWks - ok
16:13:16.0734 1212 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs J:\WINDOWS\system32\drivers\Udfs.sys
16:13:16.0734 1212 Udfs - ok
16:13:16.0734 1212 ultra - ok
16:13:16.0765 1212 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update J:\WINDOWS\system32\DRIVERS\update.sys
16:13:16.0765 1212 Update - ok
16:13:16.0781 1212 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost J:\WINDOWS\System32\upnphost.dll
16:13:16.0781 1212 upnphost - ok
16:13:16.0796 1212 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS J:\WINDOWS\System32\ups.exe
16:13:16.0812 1212 UPS - ok
16:13:16.0843 1212 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp J:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:13:16.0859 1212 usbccgp - ok
16:13:16.0875 1212 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci J:\WINDOWS\system32\DRIVERS\usbehci.sys
16:13:16.0875 1212 usbehci - ok
16:13:16.0921 1212 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub J:\WINDOWS\system32\DRIVERS\usbhub.sys
16:13:16.0921 1212 usbhub - ok
16:13:16.0937 1212 [ A717C8721046828520C9EDF31288FC00 ] usbprint J:\WINDOWS\system32\DRIVERS\usbprint.sys
16:13:16.0937 1212 usbprint - ok
16:13:16.0984 1212 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan J:\WINDOWS\system32\DRIVERS\usbscan.sys
16:13:16.0984 1212 usbscan - ok
16:13:17.0046 1212 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor J:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:13:17.0046 1212 usbstor - ok
16:13:17.0062 1212 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci J:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:13:17.0062 1212 usbuhci - ok
16:13:17.0109 1212 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave J:\WINDOWS\System32\drivers\vga.sys
16:13:17.0109 1212 VgaSave - ok
16:13:17.0109 1212 ViaIde - ok
16:13:17.0140 1212 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap J:\WINDOWS\system32\drivers\VolSnap.sys
16:13:17.0140 1212 VolSnap - ok
16:13:17.0171 1212 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS J:\WINDOWS\System32\vssvc.exe
16:13:17.0171 1212 VSS - ok
16:13:17.0203 1212 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time J:\WINDOWS\system32\w32time.dll
16:13:17.0203 1212 W32Time - ok
16:13:17.0265 1212 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp J:\WINDOWS\system32\DRIVERS\wanarp.sys
16:13:17.0265 1212 Wanarp - ok
16:13:17.0281 1212 WDICA - ok
16:13:17.0296 1212 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud J:\WINDOWS\system32\drivers\wdmaud.sys
16:13:17.0296 1212 wdmaud - ok
16:13:17.0328 1212 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient J:\WINDOWS\System32\webclnt.dll
16:13:17.0328 1212 WebClient - ok
16:13:17.0406 1212 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt J:\WINDOWS\system32\wbem\WMIsvc.dll
16:13:17.0421 1212 winmgmt - ok
16:13:17.0453 1212 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN J:\WINDOWS\system32\MsPMSNSv.dll
16:13:17.0453 1212 WmdmPmSN - ok
16:13:17.0500 1212 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi J:\WINDOWS\System32\advapi32.dll
16:13:17.0500 1212 Wmi - ok
16:13:17.0531 1212 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv J:\WINDOWS\System32\wbem\wmiapsrv.exe
16:13:17.0531 1212 WmiApSrv - ok
16:13:17.0609 1212 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc J:\Program Files\Windows Media Player\WMPNetwk.exe
16:13:17.0625 1212 WMPNetworkSvc - ok
16:13:17.0734 1212 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 J:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
16:13:17.0750 1212 WPFFontCache_v0400 - ok
16:13:17.0796 1212 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL J:\WINDOWS\System32\drivers\ws2ifsl.sys
16:13:17.0796 1212 WS2IFSL - ok
16:13:17.0843 1212 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc J:\WINDOWS\system32\wscsvc.dll
16:13:17.0843 1212 wscsvc - ok
16:13:17.0875 1212 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv J:\WINDOWS\system32\wuauserv.dll
16:13:17.0890 1212 wuauserv - ok
16:13:17.0921 1212 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf J:\WINDOWS\system32\DRIVERS\WudfPf.sys
16:13:17.0921 1212 WudfPf - ok
16:13:17.0937 1212 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd J:\WINDOWS\system32\DRIVERS\wudfrd.sys
16:13:17.0937 1212 WudfRd - ok
16:13:17.0953 1212 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc J:\WINDOWS\System32\WUDFSvc.dll
16:13:17.0953 1212 WudfSvc - ok
16:13:17.0984 1212 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC J:\WINDOWS\System32\wzcsvc.dll
16:13:18.0000 1212 WZCSVC - ok
16:13:18.0062 1212 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov J:\WINDOWS\System32\xmlprov.dll
16:13:18.0062 1212 xmlprov - ok
16:13:18.0078 1212 ================ Scan global ===============================
16:13:18.0125 1212 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] J:\WINDOWS\system32\basesrv.dll
16:13:18.0140 1212 [ 8C7DCA4B158BF16894120786A7A5F366 ] J:\WINDOWS\system32\winsrv.dll
16:13:18.0171 1212 [ 8C7DCA4B158BF16894120786A7A5F366 ] J:\WINDOWS\system32\winsrv.dll
16:13:18.0187 1212 [ 65DF52F5B8B6E9BBD183505225C37315 ] J:\WINDOWS\system32\services.exe
16:13:18.0187 1212 [Global] - ok
16:13:18.0187 1212 ================ Scan MBR ==================================
16:13:18.0203 1212 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
16:13:18.0234 1212 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected
16:13:18.0234 1212 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)
16:13:18.0265 1212 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
16:13:18.0468 1212 \Device\Harddisk1\DR1 - ok
16:13:18.0468 1212 ================ Scan VBR ==================================
16:13:18.0468 1212 [ 04CA63503D47E2FE5A8F9E87718B99DD ] \Device\Harddisk0\DR0\Partition1
16:13:18.0468 1212 \Device\Harddisk0\DR0\Partition1 - ok
16:13:18.0484 1212 [ EDC5DFF516ECCC241E9F9A05B4F23BA3 ] \Device\Harddisk1\DR1\Partition1
16:13:18.0484 1212 \Device\Harddisk1\DR1\Partition1 - ok
16:13:18.0484 1212 ============================================================
16:13:18.0484 1212 Scan finished
16:13:18.0484 1212 ============================================================
16:13:18.0500 1916 Detected object count: 1
16:13:18.0500 1916 Actual detected object count: 1
16:13:36.0359 1916 \Device\Harddisk0\DR0\# - copied to quarantine
16:13:36.0359 1916 \Device\Harddisk0\DR0 - copied to quarantine
16:13:36.0421 1916 \Device\Harddisk0\DR0 - processing error
16:14:33.0343 1916 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure
16:15:34.0437 2640 ============================================================
16:15:34.0437 2640 Scan started
16:15:34.0437 2640 Mode: Manual;
16:15:34.0437 2640 ============================================================
16:15:34.0640 2640 ================ Scan system memory ========================
16:15:34.0640 2640 System memory - ok
16:15:34.0640 2640 ================ Scan services =============================
16:15:34.0718 2640 Abiosdsk - ok
16:15:34.0734 2640 abp480n5 - ok
16:15:34.0781 2640 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI J:\WINDOWS\system32\DRIVERS\ACPI.sys
16:15:34.0781 2640 ACPI - ok
16:15:34.0828 2640 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC J:\WINDOWS\system32\drivers\ACPIEC.sys
16:15:34.0828 2640 ACPIEC - ok
16:15:34.0843 2640 adpu160m - ok
16:15:34.0875 2640 [ 8BED39E3C35D6A489438B8141717A557 ] aec J:\WINDOWS\system32\drivers\aec.sys
16:15:34.0875 2640 aec - ok
16:15:34.0906 2640 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD J:\WINDOWS\System32\drivers\afd.sys
16:15:34.0906 2640 AFD - ok
16:15:34.0937 2640 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 J:\WINDOWS\system32\DRIVERS\agp440.sys
16:15:34.0937 2640 agp440 - ok
16:15:34.0937 2640 Aha154x - ok
16:15:34.0953 2640 aic78u2 - ok
16:15:34.0953 2640 aic78xx - ok
16:15:34.0984 2640 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter J:\WINDOWS\system32\alrsvc.dll
16:15:34.0984 2640 Alerter - ok
16:15:35.0015 2640 [ 8C515081584A38AA007909CD02020B3D ] ALG J:\WINDOWS\System32\alg.exe
16:15:35.0015 2640 ALG - ok
16:15:35.0015 2640 AliIde - ok
16:15:35.0031 2640 amsint - ok
16:15:35.0078 2640 [ 8D3A55F7B7BE6B374479E5195F477226 ] AnyDVD J:\WINDOWS\system32\Drivers\AnyDVD.sys
16:15:35.0078 2640 AnyDVD - ok
16:15:35.0109 2640 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt J:\WINDOWS\System32\appmgmts.dll
16:15:35.0125 2640 AppMgmt - ok
16:15:35.0156 2640 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 J:\WINDOWS\system32\DRIVERS\arp1394.sys
16:15:35.0156 2640 Arp1394 - ok
16:15:35.0156 2640 asc - ok
16:15:35.0171 2640 asc3350p - ok
16:15:35.0171 2640 asc3550 - ok
16:15:35.0265 2640 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state J:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
16:15:35.0265 2640 aspnet_state - ok
16:15:35.0312 2640 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac J:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:15:35.0312 2640 AsyncMac - ok
16:15:35.0312 2640 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi J:\WINDOWS\system32\DRIVERS\atapi.sys
16:15:35.0312 2640 atapi - ok
16:15:35.0328 2640 Atdisk - ok
16:15:35.0343 2640 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc J:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:15:35.0343 2640 Atmarpc - ok
16:15:35.0359 2640 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv J:\WINDOWS\System32\audiosrv.dll
16:15:35.0359 2640 AudioSrv - ok
16:15:35.0390 2640 [ D9F724AA26C010A217C97606B160ED68 ] audstub J:\WINDOWS\system32\DRIVERS\audstub.sys
16:15:35.0390 2640 audstub - ok
16:15:35.0421 2640 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep J:\WINDOWS\system32\drivers\Beep.sys
16:15:35.0421 2640 Beep - ok
16:15:35.0515 2640 [ 684B12018A54ADC1F856372EC5762B48 ] BHDrvx86 J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20121030.002\BHDrvx86.sys
16:15:35.0531 2640 BHDrvx86 - ok
16:15:35.0562 2640 [ 574738F61FCA2935F5265DC4E5691314 ] BITS J:\WINDOWS\system32\qmgr.dll
16:15:35.0562 2640 BITS - ok
16:15:35.0593 2640 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser J:\WINDOWS\System32\browser.dll
16:15:35.0593 2640 Browser - ok
16:15:35.0640 2640 catchme - ok
16:15:35.0687 2640 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k J:\WINDOWS\system32\drivers\cbidf2k.sys
16:15:35.0687 2640 cbidf2k - ok
16:15:35.0703 2640 cd20xrnt - ok
16:15:35.0718 2640 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio J:\WINDOWS\system32\drivers\Cdaudio.sys
16:15:35.0718 2640 Cdaudio - ok
16:15:35.0734 2640 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs J:\WINDOWS\system32\drivers\Cdfs.sys
16:15:35.0750 2640 Cdfs - ok
16:15:35.0765 2640 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom J:\WINDOWS\system32\DRIVERS\cdrom.sys
16:15:35.0765 2640 Cdrom - ok
16:15:35.0781 2640 Changer - ok
16:15:35.0796 2640 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc J:\WINDOWS\system32\cisvc.exe
16:15:35.0796 2640 CiSvc - ok
16:15:35.0812 2640 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv J:\WINDOWS\system32\clipsrv.exe
16:15:35.0812 2640 ClipSrv - ok
16:15:35.0828 2640 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 J:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:15:35.0828 2640 clr_optimization_v2.0.50727_32 - ok
16:15:35.0875 2640 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 J:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:15:35.0875 2640 clr_optimization_v4.0.30319_32 - ok
16:15:35.0890 2640 CmdIde - ok
16:15:35.0921 2640 [ 22F8692FD3E017EAD334945B3199B0E3 ] COMMONFX J:\WINDOWS\system32\drivers\COMMONFX.SYS
16:15:35.0921 2640 COMMONFX - ok
16:15:35.0937 2640 [ 22F8692FD3E017EAD334945B3199B0E3 ] COMMONFX.SYS J:\WINDOWS\System32\drivers\COMMONFX.SYS
16:15:35.0937 2640 COMMONFX.SYS - ok
16:15:35.0953 2640 COMSysApp - ok
16:15:35.0968 2640 Cpqarray - ok
16:15:36.0015 2640 [ C0EAD9F8AB83D41FF07303C75589C2B8 ] Creative Audio Engine Licensing Service J:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
16:15:36.0015 2640 Creative Audio Engine Licensing Service - ok
16:15:36.0046 2640 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc J:\WINDOWS\System32\cryptsvc.dll
16:15:36.0046 2640 CryptSvc - ok
16:15:36.0109 2640 [ AA7E939BC07965A807C6AC2F1D4D22B7 ] ctac32k J:\WINDOWS\system32\drivers\ctac32k.sys
16:15:36.0109 2640 ctac32k - ok
16:15:36.0140 2640 [ 79E7ABBF928D8A8002EBBA0985905DC1 ] ctaud2k J:\WINDOWS\system32\drivers\ctaud2k.sys
16:15:36.0156 2640 ctaud2k - ok
16:15:36.0187 2640 [ 6D98048890B44191E0DAED4639A9F18C ] CTAUDFX J:\WINDOWS\system32\drivers\CTAUDFX.SYS
16:15:36.0187 2640 CTAUDFX - ok
16:15:36.0218 2640 [ 6D98048890B44191E0DAED4639A9F18C ] CTAUDFX.SYS J:\WINDOWS\System32\drivers\CTAUDFX.SYS
16:15:36.0218 2640 CTAUDFX.SYS - ok
16:15:36.0265 2640 [ 645EC8749BBBA7E991A72BFAC2E14AA7 ] CTAudSvcService J:\Program Files\Creative\Shared Files\CTAudSvc.exe
16:15:36.0265 2640 CTAudSvcService - ok
16:15:36.0296 2640 [ A216C8698C4406A031AF6F867AFE4F92 ] ctdvda2k J:\WINDOWS\system32\drivers\ctdvda2k.sys
16:15:36.0296 2640 ctdvda2k - ok
16:15:36.0328 2640 [ 5192225E2ADFD36D0FC7D61B8E0BAE87 ] CTERFXFX J:\WINDOWS\system32\drivers\CTERFXFX.SYS
16:15:36.0328 2640 CTERFXFX - ok
16:15:36.0343 2640 [ 5192225E2ADFD36D0FC7D61B8E0BAE87 ] CTERFXFX.SYS J:\WINDOWS\System32\drivers\CTERFXFX.SYS
16:15:36.0343 2640 CTERFXFX.SYS - ok
16:15:36.0375 2640 [ B13DF6FF4547A7629413B20262DA385A ] ctgame J:\WINDOWS\system32\DRIVERS\ctgame.sys
16:15:36.0375 2640 ctgame - ok
16:15:36.0406 2640 [ CE3395B054B641E454C8861020FF1D82 ] ctprxy2k J:\WINDOWS\system32\drivers\ctprxy2k.sys
16:15:36.0406 2640 ctprxy2k - ok
16:15:36.0421 2640 [ 8750C640D3068861117FA9166B8AECDE ] CTSBLFX J:\WINDOWS\system32\drivers\CTSBLFX.SYS
16:15:36.0437 2640 CTSBLFX - ok
16:15:36.0453 2640 [ 8750C640D3068861117FA9166B8AECDE ] CTSBLFX.SYS J:\WINDOWS\System32\drivers\CTSBLFX.SYS
16:15:36.0468 2640 CTSBLFX.SYS - ok
16:15:36.0484 2640 [ 01B9017D05D82B6FBCD5CECCE93F3AA7 ] ctsfm2k J:\WINDOWS\system32\drivers\ctsfm2k.sys
16:15:36.0484 2640 ctsfm2k - ok
16:15:36.0500 2640 dac2w2k - ok
16:15:36.0500 2640 dac960nt - ok
16:15:36.0562 2640 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch J:\WINDOWS\system32\rpcss.dll
16:15:36.0562 2640 DcomLaunch - ok
16:15:36.0578 2640 DgiVecp - ok
16:15:36.0593 2640 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp J:\WINDOWS\System32\dhcpcsvc.dll
16:15:36.0609 2640 Dhcp - ok
16:15:36.0625 2640 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk J:\WINDOWS\system32\DRIVERS\disk.sys
16:15:36.0625 2640 Disk - ok
16:15:36.0640 2640 dmadmin - ok
16:15:36.0687 2640 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot J:\WINDOWS\system32\drivers\dmboot.sys
16:15:36.0687 2640 dmboot - ok
16:15:36.0718 2640 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio J:\WINDOWS\system32\drivers\dmio.sys
16:15:36.0718 2640 dmio - ok
16:15:36.0718 2640 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload J:\WINDOWS\system32\drivers\dmload.sys
16:15:36.0734 2640 dmload - ok
16:15:36.0765 2640 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver J:\WINDOWS\System32\dmserver.dll
16:15:36.0765 2640 dmserver - ok
16:15:36.0796 2640 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic J:\WINDOWS\system32\drivers\DMusic.sys
16:15:36.0796 2640 DMusic - ok
16:15:36.0828 2640 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache J:\WINDOWS\System32\dnsrslvr.dll
16:15:36.0828 2640 Dnscache - ok
16:15:36.0875 2640 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc J:\WINDOWS\System32\dot3svc.dll
16:15:36.0875 2640 Dot3svc - ok
16:15:36.0875 2640 dpti2o - ok
16:15:36.0906 2640 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud J:\WINDOWS\system32\drivers\drmkaud.sys
16:15:36.0906 2640 drmkaud - ok
16:15:36.0937 2640 [ 2476936F4994E9084CCFE75ED4F6226A ] E1000 J:\WINDOWS\system32\DRIVERS\e1000325.sys
16:15:36.0937 2640 E1000 - ok
16:15:36.0984 2640 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost J:\WINDOWS\System32\eapsvc.dll
16:15:36.0984 2640 EapHost - ok
16:15:37.0046 2640 [ 85B8B4032A895A746D46A288A9B30DED ] eeCtrl J:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
16:15:37.0046 2640 eeCtrl - ok
16:15:37.0093 2640 [ CE37E3D51912E59C80C6D84337C0B4CD ] ElbyCDFL J:\WINDOWS\system32\Drivers\ElbyCDFL.sys
16:15:37.0093 2640 ElbyCDFL - ok
16:15:37.0140 2640 [ D71233D7CCC2E64F8715A20428D5A33B ] ElbyCDIO J:\WINDOWS\system32\Drivers\ElbyCDIO.sys
16:15:37.0140 2640 ElbyCDIO - ok
16:15:37.0156 2640 [ 71B09041642DE925E6150EB525DCC3BF ] emupia J:\WINDOWS\system32\drivers\emupia2k.sys
16:15:37.0156 2640 emupia - ok
16:15:37.0187 2640 [ B5A8A04A6E5B4E86B95B1553AA918F5F ] EraserUtilRebootDrv J:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
16:15:37.0203 2640 EraserUtilRebootDrv - ok
16:15:37.0218 2640 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc J:\WINDOWS\System32\ersvc.dll
16:15:37.0234 2640 ERSvc - ok
16:15:37.0281 2640 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog J:\WINDOWS\system32\services.exe
16:15:37.0281 2640 Eventlog - ok
16:15:37.0343 2640 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem J:\WINDOWS\System32\es.dll
16:15:37.0343 2640 EventSystem - ok
16:15:37.0359 2640 [ 38D332A6D56AF32635675F132548343E ] Fastfat J:\WINDOWS\system32\drivers\Fastfat.sys
16:15:37.0359 2640 Fastfat - ok
16:15:37.0390 2640 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility J:\WINDOWS\System32\shsvcs.dll
16:15:37.0406 2640 FastUserSwitchingCompatibility - ok
16:15:37.0421 2640 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc J:\WINDOWS\system32\DRIVERS\fdc.sys
16:15:37.0421 2640 Fdc - ok
16:15:37.0468 2640 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips J:\WINDOWS\system32\drivers\Fips.sys
16:15:37.0468 2640 Fips - ok
16:15:37.0484 2640 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk J:\WINDOWS\system32\DRIVERS\flpydisk.sys
16:15:37.0484 2640 Flpydisk - ok
16:15:37.0484 2640 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr J:\WINDOWS\system32\drivers\fltmgr.sys
16:15:37.0484 2640 FltMgr - ok
16:15:37.0578 2640 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 j:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
16:15:37.0578 2640 FontCache3.0.0.0 - ok
16:15:37.0609 2640 [ CBE5F69A5E5B918225F420BA748F3742 ] FsUsbExDisk J:\WINDOWS\system32\FsUsbExDisk.SYS
16:15:37.0609 2640 FsUsbExDisk - ok
16:15:37.0625 2640 [ 96633419F4A1E37ACB89B45EBCCFE001 ] FsUsbExService J:\WINDOWS\system32\FsUsbExService.Exe
16:15:37.0640 2640 FsUsbExService - ok
16:15:37.0656 2640 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec J:\WINDOWS\system32\drivers\Fs_Rec.sys
16:15:37.0656 2640 Fs_Rec - ok
16:15:37.0687 2640 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk J:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:15:37.0687 2640 Ftdisk - ok
16:15:37.0718 2640 [ 72FE2BEA6863D4EB93442A1C4FB5CA48 ] GcKernel J:\WINDOWS\system32\DRIVERS\GcKernel.sys
16:15:37.0718 2640 GcKernel - ok
16:15:37.0750 2640 [ 5AE3A887ECE5BBB72CFAB273C2FD1CFA ] GEARAspiWDM J:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
16:15:37.0750 2640 GEARAspiWDM - ok
16:15:37.0796 2640 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc J:\WINDOWS\system32\DRIVERS\msgpc.sys
16:15:37.0796 2640 Gpc - ok
16:15:37.0828 2640 [ 2E37C43FB534F1D85DCF552D5B2AF9BA ] ha10kx2k J:\WINDOWS\system32\drivers\ha10kx2k.sys
16:15:37.0843 2640 ha10kx2k - ok
16:15:37.0859 2640 [ 607B73DC2A69A98C7F10B5702D947319 ] hap16v2k J:\WINDOWS\system32\drivers\hap16v2k.sys
16:15:37.0859 2640 hap16v2k - ok
16:15:37.0875 2640 [ F674EEAA2D1ED14606AEDFED65C34893 ] hap17v2k J:\WINDOWS\system32\drivers\hap17v2k.sys
16:15:37.0890 2640 hap17v2k - ok
16:15:37.0968 2640 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc J:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
16:15:37.0968 2640 helpsvc - ok
16:15:37.0968 2640 HidServ - ok
16:15:38.0000 2640 [ BD205320308FB41C88A4049A2D1764B4 ] HIDSwvd J:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
16:15:38.0000 2640 HIDSwvd - ok
16:15:38.0031 2640 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb J:\WINDOWS\system32\DRIVERS\hidusb.sys
16:15:38.0031 2640 hidusb - ok
16:15:38.0078 2640 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc J:\WINDOWS\System32\kmsvc.dll
16:15:38.0078 2640 hkmsvc - ok
16:15:38.0093 2640 hpn - ok
16:15:38.0140 2640 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP J:\WINDOWS\system32\Drivers\HTTP.sys
16:15:38.0140 2640 HTTP - ok
16:15:38.0187 2640 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter J:\WINDOWS\System32\w3ssl.dll
16:15:38.0187 2640 HTTPFilter - ok
16:15:38.0203 2640 i2omgmt - ok
16:15:38.0203 2640 i2omp - ok
16:15:38.0234 2640 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt J:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:15:38.0250 2640 i8042prt - ok
16:15:38.0296 2640 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc J:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:15:38.0312 2640 idsvc - ok
16:15:38.0406 2640 [ C19BF2A07BE972A110220DF6B1E89D14 ] IDSxpx86 J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20121109.001\IDSxpx86.sys
16:15:38.0421 2640 IDSxpx86 - ok
16:15:38.0437 2640 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi J:\WINDOWS\system32\DRIVERS\imapi.sys
16:15:38.0437 2640 Imapi - ok
16:15:38.0468 2640 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService J:\WINDOWS\system32\imapi.exe
16:15:38.0468 2640 ImapiService - ok
16:15:38.0484 2640 ini910u - ok
16:15:38.0500 2640 IntelIde - ok
16:15:38.0531 2640 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm J:\WINDOWS\system32\DRIVERS\intelppm.sys
16:15:38.0531 2640 intelppm - ok
16:15:38.0546 2640 [ 3BB22519A194418D5FEC05D800A19AD0 ] ip6fw J:\WINDOWS\system32\drivers\ip6fw.sys
16:15:38.0546 2640 ip6fw - ok
16:15:38.0546 2640 IPFilter - ok
16:15:38.0593 2640 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver J:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:15:38.0593 2640 IpFilterDriver - ok
16:15:38.0609 2640 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp J:\WINDOWS\system32\DRIVERS\ipinip.sys
16:15:38.0609 2640 IpInIp - ok
16:15:38.0640 2640 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat J:\WINDOWS\system32\DRIVERS\ipnat.sys
16:15:38.0640 2640 IpNat - ok
16:15:38.0656 2640 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec J:\WINDOWS\system32\DRIVERS\ipsec.sys
16:15:38.0656 2640 IPSec - ok
16:15:38.0687 2640 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM J:\WINDOWS\system32\DRIVERS\irenum.sys
16:15:38.0687 2640 IRENUM - ok
16:15:38.0718 2640 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp J:\WINDOWS\system32\DRIVERS\isapnp.sys
16:15:38.0718 2640 isapnp - ok
16:15:38.0812 2640 [ 0A5709543986843D37A92290B7838340 ] JavaQuickStarterService J:\java\jre6\bin\jqs.exe
16:15:38.0812 2640 JavaQuickStarterService - ok
16:15:38.0859 2640 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass J:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:15:38.0859 2640 Kbdclass - ok
16:15:38.0875 2640 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid J:\WINDOWS\system32\DRIVERS\kbdhid.sys
16:15:38.0875 2640 kbdhid - ok
16:15:38.0906 2640 [ 692BCF44383D056AED41B045A323D378 ] kmixer J:\WINDOWS\system32\drivers\kmixer.sys
16:15:38.0906 2640 kmixer - ok
16:15:38.0953 2640 [ B467646C54CC746128904E1654C750C1 ] KSecDD J:\WINDOWS\system32\drivers\KSecDD.sys
16:15:38.0953 2640 KSecDD - ok
16:15:38.0984 2640 [ 4103DBB6CAA85E40D271C1AD12BBF776 ] L8042pr2 J:\WINDOWS\system32\DRIVERS\L8042pr2.Sys
16:15:39.0000 2640 L8042pr2 - ok
16:15:39.0031 2640 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver J:\WINDOWS\System32\srvsvc.dll
16:15:39.0031 2640 lanmanserver - ok
16:15:39.0093 2640 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation J:\WINDOWS\System32\wkssvc.dll
16:15:39.0093 2640 lanmanworkstation - ok
16:15:39.0093 2640 lbrtfdc - ok
16:15:39.0140 2640 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts J:\WINDOWS\System32\lmhsvc.dll
16:15:39.0140 2640 LmHosts - ok
16:15:39.0171 2640 [ B666F835C18974F392A387C6E863072F ] LMouFlt2 J:\WINDOWS\system32\DRIVERS\LMouFlt2.Sys
16:15:39.0171 2640 LMouFlt2 - ok
16:15:39.0203 2640 [ 500D089CE760D83DA2B6CBA681AA9949 ] MBAMProtector J:\WINDOWS\system32\drivers\mbam.sys
16:15:39.0203 2640 MBAMProtector - ok
16:15:39.0265 2640 [ 85B16A92B117A5A800032ECD904B86DB ] MBAMScheduler J:\Malwarebytes' Anti-Malware\mbamscheduler.exe
16:15:39.0265 2640 MBAMScheduler - ok
16:15:39.0296 2640 [ 20E2469DB709FC675E655CEAA11BE312 ] MBAMService J:\Malwarebytes' Anti-Malware\mbamservice.exe
16:15:39.0312 2640 MBAMService - ok
16:15:39.0328 2640 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger J:\WINDOWS\System32\msgsvc.dll
16:15:39.0328 2640 Messenger - ok
16:15:39.0375 2640 [ BAFDD5E28BAEA99D7F4772AF2F5EC7EE ] mfeavfk J:\WINDOWS\system32\drivers\mfeavfk.sys
16:15:39.0375 2640 mfeavfk - ok
16:15:39.0406 2640 [ 1D003E3056A43D881597D6763E83B943 ] mfebopk J:\WINDOWS\system32\drivers\mfebopk.sys
16:15:39.0406 2640 mfebopk - ok
16:15:39.0437 2640 [ 3F138A1C8A0659F329F242D1E389B2CF ] mfehidk J:\WINDOWS\system32\drivers\mfehidk.sys
16:15:39.0437 2640 mfehidk - ok
16:15:39.0484 2640 [ 41FE2F288E05A6C8AB85DD56770FFBAD ] mferkdk J:\WINDOWS\system32\drivers\mferkdk.sys
16:15:39.0484 2640 mferkdk - ok
16:15:39.0500 2640 [ 096B52EA918AA909BA5903D79E129005 ] mfesmfk J:\WINDOWS\system32\drivers\mfesmfk.sys
16:15:39.0515 2640 mfesmfk - ok
16:15:39.0593 2640 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service J:\Microsoft Office\Office12\GrooveAuditService.exe
16:15:39.0593 2640 Microsoft Office Groove Audit Service - ok
16:15:39.0640 2640 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd J:\WINDOWS\system32\drivers\mnmdd.sys
16:15:39.0640 2640 mnmdd - ok
16:15:39.0687 2640 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc J:\WINDOWS\System32\mnmsrvc.exe
16:15:39.0687 2640 mnmsrvc - ok
16:15:39.0703 2640 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem J:\WINDOWS\system32\drivers\Modem.sys
16:15:39.0703 2640 Modem - ok
16:15:39.0718 2640 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass J:\WINDOWS\system32\DRIVERS\mouclass.sys
16:15:39.0718 2640 Mouclass - ok
16:15:39.0734 2640 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr J:\WINDOWS\system32\drivers\MountMgr.sys
16:15:39.0734 2640 MountMgr - ok
16:15:39.0734 2640 mraid35x - ok
16:15:39.0750 2640 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV J:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:15:39.0750 2640 MRxDAV - ok
16:15:39.0828 2640 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb J:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:15:39.0828 2640 MRxSmb - ok
16:15:39.0875 2640 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC J:\WINDOWS\System32\msdtc.exe
16:15:39.0875 2640 MSDTC - ok
16:15:39.0890 2640 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs J:\WINDOWS\system32\drivers\Msfs.sys
16:15:39.0890 2640 Msfs - ok
16:15:39.0906 2640 MSIServer - ok
16:15:39.0921 2640 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV J:\WINDOWS\system32\drivers\MSKSSRV.sys
16:15:39.0921 2640 MSKSSRV - ok
16:15:39.0968 2640 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK J:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:15:39.0968 2640 MSPCLOCK - ok
16:15:39.0984 2640 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM J:\WINDOWS\system32\drivers\MSPQM.sys
16:15:39.0984 2640 MSPQM - ok
16:15:40.0000 2640 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios J:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:15:40.0000 2640 mssmbios - ok
16:15:40.0046 2640 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup J:\WINDOWS\system32\drivers\Mup.sys
16:15:40.0046 2640 Mup - ok
16:15:40.0078 2640 [ E78A365CC3E0FBFC018A33DCE01909F8 ] N360 J:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe
16:15:40.0078 2640 N360 - ok
16:15:40.0140 2640 [ 0102140028FAD045756796E1C685D695 ] napagent J:\WINDOWS\System32\qagentrt.dll
16:15:40.0140 2640 napagent - ok
16:15:40.0234 2640 [ 8E4C77AD9BB279900C00F870CC0C674B ] NAVENG J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20121111.008\NAVENG.SYS
16:15:40.0234 2640 NAVENG - ok
16:15:40.0281 2640 [ 826F699B69E88A3920C70F344DD42D88 ] NAVEX15 J:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20121111.008\NAVEX15.SYS
16:15:40.0296 2640 NAVEX15 - ok
16:15:40.0312 2640 [ 1DF7F42665C94B825322FAE71721130D ] NDIS J:\WINDOWS\system32\drivers\NDIS.sys
16:15:40.0312 2640 NDIS - ok
16:15:40.0343 2640 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi J:\WINDOWS\system32\DRIVERS\ndistapi.sys
16:15:40.0343 2640 NdisTapi - ok
16:15:40.0406 2640 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio J:\WINDOWS\system32\DRIVERS\ndisuio.sys
16:15:40.0406 2640 Ndisuio - ok
16:15:40.0421 2640 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan J:\WINDOWS\system32\DRIVERS\ndiswan.sys
16:15:40.0421 2640 NdisWan - ok
16:15:40.0437 2640 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy J:\WINDOWS\system32\drivers\NDProxy.sys
16:15:40.0453 2640 NDProxy - ok
16:15:40.0453 2640 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS J:\WINDOWS\system32\DRIVERS\netbios.sys
16:15:40.0453 2640 NetBIOS - ok
16:15:40.0500 2640 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT J:\WINDOWS\system32\DRIVERS\netbt.sys
16:15:40.0500 2640 NetBT - ok
16:15:40.0546 2640 [ B857BA82860D7FF85AE29B095645563B ] NetDDE J:\WINDOWS\system32\netdde.exe
16:15:40.0546 2640 NetDDE - ok
16:15:40.0546 2640 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm J:\WINDOWS\system32\netdde.exe
16:15:40.0546 2640 NetDDEdsdm - ok
16:15:40.0578 2640 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon J:\WINDOWS\system32\lsass.exe
16:15:40.0578 2640 Netlogon - ok
16:15:40.0640 2640 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman J:\WINDOWS\System32\netman.dll
16:15:40.0640 2640 Netman - ok
16:15:40.0687 2640 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing J:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:15:40.0687 2640 NetTcpPortSharing - ok
16:15:40.0703 2640 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 J:\WINDOWS\system32\DRIVERS\nic1394.sys
16:15:40.0718 2640 NIC1394 - ok
16:15:40.0765 2640 [ 943337D786A56729263071623BBB9DE5 ] Nla J:\WINDOWS\System32\mswsock.dll
16:15:40.0765 2640 Nla - ok
16:15:40.0765 2640 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs J:\WINDOWS\system32\drivers\Npfs.sys
16:15:40.0781 2640 Npfs - ok
16:15:40.0828 2640 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs J:\WINDOWS\system32\drivers\Ntfs.sys
16:15:40.0828 2640 Ntfs - ok
16:15:40.0843 2640 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp J:\WINDOWS\System32\lsass.exe
16:15:40.0843 2640 NtLmSsp - ok
16:15:40.0890 2640 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc J:\WINDOWS\system32\ntmssvc.dll
16:15:40.0890 2640 NtmsSvc - ok
16:15:40.0906 2640 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null J:\WINDOWS\system32\drivers\Null.sys
16:15:40.0906 2640 Null - ok
16:15:41.0250 2640 [ 0DC79B60CEDC3A8854C27B3C6E4B3414 ] nv J:\WINDOWS\system32\DRIVERS\nv4_mini.sys
16:15:41.0343 2640 nv - ok
16:15:41.0390 2640 [ 971B4344ABA9B79ED0E9D0BB2A5283C1 ] NVSvc J:\WINDOWS\system32\nvsvc32.exe
16:15:41.0390 2640 NVSvc - ok
16:15:41.0500 2640 [ 4CDE6D8E0A07DCE9E568F58A5DC8086C ] nvUpdatusService J:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
16:15:41.0531 2640 nvUpdatusService - ok
16:15:41.0578 2640 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt J:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
16:15:41.0578 2640 NwlnkFlt - ok
16:15:41.0593 2640 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd J:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
16:15:41.0593 2640 NwlnkFwd - ok
16:15:41.0640 2640 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv J:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
16:15:41.0656 2640 odserv - ok
16:15:41.0671 2640 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 J:\WINDOWS\system32\DRIVERS\ohci1394.sys
16:15:41.0671 2640 ohci1394 - ok
16:15:41.0750 2640 [ 5A432A042DAE460ABE7199B758E8606C ] ose J:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:15:41.0750 2640 ose - ok
16:15:41.0765 2640 [ E852A590216F0DA2B94DF5A937585554 ] ossrv J:\WINDOWS\system32\drivers\ctoss2k.sys
16:15:41.0765 2640 ossrv - ok
16:15:41.0812 2640 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport J:\WINDOWS\system32\DRIVERS\parport.sys
16:15:41.0812 2640 Parport - ok
16:15:41.0828 2640 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr J:\WINDOWS\system32\drivers\PartMgr.sys
16:15:41.0828 2640 PartMgr - ok
16:15:41.0875 2640 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm J:\WINDOWS\system32\drivers\ParVdm.sys
16:15:41.0875 2640 ParVdm - ok
16:15:41.0890 2640 [ A219903CCF74233761D92BEF471A07B1 ] PCI J:\WINDOWS\system32\DRIVERS\pci.sys
16:15:41.0890 2640 PCI - ok
16:15:41.0906 2640 PCIDump - ok
16:15:41.0906 2640 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde J:\WINDOWS\system32\DRIVERS\pciide.sys
16:15:41.0906 2640 PCIIde - ok
16:15:41.0968 2640 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia J:\WINDOWS\system32\drivers\Pcmcia.sys
16:15:41.0968 2640 Pcmcia - ok
16:15:41.0984 2640 PDCOMP - ok
16:15:41.0984 2640 PDFRAME - ok
16:15:42.0000 2640 PDRELI - ok
16:15:42.0000 2640 PDRFRAME - ok
16:15:42.0015 2640 perc2 - ok
16:15:42.0015 2640 perc2hib - ok
16:15:42.0062 2640 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay J:\WINDOWS\system32\services.exe
16:15:42.0062 2640 PlugPlay - ok
16:15:42.0078 2640 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent J:\WINDOWS\system32\lsass.exe
16:15:42.0078 2640 PolicyAgent - ok
16:15:42.0125 2640 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport J:\WINDOWS\system32\DRIVERS\raspptp.sys
16:15:42.0125 2640 PptpMiniport - ok
16:15:42.0140 2640 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor J:\WINDOWS\system32\DRIVERS\processr.sys
16:15:42.0140 2640 Processor - ok
16:15:42.0156 2640 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage J:\WINDOWS\system32\lsass.exe
16:15:42.0156 2640 ProtectedStorage - ok
16:15:42.0171 2640 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched J:\WINDOWS\system32\DRIVERS\psched.sys
16:15:42.0187 2640 PSched - ok
16:15:42.0234 2640 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink J:\WINDOWS\system32\DRIVERS\ptilink.sys
16:15:42.0234 2640 Ptilink - ok
16:15:42.0250 2640 [ FAA729E2E2FD3AFB8DF7A45DE8769CC3 ] PxHelp20 J:\WINDOWS\system32\DRIVERS\PxHelp20.sys
16:15:42.0250 2640 PxHelp20 - ok
16:15:42.0265 2640 ql1080 - ok
16:15:42.0265 2640 Ql10wnt - ok
16:15:42.0281 2640 ql12160 - ok
16:15:42.0281 2640 ql1240 - ok
16:15:42.0296 2640 ql1280 - ok
16:15:42.0312 2640 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd J:\WINDOWS\system32\DRIVERS\rasacd.sys
16:15:42.0312 2640 RasAcd - ok
16:15:42.0328 2640 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto J:\WINDOWS\System32\rasauto.dll
16:15:42.0328 2640 RasAuto - ok
16:15:42.0359 2640 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp J:\WINDOWS\system32\DRIVERS\rasl2tp.sys
16:15:42.0359 2640 Rasl2tp - ok
16:15:42.0390 2640 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan J:\WINDOWS\System32\rasmans.dll
16:15:42.0390 2640 RasMan - ok
16:15:42.0406 2640 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe J:\WINDOWS\system32\DRIVERS\raspppoe.sys
16:15:42.0406 2640 RasPppoe - ok
16:15:42.0437 2640 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti J:\WINDOWS\system32\DRIVERS\raspti.sys
16:15:42.0437 2640 Raspti - ok
16:15:42.0484 2640 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss J:\WINDOWS\system32\DRIVERS\rdbss.sys
16:15:42.0484 2640 Rdbss - ok
16:15:42.0515 2640 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD J:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:15:42.0515 2640 RDPCDD - ok
16:15:42.0531 2640 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr J:\WINDOWS\system32\DRIVERS\rdpdr.sys
16:15:42.0531 2640 rdpdr - ok
16:15:42.0578 2640 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD J:\WINDOWS\system32\drivers\RDPWD.sys
16:15:42.0578 2640 RDPWD - ok
16:15:42.0593 2640 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr J:\WINDOWS\system32\sessmgr.exe
16:15:42.0609 2640 RDSessMgr - ok
16:15:42.0625 2640 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook J:\WINDOWS\system32\DRIVERS\redbook.sys
16:15:42.0625 2640 redbook - ok
16:15:42.0671 2640 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess J:\WINDOWS\System32\mprdim.dll
16:15:42.0671 2640 RemoteAccess - ok
16:15:42.0703 2640 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry J:\WINDOWS\system32\regsvc.dll
16:15:42.0703 2640 RemoteRegistry - ok
16:15:42.0718 2640 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator J:\WINDOWS\System32\locator.exe
16:15:42.0718 2640 RpcLocator - ok
16:15:42.0765 2640 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs J:\WINDOWS\System32\rpcss.dll
16:15:42.0765 2640 RpcSs - ok
16:15:42.0828 2640 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP J:\WINDOWS\System32\rsvp.exe
16:15:42.0828 2640 RSVP - ok
16:15:42.0843 2640 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs J:\WINDOWS\system32\lsass.exe
16:15:42.0843 2640 SamSs - ok
16:15:42.0875 2640 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr J:\WINDOWS\System32\SCardSvr.exe
16:15:42.0875 2640 SCardSvr - ok
16:15:42.0906 2640 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule J:\WINDOWS\system32\schedsvc.dll
16:15:42.0906 2640 Schedule - ok
16:15:42.0968 2640 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv J:\WINDOWS\system32\DRIVERS\secdrv.sys
16:15:42.0968 2640 Secdrv - ok
16:15:42.0984 2640 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon J:\WINDOWS\System32\seclogon.dll
16:15:42.0984 2640 seclogon - ok
16:15:43.0000 2640 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS J:\WINDOWS\system32\sens.dll
16:15:43.0000 2640 SENS - ok
16:15:43.0046 2640 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum J:\WINDOWS\system32\DRIVERS\serenum.sys
16:15:43.0046 2640 serenum - ok
16:15:43.0078 2640 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial J:\WINDOWS\system32\DRIVERS\serial.sys
16:15:43.0078 2640 Serial - ok
16:15:43.0125 2640 [ 00DE597B81B381053CB5B21A7F20E365 ] sfdrv01 J:\WINDOWS\system32\drivers\sfdrv01.sys
16:15:43.0125 2640 sfdrv01 - ok
16:15:43.0140 2640 [ 64B9AB76F1B16EB059CB6CDD906C067A ] sfhlp02 J:\WINDOWS\system32\drivers\sfhlp02.sys
16:15:43.0140 2640 sfhlp02 - ok
16:15:43.0171 2640 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy J:\WINDOWS\system32\drivers\Sfloppy.sys
16:15:43.0171 2640 Sfloppy - ok
16:15:43.0187 2640 [ 798D918D8F20380008277CE3CE5319D1 ] sfsync02 J:\WINDOWS\system32\drivers\sfsync02.sys
16:15:43.0187 2640 sfsync02 - ok
16:15:43.0203 2640 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess J:\WINDOWS\System32\ipnathlp.dll
16:15:43.0203 2640 SharedAccess - ok
16:15:43.0234 2640 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection J:\WINDOWS\System32\shsvcs.dll
16:15:43.0234 2640 ShellHWDetection - ok
16:15:43.0234 2640 Simbad - ok
16:15:43.0265 2640 [ 14BB60A4F1C5291217A05D5728C403E6 ] SmartDefragDriver J:\WINDOWS\system32\Drivers\SmartDefragDriver.sys
16:15:43.0265 2640 SmartDefragDriver - ok
16:15:43.0281 2640 Sparrow - ok
16:15:43.0312 2640 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter J:\WINDOWS\system32\drivers\splitter.sys
16:15:43.0312 2640 splitter - ok
16:15:43.0343 2640 [ 60784F891563FB1B767F70117FC2428F ] Spooler J:\WINDOWS\system32\spoolsv.exe
16:15:43.0343 2640 Spooler - ok
16:15:43.0343 2640 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr J:\WINDOWS\system32\DRIVERS\sr.sys
16:15:43.0359 2640 sr - ok
16:15:43.0375 2640 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice J:\WINDOWS\system32\srsvc.dll
16:15:43.0375 2640 srservice - ok
16:15:43.0453 2640 [ 83726CF02ECED69138948083E06B6EAC ] SRTSP J:\WINDOWS\System32\Drivers\N360\0502020.003\SRTSP.SYS
16:15:43.0468 2640 SRTSP - ok
16:15:43.0484 2640 [ 4E7EAB2E5615D39CF1F1DF9C71E5E225 ] SRTSPX J:\WINDOWS\system32\drivers\N360\0502020.003\SRTSPX.SYS
16:15:43.0484 2640 SRTSPX - ok
16:15:43.0500 2640 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv J:\WINDOWS\system32\DRIVERS\srv.sys
16:15:43.0515 2640 Srv - ok
16:15:43.0531 2640 [ B2063CE662AF3AB20045121A5B716DF6 ] sscebus J:\WINDOWS\system32\DRIVERS\sscebus.sys
16:15:43.0531 2640 sscebus - ok
16:15:43.0546 2640 [ 66799DC0AFE3DCAF8368CAE17394A762 ] sscemdfl J:\WINDOWS\system32\DRIVERS\sscemdfl.sys
16:15:43.0562 2640 sscemdfl - ok
16:15:43.0562 2640 [ CBF03FFC08F8DB547BAB2F79AA663D16 ] sscemdm J:\WINDOWS\system32\DRIVERS\sscemdm.sys
16:15:43.0578 2640 sscemdm - ok
16:15:43.0593 2640 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV J:\WINDOWS\System32\ssdpsrv.dll
16:15:43.0609 2640 SSDPSRV - ok
16:15:43.0609 2640 SSPORT - ok
16:15:43.0640 2640 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc J:\WINDOWS\system32\wiaservc.dll
16:15:43.0640 2640 stisvc - ok
16:15:43.0703 2640 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum J:\WINDOWS\system32\DRIVERS\swenum.sys
16:15:43.0703 2640 swenum - ok
16:15:43.0718 2640 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi J:\WINDOWS\system32\drivers\swmidi.sys
16:15:43.0734 2640 swmidi - ok
16:15:43.0734 2640 SwPrv - ok
16:15:43.0750 2640 symc810 - ok
16:15:43.0750 2640 symc8xx - ok
16:15:43.0796 2640 [ 9BBEB8C6258E72D62E7560E6667AAD39 ] SymDS J:\WINDOWS\system32\drivers\N360\0502020.003\SYMDS.SYS
16:15:43.0796 2640 SymDS - ok
16:15:43.0828 2640 [ D5C02629C02A820A7E71BCA3D44294A3 ] SymEFA J:\WINDOWS\system32\drivers\N360\0502020.003\SYMEFA.SYS
16:15:43.0843 2640 SymEFA - ok
16:15:43.0875 2640 [ AB33C3B196197CA467CBDDA717860DBA ] SymEvent J:\WINDOWS\system32\Drivers\SYMEVENT.SYS
16:15:43.0875 2640 SymEvent - ok
16:15:43.0890 2640 SYMFW - ok
16:15:43.0890 2640 SYMIDS - ok
16:15:43.0937 2640 [ A73399804D5D4A8B20BA60FCF70C9F1F ] SymIRON J:\WINDOWS\system32\drivers\N360\0502020.003\Ironx86.SYS
16:15:43.0937 2640 SymIRON - ok
16:15:43.0953 2640 SYMNDIS - ok
16:15:43.0968 2640 [ 336CACE58F0359D5CBB1AE6B8A2FB205 ] SYMTDI J:\WINDOWS\System32\Drivers\N360\0502020.003\SYMTDI.SYS
16:15:43.0984 2640 SYMTDI - ok
16:15:43.0984 2640 sym_hi - ok
16:15:44.0000 2640 sym_u3 - ok
16:15:44.0015 2640 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio J:\WINDOWS\system32\drivers\sysaudio.sys
16:15:44.0015 2640 sysaudio - ok
16:15:44.0031 2640 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog J:\WINDOWS\system32\smlogsvc.exe
16:15:44.0046 2640 SysmonLog - ok
16:15:44.0078 2640 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv J:\WINDOWS\System32\tapisrv.dll
16:15:44.0078 2640 TapiSrv - ok
16:15:44.0140 2640 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip J:\WINDOWS\system32\DRIVERS\tcpip.sys
16:15:44.0140 2640 Tcpip - ok
16:15:44.0187 2640 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE J:\WINDOWS\system32\drivers\TDPIPE.sys
16:15:44.0187 2640 TDPIPE - ok
16:15:44.0203 2640 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP J:\WINDOWS\system32\drivers\TDTCP.sys
16:15:44.0203 2640 TDTCP - ok
16:15:44.0250 2640 [ 88155247177638048422893737429D9E ] TermDD J:\WINDOWS\system32\DRIVERS\termdd.sys
16:15:44.0250 2640 TermDD - ok
16:15:44.0281 2640 [ FF3477C03BE7201C294C35F684B3479F ] TermService J:\WINDOWS\System32\termsrv.dll
16:15:44.0281 2640 TermService - ok
16:15:44.0312 2640 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes J:\WINDOWS\System32\shsvcs.dll
16:15:44.0312 2640 Themes - ok
16:15:44.0359 2640 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr J:\WINDOWS\System32\tlntsvr.exe
16:15:44.0375 2640 TlntSvr - ok
16:15:44.0375 2640 TosIde - ok
16:15:44.0390 2640 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks J:\WINDOWS\system32\trkwks.dll
16:15:44.0390 2640 TrkWks - ok
16:15:44.0406 2640 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs J:\WINDOWS\system32\drivers\Udfs.sys
16:15:44.0406 2640 Udfs - ok
16:15:44.0421 2640 ultra - ok
16:15:44.0437 2640 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update J:\WINDOWS\system32\DRIVERS\update.sys
16:15:44.0453 2640 Update - ok
16:15:44.0468 2640 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost J:\WINDOWS\System32\upnphost.dll
16:15:44.0468 2640 upnphost - ok
16:15:44.0484 2640 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS J:\WINDOWS\System32\ups.exe
16:15:44.0484 2640 UPS - ok
16:15:44.0531 2640 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp J:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:15:44.0531 2640 usbccgp - ok
16:15:44.0562 2640 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci J:\WINDOWS\system32\DRIVERS\usbehci.sys
16:15:44.0562 2640 usbehci - ok
16:15:44.0593 2640 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub J:\WINDOWS\system32\DRIVERS\usbhub.sys
16:15:44.0593 2640 usbhub - ok
16:15:44.0609 2640 [ A717C8721046828520C9EDF31288FC00 ] usbprint J:\WINDOWS\system32\DRIVERS\usbprint.sys
16:15:44.0609 2640 usbprint - ok
16:15:44.0656 2640 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan J:\WINDOWS\system32\DRIVERS\usbscan.sys
16:15:44.0656 2640 usbscan - ok
16:15:44.0703 2640 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor J:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:15:44.0703 2640 usbstor - ok
16:15:44.0718 2640 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci J:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:15:44.0718 2640 usbuhci - ok
16:15:44.0765 2640 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave J:\WINDOWS\System32\drivers\vga.sys
16:15:44.0765 2640 VgaSave - ok
16:15:44.0765 2640 ViaIde - ok
16:15:44.0796 2640 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap J:\WINDOWS\system32\drivers\VolSnap.sys
16:15:44.0796 2640 VolSnap - ok
16:15:44.0843 2640 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS J:\WINDOWS\System32\vssvc.exe
16:15:44.0843 2640 VSS - ok
16:15:44.0875 2640 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time J:\WINDOWS\system32\w32time.dll
16:15:44.0875 2640 W32Time - ok
16:15:44.0937 2640 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp J:\WINDOWS\system32\DRIVERS\wanarp.sys
16:15:44.0937 2640 Wanarp - ok
16:15:44.0937 2640 WDICA - ok
16:15:44.0968 2640 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud J:\WINDOWS\system32\drivers\wdmaud.sys
16:15:44.0968 2640 wdmaud - ok
16:15:45.0000 2640 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient J:\WINDOWS\System32\webclnt.dll
16:15:45.0000 2640 WebClient - ok
16:15:45.0109 2640 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt J:\WINDOWS\system32\wbem\WMIsvc.dll
16:15:45.0109 2640 winmgmt - ok
16:15:45.0156 2640 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN J:\WINDOWS\system32\MsPMSNSv.dll
16:15:45.0156 2640 WmdmPmSN - ok
16:15:45.0203 2640 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi J:\WINDOWS\System32\advapi32.dll
16:15:45.0203 2640 Wmi - ok
16:15:45.0234 2640 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv J:\WINDOWS\System32\wbem\wmiapsrv.exe
16:15:45.0234 2640 WmiApSrv - ok
16:15:45.0328 2640 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc J:\Program Files\Windows Media Player\WMPNetwk.exe
16:15:45.0328 2640 WMPNetworkSvc - ok
16:15:45.0421 2640 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 J:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
16:15:45.0421 2640 WPFFontCache_v0400 - ok
16:15:45.0484 2640 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL J:\WINDOWS\System32\drivers\ws2ifsl.sys
16:15:45.0484 2640 WS2IFSL - ok
16:15:45.0515 2640 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc J:\WINDOWS\system32\wscsvc.dll
16:15:45.0531 2640 wscsvc - ok
16:15:45.0562 2640 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv J:\WINDOWS\system32\wuauserv.dll
16:15:45.0562 2640 wuauserv - ok
16:15:45.0593 2640 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf J:\WINDOWS\system32\DRIVERS\WudfPf.sys
16:15:45.0593 2640 WudfPf - ok
16:15:45.0625 2640 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd J:\WINDOWS\system32\DRIVERS\wudfrd.sys
16:15:45.0625 2640 WudfRd - ok
16:15:45.0640 2640 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc J:\WINDOWS\System32\WUDFSvc.dll
16:15:45.0640 2640 WudfSvc - ok
16:15:45.0687 2640 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC J:\WINDOWS\System32\wzcsvc.dll
16:15:45.0703 2640 WZCSVC - ok
16:15:45.0750 2640 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov J:\WINDOWS\System32\xmlprov.dll
16:15:45.0750 2640 xmlprov - ok
16:15:45.0765 2640 ================ Scan global ===============================
16:15:45.0796 2640 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] J:\WINDOWS\system32\basesrv.dll
16:15:45.0828 2640 [ 8C7DCA4B158BF16894120786A7A5F366 ] J:\WINDOWS\system32\winsrv.dll
16:15:45.0843 2640 [ 8C7DCA4B158BF16894120786A7A5F366 ] J:\WINDOWS\system32\winsrv.dll
16:15:45.0859 2640 [ 65DF52F5B8B6E9BBD183505225C37315 ] J:\WINDOWS\system32\services.exe
16:15:45.0859 2640 [Global] - ok
16:15:45.0859 2640 ================ Scan MBR ==================================
16:15:45.0875 2640 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
16:15:45.0921 2640 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected
16:15:45.0921 2640 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)
16:15:45.0937 2640 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
16:15:46.0187 2640 \Device\Harddisk1\DR1 - ok
16:15:46.0187 2640 ================ Scan VBR ==================================
16:15:46.0203 2640 [ 04CA63503D47E2FE5A8F9E87718B99DD ] \Device\Harddisk0\DR0\Partition1
16:15:46.0203 2640 \Device\Harddisk0\DR0\Partition1 - ok
16:15:46.0203 2640 [ EDC5DFF516ECCC241E9F9A05B4F23BA3 ] \Device\Harddisk1\DR1\Partition1
16:15:46.0203 2640 \Device\Harddisk1\DR1\Partition1 - ok
16:15:46.0203 2640 ============================================================
16:15:46.0203 2640 Scan finished
16:15:46.0203 2640 ============================================================
16:15:46.0218 1124 Detected object count: 1
16:15:46.0218 1124 Actual detected object count: 1
16:16:33.0578 1124 \Device\Harddisk0\DR0\# - copied to quarantine
16:16:33.0578 1124 \Device\Harddisk0\DR0 - copied to quarantine
16:16:33.0640 1124 \Device\Harddisk0\DR0 - processing error
16:16:44.0531 1124 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure
16:16:57.0968 3764 Deinitialize success