# Computer restarts when connecting to internet



## shadowandmike (Apr 9, 2013)

I really hope someone can help me with this one, because I have been on a bunch of forums looking for help with no luck.

About four days ago, I started noticing this problem. About 20-30 seconds after my laptop gains internet access, it just restarts itself, with zero warning. It just closes everything and restarts. Almost like a reset button was pushed. This happens EVERY time I gain internet access. and only when I connect online. Everything else on my laptop runs fine. I can leave it on for hours as long as I dont gain internet access.

Luckily I have a desktop which is where I am right now. Both computers use wireless connection to the same router, but only my laptop is having this problem. I currently am subscribed to Norton Internet Security. I have ran multiple virus and worm checkers, but it came up clean.

Please help!


----------



## Hitori (Mar 8, 2013)

Hi Mike
Are you saying the laptop reboots every time you open a web browser or every time you connect to the wireless network?
Just need to make sure I understand where the problem lies.


----------



## Mark1956 (May 7, 2011)

Sounds like there could be a problem with the wireless card or the driver.

Go into Device manager and uninstall the wireless card and then reboot, it will reinstall the drivers, see if that helps.

If not then please follow these instructions and post the logs.

Please go Here and follow the instructions to run DDS, then *Copy and Paste* both the logs into your next reply. You need not run HJT or GMER.

Please run these two scans and post the logs:

*SCAN 1*
Click on this link to download : ADWCleaner and save it to your desktop.

*NOTE:* If using Internet Explorer and you get an alert that stops the program downloading click on *Tools > Smartscreen Filter > Turn off Smartscreen Filter* then click on *OK* in the box that opens. Then click on the link again.

Close your browser and click on this icon on your desktop:









You will then see the screen below, click on the *Delete* button (as indicated), accept any prompts that appear and allow it to reboot the PC. When the PC has rebooted you will be presented with the report, copy & paste it into your next post. If the log does not appear you should find it on your C: drive using Windows Explorer as ADWCleaner[S1].










*SCAN 2*
Download RogueKiller (by tigzy) and save direct to your Desktop.
On the web page select the 32bit or 64bit button to match the bit rate of your version of Windows.


Quit all running programs. 
Start RogueKiller.exe by double clicking on the icon. 
Wait until Prescan has finished. 
Ensure all boxes are ticked under "Report" tab. 
Click on Scan. 
Click on Report when complete. Copy/paste the contents of the report and paste into your next reply.
NOTE: *DO NOT attempt to remove anything that the scan detects.*


----------



## shadowandmike (Apr 9, 2013)

Hi Hitori,

It restarts everytime I connect to the internet. It will restart wether I open a browser or not. Internet Access is making it restart.


----------



## shadowandmike (Apr 9, 2013)

Hey Mark,

I Uninstalled the wireless card and rebooted, but that didnt work.

I also ran both scanners you provided. The first scan worked and the log is posted below. When I tried running the Rouge Killer scan though, it would error and be forced to close. I tried this twice, but no luck.

# AdwCleaner v2.200 - Logfile created 04/13/2013 at 07:56:14
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Mike - MIKE-PC
# Boot Mode : Normal
# Running from : C:\Users\Mike\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
File Deleted : C:\user.js
Folder Deleted : C:\Program Files (x86)\1ClickDownload
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\fbphotozoom
Folder Deleted : C:\Program Files (x86)\Object
Folder Deleted : C:\Program Files (x86)\RelevantKnowledge
Folder Deleted : C:\Program Files (x86)\Shop To Win
Folder Deleted : C:\ProgramData\{B49A644A-1076-4A3D-B124-DAA7862F2318}
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iWin
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\Users\Mike\AppData\Local\Babylon
Folder Deleted : C:\Users\Mike\AppData\Local\Conduit
Folder Deleted : C:\Users\Mike\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\Mike\AppData\Local\PackageAware
Folder Deleted : C:\Users\Mike\AppData\LocalLow\BabylonToolbar
Folder Deleted : C:\Users\Mike\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Mike\AppData\Roaming\Babylon
Folder Deleted : C:\Users\Mike\AppData\Roaming\iWin
Folder Deleted : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\ce182gal.default\extensions\{a018b213-6b46-4791-9298-519020db5737}
Folder Deleted : C:\Users\Mike\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\Mike\Documents\ShopToWin
***** [Registry] *****
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\Freecause
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\Software\Classes\Installer\Features\2B1E51D87B2D71A44BB42DDD5E894160
Key Deleted : HKLM\Software\Classes\Installer\Products\2B1E51D87B2D71A44BB42DDD5E894160
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2786678
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\I Want This_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\I Want This_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F9E44926-2497-46F3-8A25-928136AC079E}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\kincjchfokkeneeofpeefomkikfkiedl
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65BCD620-07DD-012F-819F-073CF1B8F7C6}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8D15E1B2-D2B7-4A17-B44B-D2DDE5981406}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16470
[OK] Registry is clean.
-\\ Mozilla Firefox v [Unable to get version]
File : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\ce182gal.default\prefs.js
C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\ce182gal.default\user.js ... Deleted !
Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Deleted : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
Deleted : user_pref("browser.search.order.1", "Search the web (Babylon)");
Deleted : user_pref("browser.search.selectedEngine", "Search the web (Babylon)");
Deleted : user_pref("browser.startup.homepage", "hxxp://search.babylon.com/?affID=109935&tt=050412_30b&babsrc=[...]
Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Deleted : user_pref("extensions.BabylonToolbar_i.babExt", "");
Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109935&tt=050412_30b");
Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "98e721ff00000000000000ffcc9de830");
Deleted : user_pref("extensions.BabylonToolbar_i.id", "98e721ff00000000000000ffcc9de830");
Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15445");
Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true);
Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=109935&tt=05041[...]
Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "tb9");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1720:20:39");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Deleted : user_pref("keyword.URL", "hxxp://search.babylon.com/?affID=109935&tt=050412_30b&babsrc=KW_ss&mntrId=[...]
-\\ Google Chrome v25.0.1364.172
File : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[S1].txt - [6822 octets] - [13/04/2013 07:56:14]
########## EOF - C:\AdwCleaner[S1].txt - [6882 octets] ##########


----------



## Mark1956 (May 7, 2011)

ADWCleaner has removed a lot of Adware, RogueKiller may be causing an issue as it tries to connect to the internet when it is launched to check for any available updates. Can you try a cable connection to see if that will work without crashing.

Also, there has been an alert about a recent Windows Update that is causing problems on some systems.

Click on Start, Control Panel, Programs & Features. Click on View Installed Updates in the left hand pane.
Then type KB2823324 into the search box (top right hand corner) wait to see if the update appears in the main window.

If it finds the update click on it to highlight it and then click on Uninstall.
Select Reboot when prompted.

If that update was present see how things are after it has been removed.


----------



## shadowandmike (Apr 9, 2013)

Mark,

I just tried using a cable connection, but it still restarted 30 seconds after I gained internet access.

I also searched for that update, but I had never installed it. Nothing came up when I typed KB2823324 into the search box.


----------



## Mark1956 (May 7, 2011)

Ok, that update has been taken down so you would have missed it and need not be concerned about it.

Pleas try and run RogueKiller again with the internet disconnected.

If that still causes a crash please run these scans and post all three logs.

Please download *Farbar Service Scanner* and save it to your desktop. Double click on the icon to run the program.


Put a check mark in all the boxes.
Press "*Scan*".
The results will be displayed when the scan completes, please Copy & Paste the entire log into your next reply. It will also save a log on the desktop in a text file.
Please copy and paste the log into your reply.

Please download RKill 
There are three buttons to choose from with different names on, select the first one and save it to your desktop.


Double-click on the *Rkill* desktop icon to run the tool.
If using Vista or Windows 7, right-click on it and *Run As Administrator*.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
A log pops up at the end of the run. This log file is located at *C:\rkill.log*. Please post this in your next reply.
If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
If the tool does not run from any of the links provided, please let me know.

*DO NOT* reboot, run *Malwarebytes*, let it update and run a *full* scan. If it finds anything, fix it and post the resulting log. If it finds nothing, post that log instead.

RKill will reset .exe .com & .bat file associations.

You can download Malwarebytes from here if you do not have it: Malwarebytes


----------



## shadowandmike (Apr 9, 2013)

I tried Running RougeKiller again, but it still crashed. It always seems to be crashing at the same point in the scan. Under the status bar, it says "Reading MBR..." when it errors.

I also successfully ran all three scans and attached the logs below

Farbar Service Scanner:
Farbar Service Scanner Version: 03-03-2013
Ran by Mike (administrator) on 13-04-2013 at 11:24:03
Running from "C:\Users\Mike\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
There is no connection to network.
Attempt to access Google IP returned error. Google IP is unreachable
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo IP returned error. Yahoo IP is unreachable
Attempt to access Yahoo.com returned error: Other errors

Windows Firewall:
=============
Firewall Disabled Policy: 
==================

System Restore:
============
System Restore Disabled Policy: 
========================

Action Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy: 
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy: 
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

Rkill:

Rkill 2.4.7 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 04/13/2013 11:25:18 AM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* No malware processes found to kill.
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* Windows Defender Disabled
[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001
Checking Windows Service Integrity: 
* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual
* FontCache => %SystemRoot%\system32\svchost.exe -k LocalService [Incorrect ImagePath]
Searching for Missing Digital Signatures: 
* No issues found.
Checking HOSTS File: 
* No issues found.
Program finished at: 04/13/2013 11:25:26 AM
Execution time: 0 hours(s), 0 minute(s), and 8 seconds(s)

Malwarebytes:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2013.04.04.07
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Mike :: MIKE-PC [administrator]
4/13/2013 11:27:23 AM
mbam-log-2013-04-13 (11-27-23).txt
Scan type: Full scan (C:\|Q:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 1402538
Time elapsed: 2 hour(s), 22 minute(s), 34 second(s)
Memory Processes Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> 2136 -> Delete on reboot.
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{056c9352-8cb3-4465-9190-8a37b981e949} (PUP.AdurrPlugin) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLab) -> Quarantined and deleted successfully.
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 2
C:\Program Files (x86)\MyTools\searchInstaller.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.
(end)


----------



## Mark1956 (May 7, 2011)

Please reboot the system and do a repeat scan with Malwarebytes to check if that Trojan is returning. Post the log as before.

See if this will fix the internet problem:

Click on Start, then type *cmd* into the search box.
A menu will pop up, right click on *cmd* at the top of the list and select *Run a Administrator*.
Type this command at the prompt and then hit the Enter key on your keyboard.

*netsh int ip reset resetlog.txt*

Wait for confirmation to appear and then reboot the PC.


----------



## shadowandmike (Apr 9, 2013)

I just ran the scan again, and it looks like those trojans came back...

I have attached the log below.

I also tried the *netsh int ip reset resetlog.txt *command. It successfully ran, but it is still restarting upon internet access.

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2013.04.04.07
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Mike :: MIKE-PC [administrator]
4/14/2013 9:49:12 AM
mbam-log-2013-04-14 (09-49-12).txt
Scan type: Full scan (C:\|Q:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 1387414
Time elapsed: 2 hour(s), 16 minute(s), 47 second(s)
Memory Processes Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> 3892 -> Delete on reboot.
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.
(end)


----------



## Mark1956 (May 7, 2011)

Yup, the infection has returned which could indicate a Rootkit. Please run the scan below, I will have this moved to the Malware forum.

NOTE: Unless otherwise advised please use a clean working PC to download and copy FRST to a Flash Drive.
Use these links to download the correct version for your operating system and save it to the Flash Drive. 
For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit 
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit

*NOTE:* For Windows 7 systems only: If you cannot get Option 1 to work you can make a Recovery disc to use for Option 2.
Just do this: Click on *Start* > *Control Panel* and select *Backup and Restore*. In the left hand pane select *Create a System Recovery disc* and follow the prompts. This can be done on any Windows 7 PC but it must have the same bit rate as the infected PC, i.e. 64 or 32bit.

Plug the flashdrive into the infected PC.

Enter *System Recovery Options* by using* Option 1* or *Option 2*
*STEP 1*
*Option 1* 
*To enter the System Recovery Options from the Advanced Boot Options:*


Restart the computer.
As soon as the BIOS is loaded begin tapping the* F8* key until the *Advanced Boot Options* menu appears.
Use the arrow keys to select *Repair your computer* and hit the *Enter* key. If *Repair your computer* is not in the menu you will need to follow *Option 2* below.
Select *US* as the keyboard language settings, and then click *Next*. If you know your keyboard is for another language then select that from the list.
The system will scan for installed operating systems. Select the operating system you want to repair, and then click *Next*.
Select your user account and click *Next*. If there is only one user account this will go straight to the *System Recovery Options*.
Now go to the instructions for *STEP 2*.

*Option 2* 
*To enter the System Recovery Options by using a Windows installation or Recovery disc:*


Insert the Installation or Recovery disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click *Repair your computer*. NOTE: This Option will be skipped if using a Recovery disc.
Select *US* as the keyboard language settings, and then click *Next*. If you know your keyboard is for another language then select that from the list.
The system will scan for installed operating systems. Select the operating system you want to repair, and then click *Next*.
Select your user account and click *Next*. If there is only one user account this will go straight to the *System Recovery Options*.
Now go to the instructions for *STEP 2*.

NOTE: If you are unable to complete either *Option 1* or *2* then *stop* and let me know. This tool will only run correctly if you are able to get to the *System Recovery Options* menu.

*STEP 2*
*On the System Recovery Options menu you will get the following options:*

*Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt*


Select *Command Prompt*
In the command window type in *notepad* and press *Enter*.
The Notepad opens. Click on *File* and select *Open*.
Select *Computer* and find your flash drive below *Devices with Removable Storage* make a note of the drive letter and close *Notepad*. 
In the command window type *e:\frst.exe* (for x64 bit version type *e:\frst64*) and press *Enter* 
*Note:* Replace letter e with the drive letter of your flash drive. 
NOTE: if you receive an error message "the system cannot find the drive specified" go back into Notepad and check the drive letter for the Flash Drive, also note the letter can change on subsequent runs.
The tool will start to run.
When the tool opens click *Yes* to disclaimer. (This may not appear on all systems).
Press the *Scan* button. The progress bar may freeze for a while which is normal, leave it undisturbed and it will complete the scan.
It will make a log (FRST.txt) on the flash drive. Put the Flash drive back in a working PC, open Windows Explorer and then click on the Flash Drive. Double click on FRST.txt then *Copy & Paste* the log into your next reply. Please *DO NOT* send the log as an attachment.


----------



## shadowandmike (Apr 9, 2013)

I successfully ran option 1 and posted the log below.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-04-2013
Ran by SYSTEM at 15-04-2013 17:43:20
Running from F:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) 
The current controlset is ControlSet001
==================== Registry (Whitelisted) ===================
HKLM\...\Run: [] [x]
HKLM\...\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-05-17] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe [972672 2011-04-27] (TOSHIBA Corporation)
HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12558440 2011-07-07] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3 [2226280 2011-06-03] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)
HKLM\...\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-06-09] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosNC] %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38824 2011-06-28] (TOSHIBA Corporation)
HKLM-x32\...\Run: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 [1298816 2011-07-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" UNATTENDED [3218864 2011-06-22] (Toshiba)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-02] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2012-03-27] (Apple Inc.)
HKU\Mike\...\Run: [Spotify Web Helper] "C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1104280 2013-03-29] (Spotify Ltd)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Startup: C:\ProgramData\Start Menu\Programs\Startup\CineForm Status.lnk
ShortcutTarget: CineForm Status.lnk -> C:\Program Files (x86)\CineForm\Tools\GoProCineFormStatusViewer.exe (GoPro)
Startup: C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk
ShortcutTarget: RollerCoaster Tycoon 3 Registration.lnk -> (No File)
==================== Services (Whitelisted) ===================
2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] ()
2 NIS; "C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\diMaster.dll" /prefetch:1 [309688 2012-04-12] (Symantec Corporation)
2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\PC Checkup\SymcPCCULaunchSvc.exe /s [132056 2012-11-22] (Symantec Corporation)
2 PCCUJobMgr; "C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe" /s "PCCUJobMgr" /m "C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\diMaster.dll" /prefetch:1 [132984 2011-07-19] (Symantec Corporation)
2 RichVideo64; "C:\Program Files\CyberLink\Shared files\RichVideo64.exe" [390632 2012-04-24] ()
==================== Drivers (Whitelisted) =====================
1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130322.001\BHDrvx64.sys [1387608 2013-03-21] (Symantec Corporation)
1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys [167072 2012-06-06] (Symantec Corporation)
1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-08-08] (Symantec Corporation)
3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-10-26] (Symantec Corporation)
1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130329.001\IDSvia64.sys [513184 2013-01-18] (Symantec Corporation)
1 SRTSP; C:\Windows\System32\Drivers\NISx64\1309010.00E\SRTSP64.SYS [737952 2012-07-05] (Symantec Corporation)
1 SRTSPX; C:\Windows\system32\drivers\NISx64\1309010.00E\SRTSPX64.SYS [37536 2012-07-05] (Symantec Corporation)
0 SymDS; C:\Windows\System32\drivers\NISx64\1309010.00E\SYMDS64.SYS [451192 2011-05-16] (Symantec Corporation)
0 SymEFA; C:\Windows\System32\drivers\NISx64\1309010.00E\SYMEFA64.SYS [1129120 2012-05-21] (Symantec Corporation)
3 SymEvent; \??\C:\windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2012-03-26] (Symantec Corporation)
1 SymIRON; C:\Windows\system32\drivers\NISx64\1309010.00E\Ironx64.SYS [190072 2012-04-17] (Symantec Corporation)
1 SymNetS; C:\Windows\System32\Drivers\NISx64\1309010.00E\SYMNETS.SYS [405624 2012-04-17] (Symantec Corporation)
3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130405.005\ENG64.SYS [x]
3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130405.005\EX64.SYS [x]
==================== NetSvcs (Whitelisted) ====================

==================== One Month Created Files and Folders ========
2013-04-15 17:43 - 2013-04-15 17:43 - 00000000 ____D C:\FRST
2013-04-14 09:18 - 2013-04-14 09:18 - 00001250 ____A C:\Users\Mike\Desktop\RKreport[1]_S_04142013_02d1218.txt
2013-04-14 09:17 - 2013-04-14 09:18 - 00000000 ____D C:\Users\Mike\Desktop\RK_Quarantine
2013-04-14 09:12 - 2009-07-13 17:14 - 00020480 ____A (Microsoft Corporation) C:\Windows\svchost.exe
2013-04-14 06:48 - 2013-04-14 06:48 - 00001080 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-04-14 06:48 - 2013-04-13 08:22 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Mike\Desktop\mbam-setup-1.75.0.1300.exe
2013-04-13 14:38 - 2013-04-13 19:49 - 00005624 ____A C:\Windows\PFRO.log
2013-04-13 08:26 - 2013-04-14 06:48 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-04-13 08:26 - 2013-04-13 08:26 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Malwarebytes
2013-04-13 08:26 - 2013-04-13 08:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-04-13 08:26 - 2013-04-04 11:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-04-13 05:09 - 2013-04-13 05:06 - 00791040 ____A C:\Users\Mike\Desktop\RogueKillerX64.exe
2013-04-13 04:56 - 2013-04-13 04:56 - 00006947 ____A C:\AdwCleaner[S1].txt
2013-04-07 18:16 - 2013-04-14 09:11 - 00001680 ____A C:\Windows\setupact.log
2013-04-07 18:16 - 2013-04-07 18:16 - 00000000 ____A C:\Windows\setuperr.log
2013-03-31 16:02 - 2013-03-31 16:02 - 00000000 ____D C:\ProgramData\McAfee
2013-03-31 15:58 - 2013-03-31 15:58 - 00896928 ____A (Oracle Corporation) C:\Users\Mike\Downloads\chromeinstall-7u17.exe
2013-03-31 15:42 - 2013-03-31 15:42 - 33003424 ____A (Oracle Corporation) C:\Users\Mike\Downloads\jre-7u17-windows-x64 (1).exe
2013-03-25 16:50 - 2013-02-11 20:12 - 00019968 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usb8023.sys
2013-03-24 14:10 - 2013-04-13 19:20 - 00000000 ____D C:\ProgramData\Vizzed
2013-03-24 13:31 - 2013-03-24 13:31 - 01085344 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
2013-03-24 13:31 - 2013-03-24 13:31 - 00963488 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
2013-03-24 13:31 - 2013-03-24 13:31 - 00310688 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2013-03-24 13:31 - 2013-03-24 13:31 - 00188832 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2013-03-24 13:31 - 2013-03-24 13:31 - 00188320 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2013-03-24 13:31 - 2013-03-24 13:31 - 00108448 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge-64.dll
2013-03-24 13:31 - 2013-03-24 13:31 - 00000000 ____D C:\Program Files\Java
2013-03-24 13:29 - 2013-03-24 13:30 - 33003424 ____A (Oracle Corporation) C:\Users\Mike\Downloads\jre-7u17-windows-x64.exe
2013-03-18 15:37 - 2013-03-18 15:41 - 174576312 ____A C:\Users\Mike\Documents\CL.2231_GM7_Patch_VDE121029-09.exe
2013-03-18 15:35 - 2013-03-18 15:35 - 00963088 ____A (CyberLink) C:\Users\Mike\Downloads\CyberLink_PowerDirector_Downloader.exe
==================== One Month Modified Files and Folders =======
2013-04-15 14:38 - 2011-11-23 18:56 - 02060881 ____A C:\Windows\WindowsUpdate.log
2013-04-15 02:38 - 2012-04-30 15:49 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-04-14 11:59 - 2009-07-13 21:13 - 00727334 ____A C:\Windows\System32\PerfStringBackup.INI
2013-04-14 09:19 - 2009-07-13 20:45 - 00024608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-04-14 09:19 - 2009-07-13 20:45 - 00024608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-04-14 09:18 - 2013-04-14 09:18 - 00001250 ____A C:\Users\Mike\Desktop\RKreport[1]_S_04142013_02d1218.txt
2013-04-14 09:18 - 2013-04-14 09:17 - 00000000 ____D C:\Users\Mike\Desktop\RK_Quarantine
2013-04-14 09:11 - 2013-04-07 18:16 - 00001680 ____A C:\Windows\setupact.log
2013-04-14 09:11 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-04-14 06:48 - 2013-04-14 06:48 - 00001080 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-04-14 06:48 - 2013-04-13 08:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-04-13 19:49 - 2013-04-13 14:38 - 00005624 ____A C:\Windows\PFRO.log
2013-04-13 19:45 - 2012-04-01 17:09 - 00000000 ____D C:\ProgramData\Big Fish Games
2013-04-13 19:45 - 2012-04-01 17:08 - 00000000 ____D C:\BigFishGamesCache
2013-04-13 19:45 - 2011-12-23 14:46 - 00000000 ___AD C:\Program Files (x86)\Cake Poker 2.0
2013-04-13 19:44 - 2012-05-27 08:06 - 00000000 ____D C:\Program Files (x86)\Stamps.com Internet Postage
2013-04-13 19:24 - 2011-11-23 19:24 - 00000000 ____D C:\Program Files (x86)\Google
2013-04-13 19:23 - 2011-12-22 17:11 - 00000000 ____D C:\Users\Mike\AppData\Local\Google
2013-04-13 19:20 - 2013-03-24 14:10 - 00000000 ____D C:\ProgramData\Vizzed
2013-04-13 15:18 - 2012-01-22 18:54 - 00000000 ____D C:\Users\Mike\AppData\Local\CrashDumps
2013-04-13 14:37 - 2012-01-18 16:24 - 00000000 ____D C:\Program Files (x86)\MyTools
2013-04-13 08:26 - 2013-04-13 08:26 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Malwarebytes
2013-04-13 08:26 - 2013-04-13 08:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-04-13 08:22 - 2013-04-14 06:48 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Mike\Desktop\mbam-setup-1.75.0.1300.exe
2013-04-13 05:06 - 2013-04-13 05:09 - 00791040 ____A C:\Users\Mike\Desktop\RogueKillerX64.exe
2013-04-13 04:56 - 2013-04-13 04:56 - 00006947 ____A C:\AdwCleaner[S1].txt
2013-04-10 16:23 - 2013-03-10 09:00 - 00000000 ____D C:\My Works
2013-04-08 18:42 - 2011-12-22 17:07 - 00000000 ____D C:\users\Mike
2013-04-08 15:07 - 2011-01-26 00:09 - 00000000 ____D C:\Users\Mike\Desktop\BlackJack 04-06-13
2013-04-07 18:16 - 2013-04-07 18:16 - 00000000 ____A C:\Windows\setuperr.log
2013-04-07 17:05 - 2012-01-18 16:18 - 00000000 ____D C:\Users\Mike\AppData\Roaming\uTorrent
2013-04-07 16:53 - 2012-06-30 12:31 - 00000000 ____D C:\Program Files (x86)\PC Checkup
2013-04-07 16:48 - 2012-04-15 13:17 - 00000000 ____D C:\Windows\Minidump
2013-04-07 16:48 - 2011-11-23 19:31 - 00000000 ____D C:\ProgramData\Norton
2013-04-07 16:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\AppCompat
2013-04-07 16:43 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration
2013-04-04 11:50 - 2013-04-13 08:26 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-03-31 16:02 - 2013-03-31 16:02 - 00000000 ____D C:\ProgramData\McAfee
2013-03-31 15:58 - 2013-03-31 15:58 - 00896928 ____A (Oracle Corporation) C:\Users\Mike\Downloads\chromeinstall-7u17.exe
2013-03-31 15:42 - 2013-03-31 15:42 - 33003424 ____A (Oracle Corporation) C:\Users\Mike\Downloads\jre-7u17-windows-x64 (1).exe
2013-03-29 21:45 - 2012-11-16 17:56 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Spotify
2013-03-29 19:06 - 2012-11-16 17:59 - 00000000 ____D C:\Users\Mike\AppData\Local\Spotify
2013-03-24 13:31 - 2013-03-24 13:31 - 01085344 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
2013-03-24 13:31 - 2013-03-24 13:31 - 00963488 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
2013-03-24 13:31 - 2013-03-24 13:31 - 00310688 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2013-03-24 13:31 - 2013-03-24 13:31 - 00188832 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2013-03-24 13:31 - 2013-03-24 13:31 - 00188320 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2013-03-24 13:31 - 2013-03-24 13:31 - 00108448 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge-64.dll
2013-03-24 13:31 - 2013-03-24 13:31 - 00000000 ____D C:\Program Files\Java
2013-03-24 13:30 - 2013-03-24 13:29 - 33003424 ____A (Oracle Corporation) C:\Users\Mike\Downloads\jre-7u17-windows-x64.exe
2013-03-18 15:41 - 2013-03-18 15:37 - 174576312 ____A C:\Users\Mike\Documents\CL.2231_GM7_Patch_VDE121029-09.exe
2013-03-18 15:36 - 2013-03-10 08:06 - 00000000 ____D C:\ProgramData\CyberLink
2013-03-18 15:35 - 2013-03-18 15:35 - 00963088 ____A (CyberLink) C:\Users\Mike\Downloads\CyberLink_PowerDirector_Downloader.exe

ATTENTION: ========> Check for possible partition/boot infection:
C:\Windows\svchost.exe
==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
TDL4: custom:26000022 <===== ATTENTION!
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-04-08 14:35:33
Restore point made on: 2013-04-09 00:00:26
Restore point made on: 2013-04-09 15:59:46
Restore point made on: 2013-04-10 00:00:23
Restore point made on: 2013-04-11 04:34:37
Restore point made on: 2013-04-12 00:00:15
Restore point made on: 2013-04-13 00:00:22
Restore point made on: 2013-04-13 19:19:40
Restore point made on: 2013-04-14 00:00:25
Restore point made on: 2013-04-15 00:00:25
==================== Memory info =========================== 
Percentage of memory in use: 13%
Total physical RAM: 4007.98 MB
Available physical RAM: 3458.51 MB
Total Pagefile: 4006.18 MB
Available Pagefile: 3440.75 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB
==================== Partitions =============================
1 Drive c: (TI106229W0C) (Fixed) (Total:282.21 GB) (Free:151.47 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive d: (TOSHIBA System Volume) (Fixed) (Total:1.46 GB) (Free:1.27 GB) NTFS ==>[System with boot components (obtained from reading drive)]
ATTENTION: Malware custom entry on BCD on drive d: detected. Check for MBR/Partition infection.
4 Drive f: (Packer Backer) (Fixed) (Total:931.51 GB) (Free:44.46 GB) NTFS
5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 298 GB 0 B 
Disk 1 Online 931 GB 0 B 
Partitions of Disk 0:
===============
Disk ID: C270EFAA
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Recovery 1500 MB 1024 KB
Partition 2 Primary 282 GB 1501 MB
Partition 3 Primary 14 GB 283 GB
==================================================================================
Disk: 0
Partition 1
Type : 27
Hidden: Yes
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 D TOSHIBA Sys NTFS Partition 1500 MB Healthy Hidden 
=========================================================
Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C TI106229W0C NTFS Partition 282 GB Healthy 
=========================================================
Disk: 0
Partition 3
Type : 17
Hidden: Yes
Active: No
There is no volume associated with this partition.
=========================================================
Partitions of Disk 1:
===============
Disk ID: 82AE29B5
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 931 GB 31 KB
==================================================================================
Disk: 1
Partition 1
Type : 07
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F Packer Back NTFS Partition 931 GB Healthy 
=========================================================
============================== MBR Partition Table ==================
==============================
Partitions of Disk 0:
===============
Disk ID: C270EFAA
Partition 1:
=========
Hex: 8020210027591ABF0008000000E02E00
Active: YES
Type: 27
Size: 1 GB
Partition 2:
=========
Hex: 00591BBF07FEFFFF00E82E0000D04623
Active: NO
Type: 07 (NTFS)
Size: 282 GB
Partition 3:
=========
Hex: 00FEFFFF17FEFFFF00B875230028CD01
Active: NO
Type: 17
Size: 14 GB
==============================
Partitions of Disk 1:
===============
Disk ID: 82AE29B5
Partition 1:
=========
Hex: 8001010007FEFFFF3F00000082597074
Active: YES
Type: 07 (NTFS)
Size: 932 GB

Last Boot: 2013-04-13 21:18
==================== End Of Log =============================


----------



## Mark1956 (May 7, 2011)

That found the infection, please follow these instructions, when done let me know if the Internet problem has been resolved.

Open Notepad and *Copy & Paste* the contents of the code box below into it. To do this highlight the entire contents of the box, right click on the highlighted area and select *Copy* then right click in the Notepad window and select *Paste*. Save it to the flashdrive as *fixlist.txt* _*<--- it is very important to spell this name exactly as written here.*_


```
start
TDL4: custom:26000022 <===== ATTENTION!
end
```
*NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system.*

Plug the Flash Drive back into the infected PC and enter the *System Recovery Options* and select the *Command Prompt* using the same instructions you followed to run the first scan.


In the command window type *e:\frst.exe* (or for x64 bit version type *e:\frst64*) and press *Enter* 
*Note:* Replace letter e with the drive letter of your flash drive. 
*NOTE:* if you receive an error message "the system cannot find the drive specified" go back into Notepad and check the drive letter for the Flash Drive.
When the *FRST* window opens click on the *Fix* button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please *Copy & Paste* it into your next reply.


----------



## shadowandmike (Apr 9, 2013)

I successfully ran that fix code and posted the log below. Still can't get internet access for more than 30 seconds without it restarting though.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-04-2013
Ran by SYSTEM at 2013-04-16 18:06:22 Run:1
Running from F:\
==============================================

The operation completed successfully.
The operation completed successfully.
==== End of Fixlog ====


----------



## Mark1956 (May 7, 2011)

Ok, now run this:

Please follow the instructions exactly as written, deviating from the instructions and trying to fix anything before I have seen the logs may make your PC unbootable. If TDSSKiller does not offer the Cure option *DO NOT select delete* as you may remove files needed for the system to operate.

Please download Kaspersky's *TDSSKiller* and *save it to your Desktop. <-Important!*
_-- The tool is frequently updated...if you used TDSSKiller before, delete that version and download the most current one before using again._

_Be sure to print out and follow all of these instructions unless you can view them on another PC while running the program. _.


Extract (unzip) the file to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the Desktop.
Alternatively, you can download TDSSKiller.exe and use that instead.
Double-click on *TDSSKiller.exe* to run the tool for known TDSS variants.
_*Vista*/*Windows 7* users right-click and select Run As Administrator_.
If an update is available, TDSSKiller will prompt you to update and download the most current version. Click *Load Update*. Close TDSSKiller and start again.


When the program opens, click the *Change parameters.*










Under "Additional options", check the boxes next to *Verify file digital signatures* and *Detect TDLFS file system*, then click *OK*.










Click the *Start Scan* button.










Do not use the computer during the scan
If the scan completes with nothing found, click *Close* to exit.
If '*Suspicious objects*' are detected, the default action will be *Skip*. Leave the default set to Skip and click on *Continue*.
If *Malicious objects* are detected, they will show in the Scan results - *Select action for found objects:* and offer three options.










Ensure *Cure* is selected...then click *Continue* -> *Reboot computer* *for cure completion.*










*Important! ->* If *Cure* *is not available*, please choose *Skip* instead. *Do not choose Delete unless instructed.* If you choose *Delete* you may *remove critical system files* and make your PC *unstable* or possibly *unbootable*.

A log file named *TDSSKiller_version_date_time_log.txt* will be created and saved to the root directory (usually Local Disk C: ).
Copy and paste the contents of that file in your next reply.

_-- If TDSSKiller does not run, try renaming it. To do this, right-click on *TDSSKiller.exe*, select *Rename* and give it a random name with the *.com* file extension (i.e. 123abc.com). If you do not see the file extension, please refer to these instructions. In some cases it may be necessary to redownload TDSSKiller and randomly rename it to something else *before* beginning the download and saving to the computer or to perform the scan in "safe mode"._


----------



## shadowandmike (Apr 9, 2013)

Good news mark! This scan found one malicious threat, and after curing it, it appears my internet access is fully functional again! I attached the log anyways, even though the problem appears to be cured.

I want to thank you for all the help you have provided me! I thought I was going to have to get this sent in, which would cost me lots of money. You truely know what you are doing, and I am glad you came to my rescue!

log:
10:07:01.0676 5476 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
10:07:01.0708 5476 ============================================================
10:07:01.0708 5476 Current date / time: 2013/04/17 10:07:01.0708
10:07:01.0708 5476 SystemInfo:
10:07:01.0708 5476 
10:07:01.0708 5476 OS Version: 6.1.7601 ServicePack: 1.0
10:07:01.0708 5476 Product type: Workstation
10:07:01.0708 5476 ComputerName: MIKE-PC
10:07:01.0708 5476 UserName: Mike
10:07:01.0708 5476 Windows directory: C:\windows
10:07:01.0708 5476 System windows directory: C:\windows
10:07:01.0708 5476 Running under WOW64
10:07:01.0708 5476 Processor architecture: Intel x64
10:07:01.0708 5476 Number of processors: 2
10:07:01.0708 5476 Page size: 0x1000
10:07:01.0708 5476 Boot type: Normal boot
10:07:01.0708 5476 ============================================================
10:07:02.0269 5476 BG loaded
10:07:02.0722 5476 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
10:07:02.0768 5476 Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
10:07:03.0221 5476 ============================================================
10:07:03.0221 5476 \Device\Harddisk0\DR0:
10:07:03.0361 5476 MBR partitions:
10:07:03.0361 5476 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2EE800, BlocksNum 0x2346D000
10:07:03.0361 5476 \Device\Harddisk1\DR1:
10:07:03.0361 5476 MBR partitions:
10:07:03.0361 5476 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74705982
10:07:03.0361 5476 ============================================================
10:07:03.0533 5476 C: <-> \Device\Harddisk0\DR0\Partition1
10:07:03.0564 5476 F: <-> \Device\Harddisk1\DR1\Partition1
10:07:03.0564 5476 ============================================================
10:07:03.0564 5476 Initialize success
10:07:03.0564 5476 ============================================================
10:07:09.0118 5456 ============================================================
10:07:09.0118 5456 Scan started
10:07:09.0118 5456 Mode: Manual; SigCheck; TDLFS; 
10:07:09.0118 5456 ============================================================
10:07:18.0134 5456 ================ Scan system memory ========================
10:07:18.0134 5456 System memory - ok
10:07:18.0134 5456 ================ Scan services =============================
10:07:18.0431 5456 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\windows\system32\drivers\1394ohci.sys
10:07:18.0571 5456 1394ohci - ok
10:07:18.0618 5456 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\windows\system32\drivers\ACPI.sys
10:07:18.0665 5456 ACPI - ok
10:07:18.0712 5456 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\windows\system32\drivers\acpipmi.sys
10:07:18.0821 5456 AcpiPmi - ok
10:07:18.0977 5456 [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
10:07:19.0008 5456 AdobeARMservice - ok
10:07:19.0382 5456 [ EA856F4A46320389D1899B2CAA7BF40F ] AdobeFlashPlayerUpdateSvc C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
10:07:19.0414 5456 AdobeFlashPlayerUpdateSvc - ok
10:07:19.0507 5456 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\windows\system32\drivers\adp94xx.sys
10:07:19.0554 5456 adp94xx - ok
10:07:19.0632 5456 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\windows\system32\drivers\adpahci.sys
10:07:19.0663 5456 adpahci - ok
10:07:19.0772 5456 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\windows\system32\drivers\adpu320.sys
10:07:19.0819 5456 adpu320 - ok
10:07:19.0882 5456 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\windows\System32\aelupsvc.dll
10:07:20.0911 5456 AeLookupSvc - ok
10:07:20.0989 5456 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\windows\system32\drivers\afd.sys
10:07:21.0208 5456 AFD - ok
10:07:21.0254 5456 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\windows\system32\drivers\agp440.sys
10:07:21.0270 5456 agp440 - ok
10:07:21.0317 5456 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\windows\System32\alg.exe
10:07:21.0442 5456 ALG - ok
10:07:21.0504 5456 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\windows\system32\drivers\aliide.sys
10:07:21.0520 5456 aliide - ok
10:07:21.0535 5456 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\windows\system32\drivers\amdide.sys
10:07:21.0551 5456 amdide - ok
10:07:21.0722 5456 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\windows\system32\drivers\amdk8.sys
10:07:21.0800 5456 AmdK8 - ok
10:07:21.0847 5456 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\windows\system32\drivers\amdppm.sys
10:07:21.0941 5456 AmdPPM - ok
10:07:22.0081 5456 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\windows\system32\drivers\amdsata.sys
10:07:22.0159 5456 amdsata - ok
10:07:22.0190 5456 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\windows\system32\drivers\amdsbs.sys
10:07:22.0206 5456 amdsbs - ok
10:07:22.0253 5456 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\windows\system32\drivers\amdxata.sys
10:07:22.0284 5456 amdxata - ok
10:07:22.0534 5456 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\windows\system32\drivers\appid.sys
10:07:23.0392 5456 AppID - ok
10:07:23.0548 5456 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\windows\System32\appidsvc.dll
10:07:23.0704 5456 AppIDSvc - ok
10:07:23.0750 5456 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\windows\System32\appinfo.dll
10:07:23.0844 5456 Appinfo - ok
10:07:24.0031 5456 [ 7EF47644B74EBE721CC32211D3C35E76 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
10:07:24.0062 5456 Apple Mobile Device - ok
10:07:24.0125 5456 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\windows\system32\drivers\arc.sys
10:07:24.0172 5456 arc - ok
10:07:24.0187 5456 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\windows\system32\drivers\arcsas.sys
10:07:24.0203 5456 arcsas - ok
10:07:24.0281 5456 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\windows\system32\DRIVERS\asyncmac.sys
10:07:24.0437 5456 AsyncMac - ok
10:07:24.0468 5456 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\windows\system32\drivers\atapi.sys
10:07:24.0484 5456 atapi - ok
10:07:24.0546 5456 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll
10:07:24.0671 5456 AudioEndpointBuilder - ok
10:07:24.0780 5456 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\windows\System32\Audiosrv.dll
10:07:24.0842 5456 AudioSrv - ok
10:07:25.0217 5456 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\windows\System32\AxInstSV.dll
10:07:25.0654 5456 AxInstSV - ok
10:07:25.0856 5456 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\windows\system32\drivers\bxvbda.sys
10:07:25.0950 5456 b06bdrv - ok
10:07:26.0028 5456 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\windows\system32\DRIVERS\b57nd60a.sys
10:07:26.0075 5456 b57nd60a - ok
10:07:26.0168 5456 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\windows\System32\bdesvc.dll
10:07:26.0293 5456 BDESVC - ok
10:07:26.0356 5456 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\windows\system32\drivers\Beep.sys
10:07:26.0449 5456 Beep - ok
10:07:26.0558 5456 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\windows\System32\bfe.dll
10:07:26.0636 5456 BFE - ok
10:07:27.0089 5456 [ 7B56A40EAAACF1867FF178501D3EA185 ] BHDrvx64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130412.001\BHDrvx64.sys
10:07:27.0136 5456 BHDrvx64 - ok
10:07:27.0214 5456 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\windows\System32\qmgr.dll
10:07:27.0354 5456 BITS - ok
10:07:27.0385 5456 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\windows\system32\DRIVERS\blbdrive.sys
10:07:27.0416 5456 blbdrive - ok
10:07:27.0572 5456 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
10:07:27.0588 5456 Bonjour Service - ok
10:07:27.0666 5456 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\windows\system32\DRIVERS\bowser.sys
10:07:27.0744 5456 bowser - ok
10:07:27.0822 5456 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\windows\system32\drivers\BrFiltLo.sys
10:07:27.0931 5456 BrFiltLo - ok
10:07:27.0962 5456 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\windows\system32\drivers\BrFiltUp.sys
10:07:27.0994 5456 BrFiltUp - ok
10:07:28.0181 5456 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\windows\System32\browser.dll
10:07:28.0368 5456 Browser - ok
10:07:28.0446 5456 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\windows\System32\Drivers\Brserid.sys
10:07:28.0664 5456 Brserid - ok
10:07:28.0711 5456 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\windows\System32\Drivers\BrSerWdm.sys
10:07:28.0789 5456 BrSerWdm - ok
10:07:28.0836 5456 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\windows\System32\Drivers\BrUsbMdm.sys
10:07:28.0898 5456 BrUsbMdm - ok
10:07:28.0930 5456 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\windows\System32\Drivers\BrUsbSer.sys
10:07:29.0023 5456 BrUsbSer - ok
10:07:29.0210 5456 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\windows\system32\drivers\bthmodem.sys
10:07:29.0273 5456 BTHMODEM - ok
10:07:29.0351 5456 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\windows\system32\bthserv.dll
10:07:29.0444 5456 bthserv - ok
10:07:29.0694 5456 [ 2C6FFCCA37B002AAB3C7C31A6D780A76 ] ccSet_NIS C:\windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys
10:07:29.0725 5456 ccSet_NIS - ok
10:07:29.0772 5456 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\windows\system32\DRIVERS\cdfs.sys
10:07:29.0897 5456 cdfs - ok
10:07:29.0975 5456 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\windows\system32\DRIVERS\cdrom.sys
10:07:30.0022 5456 cdrom - ok
10:07:30.0162 5456 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\windows\System32\certprop.dll
10:07:30.0318 5456 CertPropSvc - ok
10:07:30.0458 5456 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\windows\system32\drivers\circlass.sys
10:07:30.0552 5456 circlass - ok
10:07:30.0692 5456 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\windows\system32\CLFS.sys
10:07:30.0708 5456 CLFS - ok
10:07:30.0770 5456 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
10:07:30.0786 5456 clr_optimization_v2.0.50727_32 - ok
10:07:30.0848 5456 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
10:07:30.0864 5456 clr_optimization_v2.0.50727_64 - ok
10:07:30.0958 5456 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
10:07:31.0082 5456 clr_optimization_v4.0.30319_32 - ok
10:07:31.0270 5456 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
10:07:31.0301 5456 clr_optimization_v4.0.30319_64 - ok
10:07:31.0504 5456 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\windows\system32\DRIVERS\CmBatt.sys
10:07:31.0566 5456 CmBatt - ok
10:07:31.0660 5456 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\windows\system32\drivers\cmdide.sys
10:07:31.0691 5456 cmdide - ok
10:07:31.0738 5456 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\windows\system32\Drivers\cng.sys
10:07:31.0784 5456 CNG - ok
10:07:31.0894 5456 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\windows\system32\drivers\compbatt.sys
10:07:31.0925 5456 Compbatt - ok
10:07:32.0112 5456 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\windows\system32\DRIVERS\CompositeBus.sys
10:07:32.0299 5456 CompositeBus - ok
10:07:32.0346 5456 COMSysApp - ok
10:07:32.0408 5456 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\windows\system32\drivers\crcdisk.sys
10:07:32.0440 5456 crcdisk - ok
10:07:32.0705 5456 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\windows\system32\cryptsvc.dll
10:07:32.0830 5456 CryptSvc - ok
10:07:33.0157 5456 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
10:07:33.0188 5456 cvhsvc - ok
10:07:33.0344 5456 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\windows\system32\rpcss.dll
10:07:33.0578 5456 DcomLaunch - ok
10:07:33.0672 5456 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\windows\System32\defragsvc.dll
10:07:33.0844 5456 defragsvc - ok
10:07:33.0953 5456 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\windows\system32\Drivers\dfsc.sys
10:07:34.0078 5456 DfsC - ok
10:07:34.0187 5456 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\windows\system32\dhcpcore.dll


----------



## Mark1956 (May 7, 2011)

You're most welcome and I am glad to hear your internet has returned.

Please could you post the complete TDSSKiller log as it is important I see it all, what you posted is only about a quarter of the full log.

We are not completely done yet as we need to be quite sure the infection has gone for good so some further scans will be required.


----------



## shadowandmike (Apr 9, 2013)

I'm having troubles locating the full log...The log I posted I found by opening TDDSKiller, and selecting reports. There was no log created on the desktop, and I ran a search for *TDSSKiller,* but only the program was found, and not the log. Any ideas where else I can look for this?


----------



## Mark1956 (May 7, 2011)

It tells you were to find the log in the instructions:


> A log file named *TDSSKiller_version_date_time_log.txt* will be created and saved to the root directory (usually Local Disk C: ).


----------



## shadowandmike (Apr 9, 2013)

I think I found the correct one...

09:59:30.0832 5492 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
09:59:30.0848 5492 ============================================================
09:59:30.0848 5492 Current date / time: 2013/04/17 09:59:30.0848
09:59:30.0848 5492 SystemInfo:
09:59:30.0848 5492 
09:59:30.0848 5492 OS Version: 6.1.7601 ServicePack: 1.0
09:59:30.0848 5492 Product type: Workstation
09:59:30.0848 5492 ComputerName: MIKE-PC
09:59:30.0848 5492 UserName: Mike
09:59:30.0848 5492 Windows directory: C:\windows
09:59:30.0848 5492 System windows directory: C:\windows
09:59:30.0848 5492 Running under WOW64
09:59:30.0848 5492 Processor architecture: Intel x64
09:59:30.0848 5492 Number of processors: 2
09:59:30.0848 5492 Page size: 0x1000
09:59:30.0848 5492 Boot type: Normal boot
09:59:30.0848 5492 ============================================================
09:59:32.0533 5492 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
09:59:32.0533 5492 Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
09:59:32.0548 5492 ============================================================
09:59:32.0548 5492 \Device\Harddisk0\DR0:
09:59:32.0548 5492 MBR partitions:
09:59:32.0548 5492 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2EE800, BlocksNum 0x2346D000
09:59:32.0548 5492 \Device\Harddisk1\DR1:
09:59:32.0548 5492 MBR partitions:
09:59:32.0548 5492 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74705982
09:59:32.0548 5492 ============================================================
09:59:32.0626 5492 C: <-> \Device\Harddisk0\DR0\Partition1
09:59:32.0642 5492 F: <-> \Device\Harddisk1\DR1\Partition1
09:59:32.0642 5492 ============================================================
09:59:32.0642 5492 Initialize success
09:59:32.0642 5492 ============================================================
10:00:12.0266 6096 ============================================================
10:00:12.0266 6096 Scan started
10:00:12.0266 6096 Mode: Manual; SigCheck; TDLFS; 
10:00:12.0266 6096 ============================================================
10:00:14.0060 6096 ================ Scan system memory ========================
10:00:14.0060 6096 System memory - ok
10:00:14.0060 6096 ================ Scan services =============================
10:00:14.0528 6096 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\windows\system32\drivers\1394ohci.sys
10:00:14.0668 6096 1394ohci - ok
10:00:14.0746 6096 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\windows\system32\drivers\ACPI.sys
10:00:14.0793 6096 ACPI - ok
10:00:14.0809 6096 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\windows\system32\drivers\acpipmi.sys
10:00:15.0058 6096 AcpiPmi - ok
10:00:15.0230 6096 [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
10:00:15.0261 6096 AdobeARMservice - ok
10:00:15.0402 6096 [ EA856F4A46320389D1899B2CAA7BF40F ] AdobeFlashPlayerUpdateSvc C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
10:00:15.0433 6096 AdobeFlashPlayerUpdateSvc - ok
10:00:15.0495 6096 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\windows\system32\drivers\adp94xx.sys
10:00:15.0511 6096 adp94xx - ok
10:00:15.0558 6096 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\windows\system32\drivers\adpahci.sys
10:00:15.0589 6096 adpahci - ok
10:00:15.0636 6096 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\windows\system32\drivers\adpu320.sys
10:00:15.0651 6096 adpu320 - ok
10:00:15.0714 6096 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\windows\System32\aelupsvc.dll
10:00:15.0979 6096 AeLookupSvc - ok
10:00:16.0041 6096 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\windows\system32\drivers\afd.sys
10:00:16.0135 6096 AFD - ok
10:00:16.0166 6096 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\windows\system32\drivers\agp440.sys
10:00:16.0197 6096 agp440 - ok
10:00:16.0244 6096 [ 3290D6946B5E30E70414990574883DDB ] ALG  C:\windows\System32\alg.exe
10:00:16.0353 6096 ALG - ok
10:00:16.0400 6096 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\windows\system32\drivers\aliide.sys
10:00:16.0416 6096 aliide - ok
10:00:16.0447 6096 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\windows\system32\drivers\amdide.sys
10:00:16.0447 6096 amdide - ok
10:00:16.0478 6096 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\windows\system32\drivers\amdk8.sys
10:00:16.0540 6096 AmdK8 - ok
10:00:16.0572 6096 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\windows\system32\drivers\amdppm.sys
10:00:16.0681 6096 AmdPPM - ok
10:00:16.0728 6096 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\windows\system32\drivers\amdsata.sys
10:00:16.0743 6096 amdsata - ok
10:00:16.0759 6096 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\windows\system32\drivers\amdsbs.sys
10:00:16.0774 6096 amdsbs - ok
10:00:16.0790 6096 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\windows\system32\drivers\amdxata.sys
10:00:16.0806 6096 amdxata - ok
10:00:16.0837 6096 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\windows\system32\drivers\appid.sys
10:00:17.0040 6096 AppID - ok
10:00:17.0071 6096 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\windows\System32\appidsvc.dll
10:00:17.0164 6096 AppIDSvc - ok
10:00:17.0211 6096 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\windows\System32\appinfo.dll
10:00:17.0289 6096 Appinfo - ok
10:00:17.0383 6096 [ 7EF47644B74EBE721CC32211D3C35E76 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
10:00:17.0414 6096 Apple Mobile Device - ok
10:00:17.0445 6096 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\windows\system32\drivers\arc.sys
10:00:17.0476 6096 arc - ok
10:00:17.0492 6096 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\windows\system32\drivers\arcsas.sys
10:00:17.0508 6096 arcsas - ok
10:00:17.0539 6096 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\windows\system32\DRIVERS\asyncmac.sys
10:00:17.0726 6096 AsyncMac - ok
10:00:17.0757 6096 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\windows\system32\drivers\atapi.sys
10:00:17.0788 6096 atapi - ok
10:00:17.0851 6096 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll
10:00:17.0929 6096 AudioEndpointBuilder - ok
10:00:17.0944 6096 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\windows\System32\Audiosrv.dll
10:00:17.0991 6096 AudioSrv - ok
10:00:18.0038 6096 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\windows\System32\AxInstSV.dll
10:00:18.0147 6096 AxInstSV - ok
10:00:18.0194 6096 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\windows\system32\drivers\bxvbda.sys
10:00:18.0319 6096 b06bdrv - ok
10:00:18.0366 6096 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\windows\system32\DRIVERS\b57nd60a.sys
10:00:18.0428 6096 b57nd60a - ok
10:00:18.0490 6096 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\windows\System32\bdesvc.dll
10:00:18.0568 6096 BDESVC - ok
10:00:18.0600 6096 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\windows\system32\drivers\Beep.sys
10:00:18.0709 6096 Beep - ok
10:00:18.0756 6096 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\windows\System32\bfe.dll
10:00:18.0834 6096 BFE - ok
10:00:19.0036 6096 [ E92A3DA47BED7CC65D264235617ED46E ] BHDrvx64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130322.001\BHDrvx64.sys
10:00:19.0083 6096 BHDrvx64 - ok
10:00:19.0146 6096 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\windows\System32\qmgr.dll
10:00:19.0239 6096 BITS - ok
10:00:19.0302 6096 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\windows\system32\DRIVERS\blbdrive.sys
10:00:19.0348 6096 blbdrive - ok
10:00:19.0442 6096 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
10:00:19.0473 6096 Bonjour Service - ok
10:00:19.0504 6096 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\windows\system32\DRIVERS\bowser.sys
10:00:19.0567 6096 bowser - ok
10:00:19.0614 6096 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\windows\system32\drivers\BrFiltLo.sys
10:00:19.0660 6096 BrFiltLo - ok
10:00:19.0692 6096 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\windows\system32\drivers\BrFiltUp.sys
10:00:19.0738 6096 BrFiltUp - ok
10:00:19.0770 6096 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\windows\System32\browser.dll
10:00:19.0848 6096 Browser - ok
10:00:19.0910 6096 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\windows\System32\Drivers\Brserid.sys
10:00:20.0035 6096 Brserid - ok
10:00:20.0050 6096 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\windows\System32\Drivers\BrSerWdm.sys
10:00:20.0097 6096 BrSerWdm - ok
10:00:20.0144 6096 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\windows\System32\Drivers\BrUsbMdm.sys
10:00:20.0206 6096 BrUsbMdm - ok
10:00:20.0253 6096 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\windows\System32\Drivers\BrUsbSer.sys
10:00:20.0300 6096 BrUsbSer - ok
10:00:20.0347 6096 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\windows\system32\drivers\bthmodem.sys
10:00:20.0409 6096 BTHMODEM - ok
10:00:20.0503 6096 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\windows\system32\bthserv.dll
10:00:20.0628 6096 bthserv - ok
10:00:20.0799 6096 [ 2C6FFCCA37B002AAB3C7C31A6D780A76 ] ccSet_NIS C:\windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys
10:00:20.0815 6096 ccSet_NIS - ok
10:00:20.0877 6096 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\windows\system32\DRIVERS\cdfs.sys
10:00:20.0971 6096 cdfs - ok
10:00:21.0018 6096 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\windows\system32\DRIVERS\cdrom.sys
10:00:21.0096 6096 cdrom - ok
10:00:21.0142 6096 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\windows\System32\certprop.dll
10:00:21.0298 6096 CertPropSvc - ok
10:00:21.0345 6096 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\windows\system32\drivers\circlass.sys
10:00:21.0408 6096 circlass - ok
10:00:21.0470 6096 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\windows\system32\CLFS.sys
10:00:21.0501 6096 CLFS - ok
10:00:21.0564 6096 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
10:00:21.0595 6096 clr_optimization_v2.0.50727_32 - ok
10:00:21.0626 6096 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
10:00:21.0642 6096 clr_optimization_v2.0.50727_64 - ok
10:00:21.0735 6096 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
10:00:21.0782 6096 clr_optimization_v4.0.30319_32 - ok
10:00:21.0829 6096 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
10:00:21.0860 6096 clr_optimization_v4.0.30319_64 - ok
10:00:21.0876 6096 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\windows\system32\DRIVERS\CmBatt.sys
10:00:21.0907 6096 CmBatt - ok
10:00:21.0954 6096 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\windows\system32\drivers\cmdide.sys
10:00:21.0985 6096 cmdide - ok
10:00:22.0032 6096 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\windows\system32\Drivers\cng.sys
10:00:22.0063 6096 CNG - ok
10:00:22.0094 6096 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\windows\system32\drivers\compbatt.sys
10:00:22.0094 6096 Compbatt - ok
10:00:22.0125 6096 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\windows\system32\DRIVERS\CompositeBus.sys
10:00:22.0156 6096 CompositeBus - ok
10:00:22.0188 6096 COMSysApp - ok
10:00:22.0203 6096 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\windows\system32\drivers\crcdisk.sys
10:00:22.0219 6096 crcdisk - ok
10:00:22.0266 6096 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\windows\system32\cryptsvc.dll
10:00:22.0359 6096 CryptSvc - ok
10:00:22.0484 6096 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
10:00:22.0531 6096 cvhsvc - ok
10:00:22.0578 6096 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\windows\system32\rpcss.dll
10:00:22.0671 6096 DcomLaunch - ok
10:00:22.0702 6096 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\windows\System32\defragsvc.dll
10:00:22.0780 6096 defragsvc - ok
10:00:22.0827 6096 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\windows\system32\Drivers\dfsc.sys
10:00:22.0921 6096 DfsC - ok
10:00:22.0983 6096 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\windows\system32\dhcpcore.dll
10:00:23.0077 6096 Dhcp - ok
10:00:23.0092 6096 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\windows\system32\drivers\discache.sys
10:00:23.0186 6096 discache - ok
10:00:23.0248 6096 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\windows\system32\drivers\disk.sys
10:00:23.0280 6096 Disk - ok
10:00:23.0326 6096 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\windows\System32\dnsrslvr.dll
10:00:23.0514 6096 Dnscache - ok
10:00:23.0545 6096 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\windows\System32\dot3svc.dll
10:00:23.0638 6096 dot3svc - ok
10:00:23.0670 6096 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\windows\system32\dps.dll
10:00:23.0748 6096 DPS - ok
10:00:23.0810 6096 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\windows\system32\drivers\drmkaud.sys
10:00:23.0872 6096 drmkaud - ok
10:00:23.0919 6096 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\windows\System32\drivers\dxgkrnl.sys
10:00:23.0950 6096 DXGKrnl - ok
10:00:24.0013 6096 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\windows\System32\eapsvc.dll
10:00:24.0122 6096 EapHost - ok
10:00:24.0684 6096 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\windows\system32\drivers\evbda.sys
10:00:25.0089 6096 ebdrv - ok
10:00:25.0245 6096 [ 4353FF94D47A0A9D52B89ECCF0CDB013 ] eeCtrl C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
10:00:25.0276 6096 eeCtrl - ok
10:00:25.0417 6096 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\windows\System32\lsass.exe
10:00:25.0635 6096 EFS - ok
10:00:25.0776 6096 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\windows\ehome\ehRecvr.exe
10:00:25.0854 6096 ehRecvr - ok
10:00:25.0869 6096 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\windows\ehome\ehsched.exe
10:00:25.0885 6096 ehSched - ok
10:00:25.0932 6096 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\windows\system32\drivers\elxstor.sys
10:00:25.0963 6096 elxstor - ok
10:00:26.0041 6096 [ C5BCCB378D0A896304A3E71BE7215983 ] EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
10:00:26.0056 6096 EraserUtilRebootDrv - ok
10:00:26.0072 6096 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\windows\system32\drivers\errdev.sys
10:00:26.0119 6096 ErrDev - ok
10:00:26.0166 6096 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\windows\system32\es.dll
10:00:26.0228 6096 EventSystem - ok
10:00:26.0275 6096 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\windows\system32\drivers\exfat.sys
10:00:26.0337 6096 exfat - ok
10:00:26.0368 6096 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\windows\system32\drivers\fastfat.sys
10:00:26.0446 6096 fastfat - ok
10:00:26.0493 6096 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\windows\system32\fxssvc.exe
10:00:26.0602 6096 Fax - ok
10:00:26.0618 6096 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\windows\system32\drivers\fdc.sys
10:00:26.0665 6096 fdc - ok
10:00:26.0727 6096 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\windows\system32\fdPHost.dll
10:00:26.0836 6096 fdPHost - ok
10:00:26.0868 6096 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\windows\system32\fdrespub.dll
10:00:26.0930 6096 FDResPub - ok
10:00:26.0977 6096 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\windows\system32\drivers\fileinfo.sys
10:00:27.0008 6096 FileInfo - ok
10:00:27.0024 6096 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\windows\system32\drivers\filetrace.sys
10:00:27.0117 6096 Filetrace - ok
10:00:27.0164 6096 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\windows\system32\drivers\flpydisk.sys
10:00:27.0164 6096 flpydisk - ok
10:00:27.0211 6096 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\windows\system32\drivers\fltmgr.sys
10:00:27.0242 6096 FltMgr - ok
10:00:27.0304 6096 [ C4C183E6551084039EC862DA1C945E3D ] FontCache C:\windows\system32\FntCache.dll
10:00:27.0367 6096 FontCache - ok
10:00:27.0429 6096 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
10:00:27.0445 6096 FontCache3.0.0.0 - ok
10:00:27.0460 6096 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\windows\system32\drivers\FsDepends.sys
10:00:27.0492 6096 FsDepends - ok
10:00:27.0554 6096 [ B16B626996C74B564005BA855C5DEE90 ] fssfltr C:\windows\system32\DRIVERS\fssfltr.sys
10:00:27.0570 6096 fssfltr - ok
10:00:27.0694 6096 [ 812E1BA5C52A78F13EA6AA10DF708B1D ] fsssvc C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
10:00:27.0757 6096 fsssvc - ok
10:00:27.0804 6096 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\windows\system32\drivers\Fs_Rec.sys
10:00:27.0835 6096 Fs_Rec - ok
10:00:27.0882 6096 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\windows\system32\DRIVERS\fvevol.sys
10:00:27.0897 6096 fvevol - ok
10:00:27.0944 6096 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\windows\system32\drivers\gagp30kx.sys
10:00:27.0975 6096 gagp30kx - ok
10:00:28.0006 6096 [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM C:\windows\system32\DRIVERS\GEARAspiWDM.sys
10:00:28.0022 6096 GEARAspiWDM - ok
10:00:28.0069 6096 [ FA07EC01952729DDDDC5BF4BAE06B09E ] GFNEXSrv C:\Windows\System32\GFNEXSrv.exe
10:00:28.0084 6096 GFNEXSrv - ok
10:00:28.0131 6096 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\windows\System32\gpsvc.dll
10:00:28.0178 6096 gpsvc - ok
10:00:28.0194 6096 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\windows\system32\drivers\hcw85cir.sys
10:00:28.0256 6096 hcw85cir - ok
10:00:28.0287 6096 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys
10:00:28.0334 6096 HdAudAddService - ok
10:00:28.0381 6096 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\windows\system32\DRIVERS\HDAudBus.sys
10:00:28.0412 6096 HDAudBus - ok
10:00:28.0443 6096 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\windows\system32\drivers\HidBatt.sys
10:00:28.0474 6096 HidBatt - ok
10:00:28.0521 6096 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\windows\system32\drivers\hidbth.sys
10:00:28.0584 6096 HidBth - ok
10:00:28.0630 6096 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\windows\system32\drivers\hidir.sys
10:00:28.0677 6096 HidIr - ok
10:00:28.0693 6096 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\windows\system32\hidserv.dll
10:00:28.0771 6096 hidserv - ok
10:00:28.0818 6096 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\windows\system32\DRIVERS\hidusb.sys
10:00:28.0833 6096 HidUsb - ok
10:00:28.0864 6096 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\windows\system32\kmsvc.dll
10:00:28.0927 6096 hkmsvc - ok
10:00:28.0958 6096 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\windows\system32\ListSvc.dll
10:00:29.0036 6096 HomeGroupListener - ok
10:00:29.0067 6096 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\windows\system32\provsvc.dll
10:00:29.0114 6096 HomeGroupProvider - ok
10:00:29.0161 6096 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\windows\system32\drivers\HpSAMD.sys
10:00:29.0192 6096 HpSAMD - ok
10:00:29.0239 6096 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\windows\system32\drivers\HTTP.sys
10:00:29.0332 6096 HTTP - ok
10:00:29.0364 6096 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\windows\system32\drivers\hwpolicy.sys
10:00:29.0395 6096 hwpolicy - ok
10:00:29.0410 6096 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\windows\system32\DRIVERS\i8042prt.sys
10:00:29.0426 6096 i8042prt - ok
10:00:29.0473 6096 [ D469B77687E12FE43E344806740B624D ] iaStor C:\windows\system32\DRIVERS\iaStor.sys
10:00:29.0488 6096 iaStor - ok
10:00:29.0535 6096 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\windows\system32\drivers\iaStorV.sys
10:00:29.0582 6096 iaStorV - ok
10:00:29.0676 6096 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
10:00:29.0754 6096 idsvc - ok
10:00:29.0863 6096 [ A48928D4CCA6F8B731989DB08CF2C0AB ] IDSVia64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130329.001\IDSvia64.sys
10:00:29.0878 6096 IDSVia64 - ok
10:00:30.0159 6096 [ 370C2A8629B30F910F740387795DDC6F ] igfx C:\windows\system32\DRIVERS\igdkmd64.sys
10:00:30.0565 6096 igfx - ok
10:00:30.0612 6096 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\windows\system32\drivers\iirsp.sys
10:00:30.0658 6096 iirsp - ok
10:00:30.0721 6096 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\windows\System32\ikeext.dll
10:00:30.0783 6096 IKEEXT - ok
10:00:30.0924 6096 [ 028E40182A6F0374978C755F85B9F07C ] IntcAzAudAddService C:\windows\system32\drivers\RTKVHD64.sys
10:00:30.0970 6096 IntcAzAudAddService - ok
10:00:30.0986 6096 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\windows\system32\drivers\intelide.sys
10:00:31.0002 6096 intelide - ok
10:00:31.0033 6096 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\windows\system32\DRIVERS\intelppm.sys
10:00:31.0080 6096 intelppm - ok
10:00:31.0126 6096 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\windows\system32\ipbusenum.dll
10:00:31.0189 6096 IPBusEnum - ok
10:00:31.0236 6096 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\windows\system32\DRIVERS\ipfltdrv.sys
10:00:31.0298 6096 IpFilterDriver - ok
10:00:31.0376 6096 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\windows\System32\iphlpsvc.dll
10:00:31.0485 6096 iphlpsvc - ok
10:00:31.0501 6096 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\windows\system32\drivers\IPMIDrv.sys
10:00:31.0548 6096 IPMIDRV - ok
10:00:31.0579 6096 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\windows\system32\drivers\ipnat.sys
10:00:31.0672 6096 IPNAT - ok
10:00:31.0719 6096 [ 50D6CCC6FF5561F9F56946B3E6164FB8 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
10:00:31.0750 6096 iPod Service - ok
10:00:31.0782 6096 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\windows\system32\drivers\irenum.sys
10:00:31.0797 6096 IRENUM - ok
10:00:31.0813 6096 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\windows\system32\drivers\isapnp.sys
10:00:31.0813 6096 isapnp - ok
10:00:31.0844 6096 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\windows\system32\drivers\msiscsi.sys
10:00:31.0860 6096 iScsiPrt - ok
10:00:31.0875 6096 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\windows\system32\DRIVERS\kbdclass.sys
10:00:31.0891 6096 kbdclass - ok
10:00:31.0922 6096 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\windows\system32\drivers\kbdhid.sys
10:00:31.0969 6096 kbdhid - ok
10:00:31.0984 6096 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\windows\system32\lsass.exe
10:00:32.0000 6096 KeyIso - ok
10:00:32.0031 6096 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\windows\system32\Drivers\ksecdd.sys
10:00:32.0062 6096 KSecDD - ok
10:00:32.0078 6096 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\windows\system32\Drivers\ksecpkg.sys
10:00:32.0094 6096 KSecPkg - ok
10:00:32.0125 6096 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\windows\system32\drivers\ksthunk.sys
10:00:32.0203 6096 ksthunk - ok
10:00:32.0250 6096 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\windows\system32\msdtckrm.dll
10:00:32.0343 6096 KtmRm - ok
10:00:32.0406 6096 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\windows\system32\srvsvc.dll
10:00:32.0499 6096 LanmanServer - ok
10:00:32.0530 6096 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\windows\System32\wkssvc.dll
10:00:32.0593 6096 LanmanWorkstation - ok
10:00:32.0655 6096 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\windows\system32\DRIVERS\lltdio.sys
10:00:32.0749 6096 lltdio - ok
10:00:32.0780 6096 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\windows\System32\lltdsvc.dll
10:00:32.0858 6096 lltdsvc - ok
10:00:32.0889 6096 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\windows\System32\lmhsvc.dll
10:00:32.0920 6096 lmhosts - ok
10:00:33.0092 6096 [ 7F32D4C47A50E7223491E8FB9359907D ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
10:00:33.0139 6096 LMS - ok
10:00:33.0186 6096 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\windows\system32\drivers\lsi_fc.sys
10:00:33.0217 6096 LSI_FC - ok
10:00:33.0248 6096 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\windows\system32\drivers\lsi_sas.sys
10:00:33.0295 6096 LSI_SAS - ok
10:00:33.0342 6096 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\windows\system32\drivers\lsi_sas2.sys
10:00:33.0373 6096 LSI_SAS2 - ok
10:00:33.0388 6096 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\windows\system32\drivers\lsi_scsi.sys
10:00:33.0404 6096 LSI_SCSI - ok
10:00:33.0420 6096 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\windows\system32\drivers\luafv.sys
10:00:33.0498 6096 luafv - ok
10:00:33.0544 6096 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\windows\system32\Mcx2Svc.dll
10:00:33.0560 6096 Mcx2Svc - ok
10:00:33.0591 6096 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\windows\system32\drivers\megasas.sys
10:00:33.0591 6096 megasas - ok
10:00:33.0622 6096 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\windows\system32\drivers\MegaSR.sys
10:00:33.0638 6096 MegaSR - ok
10:00:33.0669 6096 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\windows\system32\DRIVERS\HECIx64.sys
10:00:33.0700 6096 MEIx64 - ok
10:00:33.0747 6096 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\windows\system32\mmcss.dll
10:00:33.0841 6096 MMCSS - ok
10:00:33.0872 6096 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\windows\system32\drivers\modem.sys
10:00:33.0966 6096 Modem - ok
10:00:34.0012 6096 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\windows\system32\DRIVERS\monitor.sys
10:00:34.0075 6096 monitor - ok
10:00:34.0137 6096 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\windows\system32\DRIVERS\mouclass.sys
10:00:34.0153 6096 mouclass - ok
10:00:34.0184 6096 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\windows\system32\DRIVERS\mouhid.sys
10:00:34.0231 6096 mouhid - ok
10:00:34.0278 6096 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\windows\system32\drivers\mountmgr.sys
10:00:34.0309 6096 mountmgr - ok
10:00:34.0309 6096 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\windows\system32\drivers\mpio.sys
10:00:34.0324 6096 mpio - ok
10:00:34.0356 6096 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv  C:\windows\system32\drivers\mpsdrv.sys
10:00:34.0402 6096 mpsdrv - ok
10:00:34.0434 6096 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\windows\system32\mpssvc.dll
10:00:34.0512 6096 MpsSvc - ok
10:00:34.0543 6096 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\windows\system32\drivers\mrxdav.sys
10:00:34.0590 6096 MRxDAV - ok
10:00:34.0621 6096 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\windows\system32\DRIVERS\mrxsmb.sys
10:00:34.0699 6096 mrxsmb - ok
10:00:34.0730 6096 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\windows\system32\DRIVERS\mrxsmb10.sys
10:00:34.0777 6096 mrxsmb10 - ok
10:00:34.0792 6096 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\windows\system32\DRIVERS\mrxsmb20.sys
10:00:34.0824 6096 mrxsmb20 - ok
10:00:34.0839 6096 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\windows\system32\DRIVERS\msahci.sys
10:00:34.0855 6096 msahci - ok
10:00:34.0870 6096 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\windows\system32\drivers\msdsm.sys
10:00:34.0886 6096 msdsm - ok
10:00:34.0902 6096 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\windows\System32\msdtc.exe
10:00:34.0948 6096 MSDTC - ok
10:00:34.0995 6096 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\windows\system32\drivers\Msfs.sys
10:00:35.0058 6096 Msfs - ok
10:00:35.0073 6096 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\windows\System32\drivers\mshidkmdf.sys
10:00:35.0136 6096 mshidkmdf - ok
10:00:35.0167 6096 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\windows\system32\drivers\msisadrv.sys
10:00:35.0182 6096 msisadrv - ok
10:00:35.0214 6096 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\windows\system32\iscsiexe.dll
10:00:35.0276 6096 MSiSCSI - ok
10:00:35.0292 6096 msiserver - ok
10:00:35.0323 6096 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\windows\system32\drivers\MSKSSRV.sys
10:00:35.0416 6096 MSKSSRV - ok
10:00:35.0432 6096 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\windows\system32\drivers\MSPCLOCK.sys
10:00:35.0526 6096 MSPCLOCK - ok
10:00:35.0541 6096 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\windows\system32\drivers\MSPQM.sys
10:00:35.0604 6096 MSPQM - ok
10:00:35.0650 6096 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\windows\system32\drivers\MsRPC.sys
10:00:35.0666 6096 MsRPC - ok
10:00:35.0682 6096 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\windows\system32\DRIVERS\mssmbios.sys
10:00:35.0697 6096 mssmbios - ok
10:00:35.0728 6096 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\windows\system32\drivers\MSTEE.sys
10:00:35.0838 6096 MSTEE - ok
10:00:35.0853 6096 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\windows\system32\drivers\MTConfig.sys
10:00:35.0869 6096 MTConfig - ok
10:00:35.0884 6096 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\windows\system32\Drivers\mup.sys
10:00:35.0900 6096 Mup - ok
10:00:35.0931 6096 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\windows\system32\qagentRT.dll
10:00:35.0994 6096 napagent - ok
10:00:36.0103 6096 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\windows\system32\DRIVERS\nwifi.sys
10:00:36.0165 6096 NativeWifiP - ok
10:00:36.0212 6096 NAVENG - ok
10:00:36.0228 6096 NAVEX15 - ok
10:00:36.0337 6096 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\windows\system32\drivers\ndis.sys
10:00:36.0415 6096 NDIS - ok
10:00:36.0446 6096 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\windows\system32\DRIVERS\ndiscap.sys
10:00:36.0540 6096 NdisCap - ok
10:00:36.0586 6096 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\windows\system32\DRIVERS\ndistapi.sys
10:00:36.0618 6096 NdisTapi - ok
10:00:36.0649 6096 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\windows\system32\DRIVERS\ndisuio.sys
10:00:36.0711 6096 Ndisuio - ok
10:00:36.0742 6096 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\windows\system32\DRIVERS\ndiswan.sys
10:00:36.0805 6096 NdisWan - ok
10:00:36.0852 6096 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\windows\system32\drivers\NDProxy.sys
10:00:36.0883 6096 NDProxy - ok
10:00:36.0914 6096 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\windows\system32\DRIVERS\netbios.sys
10:00:36.0976 6096 NetBIOS - ok
10:00:37.0008 6096 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\windows\system32\DRIVERS\netbt.sys
10:00:37.0039 6096 NetBT - ok
10:00:37.0054 6096 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\windows\system32\lsass.exe
10:00:37.0070 6096 Netlogon - ok
10:00:37.0101 6096 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\windows\System32\netman.dll
10:00:37.0179 6096 Netman - ok
10:00:37.0210 6096 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\windows\System32\netprofm.dll
10:00:37.0304 6096 netprofm - ok
10:00:37.0335 6096 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
10:00:37.0366 6096 NetTcpPortSharing - ok
10:00:37.0413 6096 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\windows\system32\drivers\nfrd960.sys
10:00:37.0429 6096 nfrd960 - ok
10:00:37.0538 6096 [ F2840DBFE9322F35557219AE82CC4597 ] NIS C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
10:00:37.0569 6096 NIS - ok
10:00:37.0585 6096 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\windows\System32\nlasvc.dll
10:00:37.0647 6096 NlaSvc - ok
10:00:37.0710 6096 Norton PC Checkup Application Launcher - ok
10:00:37.0710 6096 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\windows\system32\drivers\Npfs.sys
10:00:37.0772 6096 Npfs - ok
10:00:37.0788 6096 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\windows\system32\nsisvc.dll
10:00:37.0881 6096 nsi - ok
10:00:37.0897 6096 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\windows\system32\drivers\nsiproxy.sys
10:00:37.0959 6096 nsiproxy - ok
10:00:38.0037 6096 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\windows\system32\drivers\Ntfs.sys
10:00:38.0100 6096 Ntfs - ok
10:00:38.0115 6096 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\windows\system32\drivers\Null.sys
10:00:38.0162 6096 Null - ok
10:00:38.0178 6096 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\windows\system32\drivers\nvraid.sys
10:00:38.0193 6096 nvraid - ok
10:00:38.0209 6096 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\windows\system32\drivers\nvstor.sys
10:00:38.0224 6096 nvstor - ok
10:00:38.0240 6096 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\windows\system32\drivers\nv_agp.sys
10:00:38.0256 6096 nv_agp - ok
10:00:38.0287 6096 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\windows\system32\drivers\ohci1394.sys
10:00:38.0318 6096 ohci1394 - ok
10:00:38.0380 6096 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
10:00:38.0412 6096 ose - ok
10:00:38.0599 6096 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
10:00:38.0833 6096 osppsvc - ok
10:00:38.0880 6096 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\windows\system32\pnrpsvc.dll
10:00:38.0973 6096 p2pimsvc - ok
10:00:39.0020 6096 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\windows\system32\p2psvc.dll
10:00:39.0051 6096 p2psvc - ok
10:00:39.0082 6096 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\windows\system32\drivers\parport.sys
10:00:39.0098 6096 Parport - ok
10:00:39.0114 6096 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\windows\system32\drivers\partmgr.sys
10:00:39.0129 6096 partmgr - ok
10:00:39.0160 6096 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\windows\System32\pcasvc.dll
10:00:39.0223 6096 PcaSvc - ok
10:00:39.0348 6096 [ 2F86BE1818C2D7AC90478E3323EE7FCB ] PCCUJobMgr C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
10:00:39.0363 6096 PCCUJobMgr - ok
10:00:39.0410 6096 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\windows\system32\drivers\pci.sys
10:00:39.0472 6096 pci - ok
10:00:39.0504 6096 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\windows\system32\DRIVERS\pciide.sys
10:00:39.0519 6096 pciide - ok
10:00:39.0550 6096 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\windows\system32\drivers\pcmcia.sys
10:00:39.0566 6096 pcmcia - ok
10:00:39.0628 6096 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\windows\system32\drivers\pcw.sys
10:00:39.0644 6096 pcw - ok
10:00:39.0706 6096 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\windows\system32\drivers\peauth.sys
10:00:39.0769 6096 PEAUTH - ok
10:00:40.0034 6096 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\windows\SysWow64\perfhost.exe
10:00:40.0096 6096 PerfHost - ok
10:00:40.0159 6096 [ 91111CEBBDE8015E822C46120ED9537C ] PGEffect C:\windows\system32\DRIVERS\pgeffect.sys
10:00:40.0190 6096 PGEffect - ok
10:00:40.0237 6096 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\windows\system32\pla.dll
10:00:40.0408 6096 pla - ok
10:00:40.0486 6096 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\windows\system32\umpnpmgr.dll
10:00:40.0564 6096 PlugPlay - ok
10:00:40.0596 6096 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\windows\system32\pnrpauto.dll
10:00:40.0642 6096 PNRPAutoReg - ok
10:00:40.0674 6096 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\windows\system32\pnrpsvc.dll
10:00:40.0705 6096 PNRPsvc - ok
10:00:40.0736 6096 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\windows\System32\ipsecsvc.dll
10:00:40.0830 6096 PolicyAgent - ok
10:00:40.0861 6096 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\windows\system32\umpo.dll
10:00:40.0923 6096 Power - ok
10:00:41.0001 6096 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\windows\system32\DRIVERS\raspptp.sys
10:00:41.0079 6096 PptpMiniport - ok
10:00:41.0095 6096 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\windows\system32\drivers\processr.sys
10:00:41.0157 6096 Processor - ok
10:00:41.0220 6096 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\windows\system32\profsvc.dll
10:00:41.0298 6096 ProfSvc - ok
10:00:41.0313 6096 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\windows\system32\lsass.exe
10:00:41.0329 6096 ProtectedStorage - ok
10:00:41.0360 6096 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\windows\system32\DRIVERS\pacer.sys
10:00:41.0438 6096 Psched - ok
10:00:41.0516 6096 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\windows\system32\drivers\ql2300.sys
10:00:41.0578 6096 ql2300 - ok
10:00:41.0594 6096 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\windows\system32\drivers\ql40xx.sys
10:00:41.0594 6096 ql40xx - ok
10:00:41.0625 6096 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\windows\system32\qwave.dll
10:00:41.0672 6096 QWAVE - ok
10:00:41.0672 6096 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\windows\system32\drivers\qwavedrv.sys
10:00:41.0719 6096 QWAVEdrv - ok
10:00:41.0750 6096 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\windows\system32\DRIVERS\rasacd.sys
10:00:41.0844 6096 RasAcd - ok
10:00:41.0875 6096 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\windows\system32\DRIVERS\AgileVpn.sys
10:00:41.0922 6096 RasAgileVpn - ok
10:00:41.0937 6096 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\windows\System32\rasauto.dll
10:00:42.0015 6096 RasAuto - ok
10:00:42.0046 6096 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\windows\system32\DRIVERS\rasl2tp.sys
10:00:42.0124 6096 Rasl2tp - ok
10:00:42.0171 6096 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\windows\System32\rasmans.dll
10:00:42.0234 6096 RasMan - ok
10:00:42.0265 6096 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\windows\system32\DRIVERS\raspppoe.sys
10:00:42.0343 6096 RasPppoe - ok
10:00:42.0374 6096 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\windows\system32\DRIVERS\rassstp.sys
10:00:42.0468 6096 RasSstp - ok
10:00:42.0499 6096 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\windows\system32\DRIVERS\rdbss.sys
10:00:42.0561 6096 rdbss - ok
10:00:42.0592 6096 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\windows\system32\drivers\rdpbus.sys
10:00:42.0608 6096 rdpbus - ok
10:00:42.0639 6096 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\windows\system32\DRIVERS\RDPCDD.sys
10:00:42.0717 6096 RDPCDD - ok
10:00:42.0748 6096 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\windows\system32\drivers\rdpencdd.sys
10:00:42.0826 6096 RDPENCDD - ok
10:00:42.0858 6096 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\windows\system32\drivers\rdprefmp.sys
10:00:42.0904 6096 RDPREFMP - ok
10:00:42.0951 6096 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\windows\system32\drivers\RDPWD.sys
10:00:42.0998 6096 RDPWD - ok
10:00:43.0045 6096 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\windows\system32\drivers\rdyboost.sys
10:00:43.0060 6096 rdyboost - ok
10:00:43.0092 6096 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\windows\System32\mprdim.dll
10:00:43.0154 6096 RemoteAccess - ok
10:00:43.0201 6096 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\windows\system32\regsvc.dll
10:00:43.0279 6096 RemoteRegistry - ok
10:00:43.0388 6096 [ FBA61BB4C484A01A655AFB18FF86C417 ] RichVideo64 C:\Program Files\CyberLink\Shared files\RichVideo64.exe
10:00:43.0419 6096 RichVideo64 - ok
10:00:43.0466 6096 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\windows\System32\RpcEpMap.dll
10:00:43.0544 6096 RpcEptMapper - ok
10:00:43.0575 6096 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\windows\system32\locator.exe
10:00:43.0591 6096 RpcLocator - ok
10:00:43.0606 6096 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\windows\system32\rpcss.dll
10:00:43.0653 6096 RpcSs - ok
10:00:43.0684 6096 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\windows\system32\DRIVERS\rspndr.sys
10:00:43.0778 6096 rspndr - ok
10:00:43.0856 6096 [ BE29B0A3AC1E8BD02FFAB8CEE86BADFA ] RSUSBSTOR C:\windows\system32\Drivers\RtsUStor.sys
10:00:43.0887 6096 RSUSBSTOR - ok
10:00:43.0934 6096 [ 6D3C7E7D82D3DC92DC2A8B0DF9F20F8A ] RTL8167 C:\windows\system32\DRIVERS\Rt64win7.sys
10:00:43.0950 6096 RTL8167 - ok
10:00:44.0107 6096 [ E7D79600575F755614DD5D79B044D588 ] RTL8192Ce C:\windows\system32\DRIVERS\rtl8192Ce.sys
10:00:44.0138 6096 RTL8192Ce - ok
10:00:44.0153 6096 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\windows\system32\lsass.exe
10:00:44.0153 6096 SamSs - ok
10:00:44.0216 6096 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\windows\system32\drivers\sbp2port.sys
10:00:44.0263 6096 sbp2port - ok
10:00:44.0294 6096 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\windows\System32\SCardSvr.dll
10:00:44.0325 6096 SCardSvr - ok
10:00:44.0356 6096 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\windows\system32\DRIVERS\scfilter.sys
10:00:44.0465 6096 scfilter - ok
10:00:44.0559 6096 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\windows\system32\schedsvc.dll
10:00:44.0684 6096 Schedule - ok
10:00:44.0762 6096 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\windows\System32\certprop.dll
10:00:44.0809 6096 SCPolicySvc - ok
10:00:44.0871 6096 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\windows\System32\SDRSVC.dll
10:00:45.0011 6096 SDRSVC - ok
10:00:45.0074 6096 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\windows\system32\drivers\secdrv.sys
10:00:45.0167 6096 secdrv - ok
10:00:45.0214 6096 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\windows\system32\seclogon.dll
10:00:45.0277 6096 seclogon - ok
10:00:45.0292 6096 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\windows\System32\sens.dll
10:00:45.0339 6096 SENS - ok
10:00:45.0370 6096 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\windows\system32\sensrsvc.dll
10:00:45.0433 6096 SensrSvc - ok
10:00:45.0448 6096 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\windows\system32\drivers\serenum.sys
10:00:45.0495 6096 Serenum - ok
10:00:45.0542 6096 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\windows\system32\drivers\serial.sys
10:00:45.0573 6096 Serial - ok
10:00:45.0635 6096 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\windows\system32\drivers\sermouse.sys
10:00:45.0713 6096 sermouse - ok
10:00:45.0776 6096 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\windows\system32\sessenv.dll
10:00:45.0885 6096 SessionEnv - ok
10:00:45.0901 6096 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\windows\system32\drivers\sffdisk.sys
10:00:45.0916 6096 sffdisk - ok
10:00:45.0932 6096 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\windows\system32\drivers\sffp_mmc.sys
10:00:45.0994 6096 sffp_mmc - ok
10:00:45.0994 6096 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\windows\system32\drivers\sffp_sd.sys
10:00:46.0025 6096 sffp_sd - ok
10:00:46.0041 6096 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\windows\system32\drivers\sfloppy.sys
10:00:46.0119 6096 sfloppy - ok
10:00:46.0181 6096 [ C6CC9297BD53E5229653303E556AA539 ] Sftfs C:\windows\system32\DRIVERS\Sftfslh.sys
10:00:46.0228 6096 Sftfs - ok
10:00:46.0322 6096 [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
10:00:46.0353 6096 sftlist - ok
10:00:46.0400 6096 [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay C:\windows\system32\DRIVERS\Sftplaylh.sys
10:00:46.0431 6096 Sftplay - ok
10:00:46.0509 6096 [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir C:\windows\system32\DRIVERS\Sftredirlh.sys
10:00:46.0540 6096 Sftredir - ok
10:00:46.0634 6096 [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol C:\windows\system32\DRIVERS\Sftvollh.sys
10:00:46.0649 6096 Sftvol - ok
10:00:46.0696 6096 [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
10:00:46.0743 6096 sftvsa - ok
10:00:46.0790 6096 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\windows\System32\ipnathlp.dll
10:00:46.0852 6096 SharedAccess - ok
10:00:46.0899 6096 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\windows\System32\shsvcs.dll
10:00:46.0993 6096 ShellHWDetection - ok
10:00:47.0055 6096 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\windows\system32\drivers\SiSRaid2.sys
10:00:47.0086 6096 SiSRaid2 - ok
10:00:47.0133 6096 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\windows\system32\drivers\sisraid4.sys
10:00:47.0164 6096 SiSRaid4 - ok
10:00:47.0227 6096 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\windows\system32\DRIVERS\smb.sys
10:00:47.0367 6096 Smb - ok
10:00:47.0461 6096 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\windows\System32\snmptrap.exe
10:00:47.0570 6096 SNMPTRAP - ok
10:00:47.0632 6096 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\windows\system32\drivers\spldr.sys
10:00:47.0648 6096 spldr - ok
10:00:47.0819 6096 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\windows\System32\spoolsv.exe
10:00:47.0866 6096 Spooler - ok
10:00:48.0116 6096 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\windows\system32\sppsvc.exe
10:00:48.0381 6096 sppsvc - ok
10:00:48.0428 6096 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\windows\system32\sppuinotify.dll
10:00:48.0490 6096 sppuinotify - ok
10:00:48.0818 6096 [ 891793E00432FA055CF040605C260E49 ] SRTSP C:\windows\System32\Drivers\NISx64\1309010.00E\SRTSP64.SYS
10:00:48.0849 6096 SRTSP - ok
10:00:49.0005 6096 [ 1CB7BB3B0561FB5ECFE37F7731E8BF3E ] SRTSPX C:\windows\system32\drivers\NISx64\1309010.00E\SRTSPX64.SYS
10:00:49.0021 6096 SRTSPX - ok
10:00:49.0099 6096 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\windows\system32\DRIVERS\srv.sys
10:00:49.0192 6096 srv - ok
10:00:49.0239 6096 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\windows\system32\DRIVERS\srv2.sys
10:00:49.0333 6096 srv2 - ok
10:00:49.0379 6096 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\windows\system32\DRIVERS\srvnet.sys
10:00:49.0411 6096 srvnet - ok
10:00:49.0457 6096 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\windows\System32\ssdpsrv.dll
10:00:49.0598 6096 SSDPSRV - ok
10:00:49.0629 6096 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\windows\system32\sstpsvc.dll
10:00:49.0676 6096 SstpSvc - ok
10:00:49.0707 6096 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\windows\system32\drivers\stexstor.sys
10:00:49.0723 6096 stexstor - ok
10:00:49.0801 6096 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\windows\System32\wiaservc.dll
10:00:49.0879 6096 stisvc - ok
10:00:49.0910 6096 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\windows\system32\DRIVERS\swenum.sys
10:00:49.0925 6096 swenum - ok
10:00:49.0988 6096 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\windows\System32\swprv.dll
10:00:50.0081 6096 swprv - ok
10:00:50.0191 6096 [ 8B2430762099598DA40686F754632EFD ] SymDS C:\windows\system32\drivers\NISx64\1309010.00E\SYMDS64.SYS
10:00:50.0222 6096 SymDS - ok
10:00:50.0315 6096 [ 5CB7F2FD7E30A0F52F93574BFC3A8041 ] SymEFA C:\windows\system32\drivers\NISx64\1309010.00E\SYMEFA64.SYS
10:00:50.0409 6096 SymEFA - ok
10:00:50.0440 6096 [ 894579207E39C465737E850A252CE4F2 ] SymEvent C:\windows\system32\Drivers\SYMEVENT64x86.SYS
10:00:50.0456 6096 SymEvent - ok
10:00:50.0503 6096 [ 5013A76CAAA1D7CF1C55214B490B4E35 ] SymIRON C:\windows\system32\drivers\NISx64\1309010.00E\Ironx64.SYS
10:00:50.0503 6096 SymIRON - ok
10:00:50.0534 6096 [ 3911BD0E68C010E5438A87706ABBE9AB ] SymNetS C:\windows\System32\Drivers\NISx64\1309010.00E\SYMNETS.SYS
10:00:50.0534 6096 SymNetS - ok
10:00:50.0627 6096 [ F5B46DF59FEAA48A442AED7EEB754D4B ] SynTP C:\windows\system32\DRIVERS\SynTP.sys
10:00:50.0659 6096 SynTP - ok
10:00:50.0752 6096 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\windows\system32\sysmain.dll
10:00:50.0893 6096 SysMain - ok
10:00:50.0939 6096 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\windows\System32\TabSvc.dll
10:00:50.0971 6096 TabletInputService - ok
10:00:51.0002 6096 [ 3B73C849B41FB20D77B0E553214061A5 ] tap0901 C:\windows\system32\DRIVERS\tap0901.sys
10:00:51.0080 6096 tap0901 - ok
10:00:51.0158 6096 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\windows\System32\tapisrv.dll
10:00:51.0267 6096 TapiSrv - ok
10:00:51.0298 6096 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\windows\System32\tbssvc.dll
10:00:51.0345 6096 TBS - ok
10:00:51.0548 6096 [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip C:\windows\system32\drivers\tcpip.sys
10:00:51.0595 6096 Tcpip - ok
10:00:51.0688 6096 [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6 C:\windows\system32\DRIVERS\tcpip.sys
10:00:51.0751 6096 TCPIP6 - ok
10:00:51.0829 6096 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\windows\system32\drivers\tcpipreg.sys
10:00:51.0891 6096 tcpipreg - ok
10:00:51.0938 6096 [ FD542B661BD22FA69CA789AD0AC58C29 ] tdcmdpst C:\windows\system32\DRIVERS\tdcmdpst.sys
10:00:51.0938 6096 tdcmdpst - ok
10:00:52.0031 6096 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\windows\system32\drivers\tdpipe.sys
10:00:52.0343 6096 TDPIPE - ok
10:00:52.0437 6096 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\windows\system32\drivers\tdtcp.sys
10:00:52.0515 6096 TDTCP - ok
10:00:52.0593 6096 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\windows\system32\DRIVERS\tdx.sys
10:00:52.0640 6096 tdx - ok
10:00:52.0655 6096 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\windows\system32\DRIVERS\termdd.sys
10:00:52.0671 6096 TermDD - ok
10:00:52.0702 6096 [ 2E648163254233755035B46DD7B89123 ] TermService C:\windows\System32\termsrv.dll
10:00:52.0811 6096 TermService - ok
10:00:52.0827 6096 [ F0344071948D1A1FA732231785A0664C ] Themes C:\windows\system32\themeservice.dll
10:00:52.0843 6096 Themes - ok
10:00:52.0889 6096 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\windows\system32\mmcss.dll
10:00:52.0936 6096 THREADORDER - ok
10:00:52.0983 6096 [ 71C321649B28638EE80A2EEB164C1DC8 ] TMachInfo C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
10:00:53.0014 6096 TMachInfo - ok
10:00:53.0045 6096 [ 8E2C799D3476EAC32C3BA0DF7CE6AF19 ] TODDSrv C:\windows\system32\TODDSrv.exe
10:00:53.0077 6096 TODDSrv - ok
10:00:53.0170 6096 [ 1C73689B900428C7D054A41C4687F55C ] TosCoSrv C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
10:00:53.0217 6096 TosCoSrv - ok
10:00:53.0295 6096 [ 29D0886CF250FCEF1BF9E65AB8D2C0C8 ] TOSHIBA HDD SSD Alert Service C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
10:00:53.0326 6096 TOSHIBA HDD SSD Alert Service - ok
10:00:53.0373 6096 [ 09FF7B0B1B5C3D225495CB6F5A9B39F8 ] tos_sps64 C:\windows\system32\DRIVERS\tos_sps64.sys
10:00:53.0420 6096 tos_sps64 - ok
10:00:53.0498 6096 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\windows\System32\trkwks.dll
10:00:53.0576 6096 TrkWks - ok
10:00:53.0654 6096 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe
10:00:53.0732 6096 TrustedInstaller - ok
10:00:53.0763 6096 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\windows\system32\DRIVERS\tssecsrv.sys
10:00:53.0935 6096 tssecsrv - ok
10:00:53.0997 6096 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\windows\system32\drivers\tsusbflt.sys
10:00:54.0075 6096 TsUsbFlt - ok
10:00:54.0091 6096 [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD C:\windows\system32\drivers\TsUsbGD.sys
10:00:54.0137 6096 TsUsbGD - ok
10:00:54.0200 6096 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\windows\system32\DRIVERS\tunnel.sys
10:00:54.0309 6096 tunnel - ok
10:00:54.0356 6096 [ 550B567F9364D8F7684C3FB3EA665A72 ] TVALZ C:\windows\system32\DRIVERS\TVALZ_O.SYS
10:00:54.0371 6096 TVALZ - ok
10:00:54.0418 6096 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\windows\system32\drivers\uagp35.sys
10:00:54.0434 6096 uagp35 - ok
10:00:54.0496 6096 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\windows\system32\DRIVERS\udfs.sys
10:00:54.0574 6096 udfs - ok
10:00:54.0605 6096 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\windows\system32\UI0Detect.exe
10:00:54.0621 6096 UI0Detect - ok
10:00:54.0652 6096 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\windows\system32\drivers\uliagpkx.sys
10:00:54.0668 6096 uliagpkx - ok
10:00:54.0715 6096 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\windows\system32\DRIVERS\umbus.sys
10:00:54.0808 6096 umbus - ok
10:00:54.0839 6096 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\windows\system32\drivers\umpass.sys
10:00:54.0902 6096 UmPass - ok
10:00:55.0261 6096 [ 2C16648A12999AE69A9EBF41974B0BA2 ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
10:00:55.0463 6096 UNS - ok
10:00:55.0526 6096 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\windows\System32\upnphost.dll
10:00:55.0666 6096 upnphost - ok
10:00:55.0729 6096 [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64 C:\windows\system32\Drivers\usbaapl64.sys
10:00:55.0822 6096 USBAAPL64 - ok
10:00:55.0853 6096 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\windows\system32\DRIVERS\usbccgp.sys
10:00:55.0916 6096 usbccgp - ok
10:00:55.0931 6096 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\windows\system32\drivers\usbcir.sys
10:00:55.0978 6096 usbcir - ok
10:00:56.0025 6096 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\windows\system32\DRIVERS\usbehci.sys
10:00:56.0087 6096 usbehci - ok
10:00:56.0165 6096 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\windows\system32\DRIVERS\usbhub.sys
10:00:56.0243 6096 usbhub - ok
10:00:56.0275 6096 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\windows\system32\drivers\usbohci.sys
10:00:56.0337 6096 usbohci - ok
10:00:56.0368 6096 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\windows\system32\drivers\usbprint.sys
10:00:56.0462 6096 usbprint - ok
10:00:56.0477 6096 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\windows\system32\DRIVERS\USBSTOR.SYS
10:00:56.0602 6096 USBSTOR - ok
10:00:56.0633 6096 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\windows\system32\drivers\usbuhci.sys
10:00:56.0696 6096 usbuhci - ok
10:00:56.0743 6096 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\windows\system32\Drivers\usbvideo.sys
10:00:56.0774 6096 usbvideo - ok
10:00:56.0821 6096 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\windows\System32\uxsms.dll
10:00:56.0914 6096 UxSms - ok
10:00:56.0945 6096 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\windows\system32\lsass.exe
10:00:56.0961 6096 VaultSvc - ok
10:00:57.0008 6096 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\windows\system32\drivers\vdrvroot.sys
10:00:57.0008 6096 vdrvroot - ok
10:00:57.0070 6096 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\windows\System32\vds.exe
10:00:57.0195 6096 vds - ok
10:00:57.0242 6096 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\windows\system32\DRIVERS\vgapnp.sys
10:00:57.0289 6096 vga - ok
10:00:57.0304 6096 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\windows\System32\drivers\vga.sys
10:00:57.0413 6096 VgaSave - ok
10:00:57.0445 6096 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\windows\system32\drivers\vhdmp.sys
10:00:57.0460 6096 vhdmp - ok
10:00:57.0491 6096 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\windows\system32\drivers\viaide.sys
10:00:57.0507 6096 viaide - ok
10:00:57.0538 6096 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\windows\system32\drivers\volmgr.sys
10:00:57.0569 6096 volmgr - ok
10:00:57.0601 6096 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\windows\system32\drivers\volmgrx.sys
10:00:57.0632 6096 volmgrx - ok
10:00:57.0647 6096 [ DF8126BD41180351A093A3AD2FC8903B ] volsnap C:\windows\system32\drivers\volsnap.sys
10:00:57.0710 6096 volsnap - ok
10:00:57.0772 6096 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\windows\system32\drivers\vsmraid.sys
10:00:57.0819 6096 vsmraid - ok
10:00:57.0975 6096 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\windows\system32\vssvc.exe
10:00:58.0240 6096 VSS - ok
10:00:58.0271 6096 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\windows\system32\DRIVERS\vwifibus.sys
10:00:58.0334 6096 vwifibus - ok
10:00:58.0443 6096 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\windows\system32\DRIVERS\vwififlt.sys
10:00:58.0521 6096 vwififlt - ok
10:00:58.0646 6096 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\windows\system32\w32time.dll
10:00:58.0708 6096 W32Time - ok
10:00:58.0755 6096 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\windows\system32\drivers\wacompen.sys
10:00:58.0833 6096 WacomPen - ok
10:00:58.0895 6096 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\windows\system32\DRIVERS\wanarp.sys
10:00:59.0067 6096 WANARP - ok
10:00:59.0239 6096 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\windows\system32\DRIVERS\wanarp.sys
10:00:59.0301 6096 Wanarpv6 - ok
10:00:59.0566 6096 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\windows\system32\Wat\WatAdminSvc.exe
10:00:59.0613 6096 WatAdminSvc - ok
10:00:59.0738 6096 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\windows\system32\wbengine.exe
10:00:59.0956 6096 wbengine - ok
10:01:00.0050 6096 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\windows\System32\wbiosrvc.dll
10:01:00.0112 6096 WbioSrvc - ok
10:01:00.0253 6096 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\windows\System32\wcncsvc.dll
10:01:00.0393 6096 wcncsvc - ok
10:01:00.0440 6096 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll
10:01:00.0502 6096 WcsPlugInService - ok
10:01:00.0565 6096 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\windows\system32\drivers\wd.sys
10:01:00.0611 6096 Wd - ok
10:01:00.0767 6096 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\windows\system32\drivers\Wdf01000.sys
10:01:00.0814 6096 Wdf01000 - ok
10:01:00.0861 6096 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\windows\system32\wdi.dll
10:01:01.0438 6096 WdiServiceHost - ok
10:01:01.0503 6096 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\windows\system32\wdi.dll
10:01:01.0538 6096 WdiSystemHost - ok
10:01:01.0617 6096 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\windows\System32\webclnt.dll
10:01:01.0728 6096 WebClient - ok
10:01:01.0763 6096 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\windows\system32\wecsvc.dll
10:01:02.0062 6096 Wecsvc - ok
10:01:02.0121 6096 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\windows\System32\wercplsupport.dll
10:01:02.0161 6096 wercplsupport - ok
10:01:02.0238 6096 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\windows\System32\WerSvc.dll
10:01:02.0284 6096 WerSvc - ok
10:01:02.0394 6096 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\windows\system32\DRIVERS\wfplwf.sys
10:01:02.0456 6096 WfpLwf - ok
10:01:02.0487 6096 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\windows\system32\drivers\wimmount.sys
10:01:02.0503 6096 WIMMount - ok
10:01:02.0565 6096 WinDefend - ok
10:01:02.0565 6096 WinHttpAutoProxySvc - ok
10:01:02.0768 6096 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\windows\system32\wbem\WMIsvc.dll
10:01:02.0830 6096 Winmgmt - ok
10:01:02.0986 6096 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\windows\system32\WsmSvc.dll
10:01:03.0174 6096 WinRM - ok
10:01:03.0361 6096 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\windows\System32\wlansvc.dll
10:01:03.0486 6096 Wlansvc - ok
10:01:03.0844 6096 [ 357CABBF155AFD1D3926E62539D2A3A7 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
10:01:04.0000 6096 wlidsvc - ok
10:01:04.0094 6096 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\windows\system32\DRIVERS\wmiacpi.sys
10:01:04.0188 6096 WmiAcpi - ok
10:01:04.0281 6096 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\windows\system32\wbem\WmiApSrv.exe
10:01:04.0344 6096 wmiApSrv - ok
10:01:04.0406 6096 WMPNetworkSvc - ok
10:01:04.0484 6096 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\windows\System32\wpcsvc.dll
10:01:04.0562 6096 WPCSvc - ok
10:01:04.0593 6096 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\windows\system32\wpdbusenum.dll
10:01:04.0640 6096 WPDBusEnum - ok
10:01:04.0718 6096 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\windows\system32\drivers\ws2ifsl.sys
10:01:04.0780 6096 ws2ifsl - ok
10:01:04.0827 6096 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\windows\System32\wscsvc.dll
10:01:04.0921 6096 wscsvc - ok
10:01:04.0936 6096 WSearch - ok
10:01:05.0217 6096 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\windows\system32\wuaueng.dll
10:01:05.0373 6096 wuauserv - ok
10:01:05.0404 6096 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\windows\system32\drivers\WudfPf.sys
10:01:05.0545 6096 WudfPf - ok
10:01:05.0623 6096 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\windows\system32\DRIVERS\WUDFRd.sys
10:01:05.0748 6096 WUDFRd - ok
10:01:05.0826 6096 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\windows\System32\WUDFSvc.dll
10:01:05.0888 6096 wudfsvc - ok
10:01:05.0950 6096 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\windows\System32\wwansvc.dll
10:01:06.0044 6096 WwanSvc - ok
10:01:06.0106 6096 ================ Scan global ===============================
10:01:06.0169 6096 [ BA0CD8C393E8C9F83354106093832C7B ] C:\windows\system32\basesrv.dll
10:01:06.0325 6096 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\windows\system32\winsrv.dll
10:01:06.0372 6096 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\windows\system32\winsrv.dll
10:01:06.0434 6096 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\windows\system32\sxssrv.dll
10:01:06.0577 6096 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\windows\system32\services.exe
10:01:06.0606 6096 [Global] - ok
10:01:06.0606 6096 ================ Scan MBR ==================================
10:01:06.0656 6096 [ 849E52748AAB5959BC8000CB4974BC13 ] \Device\Harddisk0\DR0
10:01:06.0656 6096 Suspicious mbr (Forged): \Device\Harddisk0\DR0
10:01:06.0736 6096 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected
10:01:06.0736 6096 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)
10:01:07.0017 6096 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
10:01:07.0017 6096 \Device\Harddisk0\DR0 - detected TDSS File System (1)
10:01:07.0490 6096 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
10:01:07.0762 6096 \Device\Harddisk1\DR1 - ok
10:01:07.0765 6096 ================ Scan VBR ==================================
10:01:07.0839 6096 [ 9CA4803AA10E7B14FD929B8082DF0620 ] \Device\Harddisk0\DR0\Partition1
10:01:07.0871 6096 \Device\Harddisk0\DR0\Partition1 - ok
10:01:07.0886 6096 [ 1893FDA9EFAD0EBF6166572C9F2F7426 ] \Device\Harddisk1\DR1\Partition1
10:01:07.0886 6096 \Device\Harddisk1\DR1\Partition1 - ok
10:01:07.0886 6096 ============================================================
10:01:07.0886 6096 Scan finished
10:01:07.0886 6096 ============================================================
10:01:07.0917 6108 Detected object count: 2
10:01:07.0917 6108 Actual detected object count: 2
10:02:49.0615 6108 \Device\Harddisk0\DR0\# - copied to quarantine
10:02:49.0647 6108 \Device\Harddisk0\DR0 - copied to quarantine
10:02:49.0740 6108 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine
10:02:49.0740 6108 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine
10:02:49.0740 6108 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine
10:02:49.0756 6108 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine
10:02:49.0771 6108 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine
10:02:49.0771 6108 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine
10:02:49.0787 6108 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine
10:02:49.0787 6108 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine
10:02:49.0787 6108 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine
10:02:49.0787 6108 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine
10:02:49.0787 6108 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine
10:02:49.0787 6108 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine
10:02:49.0787 6108 \Device\Harddisk0\DR0\TDLFS\gqpv - copied to quarantine
10:02:49.0787 6108 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine
10:02:49.0787 6108 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine
10:02:49.0849 6108 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot
10:02:49.0865 6108 \Device\Harddisk0\DR0 - ok
10:02:50.0255 6108 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure 
10:02:50.0255 6108 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
10:02:50.0255 6108 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip 
10:02:55.0699 5604 Deinitialize success


----------



## Mark1956 (May 7, 2011)

That is a nasty Rootkit infection that has been removed. I now need you to run TDSSKiller again and select Delete for this entry:

*\Device\Harddisk0\DR0 ( TDSS File System )*

When done post the new log and then run this scan:

*STEP 1*
*NOTE:* If you have already used Combofix please delete the icon from your desktop.


Please download DeFogger and save it to your desktop.
Once downloaded, double-click on the *DeFogger* icon to start the tool.
The application window will appear.
You should now click on the *Disable* button to disable your CD Emulation drivers.
When it prompts you whether or not you want to continue, please click on the *Yes* button to continue.
When the program has completed you will see a *Finished!* message. Click on the *OK* button to exit the program.
If CD Emulation programs are present and have been disabled, *DeFogger* will now ask you to reboot the machine. Please allow it to do so by clicking on the *OK* button.

*STEP 2*
Please download *ComboFix*







from one of the locations below and *save it to your Desktop. <-Important!!!*


Download Mirror #1
Download Mirror #2

Be sure to print out and follow these instructions: *A guide and tutorial on using ComboFix*

*Vista*/*Windows 7* users can skip the Recovery Console instructions and use the Windows DVD to boot into the Vista Recovery Environment or Windows 7 System Recovery Options if something goes awry. If you do not have a Windows 7 DVD then please create a Windows 7 Repair Disc. *XP* users need to install the Recovery Console first.


Temporarily *disable* your *anti-virus*, script blocking and any *anti-malware* real-time protection _*before*_ performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause _"unpredictable results"_. Click this link to see a list of such programs and how to disable them.
If ComboFix detects an older version of itself, you will be asked to update the program.
ComboFix will begin by showing a Disclaimer. Read it and click *I Agree* if you want to continue.
Follow the prompts and click on *Yes* to continue scanning for malware.
If using Windows 7 or Vista and you receive a UAC prompt asking if you want to continue running the program, you should press the *Continue* button.
When finished, please copy and paste the contents of C:\*ComboFix.txt* (_which will open after reboot_) in your next reply.
Be sure to *re-enable* your anti-virus and other security programs.

_-- Do not touch your mouse/keyboard until the ComboFix scan has completed, as this may cause the process to stall or the computer to lock.
-- ComboFix will temporarily disable your desktop, and if interrupted may leave it disabled. If this occurs, please reboot to restore it.
-- ComboFix disables autorun of all CD, floppy and USB devices to assist with malware removal and increase security._

If you no longer have access to your Internet connection after running ComboFix, please reboot to restore it. If that does not restore the connection, then follow the instructions for Manually restoring the Internet connection provided in the "_How to Guide_" you printed out earlier. Those instructions only apply to XP, for Vista and Windows 7 go here: Internet connection repair

*NOTE:* if you see a message like this when you attempt to open anything after the reboot *"Illegal Operation attempted on a registry key that has been marked for deletion"* please reboot the system again and the warning should not return.



> *Do NOT use ComboFix* unless you have been instructed to do so by a Malware Removal Expert. It is a powerful tool intended by its creator to be used under the guidance and supervision of an expert, *NOT for general public or personal use*. *Using this tool incorrectly could lead to serious problems with your operating system such as preventing it from ever starting again.* This site, sUBs and myself *will not* be responsible for any damage caused to your machine by misusing or running ComboFix on your own. Please read *ComboFix's Disclaimer*.


----------



## shadowandmike (Apr 9, 2013)

I ran both scans. I have attached The TDSSKiller log first, then the ComboFix log.

18:26:13.0696 6948 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
18:26:15.0348 6948 ============================================================
18:26:15.0348 6948 Current date / time: 2013/04/17 18:26:15.0348
18:26:15.0348 6948 SystemInfo:
18:26:15.0348 6948 
18:26:15.0348 6948 OS Version: 6.1.7601 ServicePack: 1.0
18:26:15.0348 6948 Product type: Workstation
18:26:15.0348 6948 ComputerName: MIKE-PC
18:26:15.0348 6948 UserName: Mike
18:26:15.0348 6948 Windows directory: C:\windows
18:26:15.0348 6948 System windows directory: C:\windows
18:26:15.0348 6948 Running under WOW64
18:26:15.0348 6948 Processor architecture: Intel x64
18:26:15.0348 6948 Number of processors: 2
18:26:15.0348 6948 Page size: 0x1000
18:26:15.0348 6948 Boot type: Normal boot
18:26:15.0348 6948 ============================================================
18:26:16.0078 6948 BG loaded
18:26:16.0518 6948 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
18:26:16.0528 6948 Drive \Device\Harddisk1\DR2 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
18:26:24.0200 6948 ============================================================
18:26:24.0200 6948 \Device\Harddisk0\DR0:
18:26:24.0220 6948 MBR partitions:
18:26:24.0220 6948 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2EE800, BlocksNum 0x2346D000
18:26:24.0220 6948 \Device\Harddisk1\DR2:
18:26:24.0220 6948 MBR partitions:
18:26:24.0220 6948 \Device\Harddisk1\DR2\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74705982
18:26:24.0220 6948 ============================================================
18:26:24.0270 6948 C: <-> \Device\Harddisk0\DR0\Partition1
18:26:24.0300 6948 F: <-> \Device\Harddisk1\DR2\Partition1
18:26:24.0300 6948 ============================================================
18:26:24.0300 6948 Initialize success
18:26:24.0300 6948 ============================================================
18:27:51.0927 4656 ============================================================
18:27:51.0927 4656 Scan started
18:27:51.0927 4656 Mode: Manual; SigCheck; TDLFS; 
18:27:51.0927 4656 ============================================================
18:27:53.0269 4656 ================ Scan system memory ========================
18:27:53.0269 4656 System memory - ok
18:27:53.0269 4656 ================ Scan services =============================
18:27:53.0440 4656 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\windows\system32\drivers\1394ohci.sys
18:27:53.0643 4656 1394ohci - ok
18:27:53.0705 4656 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\windows\system32\drivers\ACPI.sys
18:27:53.0737 4656 ACPI - ok
18:27:53.0752 4656 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\windows\system32\drivers\acpipmi.sys
18:27:53.0846 4656 AcpiPmi - ok
18:27:54.0033 4656 [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
18:27:54.0064 4656 AdobeARMservice - ok
18:27:54.0220 4656 [ EA856F4A46320389D1899B2CAA7BF40F ] AdobeFlashPlayerUpdateSvc C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
18:27:54.0251 4656 AdobeFlashPlayerUpdateSvc - ok
18:27:54.0298 4656 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\windows\system32\drivers\adp94xx.sys
18:27:54.0329 4656 adp94xx - ok
18:27:54.0361 4656 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\windows\system32\drivers\adpahci.sys
18:27:54.0376 4656 adpahci - ok
18:27:54.0423 4656 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\windows\system32\drivers\adpu320.sys
18:27:54.0439 4656 adpu320 - ok
18:27:54.0470 4656 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\windows\System32\aelupsvc.dll
18:27:54.0782 4656 AeLookupSvc - ok
18:27:54.0844 4656 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\windows\system32\drivers\afd.sys
18:27:55.0031 4656 AFD - ok
18:27:55.0109 4656 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\windows\system32\drivers\agp440.sys
18:27:55.0156 4656 agp440 - ok
18:27:55.0203 4656 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\windows\System32\alg.exe
18:27:55.0312 4656 ALG - ok
18:27:55.0421 4656 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\windows\system32\drivers\aliide.sys
18:27:55.0453 4656 aliide - ok
18:27:55.0484 4656 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\windows\system32\drivers\amdide.sys
18:27:55.0531 4656 amdide - ok
18:27:55.0562 4656 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\windows\system32\drivers\amdk8.sys
18:27:55.0609 4656 AmdK8 - ok
18:27:55.0640 4656 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\windows\system32\drivers\amdppm.sys
18:27:55.0687 4656 AmdPPM - ok
18:27:55.0796 4656 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\windows\system32\drivers\amdsata.sys
18:27:55.0843 4656 amdsata - ok
18:27:55.0874 4656 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\windows\system32\drivers\amdsbs.sys
18:27:55.0889 4656 amdsbs - ok
18:27:55.0889 4656 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\windows\system32\drivers\amdxata.sys
18:27:55.0905 4656 amdxata - ok
18:27:55.0936 4656 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\windows\system32\drivers\appid.sys
18:27:56.0217 4656 AppID - ok
18:27:56.0264 4656 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\windows\System32\appidsvc.dll
18:27:56.0357 4656 AppIDSvc - ok
18:27:56.0404 4656 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\windows\System32\appinfo.dll
18:27:56.0467 4656 Appinfo - ok
18:27:56.0560 4656 [ 7EF47644B74EBE721CC32211D3C35E76 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
18:27:56.0576 4656 Apple Mobile Device - ok
18:27:56.0623 4656 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\windows\system32\drivers\arc.sys
18:27:56.0654 4656 arc - ok
18:27:56.0669 4656 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\windows\system32\drivers\arcsas.sys
18:27:56.0716 4656 arcsas - ok
18:27:56.0747 4656 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\windows\system32\DRIVERS\asyncmac.sys
18:27:56.0825 4656 AsyncMac - ok
18:27:56.0857 4656 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\windows\system32\drivers\atapi.sys
18:27:56.0857 4656 atapi - ok
18:27:56.0919 4656 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll
18:27:56.0997 4656 AudioEndpointBuilder - ok
18:27:57.0091 4656 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\windows\System32\Audiosrv.dll
18:27:57.0153 4656 AudioSrv - ok
18:27:57.0184 4656 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\windows\System32\AxInstSV.dll
18:27:57.0309 4656 AxInstSV - ok
18:27:57.0387 4656 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\windows\system32\drivers\bxvbda.sys
18:27:57.0543 4656 b06bdrv - ok
18:27:57.0605 4656 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\windows\system32\DRIVERS\b57nd60a.sys
18:27:57.0730 4656 b57nd60a - ok
18:27:57.0793 4656 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\windows\System32\bdesvc.dll
18:27:57.0980 4656 BDESVC - ok
18:27:58.0027 4656 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\windows\system32\drivers\Beep.sys
18:27:58.0089 4656 Beep - ok
18:27:58.0198 4656 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\windows\System32\bfe.dll
18:27:58.0307 4656 BFE - ok
18:27:58.0495 4656 [ 7B56A40EAAACF1867FF178501D3EA185 ] BHDrvx64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130412.001\BHDrvx64.sys
18:27:58.0541 4656 BHDrvx64 - ok
18:27:58.0588 4656 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\windows\System32\qmgr.dll
18:27:58.0666 4656 BITS - ok
18:27:58.0713 4656 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\windows\system32\DRIVERS\blbdrive.sys
18:27:58.0791 4656 blbdrive - ok
18:27:58.0931 4656 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
18:27:58.0963 4656 Bonjour Service - ok
18:27:59.0009 4656 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\windows\system32\DRIVERS\bowser.sys
18:27:59.0165 4656 bowser - ok
18:27:59.0212 4656 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\windows\system32\drivers\BrFiltLo.sys
18:27:59.0275 4656 BrFiltLo - ok
18:27:59.0306 4656 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\windows\system32\drivers\BrFiltUp.sys
18:27:59.0415 4656 BrFiltUp - ok
18:27:59.0477 4656 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\windows\System32\browser.dll
18:27:59.0571 4656 Browser - ok
18:27:59.0680 4656 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\windows\System32\Drivers\Brserid.sys
18:27:59.0836 4656 Brserid - ok
18:27:59.0914 4656 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\windows\System32\Drivers\BrSerWdm.sys
18:27:59.0992 4656 BrSerWdm - ok
18:28:00.0039 4656 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\windows\System32\Drivers\BrUsbMdm.sys
18:28:00.0101 4656 BrUsbMdm - ok
18:28:00.0148 4656 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\windows\System32\Drivers\BrUsbSer.sys
18:28:00.0211 4656 BrUsbSer - ok
18:28:00.0242 4656 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\windows\system32\drivers\bthmodem.sys
18:28:00.0304 4656 BTHMODEM - ok
18:28:00.0429 4656 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\windows\system32\bthserv.dll
18:28:00.0538 4656 bthserv - ok
18:28:00.0648 4656 [ 2C6FFCCA37B002AAB3C7C31A6D780A76 ] ccSet_NIS C:\windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys
18:28:00.0694 4656 ccSet_NIS - ok
18:28:00.0741 4656 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\windows\system32\DRIVERS\cdfs.sys
18:28:00.0866 4656 cdfs - ok
18:28:00.0913 4656 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\windows\system32\DRIVERS\cdrom.sys
18:28:00.0975 4656 cdrom - ok
18:28:01.0022 4656 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\windows\System32\certprop.dll
18:28:01.0116 4656 CertPropSvc - ok
18:28:01.0162 4656 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\windows\system32\drivers\circlass.sys
18:28:01.0240 4656 circlass - ok
18:28:01.0303 4656 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\windows\system32\CLFS.sys
18:28:01.0334 4656 CLFS - ok
18:28:01.0396 4656 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:28:01.0443 4656 clr_optimization_v2.0.50727_32 - ok
18:28:01.0506 4656 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
18:28:01.0552 4656 clr_optimization_v2.0.50727_64 - ok
18:28:01.0630 4656 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:28:01.0662 4656 clr_optimization_v4.0.30319_32 - ok
18:28:01.0693 4656 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
18:28:01.0708 4656 clr_optimization_v4.0.30319_64 - ok
18:28:01.0724 4656 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\windows\system32\DRIVERS\CmBatt.sys
18:28:01.0771 4656 CmBatt - ok
18:28:01.0802 4656 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\windows\system32\drivers\cmdide.sys
18:28:01.0849 4656 cmdide - ok
18:28:01.0911 4656 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\windows\system32\Drivers\cng.sys
18:28:01.0958 4656 CNG - ok
18:28:02.0005 4656 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\windows\system32\drivers\compbatt.sys
18:28:02.0036 4656 Compbatt - ok
18:28:02.0052 4656 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\windows\system32\DRIVERS\CompositeBus.sys
18:28:02.0130 4656 CompositeBus - ok
18:28:02.0161 4656 COMSysApp - ok
18:28:02.0176 4656 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\windows\system32\drivers\crcdisk.sys
18:28:02.0239 4656 crcdisk - ok
18:28:02.0286 4656 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\windows\system32\cryptsvc.dll
18:28:02.0395 4656 CryptSvc - ok
18:28:02.0504 4656 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
18:28:02.0535 4656 cvhsvc - ok
18:28:02.0598 4656 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\windows\system32\rpcss.dll
18:28:02.0676 4656 DcomLaunch - ok
18:28:02.0738 4656 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\windows\System32\defragsvc.dll
18:28:02.0816 4656 defragsvc - ok
18:28:02.0863 4656 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\windows\system32\Drivers\dfsc.sys
18:28:02.0956 4656 DfsC - ok
18:28:03.0019 4656 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\windows\system32\dhcpcore.dll
18:28:03.0128 4656 Dhcp - ok
18:28:03.0159 4656 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\windows\system32\drivers\discache.sys
18:28:03.0237 4656 discache - ok
18:28:03.0284 4656 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\windows\system32\drivers\disk.sys
18:28:03.0315 4656 Disk - ok
18:28:03.0346 4656 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\windows\System32\dnsrslvr.dll
18:28:03.0456 4656 Dnscache - ok
18:28:03.0502 4656 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\windows\System32\dot3svc.dll
18:28:03.0596 4656 dot3svc - ok
18:28:03.0643 4656 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\windows\system32\dps.dll
18:28:03.0721 4656 DPS - ok
18:28:03.0768 4656 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\windows\system32\drivers\drmkaud.sys
18:28:03.0861 4656 drmkaud - ok
18:28:04.0002 4656 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\windows\System32\drivers\dxgkrnl.sys
18:28:04.0048 4656 DXGKrnl - ok
18:28:04.0080 4656 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\windows\System32\eapsvc.dll
18:28:04.0158 4656 EapHost - ok
18:28:04.0282 4656 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\windows\system32\drivers\evbda.sys
18:28:04.0470 4656 ebdrv - ok
18:28:04.0532 4656 [ 4353FF94D47A0A9D52B89ECCF0CDB013 ] eeCtrl C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
18:28:04.0594 4656 eeCtrl - ok
18:28:04.0626 4656 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\windows\System32\lsass.exe
18:28:04.0704 4656 EFS - ok
18:28:04.0782 4656 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\windows\ehome\ehRecvr.exe
18:28:04.0922 4656 ehRecvr - ok
18:28:04.0953 4656 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\windows\ehome\ehsched.exe
18:28:05.0031 4656 ehSched - ok
18:28:05.0078 4656 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\windows\system32\drivers\elxstor.sys
18:28:05.0140 4656 elxstor - ok
18:28:05.0250 4656 [ C5BCCB378D0A896304A3E71BE7215983 ] EraserUtilDrv11220 C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11220.sys
18:28:05.0265 4656 EraserUtilDrv11220 - ok
18:28:05.0328 4656 [ C5BCCB378D0A896304A3E71BE7215983 ] EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
18:28:05.0359 4656 EraserUtilRebootDrv - ok
18:28:05.0374 4656 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\windows\system32\drivers\errdev.sys
18:28:05.0421 4656 ErrDev - ok
18:28:05.0468 4656 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\windows\system32\es.dll
18:28:05.0577 4656 EventSystem - ok
18:28:05.0608 4656 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\windows\system32\drivers\exfat.sys
18:28:05.0686 4656 exfat - ok
18:28:05.0718 4656 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\windows\system32\drivers\fastfat.sys
18:28:05.0796 4656 fastfat - ok
18:28:05.0842 4656 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\windows\system32\fxssvc.exe
18:28:05.0952 4656 Fax - ok
18:28:05.0983 4656 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\windows\system32\drivers\fdc.sys
18:28:06.0045 4656 fdc - ok
18:28:06.0076 4656 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\windows\system32\fdPHost.dll
18:28:06.0154 4656 fdPHost - ok
18:28:06.0186 4656 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\windows\system32\fdrespub.dll
18:28:06.0264 4656 FDResPub - ok
18:28:06.0310 4656 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\windows\system32\drivers\fileinfo.sys
18:28:06.0342 4656 FileInfo - ok
18:28:06.0342 4656 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\windows\system32\drivers\filetrace.sys
18:28:06.0466 4656 Filetrace - ok
18:28:06.0513 4656 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\windows\system32\drivers\flpydisk.sys
18:28:06.0529 4656 flpydisk - ok
18:28:06.0560 4656 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\windows\system32\drivers\fltmgr.sys
18:28:06.0576 4656 FltMgr - ok
18:28:06.0654 4656 [ C4C183E6551084039EC862DA1C945E3D ] FontCache C:\windows\system32\FntCache.dll
18:28:06.0732 4656 FontCache - ok
18:28:06.0778 4656 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
18:28:06.0794 4656 FontCache3.0.0.0 - ok
18:28:06.0810 4656 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\windows\system32\drivers\FsDepends.sys
18:28:06.0825 4656 FsDepends - ok
18:28:06.0888 4656 [ B16B626996C74B564005BA855C5DEE90 ] fssfltr C:\windows\system32\DRIVERS\fssfltr.sys
18:28:06.0919 4656 fssfltr - ok
18:28:07.0044 4656 [ 812E1BA5C52A78F13EA6AA10DF708B1D ] fsssvc C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
18:28:07.0090 4656 fsssvc - ok
18:28:07.0137 4656 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\windows\system32\drivers\Fs_Rec.sys
18:28:07.0137 4656 Fs_Rec - ok
18:28:07.0168 4656 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\windows\system32\DRIVERS\fvevol.sys
18:28:07.0200 4656 fvevol - ok
18:28:07.0215 4656 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\windows\system32\drivers\gagp30kx.sys
18:28:07.0231 4656 gagp30kx - ok
18:28:07.0246 4656 [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM C:\windows\system32\DRIVERS\GEARAspiWDM.sys
18:28:07.0262 4656 GEARAspiWDM - ok
18:28:07.0309 4656 [ FA07EC01952729DDDDC5BF4BAE06B09E ] GFNEXSrv C:\Windows\System32\GFNEXSrv.exe
18:28:07.0340 4656 GFNEXSrv - ok
18:28:07.0371 4656 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\windows\System32\gpsvc.dll
18:28:07.0465 4656 gpsvc - ok
18:28:07.0512 4656 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\windows\system32\drivers\hcw85cir.sys
18:28:07.0605 4656 hcw85cir - ok
18:28:07.0636 4656 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys
18:28:07.0714 4656 HdAudAddService - ok
18:28:07.0761 4656 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\windows\system32\DRIVERS\HDAudBus.sys
18:28:07.0824 4656 HDAudBus - ok
18:28:07.0855 4656 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\windows\system32\drivers\HidBatt.sys
18:28:07.0886 4656 HidBatt - ok
18:28:07.0933 4656 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\windows\system32\drivers\hidbth.sys
18:28:07.0995 4656 HidBth - ok
18:28:08.0026 4656 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\windows\system32\drivers\hidir.sys
18:28:08.0042 4656 HidIr - ok
18:28:08.0058 4656 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\windows\system32\hidserv.dll
18:28:08.0151 4656 hidserv - ok
18:28:08.0198 4656 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\windows\system32\DRIVERS\hidusb.sys
18:28:08.0214 4656 HidUsb - ok
18:28:08.0245 4656 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\windows\system32\kmsvc.dll
18:28:08.0354 4656 hkmsvc - ok
18:28:08.0385 4656 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\windows\system32\ListSvc.dll
18:28:08.0510 4656 HomeGroupListener - ok
18:28:08.0541 4656 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\windows\system32\provsvc.dll
18:28:08.0604 4656 HomeGroupProvider - ok
18:28:08.0650 4656 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\windows\system32\drivers\HpSAMD.sys
18:28:08.0682 4656 HpSAMD - ok
18:28:08.0728 4656 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\windows\system32\drivers\HTTP.sys
18:28:08.0806 4656 HTTP - ok
18:28:08.0838 4656 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\windows\system32\drivers\hwpolicy.sys
18:28:08.0853 4656 hwpolicy - ok
18:28:08.0884 4656 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\windows\system32\DRIVERS\i8042prt.sys
18:28:08.0900 4656 i8042prt - ok
18:28:08.0947 4656 [ D469B77687E12FE43E344806740B624D ] iaStor C:\windows\system32\DRIVERS\iaStor.sys
18:28:08.0962 4656 iaStor - ok
18:28:09.0009 4656 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\windows\system32\drivers\iaStorV.sys
18:28:09.0040 4656 iaStorV - ok
18:28:09.0087 4656 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
18:28:09.0134 4656 idsvc - ok
18:28:09.0228 4656 [ A48928D4CCA6F8B731989DB08CF2C0AB ] IDSVia64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130417.001\IDSvia64.sys
18:28:09.0259 4656 IDSVia64 - ok
18:28:09.0540 4656 [ 370C2A8629B30F910F740387795DDC6F ] igfx C:\windows\system32\DRIVERS\igdkmd64.sys
18:28:09.0914 4656 igfx - ok
18:28:09.0961 4656 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\windows\system32\drivers\iirsp.sys
18:28:09.0976 4656 iirsp - ok
18:28:10.0054 4656 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\windows\System32\ikeext.dll
18:28:10.0132 4656 IKEEXT - ok
18:28:10.0257 4656 [ 028E40182A6F0374978C755F85B9F07C ] IntcAzAudAddService C:\windows\system32\drivers\RTKVHD64.sys
18:28:10.0335 4656 IntcAzAudAddService - ok
18:28:10.0351 4656 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\windows\system32\drivers\intelide.sys
18:28:10.0351 4656 intelide - ok
18:28:10.0382 4656 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\windows\system32\DRIVERS\intelppm.sys
18:28:10.0460 4656 intelppm - ok
18:28:10.0491 4656 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\windows\system32\ipbusenum.dll
18:28:10.0585 4656 IPBusEnum - ok
18:28:10.0632 4656 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\windows\system32\DRIVERS\ipfltdrv.sys
18:28:10.0678 4656 IpFilterDriver - ok
18:28:10.0756 4656 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\windows\System32\iphlpsvc.dll
18:28:10.0850 4656 iphlpsvc - ok
18:28:10.0881 4656 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\windows\system32\drivers\IPMIDrv.sys
18:28:10.0928 4656 IPMIDRV - ok
18:28:10.0959 4656 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\windows\system32\drivers\ipnat.sys
18:28:11.0022 4656 IPNAT - ok
18:28:11.0100 4656 [ 50D6CCC6FF5561F9F56946B3E6164FB8 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
18:28:11.0131 4656 iPod Service - ok
18:28:11.0162 4656 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\windows\system32\drivers\irenum.sys
18:28:11.0178 4656 IRENUM - ok
18:28:11.0193 4656 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\windows\system32\drivers\isapnp.sys
18:28:11.0193 4656 isapnp - ok
18:28:11.0224 4656 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\windows\system32\drivers\msiscsi.sys
18:28:11.0240 4656 iScsiPrt - ok
18:28:11.0256 4656 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\windows\system32\DRIVERS\kbdclass.sys
18:28:11.0271 4656 kbdclass - ok
18:28:11.0287 4656 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\windows\system32\drivers\kbdhid.sys
18:28:11.0302 4656 kbdhid - ok
18:28:11.0334 4656 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\windows\system32\lsass.exe
18:28:11.0349 4656 KeyIso - ok
18:28:11.0396 4656 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\windows\system32\Drivers\ksecdd.sys
18:28:11.0412 4656 KSecDD - ok
18:28:11.0427 4656 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\windows\system32\Drivers\ksecpkg.sys
18:28:11.0443 4656 KSecPkg - ok
18:28:11.0458 4656 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\windows\system32\drivers\ksthunk.sys
18:28:11.0568 4656 ksthunk - ok
18:28:11.0614 4656 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\windows\system32\msdtckrm.dll
18:28:11.0708 4656 KtmRm - ok
18:28:11.0770 4656 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\windows\system32\srvsvc.dll
18:28:11.0864 4656 LanmanServer - ok
18:28:11.0895 4656 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\windows\System32\wkssvc.dll
18:28:11.0973 4656 LanmanWorkstation - ok
18:28:12.0036 4656 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\windows\system32\DRIVERS\lltdio.sys
18:28:12.0098 4656 lltdio - ok
18:28:12.0114 4656 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\windows\System32\lltdsvc.dll
18:28:12.0223 4656 lltdsvc - ok
18:28:12.0254 4656 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\windows\System32\lmhsvc.dll
18:28:12.0285 4656 lmhosts - ok
18:28:12.0363 4656 [ 7F32D4C47A50E7223491E8FB9359907D ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
18:28:12.0394 4656 LMS - ok
18:28:12.0426 4656 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\windows\system32\drivers\lsi_fc.sys
18:28:12.0441 4656 LSI_FC - ok
18:28:12.0457 4656 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\windows\system32\drivers\lsi_sas.sys
18:28:12.0472 4656 LSI_SAS - ok
18:28:12.0488 4656 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\windows\system32\drivers\lsi_sas2.sys
18:28:12.0504 4656 LSI_SAS2 - ok
18:28:12.0519 4656 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\windows\system32\drivers\lsi_scsi.sys
18:28:12.0535 4656 LSI_SCSI - ok
18:28:12.0566 4656 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\windows\system32\drivers\luafv.sys
18:28:12.0628 4656 luafv - ok
18:28:12.0675 4656 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\windows\system32\Mcx2Svc.dll
18:28:12.0738 4656 Mcx2Svc - ok
18:28:12.0769 4656 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\windows\system32\drivers\megasas.sys
18:28:12.0784 4656 megasas - ok
18:28:12.0831 4656 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\windows\system32\drivers\MegaSR.sys
18:28:12.0862 4656 MegaSR - ok
18:28:12.0894 4656 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\windows\system32\DRIVERS\HECIx64.sys
18:28:12.0940 4656 MEIx64 - ok
18:28:12.0956 4656 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\windows\system32\mmcss.dll
18:28:13.0018 4656 MMCSS - ok
18:28:13.0065 4656 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\windows\system32\drivers\modem.sys
18:28:13.0159 4656 Modem - ok
18:28:13.0206 4656 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\windows\system32\DRIVERS\monitor.sys
18:28:13.0268 4656 monitor - ok
18:28:13.0315 4656 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\windows\system32\DRIVERS\mouclass.sys
18:28:13.0330 4656 mouclass - ok
18:28:13.0362 4656 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\windows\system32\DRIVERS\mouhid.sys
18:28:13.0424 4656 mouhid - ok
18:28:13.0455 4656 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\windows\system32\drivers\mountmgr.sys
18:28:13.0486 4656 mountmgr - ok
18:28:13.0502 4656 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\windows\system32\drivers\mpio.sys
18:28:13.0533 4656 mpio - ok
18:28:13.0564 4656 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\windows\system32\drivers\mpsdrv.sys
18:28:13.0611 4656 mpsdrv - ok
18:28:13.0642 4656 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\windows\system32\mpssvc.dll
18:28:13.0720 4656 MpsSvc - ok
18:28:13.0752 4656 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\windows\system32\drivers\mrxdav.sys
18:28:13.0814 4656 MRxDAV - ok
18:28:13.0861 4656 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\windows\system32\DRIVERS\mrxsmb.sys
18:28:13.0939 4656 mrxsmb - ok
18:28:13.0970 4656 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\windows\system32\DRIVERS\mrxsmb10.sys
18:28:14.0048 4656 mrxsmb10 - ok
18:28:14.0048 4656 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\windows\system32\DRIVERS\mrxsmb20.sys
18:28:14.0064 4656 mrxsmb20 - ok
18:28:14.0095 4656 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\windows\system32\DRIVERS\msahci.sys
18:28:14.0110 4656 msahci - ok
18:28:14.0126 4656 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\windows\system32\drivers\msdsm.sys
18:28:14.0142 4656 msdsm - ok
18:28:14.0157 4656 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\windows\System32\msdtc.exe
18:28:14.0173 4656 MSDTC - ok
18:28:14.0204 4656 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\windows\system32\drivers\Msfs.sys
18:28:14.0251 4656 Msfs - ok
18:28:14.0266 4656 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\windows\System32\drivers\mshidkmdf.sys
18:28:14.0360 4656 mshidkmdf - ok
18:28:14.0391 4656 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\windows\system32\drivers\msisadrv.sys
18:28:14.0391 4656 msisadrv - ok
18:28:14.0422 4656 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\windows\system32\iscsiexe.dll
18:28:14.0516 4656 MSiSCSI - ok
18:28:14.0532 4656 msiserver - ok
18:28:14.0563 4656 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\windows\system32\drivers\MSKSSRV.sys
18:28:14.0641 4656 MSKSSRV - ok
18:28:14.0688 4656 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\windows\system32\drivers\MSPCLOCK.sys
18:28:14.0781 4656 MSPCLOCK - ok
18:28:14.0781 4656 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\windows\system32\drivers\MSPQM.sys
18:28:14.0875 4656 MSPQM - ok
18:28:14.0906 4656 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\windows\system32\drivers\MsRPC.sys
18:28:14.0922 4656 MsRPC - ok
18:28:14.0953 4656 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\windows\system32\DRIVERS\mssmbios.sys
18:28:14.0953 4656 mssmbios - ok
18:28:14.0984 4656 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\windows\system32\drivers\MSTEE.sys
18:28:15.0078 4656 MSTEE - ok
18:28:15.0109 4656 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\windows\system32\drivers\MTConfig.sys
18:28:15.0156 4656 MTConfig - ok
18:28:15.0187 4656 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\windows\system32\Drivers\mup.sys
18:28:15.0218 4656 Mup - ok
18:28:15.0249 4656 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\windows\system32\qagentRT.dll
18:28:15.0312 4656 napagent - ok
18:28:15.0374 4656 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\windows\system32\DRIVERS\nwifi.sys
18:28:15.0436 4656 NativeWifiP - ok
18:28:15.0514 4656 [ 88A2F45CE66B904285978D6BB13AFEB2 ] NAVENG C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130417.004\ENG64.SYS
18:28:15.0546 4656 NAVENG - ok
18:28:15.0624 4656 [ D2A545DA3A90BBFA40E020C23F1B7A48 ] NAVEX15 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130417.004\EX64.SYS
18:28:15.0670 4656 NAVEX15 - ok
18:28:15.0717 4656 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\windows\system32\drivers\ndis.sys
18:28:15.0748 4656 NDIS - ok
18:28:15.0780 4656 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\windows\system32\DRIVERS\ndiscap.sys
18:28:15.0842 4656 NdisCap - ok
18:28:15.0873 4656 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\windows\system32\DRIVERS\ndistapi.sys
18:28:15.0920 4656 NdisTapi - ok
18:28:15.0936 4656 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\windows\system32\DRIVERS\ndisuio.sys
18:28:15.0998 4656 Ndisuio - ok
18:28:16.0029 4656 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\windows\system32\DRIVERS\ndiswan.sys
18:28:16.0092 4656 NdisWan - ok
18:28:16.0138 4656 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\windows\system32\drivers\NDProxy.sys
18:28:16.0201 4656 NDProxy - ok
18:28:16.0248 4656 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\windows\system32\DRIVERS\netbios.sys
18:28:16.0326 4656 NetBIOS - ok
18:28:16.0357 4656 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\windows\system32\DRIVERS\netbt.sys
18:28:16.0419 4656 NetBT - ok
18:28:16.0435 4656 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\windows\system32\lsass.exe
18:28:16.0450 4656 Netlogon - ok
18:28:16.0482 4656 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\windows\System32\netman.dll
18:28:16.0560 4656 Netman - ok
18:28:16.0591 4656 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\windows\System32\netprofm.dll
18:28:16.0684 4656 netprofm - ok
18:28:16.0716 4656 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:28:16.0762 4656 NetTcpPortSharing - ok
18:28:16.0809 4656 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\windows\system32\drivers\nfrd960.sys
18:28:16.0840 4656 nfrd960 - ok
18:28:16.0950 4656 [ F2840DBFE9322F35557219AE82CC4597 ] NIS C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
18:28:16.0965 4656 NIS - ok
18:28:16.0996 4656 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\windows\System32\nlasvc.dll
18:28:17.0043 4656 NlaSvc - ok
18:28:17.0106 4656 Norton PC Checkup Application Launcher - ok
18:28:17.0121 4656 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\windows\system32\drivers\Npfs.sys
18:28:17.0168 4656 Npfs - ok
18:28:17.0199 4656 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\windows\system32\nsisvc.dll
18:28:17.0277 4656 nsi - ok
18:28:17.0308 4656 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\windows\system32\drivers\nsiproxy.sys
18:28:17.0386 4656 nsiproxy - ok
18:28:17.0464 4656 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\windows\system32\drivers\Ntfs.sys
18:28:17.0511 4656 Ntfs - ok
18:28:17.0542 4656 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\windows\system32\drivers\Null.sys
18:28:17.0589 4656 Null - ok
18:28:17.0605 4656 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\windows\system32\drivers\nvraid.sys
18:28:17.0620 4656 nvraid - ok
18:28:17.0636 4656 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\windows\system32\drivers\nvstor.sys
18:28:17.0636 4656 nvstor - ok
18:28:17.0667 4656 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\windows\system32\drivers\nv_agp.sys
18:28:17.0683 4656 nv_agp - ok
18:28:17.0714 4656 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\windows\system32\drivers\ohci1394.sys
18:28:17.0730 4656 ohci1394 - ok
18:28:17.0792 4656 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:28:17.0839 4656 ose - ok
18:28:18.0010 4656 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
18:28:18.0229 4656 osppsvc - ok
18:28:18.0260 4656 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\windows\system32\pnrpsvc.dll
18:28:18.0354 4656 p2pimsvc - ok
18:28:18.0385 4656 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\windows\system32\p2psvc.dll
18:28:18.0432 4656 p2psvc - ok
18:28:18.0463 4656 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\windows\system32\drivers\parport.sys
18:28:18.0478 4656 Parport - ok
18:28:18.0494 4656 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\windows\system32\drivers\partmgr.sys
18:28:18.0510 4656 partmgr - ok
18:28:18.0541 4656 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\windows\System32\pcasvc.dll
18:28:18.0603 4656 PcaSvc - ok
18:28:18.0681 4656 [ 2F86BE1818C2D7AC90478E3323EE7FCB ] PCCUJobMgr C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
18:28:18.0697 4656 PCCUJobMgr - ok
18:28:18.0744 4656 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\windows\system32\drivers\pci.sys
18:28:18.0759 4656 pci - ok
18:28:18.0775 4656 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\windows\system32\DRIVERS\pciide.sys
18:28:18.0790 4656 pciide - ok
18:28:18.0806 4656 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\windows\system32\drivers\pcmcia.sys
18:28:18.0822 4656 pcmcia - ok
18:28:18.0853 4656 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\windows\system32\drivers\pcw.sys
18:28:18.0868 4656 pcw - ok
18:28:18.0915 4656 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\windows\system32\drivers\peauth.sys
18:28:19.0009 4656 PEAUTH - ok
18:28:19.0102 4656 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\windows\SysWow64\perfhost.exe
18:28:19.0149 4656 PerfHost - ok
18:28:19.0212 4656 [ 91111CEBBDE8015E822C46120ED9537C ] PGEffect C:\windows\system32\DRIVERS\pgeffect.sys
18:28:19.0243 4656 PGEffect - ok
18:28:19.0290 4656 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\windows\system32\pla.dll
18:28:19.0414 4656 pla - ok
18:28:19.0477 4656 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\windows\system32\umpnpmgr.dll
18:28:19.0586 4656 PlugPlay - ok
18:28:19.0617 4656 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\windows\system32\pnrpauto.dll
18:28:19.0695 4656 PNRPAutoReg - ok
18:28:19.0742 4656 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\windows\system32\pnrpsvc.dll
18:28:19.0773 4656 PNRPsvc - ok
18:28:19.0804 4656 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\windows\System32\ipsecsvc.dll
18:28:19.0882 4656 PolicyAgent - ok
18:28:19.0914 4656 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\windows\system32\umpo.dll
18:28:19.0992 4656 Power - ok
18:28:20.0054 4656 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\windows\system32\DRIVERS\raspptp.sys
18:28:20.0132 4656 PptpMiniport - ok
18:28:20.0163 4656 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\windows\system32\drivers\processr.sys
18:28:20.0226 4656 Processor - ok
18:28:20.0272 4656 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\windows\system32\profsvc.dll
18:28:20.0382 4656 ProfSvc - ok
18:28:20.0397 4656 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\windows\system32\lsass.exe
18:28:20.0413 4656 ProtectedStorage - ok
18:28:20.0444 4656 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\windows\system32\DRIVERS\pacer.sys
18:28:20.0491 4656 Psched - ok
18:28:20.0553 4656 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\windows\system32\drivers\ql2300.sys
18:28:20.0678 4656 ql2300 - ok
18:28:20.0709 4656 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\windows\system32\drivers\ql40xx.sys
18:28:20.0725 4656 ql40xx - ok
18:28:20.0756 4656 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\windows\system32\qwave.dll
18:28:20.0818 4656 QWAVE - ok
18:28:20.0850 4656 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\windows\system32\drivers\qwavedrv.sys
18:28:20.0881 4656 QWAVEdrv - ok
18:28:20.0928 4656 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\windows\system32\DRIVERS\rasacd.sys
18:28:21.0006 4656 RasAcd - ok
18:28:21.0037 4656 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\windows\system32\DRIVERS\AgileVpn.sys
18:28:21.0084 4656 RasAgileVpn - ok
18:28:21.0099 4656 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\windows\System32\rasauto.dll
18:28:21.0193 4656 RasAuto - ok
18:28:21.0224 4656 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\windows\system32\DRIVERS\rasl2tp.sys
18:28:21.0286 4656 Rasl2tp - ok
18:28:21.0318 4656 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\windows\System32\rasmans.dll
18:28:21.0364 4656 RasMan - ok
18:28:21.0380 4656 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\windows\system32\DRIVERS\raspppoe.sys
18:28:21.0442 4656 RasPppoe - ok
18:28:21.0489 4656 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\windows\system32\DRIVERS\rassstp.sys
18:28:21.0614 4656 RasSstp - ok
18:28:21.0645 4656 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\windows\system32\DRIVERS\rdbss.sys
18:28:21.0739 4656 rdbss - ok
18:28:21.0770 4656 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\windows\system32\drivers\rdpbus.sys
18:28:21.0786 4656 rdpbus - ok
18:28:21.0817 4656 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\windows\system32\DRIVERS\RDPCDD.sys
18:28:21.0926 4656 RDPCDD - ok
18:28:21.0942 4656 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\windows\system32\drivers\rdpencdd.sys
18:28:22.0020 4656 RDPENCDD - ok
18:28:22.0051 4656 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\windows\system32\drivers\rdprefmp.sys
18:28:22.0160 4656 RDPREFMP - ok
18:28:22.0207 4656 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\windows\system32\drivers\RDPWD.sys
18:28:22.0269 4656 RDPWD - ok
18:28:22.0300 4656 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\windows\system32\drivers\rdyboost.sys
18:28:22.0316 4656 rdyboost - ok
18:28:22.0347 4656 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\windows\System32\mprdim.dll
18:28:22.0425 4656 RemoteAccess - ok
18:28:22.0472 4656 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\windows\system32\regsvc.dll
18:28:22.0519 4656 RemoteRegistry - ok
18:28:22.0628 4656 [ FBA61BB4C484A01A655AFB18FF86C417 ] RichVideo64 C:\Program Files\CyberLink\Shared files\RichVideo64.exe
18:28:22.0659 4656 RichVideo64 - ok
18:28:22.0675 4656 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\windows\System32\RpcEpMap.dll
18:28:22.0737 4656 RpcEptMapper - ok
18:28:22.0784 4656 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\windows\system32\locator.exe
18:28:22.0831 4656 RpcLocator - ok
18:28:22.0878 4656 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\windows\system32\rpcss.dll
18:28:22.0940 4656 RpcSs - ok
18:28:22.0956 4656 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\windows\system32\DRIVERS\rspndr.sys
18:28:23.0018 4656 rspndr - ok
18:28:23.0065 4656 [ BE29B0A3AC1E8BD02FFAB8CEE86BADFA ] RSUSBSTOR C:\windows\system32\Drivers\RtsUStor.sys
18:28:23.0080 4656 RSUSBSTOR - ok
18:28:23.0112 4656 [ 6D3C7E7D82D3DC92DC2A8B0DF9F20F8A ] RTL8167 C:\windows\system32\DRIVERS\Rt64win7.sys
18:28:23.0127 4656 RTL8167 - ok
18:28:23.0190 4656 [ E7D79600575F755614DD5D79B044D588 ] RTL8192Ce C:\windows\system32\DRIVERS\rtl8192Ce.sys
18:28:23.0236 4656 RTL8192Ce - ok
18:28:23.0252 4656 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\windows\system32\lsass.exe
18:28:23.0268 4656 SamSs - ok
18:28:23.0283 4656 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\windows\system32\drivers\sbp2port.sys
18:28:23.0299 4656 sbp2port - ok
18:28:23.0330 4656 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\windows\System32\SCardSvr.dll
18:28:23.0408 4656 SCardSvr - ok
18:28:23.0439 4656 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\windows\system32\DRIVERS\scfilter.sys
18:28:23.0486 4656 scfilter - ok
18:28:23.0564 4656 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\windows\system32\schedsvc.dll
18:28:23.0673 4656 Schedule - ok
18:28:23.0704 4656 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\windows\System32\certprop.dll
18:28:23.0767 4656 SCPolicySvc - ok
18:28:23.0798 4656 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\windows\System32\SDRSVC.dll
18:28:23.0923 4656 SDRSVC - ok
18:28:23.0954 4656 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\windows\system32\drivers\secdrv.sys
18:28:24.0032 4656 secdrv - ok
18:28:24.0063 4656 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\windows\system32\seclogon.dll
18:28:24.0157 4656 seclogon - ok
18:28:24.0172 4656 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\windows\System32\sens.dll
18:28:24.0266 4656 SENS - ok
18:28:24.0313 4656 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\windows\system32\sensrsvc.dll
18:28:24.0422 4656 SensrSvc - ok
18:28:24.0453 4656 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\windows\system32\drivers\serenum.sys
18:28:24.0516 4656 Serenum - ok
18:28:24.0547 4656 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\windows\system32\drivers\serial.sys
18:28:24.0594 4656 Serial - ok
18:28:24.0625 4656 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\windows\system32\drivers\sermouse.sys
18:28:24.0687 4656 sermouse - ok
18:28:24.0734 4656 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\windows\system32\sessenv.dll
18:28:24.0812 4656 SessionEnv - ok
18:28:24.0843 4656 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\windows\system32\drivers\sffdisk.sys
18:28:24.0890 4656 sffdisk - ok
18:28:24.0921 4656 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\windows\system32\drivers\sffp_mmc.sys
18:28:24.0968 4656 sffp_mmc - ok
18:28:24.0984 4656 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\windows\system32\drivers\sffp_sd.sys
18:28:25.0015 4656 sffp_sd - ok
18:28:25.0046 4656 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\windows\system32\drivers\sfloppy.sys
18:28:25.0062 4656 sfloppy - ok
18:28:25.0124 4656 [ C6CC9297BD53E5229653303E556AA539 ] Sftfs C:\windows\system32\DRIVERS\Sftfslh.sys
18:28:25.0155 4656 Sftfs - ok
18:28:25.0249 4656 [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
18:28:25.0280 4656 sftlist - ok
18:28:25.0327 4656 [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay C:\windows\system32\DRIVERS\Sftplaylh.sys
18:28:25.0342 4656 Sftplay - ok
18:28:25.0374 4656 [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir C:\windows\system32\DRIVERS\Sftredirlh.sys
18:28:25.0405 4656 Sftredir - ok
18:28:25.0436 4656 [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol C:\windows\system32\DRIVERS\Sftvollh.sys
18:28:25.0467 4656 Sftvol - ok
18:28:25.0498 4656 [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
18:28:25.0530 4656 sftvsa - ok
18:28:25.0561 4656 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\windows\System32\ipnathlp.dll
18:28:25.0654 4656 SharedAccess - ok
18:28:25.0686 4656 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\windows\System32\shsvcs.dll
18:28:25.0795 4656 ShellHWDetection - ok
18:28:25.0826 4656 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\windows\system32\drivers\SiSRaid2.sys
18:28:25.0857 4656 SiSRaid2 - ok
18:28:25.0888 4656 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\windows\system32\drivers\sisraid4.sys
18:28:25.0904 4656 SiSRaid4 - ok
18:28:25.0935 4656 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\windows\system32\DRIVERS\smb.sys
18:28:25.0998 4656 Smb - ok
18:28:26.0060 4656 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\windows\System32\snmptrap.exe
18:28:26.0122 4656 SNMPTRAP - ok
18:28:26.0154 4656 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\windows\system32\drivers\spldr.sys
18:28:26.0169 4656 spldr - ok
18:28:26.0216 4656 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\windows\System32\spoolsv.exe
18:28:26.0294 4656 Spooler - ok
18:28:26.0388 4656 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\windows\system32\sppsvc.exe
18:28:26.0559 4656 sppsvc - ok
18:28:26.0606 4656 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\windows\system32\sppuinotify.dll
18:28:26.0637 4656 sppuinotify - ok
18:28:26.0762 4656 [ 891793E00432FA055CF040605C260E49 ] SRTSP C:\windows\System32\Drivers\NISx64\1309010.00E\SRTSP64.SYS
18:28:26.0824 4656 SRTSP - ok
18:28:26.0840 4656 [ 1CB7BB3B0561FB5ECFE37F7731E8BF3E ] SRTSPX C:\windows\system32\drivers\NISx64\1309010.00E\SRTSPX64.SYS
18:28:26.0871 4656 SRTSPX - ok
18:28:26.0918 4656 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\windows\system32\DRIVERS\srv.sys
18:28:27.0012 4656 srv - ok
18:28:27.0043 4656 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\windows\system32\DRIVERS\srv2.sys
18:28:27.0090 4656 srv2 - ok
18:28:27.0136 4656 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\windows\system32\DRIVERS\srvnet.sys
18:28:27.0168 4656 srvnet - ok
18:28:27.0199 4656 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\windows\System32\ssdpsrv.dll
18:28:27.0277 4656 SSDPSRV - ok
18:28:27.0308 4656 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\windows\system32\sstpsvc.dll
18:28:27.0386 4656 SstpSvc - ok
18:28:27.0417 4656 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\windows\system32\drivers\stexstor.sys
18:28:27.0433 4656 stexstor - ok
18:28:27.0464 4656 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\windows\System32\wiaservc.dll
18:28:27.0495 4656 stisvc - ok
18:28:27.0526 4656 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\windows\system32\DRIVERS\swenum.sys
18:28:27.0542 4656 swenum - ok
18:28:27.0573 4656 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\windows\System32\swprv.dll
18:28:27.0651 4656 swprv - ok
18:28:27.0714 4656 [ 8B2430762099598DA40686F754632EFD ] SymDS C:\windows\system32\drivers\NISx64\1309010.00E\SYMDS64.SYS
18:28:27.0776 4656 SymDS - ok
18:28:27.0823 4656 [ 5CB7F2FD7E30A0F52F93574BFC3A8041 ] SymEFA C:\windows\system32\drivers\NISx64\1309010.00E\SYMEFA64.SYS
18:28:27.0901 4656 SymEFA - ok
18:28:27.0932 4656 [ 894579207E39C465737E850A252CE4F2 ] SymEvent C:\windows\system32\Drivers\SYMEVENT64x86.SYS
18:28:27.0963 4656 SymEvent - ok
18:28:27.0994 4656 [ 5013A76CAAA1D7CF1C55214B490B4E35 ] SymIRON C:\windows\system32\drivers\NISx64\1309010.00E\Ironx64.SYS
18:28:28.0041 4656 SymIRON - ok
18:28:28.0072 4656 [ 3911BD0E68C010E5438A87706ABBE9AB ] SymNetS C:\windows\System32\Drivers\NISx64\1309010.00E\SYMNETS.SYS
18:28:28.0119 4656 SymNetS - ok
18:28:28.0213 4656 [ F5B46DF59FEAA48A442AED7EEB754D4B ] SynTP C:\windows\system32\DRIVERS\SynTP.sys
18:28:28.0260 4656 SynTP - ok
18:28:28.0322 4656 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\windows\system32\sysmain.dll
18:28:28.0400 4656 SysMain - ok
18:28:28.0447 4656 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\windows\System32\TabSvc.dll
18:28:28.0462 4656 TabletInputService - ok
18:28:28.0509 4656 [ 3B73C849B41FB20D77B0E553214061A5 ] tap0901 C:\windows\system32\DRIVERS\tap0901.sys
18:28:28.0618 4656 tap0901 - ok
18:28:28.0650 4656 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\windows\System32\tapisrv.dll
18:28:28.0743 4656 TapiSrv - ok
18:28:28.0774 4656 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\windows\System32\tbssvc.dll
18:28:28.0806 4656 TBS - ok
18:28:28.0915 4656 [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip C:\windows\system32\drivers\tcpip.sys
18:28:28.0977 4656 Tcpip - ok
18:28:29.0040 4656 [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6 C:\windows\system32\DRIVERS\tcpip.sys
18:28:29.0086 4656 TCPIP6 - ok
18:28:29.0133 4656 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\windows\system32\drivers\tcpipreg.sys
18:28:29.0149 4656 tcpipreg - ok
18:28:29.0164 4656 [ FD542B661BD22FA69CA789AD0AC58C29 ] tdcmdpst C:\windows\system32\DRIVERS\tdcmdpst.sys
18:28:29.0180 4656 tdcmdpst - ok
18:28:29.0211 4656 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\windows\system32\drivers\tdpipe.sys
18:28:29.0289 4656 TDPIPE - ok
18:28:29.0305 4656 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\windows\system32\drivers\tdtcp.sys
18:28:29.0367 4656 TDTCP - ok
18:28:29.0414 4656 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\windows\system32\DRIVERS\tdx.sys
18:28:29.0461 4656 tdx - ok
18:28:29.0476 4656 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\windows\system32\DRIVERS\termdd.sys
18:28:29.0492 4656 TermDD - ok
18:28:29.0523 4656 [ 2E648163254233755035B46DD7B89123 ] TermService C:\windows\System32\termsrv.dll
18:28:29.0601 4656 TermService - ok
18:28:29.0632 4656 [ F0344071948D1A1FA732231785A0664C ] Themes C:\windows\system32\themeservice.dll
18:28:29.0648 4656 Themes - ok
18:28:29.0679 4656 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\windows\system32\mmcss.dll
18:28:29.0710 4656 THREADORDER - ok
18:28:29.0757 4656 [ 71C321649B28638EE80A2EEB164C1DC8 ] TMachInfo C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
18:28:29.0773 4656 TMachInfo - ok
18:28:29.0788 4656 [ 8E2C799D3476EAC32C3BA0DF7CE6AF19 ] TODDSrv C:\windows\system32\TODDSrv.exe
18:28:29.0804 4656 TODDSrv - ok
18:28:29.0866 4656 [ 1C73689B900428C7D054A41C4687F55C ] TosCoSrv C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
18:28:29.0898 4656 TosCoSrv - ok
18:28:29.0944 4656 [ 29D0886CF250FCEF1BF9E65AB8D2C0C8 ] TOSHIBA HDD SSD Alert Service C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
18:28:29.0976 4656 TOSHIBA HDD SSD Alert Service - ok
18:28:30.0007 4656 [ 09FF7B0B1B5C3D225495CB6F5A9B39F8 ] tos_sps64 C:\windows\system32\DRIVERS\tos_sps64.sys
18:28:30.0038 4656 tos_sps64 - ok
18:28:30.0085 4656 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\windows\System32\trkwks.dll
18:28:30.0194 4656 TrkWks - ok
18:28:30.0241 4656 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe
18:28:30.0303 4656 TrustedInstaller - ok
18:28:30.0319 4656 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\windows\system32\DRIVERS\tssecsrv.sys
18:28:30.0381 4656 tssecsrv - ok
18:28:30.0428 4656 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\windows\system32\drivers\tsusbflt.sys
18:28:30.0490 4656 TsUsbFlt - ok
18:28:30.0506 4656 [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD C:\windows\system32\drivers\TsUsbGD.sys
18:28:30.0553 4656 TsUsbGD - ok
18:28:30.0631 4656 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\windows\system32\DRIVERS\tunnel.sys
18:28:30.0693 4656 tunnel - ok
18:28:30.0724 4656 [ 550B567F9364D8F7684C3FB3EA665A72 ] TVALZ C:\windows\system32\DRIVERS\TVALZ_O.SYS
18:28:30.0740 4656 TVALZ - ok
18:28:30.0740 4656 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\windows\system32\drivers\uagp35.sys
18:28:30.0756 4656 uagp35 - ok
18:28:30.0771 4656 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\windows\system32\DRIVERS\udfs.sys
18:28:30.0834 4656 udfs - ok
18:28:30.0865 4656 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\windows\system32\UI0Detect.exe
18:28:30.0912 4656 UI0Detect - ok
18:28:30.0943 4656 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\windows\system32\drivers\uliagpkx.sys
18:28:30.0943 4656 uliagpkx - ok
18:28:30.0974 4656 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\windows\system32\DRIVERS\umbus.sys
18:28:31.0021 4656 umbus - ok
18:28:31.0052 4656 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\windows\system32\drivers\umpass.sys
18:28:31.0099 4656 UmPass - ok
18:28:31.0302 4656 [ 2C16648A12999AE69A9EBF41974B0BA2 ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
18:28:31.0395 4656 UNS - ok
18:28:31.0426 4656 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\windows\System32\upnphost.dll
18:28:31.0489 4656 upnphost - ok
18:28:31.0551 4656 [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64 C:\windows\system32\Drivers\usbaapl64.sys
18:28:31.0645 4656 USBAAPL64 - ok
18:28:31.0660 4656 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\windows\system32\DRIVERS\usbccgp.sys
18:28:31.0738 4656 usbccgp - ok
18:28:31.0770 4656 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\windows\system32\drivers\usbcir.sys
18:28:31.0801 4656 usbcir - ok
18:28:31.0832 4656 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\windows\system32\DRIVERS\usbehci.sys
18:28:31.0879 4656 usbehci - ok
18:28:31.0941 4656 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\windows\system32\DRIVERS\usbhub.sys
18:28:32.0004 4656 usbhub - ok
18:28:32.0035 4656 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\windows\system32\drivers\usbohci.sys
18:28:32.0082 4656 usbohci - ok
18:28:32.0113 4656 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\windows\system32\drivers\usbprint.sys
18:28:32.0175 4656 usbprint - ok
18:28:32.0206 4656 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\windows\system32\DRIVERS\USBSTOR.SYS
18:28:32.0284 4656 USBSTOR - ok
18:28:32.0316 4656 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\windows\system32\drivers\usbuhci.sys
18:28:32.0362 4656 usbuhci - ok
18:28:32.0409 4656 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\windows\system32\Drivers\usbvideo.sys
18:28:32.0440 4656 usbvideo - ok
18:28:32.0456 4656 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\windows\System32\uxsms.dll
18:28:32.0518 4656 UxSms - ok
18:28:32.0534 4656 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\windows\system32\lsass.exe
18:28:32.0534 4656 VaultSvc - ok
18:28:32.0581 4656 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\windows\system32\drivers\vdrvroot.sys
18:28:32.0596 4656 vdrvroot - ok
18:28:32.0628 4656 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\windows\System32\vds.exe
18:28:32.0752 4656 vds - ok
18:28:32.0799 4656 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\windows\system32\DRIVERS\vgapnp.sys
18:28:32.0846 4656 vga - ok
18:28:32.0877 4656 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\windows\System32\drivers\vga.sys
18:28:32.0940 4656 VgaSave - ok
18:28:32.0971 4656 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\windows\system32\drivers\vhdmp.sys
18:28:32.0986 4656 vhdmp - ok
18:28:33.0002 4656 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\windows\system32\drivers\viaide.sys
18:28:33.0018 4656 viaide - ok
18:28:33.0033 4656 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\windows\system32\drivers\volmgr.sys
18:28:33.0049 4656 volmgr - ok
18:28:33.0064 4656 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\windows\system32\drivers\volmgrx.sys
18:28:33.0080 4656 volmgrx - ok
18:28:33.0096 4656 [ DF8126BD41180351A093A3AD2FC8903B ] volsnap C:\windows\system32\drivers\volsnap.sys
18:28:33.0111 4656 volsnap - ok
18:28:33.0158 4656 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\windows\system32\drivers\vsmraid.sys
18:28:33.0205 4656 vsmraid - ok
18:28:33.0267 4656 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\windows\system32\vssvc.exe
18:28:33.0361 4656 VSS - ok
18:28:33.0392 4656 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\windows\system32\DRIVERS\vwifibus.sys
18:28:33.0439 4656 vwifibus - ok
18:28:33.0470 4656 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\windows\system32\DRIVERS\vwififlt.sys
18:28:33.0501 4656 vwififlt - ok
18:28:33.0532 4656 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\windows\system32\w32time.dll
18:28:33.0595 4656 W32Time - ok
18:28:33.0626 4656 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\windows\system32\drivers\wacompen.sys
18:28:33.0688 4656 WacomPen - ok
18:28:33.0720 4656 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\windows\system32\DRIVERS\wanarp.sys
18:28:33.0798 4656 WANARP - ok
18:28:33.0798 4656 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\windows\system32\DRIVERS\wanarp.sys
18:28:33.0829 4656 Wanarpv6 - ok
18:28:33.0922 4656 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\windows\system32\Wat\WatAdminSvc.exe
18:28:34.0016 4656 WatAdminSvc - ok
18:28:34.0078 4656 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\windows\system32\wbengine.exe
18:28:34.0203 4656 wbengine - ok
18:28:34.0219 4656 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\windows\System32\wbiosrvc.dll
18:28:34.0250 4656 WbioSrvc - ok
18:28:34.0297 4656 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\windows\System32\wcncsvc.dll
18:28:34.0375 4656 wcncsvc - ok
18:28:34.0422 4656 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll
18:28:34.0531 4656 WcsPlugInService - ok
18:28:34.0546 4656 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\windows\system32\drivers\wd.sys
18:28:34.0562 4656 Wd - ok
18:28:34.0624 4656 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\windows\system32\drivers\Wdf01000.sys
18:28:34.0656 4656 Wdf01000 - ok
18:28:34.0671 4656 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\windows\system32\wdi.dll
18:28:34.0796 4656 WdiServiceHost - ok
18:28:34.0796 4656 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\windows\system32\wdi.dll
18:28:34.0827 4656 WdiSystemHost - ok
18:28:34.0858 4656 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\windows\System32\webclnt.dll
18:28:34.0905 4656 WebClient - ok
18:28:34.0936 4656 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\windows\system32\wecsvc.dll
18:28:35.0046 4656 Wecsvc - ok
18:28:35.0077 4656 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\windows\System32\wercplsupport.dll
18:28:35.0170 4656 wercplsupport - ok
18:28:35.0202 4656 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\windows\System32\WerSvc.dll
18:28:35.0248 4656 WerSvc - ok
18:28:35.0264 4656 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\windows\system32\DRIVERS\wfplwf.sys
18:28:35.0295 4656 WfpLwf - ok
18:28:35.0311 4656 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\windows\system32\drivers\wimmount.sys
18:28:35.0326 4656 WIMMount - ok
18:28:35.0342 4656 WinDefend - ok
18:28:35.0342 4656 WinHttpAutoProxySvc - ok
18:28:35.0404 4656 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\windows\system32\wbem\WMIsvc.dll
18:28:35.0498 4656 Winmgmt - ok
18:28:35.0592 4656 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\windows\system32\WsmSvc.dll
18:28:35.0654 4656 WinRM - ok
18:28:35.0701 4656 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\windows\System32\wlansvc.dll
18:28:35.0779 4656 Wlansvc - ok
18:28:35.0919 4656 [ 357CABBF155AFD1D3926E62539D2A3A7 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
18:28:35.0982 4656 wlidsvc - ok
18:28:36.0013 4656 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\windows\system32\DRIVERS\wmiacpi.sys
18:28:36.0075 4656 WmiAcpi - ok
18:28:36.0138 4656 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\windows\system32\wbem\WmiApSrv.exe
18:28:36.0216 4656 wmiApSrv - ok
18:28:36.0262 4656 WMPNetworkSvc - ok
18:28:36.0294 4656 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\windows\System32\wpcsvc.dll
18:28:36.0372 4656 WPCSvc - ok
18:28:36.0387 4656 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\windows\system32\wpdbusenum.dll
18:28:36.0434 4656 WPDBusEnum - ok
18:28:36.0465 4656 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\windows\system32\drivers\ws2ifsl.sys
18:28:36.0512 4656 ws2ifsl - ok
18:28:36.0528 4656 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\windows\System32\wscsvc.dll
18:28:36.0574 4656 wscsvc - ok
18:28:36.0574 4656 WSearch - ok
18:28:36.0668 4656 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\windows\system32\wuaueng.dll
18:28:36.0730 4656 wuauserv - ok
18:28:36.0777 4656 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\windows\system32\drivers\WudfPf.sys
18:28:36.0871 4656 WudfPf - ok
18:28:36.0918 4656 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\windows\system32\DRIVERS\WUDFRd.sys
18:28:36.0980 4656 WUDFRd - ok
18:28:37.0027 4656 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\windows\System32\WUDFSvc.dll
18:28:37.0074 4656 wudfsvc - ok
18:28:37.0120 4656 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\windows\System32\wwansvc.dll
18:28:37.0183 4656 WwanSvc - ok
18:28:37.0214 4656 ================ Scan global ===============================
18:28:37.0245 4656 [ BA0CD8C393E8C9F83354106093832C7B ] C:\windows\system32\basesrv.dll
18:28:37.0292 4656 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\windows\system32\winsrv.dll
18:28:37.0308 4656 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\windows\system32\winsrv.dll
18:28:37.0323 4656 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\windows\system32\sxssrv.dll
18:28:37.0339 4656 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\windows\system32\services.exe
18:28:37.0354 4656 [Global] - ok
18:28:37.0354 4656 ================ Scan MBR ==================================
18:28:37.0370 4656 [ 5B5E648D12FCADC244C1EC30318E1EB9 ] \Device\Harddisk0\DR0
18:28:37.0666 4656 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
18:28:37.0666 4656 \Device\Harddisk0\DR0 - detected TDSS File System (1)
18:28:38.0134 4656 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR2
18:28:38.0368 4656 \Device\Harddisk1\DR2 - ok
18:28:38.0368 4656 ================ Scan VBR ==================================
18:28:38.0384 4656 [ 9CA4803AA10E7B14FD929B8082DF0620 ] \Device\Harddisk0\DR0\Partition1
18:28:38.0400 4656 \Device\Harddisk0\DR0\Partition1 - ok
18:28:38.0400 4656 [ 1893FDA9EFAD0EBF6166572C9F2F7426 ] \Device\Harddisk1\DR2\Partition1
18:28:38.0400 4656 \Device\Harddisk1\DR2\Partition1 - ok
18:28:38.0400 4656 ============================================================
18:28:38.0400 4656 Scan finished
18:28:38.0400 4656 ============================================================
18:28:38.0415 6368 Detected object count: 1
18:28:38.0415 6368 Actual detected object count: 1
18:29:12.0205 6368 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine
18:29:12.0205 6368 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine
18:29:12.0220 6368 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine
18:29:12.0220 6368 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine
18:29:12.0236 6368 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine
18:29:12.0252 6368 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine
18:29:12.0252 6368 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine
18:29:12.0252 6368 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine
18:29:12.0267 6368 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine
18:29:12.0267 6368 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine
18:29:12.0267 6368 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine
18:29:12.0283 6368 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine
18:29:12.0283 6368 \Device\Harddisk0\DR0\TDLFS\gqpv - copied to quarantine
18:29:12.0283 6368 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine
18:29:12.0283 6368 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine
18:29:12.0283 6368 \Device\Harddisk0\DR0\TDLFS - deleted
18:29:12.0283 6368 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Delete 
18:29:21.0144 1544 Deinitialize success

ComboFix log:

ComboFix 13-04-17.01 - Mike 04/17/2013 18:44:52.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4008.2321 [GMT -5:00]
Running from: c:\users\Mike\Desktop\ComboFix.exe.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\svchost.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-03-17 to 2013-04-17 )))))))))))))))))))))))))))))))
.
.
2013-04-17 23:58 . 2013-04-17 23:58 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-04-17 16:28 . 2013-04-17 17:26 -------- d-----w- c:\program files (x86)\BackgammonMasters
2013-04-17 15:02 . 2013-04-17 23:29 -------- d-----w- C:\TDSSKiller_Quarantine
2013-04-16 01:43 . 2013-04-16 01:43 -------- d-----w- C:\FRST
2013-04-13 16:26 . 2013-04-13 16:26 -------- d-----w- c:\users\Mike\AppData\Roaming\Malwarebytes
2013-04-13 16:26 . 2013-04-13 16:26 -------- d-----w- c:\programdata\Malwarebytes
2013-04-13 16:26 . 2013-04-14 14:48 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-13 16:26 . 2013-04-04 19:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-13 16:26 . 2013-04-13 16:26 -------- d-----w- c:\users\Mike\AppData\Local\Programs
2013-04-01 00:02 . 2013-04-01 00:02 -------- d-----w- c:\programdata\McAfee
2013-03-26 00:50 . 2013-02-12 04:12 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-03-24 22:10 . 2013-04-14 03:20 -------- d-----w- c:\programdata\Vizzed
2013-03-24 21:31 . 2013-03-24 21:31 963488 ----a-w- c:\windows\system32\deployJava1.dll
2013-03-24 21:31 . 2013-03-24 21:31 310688 ----a-w- c:\windows\system32\javaws.exe
2013-03-24 21:31 . 2013-03-24 21:31 1085344 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-03-24 21:31 . 2013-03-24 21:31 188832 ----a-w- c:\windows\system32\javaw.exe
2013-03-24 21:31 . 2013-03-24 21:31 188320 ----a-w- c:\windows\system32\java.exe
2013-03-24 21:31 . 2013-03-24 21:31 108448 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2013-03-24 21:31 . 2013-03-24 21:31 -------- d-----w- c:\program files\Java
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-14 08:08 . 2011-12-24 16:41 72013344 ----a-w- c:\windows\system32\MRT.exe
2013-03-13 16:38 . 2012-04-30 23:49 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-13 16:38 . 2011-07-27 03:34 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-14 06:54 . 2012-01-27 01:51 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2013-02-14 06:54 . 2012-02-22 06:17 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-02-14 06:54 . 2012-02-22 06:17 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-02-12 05:45 . 2013-03-13 20:39 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-13 20:39 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45 . 2013-03-13 20:39 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-13 20:39 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48 . 2013-03-13 20:39 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-13 20:39 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-02 07:31 . 2013-03-14 08:06 17815040 ----a-w- c:\windows\system32\mshtml.dll
2013-02-02 06:58 . 2013-03-14 08:06 10925568 ----a-w- c:\windows\system32\ieframe.dll
2013-02-02 06:57 . 2013-03-14 08:06 2312704 ----a-w- c:\windows\system32\jscript9.dll
2013-02-02 06:48 . 2013-03-14 08:06 1346048 ----a-w- c:\windows\system32\urlmon.dll
2013-02-02 06:47 . 2013-03-14 08:06 1494528 ----a-w- c:\windows\system32\inetcpl.cpl
2013-02-02 06:47 . 2013-03-14 08:06 1392128 ----a-w- c:\windows\system32\wininet.dll
2013-02-02 06:46 . 2013-03-14 08:06 237056 ----a-w- c:\windows\system32\url.dll
2013-02-02 06:43 . 2013-03-14 08:06 85504 ----a-w- c:\windows\system32\jsproxy.dll
2013-02-02 06:42 . 2013-03-14 08:06 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2013-02-02 06:42 . 2013-03-14 08:06 816640 ----a-w- c:\windows\system32\jscript.dll
2013-02-02 06:41 . 2013-03-14 08:06 599040 ----a-w- c:\windows\system32\vbscript.dll
2013-02-02 06:40 . 2013-03-14 08:06 729088 ----a-w- c:\windows\system32\msfeeds.dll
2013-02-02 06:39 . 2013-03-14 08:06 2147840 ----a-w- c:\windows\system32\iertutil.dll
2013-02-02 06:38 . 2013-03-14 08:06 96768 ----a-w- c:\windows\system32\mshtmled.dll
2013-02-02 06:38 . 2013-03-14 08:06 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2013-02-02 06:34 . 2013-03-14 08:06 248320 ----a-w- c:\windows\system32\ieui.dll
2013-02-02 03:38 . 2013-03-14 08:06 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-02-02 03:30 . 2013-03-14 08:06 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-02-02 03:30 . 2013-03-14 08:06 1129472 ----a-w- c:\windows\SysWow64\wininet.dll
2013-02-02 03:26 . 2013-03-14 08:06 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-02-02 03:26 . 2013-03-14 08:06 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-02-02 03:23 . 2013-03-14 08:06 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Spotify Web Helper"="c:\users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-03-29 1104280]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2011-07-12 1298816]
"NortonOnlineBackupReminder"="c:\program files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" [2011-06-22 3218864]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
c:\users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
RollerCoaster Tycoon 3 Registration.lnk - c:\users\Mike\AppData\Local\Temp\{0FD194DB-0062-449A-A8F3-A4DBDDEF87CC}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
CineForm Status.lnk - c:\program files (x86)\CineForm\Tools\GoProCineFormStatusViewer.exe [2012-10-28 152064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-10-26 138912]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-10-30 250984]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-12-24 1255736]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1309010.00E\SYMDS64.SYS [2011-05-16 451192]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1309010.00E\SYMEFA64.SYS [2012-05-22 1129120]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2009-06-24 482384]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130412.001\BHDrvx64.sys [2013-04-12 1390680]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys [2012-06-07 167072]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130417.001\IDSvia64.sys [2013-04-16 513184]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1309010.00E\Ironx64.SYS [2012-04-18 190072]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1309010.00E\SYMNETS.SYS [2012-04-18 405624]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 GFNEXSrv;GFNEX Service;c:\windows\System32\GFNEXSrv.exe [2010-09-10 162824]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [2012-06-16 138272]
S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files (x86)\PC Checkup\SymcPCCULaunchSvc.exe [2012-11-22 132056]
S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [2011-07-19 126392]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe [2012-04-24 390632]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-21 2656280]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2011-02-09 38096]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-14 413800]
S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [2010-11-03 1103464]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2011-07-12 57216]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2011-06-10 138152]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 22197306
*NewlyCreated* - 40882568
*NewlyCreated* - 71184780
*Deregistered* - 22197306
*Deregistered* - 40882568
*Deregistered* - 71184780
*Deregistered* - EraserUtilDrv11220
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-30 16:38]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-08 167256]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-08 391000]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-08 418136]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-07 12558440]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2011-06-10 710560]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://search.mytool.co/?babsrc=home&s=web&as=0&isid=9848
mLocal Page = c:\windows\SysWOW64\blank.htm
Trusted Zone: vizzed.com\www
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
Toolbar-Locked - (no file)
SafeBoot-40882568.sys
Toolbar-Locked - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.9.1.14\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr]
"ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\diMaster.dll\" /prefetch:1"
"ImagePath"="\"c:\program files\CyberLink\Shared files\RichVideo64.exe\"\00Z
[\]^_Ä\00\00Ä\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~Ä\00\00Ä\00\00\00\00r\00\00\00\00\00\00\00''""
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"=hex:51,66,7a,6c,4c,1d,38,12,8d,ec,f8,
7b,2b,25,27,06,e7,c4,bc,f0,98,15,0d,de
"{056C9352-8CB3-4465-9190-8A37B981E949}"=hex:51,66,7a,6c,4c,1d,38,12,3c,90,7f,
01,81,c2,0b,01,ee,86,c9,77,bc,df,ad,5d
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}"=hex:51,66,7a,6c,4c,1d,38,12,60,d8,39,
64,cd,04,79,07,f5,b7,d6,9a,c1,81,e0,1c
"{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,38,12,ea,ef,40,
69,9c,24,e9,02,d1,f8,b7,22,8a,5f,45,18
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{F3C88694-EFFA-4D78-B409-54B7B2535B14}"=hex:51,66,7a,6c,4c,1d,38,12,fa,85,db,
f7,c8,a1,16,08,cb,1f,17,f7,b7,0d,1f,00
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:f6,9a,6d,0b,60,52,cd,01
.
[HKEY_USERS\S-1-5-21-902127083-3053317369-3274058323-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-902127083-3053317369-3274058323-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-902127083-3053317369-3274058323-1000\Software\SecuROM\License information*]
"datasecu"=hex:ef,44,bc,e7,18,e4,3c,74,1b,a0,5c,1a,8b,90,e1,fb,b9,57,a9,6b,19,
0a,23,de,dc,f6,c9,a3,ee,2b,4c,b7,a1,d0,b9,92,1b,e0,e8,5c,ef,76,9a,b8,7d,3e,\
"rkeysecu"=hex:f4,d8,36,e9,9d,8d,46,6c,39,82,4c,ed,3c,2b,7b,26
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-04-17 19:11:59
ComboFix-quarantined-files.txt 2013-04-18 00:11
.
Pre-Run: 160,229,851,136 bytes free
Post-Run: 159,970,066,432 bytes free
.
- - End Of File - - F714A1F739AE23EFAB1E3A7F605E2DD0


----------



## Mark1956 (May 7, 2011)

We are getting there. TDSSKiller has deleted the other entry I asked you to remove, but it also shows the same list of items being moved to quarantine, please run it again so we can be sure everything has now gone.

We also need to unlock and delete an item of Adware from IE found by Combofix.

We are now going to run ComboFix a different way.

Open Notepad by clicking on







and in the *Search* box type: *Notepad.exe* and hit *Enter*.
Copy and paste everything in the *code box* below into it.
_-- Note: Make sure Word Wrap is *unchecked* in Notepad by clicking on *Format* in the top menu._


```
KillAll::
RegLock::
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

RegLockDel;;
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
"{056C9352-8CB3-4465-9190-8A37B981E949}"=-

ClearJavaCache::

Reboot::
```

Save the file as *CFScript.txt* by choosing _Save As..._ in the File Menu, and save it to your Desktop where the ComboFix icon is also located.
Close your browser and* disconnect* from the Internet.
Now use your mouse to *drag*, then *drop* the CFScript.txt file on top of ComboFix.exe as seen in the image below.









This will start ComboFix again and launch the script.
ComboFix may reboot your system when it finishes. This is normal.
A log will be created just as before and saved to C:\ComboFix.txt. Please copy and paste the contents of *ComboFix.txt* in your next reply.
Be sure to *re-enable* your anti-virus and other security programs *after* the scan is complete.
NOTE: if you see a message like this when you attempt to open anything after the reboot *"Illegal Operation attempted on a registry key that has been marked for deletion"* please reboot the system again and the warning should not return.


----------



## shadowandmike (Apr 9, 2013)

I ran both scans as directed. I will post the TDSSKiller log first.

18:28:30.0830 3376 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
18:28:31.0407 3376 ============================================================
18:28:31.0407 3376 Current date / time: 2013/04/18 18:28:31.0407
18:28:31.0407 3376 SystemInfo:
18:28:31.0407 3376 
18:28:31.0407 3376 OS Version: 6.1.7601 ServicePack: 1.0
18:28:31.0407 3376 Product type: Workstation
18:28:31.0407 3376 ComputerName: MIKE-PC
18:28:31.0407 3376 UserName: Mike
18:28:31.0407 3376 Windows directory: C:\windows
18:28:31.0407 3376 System windows directory: C:\windows
18:28:31.0407 3376 Running under WOW64
18:28:31.0407 3376 Processor architecture: Intel x64
18:28:31.0407 3376 Number of processors: 2
18:28:31.0407 3376 Page size: 0x1000
18:28:31.0407 3376 Boot type: Normal boot
18:28:31.0407 3376 ============================================================
18:28:33.0186 3376 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
18:28:33.0201 3376 Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
18:28:33.0669 3376 ============================================================
18:28:33.0669 3376 \Device\Harddisk0\DR0:
18:28:33.0701 3376 MBR partitions:
18:28:33.0701 3376 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2EE800, BlocksNum 0x2346D000
18:28:33.0701 3376 \Device\Harddisk1\DR1:
18:28:33.0701 3376 MBR partitions:
18:28:33.0701 3376 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74705982
18:28:33.0701 3376 ============================================================
18:28:33.0747 3376 C: <-> \Device\Harddisk0\DR0\Partition1
18:28:33.0779 3376 F: <-> \Device\Harddisk1\DR1\Partition1
18:28:33.0779 3376 ============================================================
18:28:33.0779 3376 Initialize success
18:28:33.0779 3376 ============================================================
18:28:43.0310 4932 ============================================================
18:28:43.0310 4932 Scan started
18:28:43.0310 4932 Mode: Manual; SigCheck; TDLFS; 
18:28:43.0310 4932 ============================================================
18:28:46.0477 4932 ================ Scan system memory ========================
18:28:46.0477 4932 System memory - ok
18:28:46.0477 4932 ================ Scan services =============================
18:28:47.0741 4932 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\windows\system32\drivers\1394ohci.sys
18:28:48.0287 4932 1394ohci - ok
18:28:48.0380 4932 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\windows\system32\drivers\ACPI.sys
18:28:48.0411 4932 ACPI - ok
18:28:48.0458 4932 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\windows\system32\drivers\acpipmi.sys
18:28:48.0770 4932 AcpiPmi - ok
18:28:48.0942 4932 [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
18:28:48.0957 4932 AdobeARMservice - ok
18:28:49.0254 4932 [ EA856F4A46320389D1899B2CAA7BF40F ] AdobeFlashPlayerUpdateSvc C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
18:28:49.0301 4932 AdobeFlashPlayerUpdateSvc - ok
18:28:49.0394 4932 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\windows\system32\drivers\adp94xx.sys
18:28:49.0441 4932 adp94xx - ok
18:28:49.0488 4932 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\windows\system32\drivers\adpahci.sys
18:28:49.0503 4932 adpahci - ok
18:28:49.0566 4932 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\windows\system32\drivers\adpu320.sys
18:28:49.0597 4932 adpu320 - ok
18:28:49.0644 4932 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\windows\System32\aelupsvc.dll
18:28:49.0971 4932 AeLookupSvc - ok
18:28:50.0034 4932 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\windows\system32\drivers\afd.sys
18:28:50.0205 4932 AFD - ok
18:28:50.0268 4932 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\windows\system32\drivers\agp440.sys
18:28:50.0283 4932 agp440 - ok
18:28:50.0361 4932 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\windows\System32\alg.exe
18:28:50.0486 4932 ALG - ok
18:28:50.0549 4932 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\windows\system32\drivers\aliide.sys
18:28:50.0611 4932 aliide - ok
18:28:50.0642 4932 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\windows\system32\drivers\amdide.sys
18:28:50.0705 4932 amdide - ok
18:28:50.0751 4932 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\windows\system32\drivers\amdk8.sys
18:28:50.0876 4932 AmdK8 - ok
18:28:50.0907 4932 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\windows\system32\drivers\amdppm.sys
18:28:51.0048 4932 AmdPPM - ok
18:28:51.0157 4932 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\windows\system32\drivers\amdsata.sys
18:28:51.0235 4932 amdsata - ok
18:28:51.0298 4932 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\windows\system32\drivers\amdsbs.sys
18:28:51.0345 4932 amdsbs - ok
18:28:51.0408 4932 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\windows\system32\drivers\amdxata.sys
18:28:51.0423 4932 amdxata - ok
18:28:51.0486 4932 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\windows\system32\drivers\appid.sys
18:28:51.0985 4932 AppID - ok
18:28:52.0016 4932 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\windows\System32\appidsvc.dll
18:28:52.0141 4932 AppIDSvc - ok
18:28:52.0219 4932 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\windows\System32\appinfo.dll
18:28:52.0281 4932 Appinfo - ok
18:28:52.0406 4932 [ 7EF47644B74EBE721CC32211D3C35E76 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
18:28:52.0453 4932 Apple Mobile Device - ok
18:28:52.0546 4932 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\windows\system32\drivers\arc.sys
18:28:52.0593 4932 arc - ok
18:28:52.0640 4932 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\windows\system32\drivers\arcsas.sys
18:28:52.0687 4932 arcsas - ok
18:28:52.0765 4932 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\windows\system32\DRIVERS\asyncmac.sys
18:28:52.0936 4932 AsyncMac - ok
18:28:52.0999 4932 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\windows\system32\drivers\atapi.sys
18:28:53.0014 4932 atapi - ok
18:28:53.0139 4932 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll
18:28:53.0248 4932 AudioEndpointBuilder - ok
18:28:53.0280 4932 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\windows\System32\Audiosrv.dll
18:28:53.0326 4932 AudioSrv - ok
18:28:53.0451 4932 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\windows\System32\AxInstSV.dll
18:28:53.0857 4932 AxInstSV - ok
18:28:53.0982 4932 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\windows\system32\drivers\bxvbda.sys
18:28:54.0184 4932 b06bdrv - ok
18:28:54.0278 4932 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\windows\system32\DRIVERS\b57nd60a.sys
18:28:54.0356 4932 b57nd60a - ok
18:28:54.0403 4932 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\windows\System32\bdesvc.dll
18:28:54.0590 4932 BDESVC - ok
18:28:54.0652 4932 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\windows\system32\drivers\Beep.sys
18:28:54.0793 4932 Beep - ok
18:28:54.0855 4932 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\windows\System32\bfe.dll
18:28:54.0933 4932 BFE - ok
18:28:55.0245 4932 [ 7B56A40EAAACF1867FF178501D3EA185 ] BHDrvx64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130412.001\BHDrvx64.sys
18:28:55.0276 4932 BHDrvx64 - ok
18:28:55.0354 4932 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\windows\system32\qmgr.dll
18:28:55.0542 4932 BITS - ok
18:28:55.0588 4932 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\windows\system32\DRIVERS\blbdrive.sys
18:28:55.0682 4932 blbdrive - ok
18:28:55.0822 4932 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
18:28:55.0838 4932 Bonjour Service - ok
18:28:55.0885 4932 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\windows\system32\DRIVERS\bowser.sys
18:28:56.0025 4932 bowser - ok
18:28:56.0166 4932 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\windows\system32\drivers\BrFiltLo.sys
18:28:56.0306 4932 BrFiltLo - ok
18:28:56.0431 4932 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\windows\system32\drivers\BrFiltUp.sys
18:28:56.0493 4932 BrFiltUp - ok
18:28:56.0587 4932 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\windows\system32\DRIVERS\bridge.sys
18:28:56.0743 4932 BridgeMP - ok
18:28:56.0852 4932 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\windows\System32\browser.dll
18:28:56.0992 4932 Browser - ok
18:28:57.0070 4932 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\windows\System32\Drivers\Brserid.sys
18:28:57.0180 4932 Brserid - ok
18:28:57.0211 4932 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\windows\System32\Drivers\BrSerWdm.sys
18:28:57.0289 4932 BrSerWdm - ok
18:28:57.0320 4932 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\windows\System32\Drivers\BrUsbMdm.sys
18:28:57.0460 4932 BrUsbMdm - ok
18:28:57.0492 4932 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\windows\System32\Drivers\BrUsbSer.sys
18:28:57.0554 4932 BrUsbSer - ok
18:28:57.0616 4932 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\windows\system32\drivers\bthmodem.sys
18:28:57.0694 4932 BTHMODEM - ok
18:28:57.0772 4932 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\windows\system32\bthserv.dll
18:28:57.0897 4932 bthserv - ok
18:28:57.0928 4932 catchme - ok
18:28:58.0100 4932 [ 2C6FFCCA37B002AAB3C7C31A6D780A76 ] ccSet_NIS C:\windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys
18:28:58.0147 4932 ccSet_NIS - ok
18:28:58.0225 4932 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\windows\system32\DRIVERS\cdfs.sys
18:28:58.0350 4932 cdfs - ok
18:28:58.0396 4932 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\windows\system32\DRIVERS\cdrom.sys
18:28:58.0537 4932 cdrom - ok
18:28:58.0662 4932 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\windows\System32\certprop.dll
18:28:58.0849 4932 CertPropSvc - ok
18:28:58.0911 4932 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\windows\system32\drivers\circlass.sys
18:28:59.0067 4932 circlass - ok
18:28:59.0145 4932 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\windows\system32\CLFS.sys
18:28:59.0192 4932 CLFS - ok
18:28:59.0301 4932 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:28:59.0364 4932 clr_optimization_v2.0.50727_32 - ok
18:28:59.0473 4932 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
18:28:59.0520 4932 clr_optimization_v2.0.50727_64 - ok
18:28:59.0691 4932 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:28:59.0878 4932 clr_optimization_v4.0.30319_32 - ok
18:29:00.0003 4932 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
18:29:00.0066 4932 clr_optimization_v4.0.30319_64 - ok
18:29:00.0112 4932 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\windows\system32\DRIVERS\CmBatt.sys
18:29:00.0159 4932 CmBatt - ok
18:29:00.0237 4932 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\windows\system32\drivers\cmdide.sys
18:29:00.0331 4932 cmdide - ok
18:29:00.0409 4932 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\windows\system32\Drivers\cng.sys
18:29:00.0518 4932 CNG - ok
18:29:00.0596 4932 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\windows\system32\drivers\compbatt.sys
18:29:00.0612 4932 Compbatt - ok
18:29:00.0658 4932 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\windows\system32\DRIVERS\CompositeBus.sys
18:29:00.0721 4932 CompositeBus - ok
18:29:00.0752 4932 COMSysApp - ok
18:29:00.0783 4932 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\windows\system32\drivers\crcdisk.sys
18:29:00.0814 4932 crcdisk - ok
18:29:00.0877 4932 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\windows\system32\cryptsvc.dll
18:29:01.0017 4932 CryptSvc - ok
18:29:01.0204 4932 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
18:29:01.0251 4932 cvhsvc - ok
18:29:01.0376 4932 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\windows\system32\rpcss.dll
18:29:01.0516 4932 DcomLaunch - ok
18:29:01.0610 4932 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\windows\System32\defragsvc.dll
18:29:01.0766 4932 defragsvc - ok
18:29:01.0844 4932 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\windows\system32\Drivers\dfsc.sys
18:29:01.0984 4932 DfsC - ok
18:29:02.0062 4932 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\windows\system32\dhcpcore.dll
18:29:02.0421 4932 Dhcp - ok
18:29:02.0452 4932 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\windows\system32\drivers\discache.sys
18:29:02.0608 4932 discache - ok
18:29:02.0686 4932 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\windows\system32\drivers\disk.sys
18:29:02.0718 4932 Disk - ok
18:29:02.0764 4932 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\windows\System32\dnsrslvr.dll
18:29:02.0905 4932 Dnscache - ok
18:29:02.0967 4932 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\windows\System32\dot3svc.dll
18:29:03.0076 4932 dot3svc - ok
18:29:03.0123 4932 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\windows\system32\dps.dll
18:29:03.0248 4932 DPS - ok
18:29:03.0326 4932 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\windows\system32\drivers\drmkaud.sys
18:29:03.0435 4932 drmkaud - ok
18:29:03.0576 4932 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\windows\System32\drivers\dxgkrnl.sys
18:29:03.0622 4932 DXGKrnl - ok
18:29:03.0685 4932 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\windows\System32\eapsvc.dll
18:29:03.0794 4932 EapHost - ok
18:29:04.0075 4932 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\windows\system32\drivers\evbda.sys
18:29:05.0027 4932 ebdrv - ok
18:29:05.0293 4932 [ 4353FF94D47A0A9D52B89ECCF0CDB013 ] eeCtrl C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
18:29:05.0511 4932 eeCtrl - ok
18:29:05.0620 4932 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\windows\System32\lsass.exe
18:29:06.0322 4932 EFS - ok
18:29:06.0541 4932 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\windows\ehome\ehRecvr.exe
18:29:07.0149 4932 ehRecvr - ok
18:29:07.0289 4932 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\windows\ehome\ehsched.exe
18:29:07.0352 4932 ehSched - ok
18:29:07.0508 4932 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\windows\system32\drivers\elxstor.sys
18:29:07.0555 4932 elxstor - ok
18:29:07.0679 4932 [ C5BCCB378D0A896304A3E71BE7215983 ] EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
18:29:07.0695 4932 EraserUtilRebootDrv - ok
18:29:07.0711 4932 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\windows\system32\drivers\errdev.sys
18:29:07.0789 4932 ErrDev - ok
18:29:07.0882 4932 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\windows\system32\es.dll
18:29:08.0023 4932 EventSystem - ok
18:29:08.0085 4932 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\windows\system32\drivers\exfat.sys
18:29:08.0163 4932 exfat - ok
18:29:08.0194 4932 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\windows\system32\drivers\fastfat.sys
18:29:08.0350 4932 fastfat - ok
18:29:08.0444 4932 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\windows\system32\fxssvc.exe
18:29:08.0615 4932 Fax - ok
18:29:08.0662 4932 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\windows\system32\drivers\fdc.sys
18:29:08.0740 4932 fdc - ok
18:29:08.0787 4932 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\windows\system32\fdPHost.dll
18:29:08.0881 4932 fdPHost - ok
18:29:08.0912 4932 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\windows\system32\fdrespub.dll
18:29:09.0037 4932 FDResPub - ok
18:29:09.0115 4932 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\windows\system32\drivers\fileinfo.sys
18:29:09.0161 4932 FileInfo - ok
18:29:09.0177 4932 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\windows\system32\drivers\filetrace.sys
18:29:09.0286 4932 Filetrace - ok
18:29:09.0349 4932 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\windows\system32\drivers\flpydisk.sys
18:29:09.0395 4932 flpydisk - ok
18:29:09.0505 4932 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\windows\system32\drivers\fltmgr.sys
18:29:09.0551 4932 FltMgr - ok
18:29:09.0801 4932 [ C4C183E6551084039EC862DA1C945E3D ] FontCache C:\windows\system32\FntCache.dll
18:29:09.0973 4932 FontCache - ok
18:29:10.0097 4932 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
18:29:10.0129 4932 FontCache3.0.0.0 - ok
18:29:10.0160 4932 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\windows\system32\drivers\FsDepends.sys
18:29:10.0175 4932 FsDepends - ok
18:29:10.0285 4932 [ B16B626996C74B564005BA855C5DEE90 ] fssfltr C:\windows\system32\DRIVERS\fssfltr.sys
18:29:10.0363 4932 fssfltr - ok
18:29:10.0628 4932 [ 812E1BA5C52A78F13EA6AA10DF708B1D ] fsssvc C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
18:29:10.0815 4932 fsssvc - ok
18:29:10.0862 4932 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\windows\system32\drivers\Fs_Rec.sys
18:29:10.0893 4932 Fs_Rec - ok
18:29:10.0971 4932 [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol C:\windows\system32\DRIVERS\fvevol.sys
18:29:11.0018 4932 fvevol - ok
18:29:11.0080 4932 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\windows\system32\drivers\gagp30kx.sys
18:29:11.0127 4932 gagp30kx - ok
18:29:11.0189 4932 [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM C:\windows\system32\DRIVERS\GEARAspiWDM.sys
18:29:11.0205 4932 GEARAspiWDM - ok
18:29:11.0330 4932 [ FA07EC01952729DDDDC5BF4BAE06B09E ] GFNEXSrv C:\Windows\System32\GFNEXSrv.exe
18:29:11.0361 4932 GFNEXSrv - ok
18:29:11.0486 4932 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\windows\System32\gpsvc.dll
18:29:11.0579 4932 gpsvc - ok
18:29:11.0611 4932 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\windows\system32\drivers\hcw85cir.sys
18:29:11.0751 4932 hcw85cir - ok
18:29:11.0876 4932 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys
18:29:11.0969 4932 HdAudAddService - ok
18:29:12.0032 4932 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\windows\system32\DRIVERS\HDAudBus.sys
18:29:12.0110 4932 HDAudBus - ok
18:29:12.0125 4932 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\windows\system32\drivers\HidBatt.sys
18:29:12.0219 4932 HidBatt - ok
18:29:12.0266 4932 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\windows\system32\drivers\hidbth.sys
18:29:12.0422 4932 HidBth - ok
18:29:12.0469 4932 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\windows\system32\drivers\hidir.sys
18:29:12.0562 4932 HidIr - ok
18:29:12.0593 4932 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\windows\System32\hidserv.dll
18:29:12.0687 4932 hidserv - ok
18:29:12.0781 4932 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\windows\system32\DRIVERS\hidusb.sys
18:29:12.0812 4932 HidUsb - ok
18:29:12.0874 4932 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\windows\system32\kmsvc.dll
18:29:13.0077 4932 hkmsvc - ok
18:29:13.0108 4932 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\windows\system32\ListSvc.dll
18:29:13.0295 4932 HomeGroupListener - ok
18:29:13.0358 4932 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\windows\system32\provsvc.dll
18:29:13.0436 4932 HomeGroupProvider - ok
18:29:13.0498 4932 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\windows\system32\drivers\HpSAMD.sys
18:29:13.0545 4932 HpSAMD - ok
18:29:13.0623 4932 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\windows\system32\drivers\HTTP.sys
18:29:13.0748 4932 HTTP - ok
18:29:13.0779 4932 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\windows\system32\drivers\hwpolicy.sys
18:29:13.0795 4932 hwpolicy - ok
18:29:13.0857 4932 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\windows\system32\DRIVERS\i8042prt.sys
18:29:13.0904 4932 i8042prt - ok
18:29:14.0013 4932 [ D469B77687E12FE43E344806740B624D ] iaStor C:\windows\system32\DRIVERS\iaStor.sys
18:29:14.0029 4932 iaStor - ok
18:29:14.0138 4932 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\windows\system32\drivers\iaStorV.sys
18:29:14.0216 4932 iaStorV - ok
18:29:14.0356 4932 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
18:29:14.0543 4932 idsvc - ok
18:29:14.0777 4932 [ A48928D4CCA6F8B731989DB08CF2C0AB ] IDSVia64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130417.001\IDSvia64.sys
18:29:14.0809 4932 IDSVia64 - ok
18:29:15.0916 4932 [ 370C2A8629B30F910F740387795DDC6F ] igfx C:\windows\system32\DRIVERS\igdkmd64.sys
18:29:16.0384 4932 igfx - ok
18:29:16.0431 4932 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\windows\system32\drivers\iirsp.sys
18:29:16.0493 4932 iirsp - ok
18:29:16.0603 4932 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\windows\System32\ikeext.dll
18:29:16.0696 4932 IKEEXT - ok
18:29:17.0133 4932 [ 028E40182A6F0374978C755F85B9F07C ] IntcAzAudAddService C:\windows\system32\drivers\RTKVHD64.sys
18:29:17.0180 4932 IntcAzAudAddService - ok
18:29:17.0242 4932 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\windows\system32\drivers\intelide.sys
18:29:17.0273 4932 intelide - ok
18:29:17.0351 4932 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\windows\system32\DRIVERS\intelppm.sys
18:29:17.0429 4932 intelppm - ok
18:29:17.0507 4932 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\windows\system32\ipbusenum.dll
18:29:17.0632 4932 IPBusEnum - ok
18:29:17.0679 4932 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\windows\system32\DRIVERS\ipfltdrv.sys
18:29:17.0804 4932 IpFilterDriver - ok
18:29:17.0913 4932 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\windows\System32\iphlpsvc.dll
18:29:18.0069 4932 iphlpsvc - ok
18:29:18.0100 4932 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\windows\system32\drivers\IPMIDrv.sys
18:29:18.0163 4932 IPMIDRV - ok
18:29:18.0194 4932 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\windows\system32\drivers\ipnat.sys
18:29:18.0303 4932 IPNAT - ok
18:29:18.0490 4932 [ 50D6CCC6FF5561F9F56946B3E6164FB8 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
18:29:18.0537 4932 iPod Service - ok
18:29:18.0615 4932 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\windows\system32\drivers\irenum.sys
18:29:18.0693 4932 IRENUM - ok
18:29:18.0709 4932 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\windows\system32\drivers\isapnp.sys
18:29:18.0724 4932 isapnp - ok
18:29:18.0818 4932 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\windows\system32\drivers\msiscsi.sys
18:29:18.0911 4932 iScsiPrt - ok
18:29:18.0974 4932 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\windows\system32\DRIVERS\kbdclass.sys
18:29:19.0005 4932 kbdclass - ok
18:29:19.0036 4932 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\windows\system32\drivers\kbdhid.sys
18:29:19.0114 4932 kbdhid - ok
18:29:19.0145 4932 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\windows\system32\lsass.exe
18:29:19.0145 4932 KeyIso - ok
18:29:19.0208 4932 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\windows\system32\Drivers\ksecdd.sys
18:29:19.0255 4932 KSecDD - ok
18:29:19.0317 4932 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\windows\system32\Drivers\ksecpkg.sys
18:29:19.0364 4932 KSecPkg - ok
18:29:19.0395 4932 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\windows\system32\drivers\ksthunk.sys
18:29:19.0489 4932 ksthunk - ok
18:29:19.0535 4932 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\windows\system32\msdtckrm.dll
18:29:19.0660 4932 KtmRm - ok
18:29:19.0723 4932 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\windows\System32\srvsvc.dll
18:29:19.0816 4932 LanmanServer - ok
18:29:19.0847 4932 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\windows\System32\wkssvc.dll
18:29:19.0925 4932 LanmanWorkstation - ok
18:29:19.0972 4932 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\windows\system32\DRIVERS\lltdio.sys
18:29:20.0050 4932 lltdio - ok
18:29:20.0159 4932 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\windows\System32\lltdsvc.dll
18:29:20.0269 4932 lltdsvc - ok
18:29:20.0300 4932 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\windows\System32\lmhsvc.dll
18:29:20.0331 4932 lmhosts - ok
18:29:20.0518 4932 [ 7F32D4C47A50E7223491E8FB9359907D ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
18:29:21.0033 4932 LMS - ok
18:29:21.0064 4932 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\windows\system32\drivers\lsi_fc.sys
18:29:21.0080 4932 LSI_FC - ok
18:29:21.0127 4932 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\windows\system32\drivers\lsi_sas.sys
18:29:21.0173 4932 LSI_SAS - ok
18:29:21.0189 4932 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\windows\system32\drivers\lsi_sas2.sys
18:29:21.0205 4932 LSI_SAS2 - ok
18:29:21.0251 4932 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\windows\system32\drivers\lsi_scsi.sys
18:29:21.0283 4932 LSI_SCSI - ok
18:29:21.0345 4932 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\windows\system32\drivers\luafv.sys
18:29:21.0439 4932 luafv - ok
18:29:21.0470 4932 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\windows\system32\Mcx2Svc.dll
18:29:21.0532 4932 Mcx2Svc - ok
18:29:21.0563 4932 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\windows\system32\drivers\megasas.sys
18:29:21.0610 4932 megasas - ok
18:29:21.0673 4932 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\windows\system32\drivers\MegaSR.sys
18:29:21.0719 4932 MegaSR - ok
18:29:21.0782 4932 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\windows\system32\DRIVERS\HECIx64.sys
18:29:21.0813 4932 MEIx64 - ok
18:29:21.0844 4932 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\windows\system32\mmcss.dll
18:29:21.0907 4932 MMCSS - ok
18:29:21.0969 4932 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\windows\system32\drivers\modem.sys
18:29:22.0094 4932 Modem - ok
18:29:22.0156 4932 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\windows\system32\DRIVERS\monitor.sys
18:29:22.0219 4932 monitor - ok
18:29:22.0265 4932 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\windows\system32\DRIVERS\mouclass.sys
18:29:22.0297 4932 mouclass - ok
18:29:22.0328 4932 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\windows\system32\DRIVERS\mouhid.sys
18:29:22.0390 4932 mouhid - ok
18:29:22.0421 4932 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\windows\system32\drivers\mountmgr.sys
18:29:22.0468 4932 mountmgr - ok
18:29:22.0515 4932 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\windows\system32\drivers\mpio.sys
18:29:22.0531 4932 mpio - ok
18:29:22.0562 4932 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\windows\system32\drivers\mpsdrv.sys
18:29:22.0593 4932 mpsdrv - ok
18:29:22.0624 4932 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\windows\system32\mpssvc.dll
18:29:22.0702 4932 MpsSvc - ok
18:29:22.0733 4932 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\windows\system32\drivers\mrxdav.sys
18:29:22.0796 4932 MRxDAV - ok
18:29:22.0858 4932 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\windows\system32\DRIVERS\mrxsmb.sys
18:29:22.0952 4932 mrxsmb - ok
18:29:22.0983 4932 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\windows\system32\DRIVERS\mrxsmb10.sys
18:29:23.0061 4932 mrxsmb10 - ok
18:29:23.0077 4932 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\windows\system32\DRIVERS\mrxsmb20.sys
18:29:23.0108 4932 mrxsmb20 - ok
18:29:23.0155 4932 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\windows\system32\DRIVERS\msahci.sys
18:29:23.0186 4932 msahci - ok
18:29:23.0217 4932 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\windows\system32\drivers\msdsm.sys
18:29:23.0248 4932 msdsm - ok
18:29:23.0264 4932 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\windows\System32\msdtc.exe
18:29:23.0342 4932 MSDTC - ok
18:29:23.0389 4932 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\windows\system32\drivers\Msfs.sys
18:29:23.0435 4932 Msfs - ok
18:29:23.0451 4932 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\windows\System32\drivers\mshidkmdf.sys
18:29:23.0513 4932 mshidkmdf - ok
18:29:23.0545 4932 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\windows\system32\drivers\msisadrv.sys
18:29:23.0560 4932 msisadrv - ok
18:29:23.0591 4932 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\windows\system32\iscsiexe.dll
18:29:23.0685 4932 MSiSCSI - ok
18:29:23.0701 4932 msiserver - ok
18:29:23.0732 4932 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\windows\system32\drivers\MSKSSRV.sys
18:29:23.0825 4932 MSKSSRV - ok
18:29:23.0857 4932 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\windows\system32\drivers\MSPCLOCK.sys
18:29:23.0950 4932 MSPCLOCK - ok
18:29:23.0981 4932 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\windows\system32\drivers\MSPQM.sys
18:29:24.0044 4932 MSPQM - ok
18:29:24.0075 4932 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\windows\system32\drivers\MsRPC.sys
18:29:24.0122 4932 MsRPC - ok
18:29:24.0153 4932 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\windows\system32\DRIVERS\mssmbios.sys
18:29:24.0153 4932 mssmbios - ok
18:29:24.0215 4932 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\windows\system32\drivers\MSTEE.sys
18:29:24.0309 4932 MSTEE - ok
18:29:24.0340 4932 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\windows\system32\drivers\MTConfig.sys
18:29:24.0387 4932 MTConfig - ok
18:29:24.0403 4932 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\windows\system32\Drivers\mup.sys
18:29:24.0403 4932 Mup - ok
18:29:24.0465 4932 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\windows\system32\qagentRT.dll
18:29:24.0559 4932 napagent - ok
18:29:24.0637 4932 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\windows\system32\DRIVERS\nwifi.sys
18:29:24.0683 4932 NativeWifiP - ok
18:29:24.0839 4932 [ 88A2F45CE66B904285978D6BB13AFEB2 ] NAVENG C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130418.005\ENG64.SYS
18:29:25.0151 4932 NAVENG - ok
18:29:25.0370 4932 [ D2A545DA3A90BBFA40E020C23F1B7A48 ] NAVEX15 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20130418.005\EX64.SYS
18:29:25.0448 4932 NAVEX15 - ok
18:29:25.0557 4932 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\windows\system32\drivers\ndis.sys
18:29:25.0604 4932 NDIS - ok
18:29:25.0651 4932 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\windows\system32\DRIVERS\ndiscap.sys
18:29:25.0744 4932 NdisCap - ok
18:29:25.0775 4932 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\windows\system32\DRIVERS\ndistapi.sys
18:29:25.0822 4932 NdisTapi - ok
18:29:25.0838 4932 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\windows\system32\DRIVERS\ndisuio.sys
18:29:25.0900 4932 Ndisuio - ok
18:29:25.0947 4932 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\windows\system32\DRIVERS\ndiswan.sys
18:29:26.0041 4932 NdisWan - ok
18:29:26.0056 4932 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\windows\system32\drivers\NDProxy.sys
18:29:26.0103 4932 NDProxy - ok
18:29:26.0119 4932 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\windows\system32\DRIVERS\netbios.sys
18:29:26.0212 4932 NetBIOS - ok
18:29:26.0306 4932 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\windows\system32\DRIVERS\netbt.sys
18:29:26.0368 4932 NetBT - ok
18:29:26.0384 4932 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\windows\system32\lsass.exe
18:29:26.0399 4932 Netlogon - ok
18:29:26.0446 4932 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\windows\System32\netman.dll
18:29:26.0509 4932 Netman - ok
18:29:26.0602 4932 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\windows\System32\netprofm.dll
18:29:26.0696 4932 netprofm - ok
18:29:26.0727 4932 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
18:29:26.0758 4932 NetTcpPortSharing - ok
18:29:26.0805 4932 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\windows\system32\drivers\nfrd960.sys
18:29:26.0821 4932 nfrd960 - ok
18:29:26.0977 4932 [ F2840DBFE9322F35557219AE82CC4597 ] NIS C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
18:29:27.0008 4932 NIS - ok
18:29:27.0039 4932 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\windows\System32\nlasvc.dll
18:29:27.0086 4932 NlaSvc - ok
18:29:27.0148 4932 Norton PC Checkup Application Launcher - ok
18:29:27.0164 4932 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\windows\system32\drivers\Npfs.sys
18:29:27.0226 4932 Npfs - ok
18:29:27.0242 4932 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\windows\system32\nsisvc.dll
18:29:27.0320 4932 nsi - ok
18:29:27.0351 4932 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\windows\system32\drivers\nsiproxy.sys
18:29:27.0445 4932 nsiproxy - ok
18:29:27.0569 4932 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\windows\system32\drivers\Ntfs.sys
18:29:27.0679 4932 Ntfs - ok
18:29:27.0710 4932 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\windows\system32\drivers\Null.sys
18:29:27.0757 4932 Null - ok
18:29:27.0788 4932 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\windows\system32\drivers\nvraid.sys
18:29:27.0819 4932 nvraid - ok
18:29:27.0835 4932 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\windows\system32\drivers\nvstor.sys
18:29:27.0850 4932 nvstor - ok
18:29:27.0866 4932 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\windows\system32\drivers\nv_agp.sys
18:29:27.0881 4932 nv_agp - ok
18:29:27.0913 4932 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\windows\system32\drivers\ohci1394.sys
18:29:27.0975 4932 ohci1394 - ok
18:29:28.0037 4932 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:29:28.0084 4932 ose - ok
18:29:28.0568 4932 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
18:29:28.0864 4932 osppsvc - ok
18:29:28.0911 4932 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\windows\system32\pnrpsvc.dll
18:29:29.0020 4932 p2pimsvc - ok
18:29:29.0067 4932 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\windows\system32\p2psvc.dll
18:29:29.0129 4932 p2psvc - ok
18:29:29.0176 4932 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\windows\system32\drivers\parport.sys
18:29:29.0207 4932 Parport - ok
18:29:29.0270 4932 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\windows\system32\drivers\partmgr.sys
18:29:29.0301 4932 partmgr - ok
18:29:29.0348 4932 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\windows\System32\pcasvc.dll
18:29:29.0426 4932 PcaSvc - ok
18:29:29.0488 4932 [ 2F86BE1818C2D7AC90478E3323EE7FCB ] PCCUJobMgr C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
18:29:29.0519 4932 PCCUJobMgr - ok
18:29:29.0551 4932 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\windows\system32\drivers\pci.sys
18:29:29.0566 4932 pci - ok
18:29:29.0582 4932 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\windows\system32\DRIVERS\pciide.sys
18:29:29.0597 4932 pciide - ok
18:29:29.0597 4932 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\windows\system32\drivers\pcmcia.sys
18:29:29.0629 4932 pcmcia - ok
18:29:29.0629 4932 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\windows\system32\drivers\pcw.sys
18:29:29.0644 4932 pcw - ok
18:29:29.0675 4932 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\windows\system32\drivers\peauth.sys
18:29:29.0769 4932 PEAUTH - ok
18:29:30.0206 4932 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\windows\SysWow64\perfhost.exe
18:29:30.0284 4932 PerfHost - ok
18:29:30.0346 4932 [ 91111CEBBDE8015E822C46120ED9537C ] PGEffect C:\windows\system32\DRIVERS\pgeffect.sys
18:29:30.0377 4932 PGEffect - ok
18:29:30.0440 4932 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\windows\system32\pla.dll
18:29:30.0596 4932 pla - ok
18:29:30.0643 4932 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\windows\system32\umpnpmgr.dll
18:29:30.0752 4932 PlugPlay - ok
18:29:30.0783 4932 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\windows\system32\pnrpauto.dll
18:29:30.0845 4932 PNRPAutoReg - ok
18:29:30.0892 4932 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\windows\system32\pnrpsvc.dll
18:29:30.0923 4932 PNRPsvc - ok
18:29:30.0970 4932 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\windows\System32\ipsecsvc.dll
18:29:31.0048 4932 PolicyAgent - ok
18:29:31.0079 4932 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\windows\system32\umpo.dll
18:29:31.0142 4932 Power - ok
18:29:31.0189 4932 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\windows\system32\DRIVERS\raspptp.sys
18:29:31.0298 4932 PptpMiniport - ok
18:29:31.0345 4932 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\windows\system32\drivers\processr.sys
18:29:31.0407 4932 Processor - ok
18:29:31.0454 4932 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\windows\system32\profsvc.dll
18:29:31.0532 4932 ProfSvc - ok
18:29:31.0547 4932 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\windows\system32\lsass.exe
18:29:31.0563 4932 ProtectedStorage - ok
18:29:31.0594 4932 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\windows\system32\DRIVERS\pacer.sys
18:29:31.0657 4932 Psched - ok
18:29:31.0766 4932 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\windows\system32\drivers\ql2300.sys
18:29:31.0828 4932 ql2300 - ok
18:29:31.0859 4932 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\windows\system32\drivers\ql40xx.sys
18:29:31.0906 4932 ql40xx - ok
18:29:31.0937 4932 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\windows\system32\qwave.dll
18:29:31.0969 4932 QWAVE - ok
18:29:31.0984 4932 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\windows\system32\drivers\qwavedrv.sys
18:29:32.0031 4932 QWAVEdrv - ok
18:29:32.0078 4932 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\windows\system32\DRIVERS\rasacd.sys
18:29:32.0171 4932 RasAcd - ok
18:29:32.0203 4932 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\windows\system32\DRIVERS\AgileVpn.sys
18:29:32.0234 4932 RasAgileVpn - ok
18:29:32.0265 4932 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\windows\System32\rasauto.dll
18:29:32.0343 4932 RasAuto - ok
18:29:32.0374 4932 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\windows\system32\DRIVERS\rasl2tp.sys
18:29:32.0452 4932 Rasl2tp - ok
18:29:32.0499 4932 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\windows\System32\rasmans.dll
18:29:32.0546 4932 RasMan - ok
18:29:32.0561 4932 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\windows\system32\DRIVERS\raspppoe.sys
18:29:32.0624 4932 RasPppoe - ok
18:29:32.0671 4932 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\windows\system32\DRIVERS\rassstp.sys
18:29:32.0749 4932 RasSstp - ok
18:29:32.0780 4932 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\windows\system32\DRIVERS\rdbss.sys
18:29:32.0842 4932 rdbss - ok
18:29:32.0873 4932 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\windows\system32\drivers\rdpbus.sys
18:29:32.0936 4932 rdpbus - ok
18:29:32.0951 4932 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\windows\system32\DRIVERS\RDPCDD.sys
18:29:33.0045 4932 RDPCDD - ok
18:29:33.0076 4932 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\windows\system32\drivers\rdpencdd.sys
18:29:33.0139 4932 RDPENCDD - ok
18:29:33.0170 4932 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\windows\system32\drivers\rdprefmp.sys
18:29:33.0201 4932 RDPREFMP - ok
18:29:33.0248 4932 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\windows\system32\drivers\RDPWD.sys
18:29:33.0326 4932 RDPWD - ok
18:29:33.0373 4932 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\windows\system32\drivers\rdyboost.sys
18:29:33.0388 4932 rdyboost - ok
18:29:33.0419 4932 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\windows\System32\mprdim.dll
18:29:33.0513 4932 RemoteAccess - ok
18:29:33.0575 4932 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\windows\system32\regsvc.dll
18:29:33.0669 4932 RemoteRegistry - ok
18:29:33.0794 4932 [ FBA61BB4C484A01A655AFB18FF86C417 ] RichVideo64 C:\Program Files\CyberLink\Shared files\RichVideo64.exe
18:29:33.0841 4932 RichVideo64 - ok
18:29:33.0872 4932 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\windows\System32\RpcEpMap.dll
18:29:33.0934 4932 RpcEptMapper - ok
18:29:33.0965 4932 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\windows\system32\locator.exe
18:29:34.0028 4932 RpcLocator - ok
18:29:34.0059 4932 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\windows\system32\rpcss.dll
18:29:34.0106 4932 RpcSs - ok
18:29:34.0137 4932 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\windows\system32\DRIVERS\rspndr.sys
18:29:34.0215 4932 rspndr - ok
18:29:34.0277 4932 [ BE29B0A3AC1E8BD02FFAB8CEE86BADFA ] RSUSBSTOR C:\windows\system32\Drivers\RtsUStor.sys
18:29:34.0324 4932 RSUSBSTOR - ok
18:29:34.0371 4932 [ 6D3C7E7D82D3DC92DC2A8B0DF9F20F8A ] RTL8167 C:\windows\system32\DRIVERS\Rt64win7.sys
18:29:34.0402 4932 RTL8167 - ok
18:29:34.0449 4932 [ E7D79600575F755614DD5D79B044D588 ] RTL8192Ce C:\windows\system32\DRIVERS\rtl8192Ce.sys
18:29:34.0480 4932 RTL8192Ce - ok
18:29:34.0480 4932 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\windows\system32\lsass.exe
18:29:34.0496 4932 SamSs - ok
18:29:34.0527 4932 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\windows\system32\drivers\sbp2port.sys
18:29:34.0543 4932 sbp2port - ok
18:29:34.0574 4932 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\windows\System32\SCardSvr.dll
18:29:34.0605 4932 SCardSvr - ok
18:29:34.0621 4932 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\windows\system32\DRIVERS\scfilter.sys
18:29:34.0699 4932 scfilter - ok
18:29:34.0761 4932 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\windows\system32\schedsvc.dll
18:29:34.0886 4932 Schedule - ok
18:29:34.0917 4932 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\windows\System32\certprop.dll
18:29:34.0964 4932 SCPolicySvc - ok
18:29:34.0995 4932 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\windows\System32\SDRSVC.dll
18:29:35.0104 4932 SDRSVC - ok
18:29:35.0135 4932 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\windows\system32\drivers\secdrv.sys
18:29:35.0229 4932 secdrv - ok
18:29:35.0260 4932 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\windows\system32\seclogon.dll
18:29:35.0291 4932 seclogon - ok
18:29:35.0323 4932 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\windows\system32\sens.dll
18:29:35.0385 4932 SENS - ok
18:29:35.0385 4932 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\windows\system32\sensrsvc.dll
18:29:35.0510 4932 SensrSvc - ok
18:29:35.0541 4932 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\windows\system32\drivers\serenum.sys
18:29:35.0588 4932 Serenum - ok
18:29:35.0635 4932 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\windows\system32\drivers\serial.sys
18:29:35.0697 4932 Serial - ok
18:29:35.0728 4932 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\windows\system32\drivers\sermouse.sys
18:29:35.0806 4932 sermouse - ok
18:29:35.0869 4932 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\windows\system32\sessenv.dll
18:29:35.0993 4932 SessionEnv - ok
18:29:36.0009 4932 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\windows\system32\drivers\sffdisk.sys
18:29:36.0087 4932 sffdisk - ok
18:29:36.0134 4932 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\windows\system32\drivers\sffp_mmc.sys
18:29:36.0181 4932 sffp_mmc - ok
18:29:36.0227 4932 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\windows\system32\drivers\sffp_sd.sys
18:29:36.0337 4932 sffp_sd - ok
18:29:36.0399 4932 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\windows\system32\drivers\sfloppy.sys
18:29:36.0430 4932 sfloppy - ok
18:29:36.0524 4932 [ C6CC9297BD53E5229653303E556AA539 ] Sftfs C:\windows\system32\DRIVERS\Sftfslh.sys
18:29:36.0586 4932 Sftfs - ok
18:29:36.0742 4932 [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
18:29:36.0773 4932 sftlist - ok
18:29:36.0836 4932 [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay C:\windows\system32\DRIVERS\Sftplaylh.sys
18:29:36.0867 4932 Sftplay - ok
18:29:36.0914 4932 [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir C:\windows\system32\DRIVERS\Sftredirlh.sys
18:29:36.0929 4932 Sftredir - ok
18:29:36.0976 4932 [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol C:\windows\system32\DRIVERS\Sftvollh.sys
18:29:36.0992 4932 Sftvol - ok
18:29:37.0039 4932 [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
18:29:37.0054 4932 sftvsa - ok
18:29:37.0117 4932 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\windows\System32\ipnathlp.dll
18:29:37.0179 4932 SharedAccess - ok
18:29:37.0226 4932 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\windows\System32\shsvcs.dll
18:29:37.0319 4932 ShellHWDetection - ok
18:29:37.0491 4932 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\windows\system32\drivers\SiSRaid2.sys
18:29:37.0553 4932 SiSRaid2 - ok
18:29:37.0585 4932 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\windows\system32\drivers\sisraid4.sys
18:29:37.0663 4932 SiSRaid4 - ok
18:29:37.0709 4932 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\windows\system32\DRIVERS\smb.sys
18:29:37.0803 4932 Smb - ok
18:29:37.0897 4932 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\windows\System32\snmptrap.exe
18:29:37.0928 4932 SNMPTRAP - ok
18:29:37.0959 4932 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\windows\system32\drivers\spldr.sys
18:29:37.0975 4932 spldr - ok
18:29:38.0053 4932 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\windows\System32\spoolsv.exe
18:29:38.0099 4932 Spooler - ok
18:29:38.0209 4932 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\windows\system32\sppsvc.exe
18:29:38.0349 4932 sppsvc - ok
18:29:38.0396 4932 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\windows\system32\sppuinotify.dll
18:29:38.0458 4932 sppuinotify - ok
18:29:38.0567 4932 [ 891793E00432FA055CF040605C260E49 ] SRTSP C:\windows\System32\Drivers\NISx64\1309010.00E\SRTSP64.SYS
18:29:38.0630 4932 SRTSP - ok
18:29:38.0661 4932 [ 1CB7BB3B0561FB5ECFE37F7731E8BF3E ] SRTSPX C:\windows\system32\drivers\NISx64\1309010.00E\SRTSPX64.SYS
18:29:38.0677 4932 SRTSPX - ok
18:29:38.0708 4932 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\windows\system32\DRIVERS\srv.sys
18:29:38.0817 4932 srv - ok
18:29:38.0833 4932 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\windows\system32\DRIVERS\srv2.sys
18:29:38.0895 4932 srv2 - ok
18:29:38.0926 4932 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\windows\system32\DRIVERS\srvnet.sys
18:29:38.0942 4932 srvnet - ok
18:29:38.0989 4932 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV  C:\windows\System32\ssdpsrv.dll
18:29:39.0082 4932 SSDPSRV - ok
18:29:39.0113 4932 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\windows\system32\sstpsvc.dll
18:29:39.0160 4932 SstpSvc - ok
18:29:39.0191 4932 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\windows\system32\drivers\stexstor.sys
18:29:39.0191 4932 stexstor - ok
18:29:39.0238 4932 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\windows\System32\wiaservc.dll
18:29:39.0285 4932 stisvc - ok
18:29:39.0301 4932 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\windows\system32\DRIVERS\swenum.sys
18:29:39.0316 4932 swenum - ok
18:29:39.0363 4932 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\windows\System32\swprv.dll
18:29:39.0441 4932 swprv - ok
18:29:39.0503 4932 [ 8B2430762099598DA40686F754632EFD ] SymDS C:\windows\system32\drivers\NISx64\1309010.00E\SYMDS64.SYS
18:29:39.0535 4932 SymDS - ok
18:29:39.0566 4932 [ 5CB7F2FD7E30A0F52F93574BFC3A8041 ] SymEFA C:\windows\system32\drivers\NISx64\1309010.00E\SYMEFA64.SYS
18:29:39.0597 4932 SymEFA - ok
18:29:39.0628 4932 [ 894579207E39C465737E850A252CE4F2 ] SymEvent C:\windows\system32\Drivers\SYMEVENT64x86.SYS
18:29:39.0659 4932 SymEvent - ok
18:29:39.0706 4932 [ 5013A76CAAA1D7CF1C55214B490B4E35 ] SymIRON C:\windows\system32\drivers\NISx64\1309010.00E\Ironx64.SYS
18:29:39.0706 4932 SymIRON - ok
18:29:39.0722 4932 [ 3911BD0E68C010E5438A87706ABBE9AB ] SymNetS C:\windows\System32\Drivers\NISx64\1309010.00E\SYMNETS.SYS
18:29:39.0753 4932 SymNetS - ok
18:29:39.0831 4932 [ F5B46DF59FEAA48A442AED7EEB754D4B ] SynTP C:\windows\system32\DRIVERS\SynTP.sys
18:29:39.0878 4932 SynTP - ok
18:29:39.0940 4932 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\windows\system32\sysmain.dll
18:29:40.0018 4932 SysMain - ok
18:29:40.0065 4932 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\windows\System32\TabSvc.dll
18:29:40.0127 4932 TabletInputService - ok
18:29:40.0174 4932 [ 3B73C849B41FB20D77B0E553214061A5 ] tap0901 C:\windows\system32\DRIVERS\tap0901.sys
18:29:40.0283 4932 tap0901 - ok
18:29:40.0315 4932 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\windows\System32\tapisrv.dll
18:29:40.0408 4932 TapiSrv - ok
18:29:40.0439 4932 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\windows\System32\tbssvc.dll
18:29:40.0486 4932 TBS - ok
18:29:40.0564 4932 [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip C:\windows\system32\drivers\tcpip.sys
18:29:40.0627 4932 Tcpip - ok
18:29:40.0689 4932 [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6 C:\windows\system32\DRIVERS\tcpip.sys
18:29:40.0736 4932 TCPIP6 - ok
18:29:40.0783 4932 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\windows\system32\drivers\tcpipreg.sys
18:29:40.0783 4932 tcpipreg - ok
18:29:40.0814 4932 [ FD542B661BD22FA69CA789AD0AC58C29 ] tdcmdpst C:\windows\system32\DRIVERS\tdcmdpst.sys
18:29:40.0829 4932 tdcmdpst - ok
18:29:40.0845 4932 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\windows\system32\drivers\tdpipe.sys
18:29:40.0954 4932 TDPIPE - ok
18:29:40.0985 4932 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\windows\system32\drivers\tdtcp.sys
18:29:41.0032 4932 TDTCP - ok
18:29:41.0063 4932 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\windows\system32\DRIVERS\tdx.sys
18:29:41.0126 4932 tdx - ok
18:29:41.0141 4932 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\windows\system32\DRIVERS\termdd.sys
18:29:41.0157 4932 TermDD - ok
18:29:41.0188 4932 [ 2E648163254233755035B46DD7B89123 ] TermService C:\windows\System32\termsrv.dll
18:29:41.0297 4932 TermService - ok
18:29:41.0329 4932 [ F0344071948D1A1FA732231785A0664C ] Themes  C:\windows\system32\themeservice.dll
18:29:41.0375 4932 Themes - ok
18:29:41.0407 4932 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\windows\system32\mmcss.dll
18:29:41.0453 4932 THREADORDER - ok
18:29:41.0500 4932 [ 71C321649B28638EE80A2EEB164C1DC8 ] TMachInfo C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
18:29:41.0531 4932 TMachInfo - ok
18:29:41.0563 4932 [ 8E2C799D3476EAC32C3BA0DF7CE6AF19 ] TODDSrv C:\windows\system32\TODDSrv.exe
18:29:41.0578 4932 TODDSrv - ok
18:29:41.0641 4932 [ 1C73689B900428C7D054A41C4687F55C ] TosCoSrv C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
18:29:41.0672 4932 TosCoSrv - ok
18:29:41.0719 4932 [ 29D0886CF250FCEF1BF9E65AB8D2C0C8 ] TOSHIBA HDD SSD Alert Service C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
18:29:41.0750 4932 TOSHIBA HDD SSD Alert Service - ok
18:29:41.0781 4932 [ 09FF7B0B1B5C3D225495CB6F5A9B39F8 ] tos_sps64 C:\windows\system32\DRIVERS\tos_sps64.sys
18:29:41.0812 4932 tos_sps64 - ok
18:29:41.0828 4932 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\windows\System32\trkwks.dll
18:29:41.0921 4932 TrkWks - ok
18:29:42.0015 4932 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe
18:29:42.0077 4932 TrustedInstaller - ok
18:29:42.0109 4932 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\windows\system32\DRIVERS\tssecsrv.sys
18:29:42.0202 4932 tssecsrv - ok
18:29:42.0280 4932 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\windows\system32\drivers\tsusbflt.sys
18:29:42.0405 4932 TsUsbFlt - ok
18:29:42.0436 4932 [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD C:\windows\system32\drivers\TsUsbGD.sys
18:29:42.0514 4932 TsUsbGD - ok
18:29:42.0623 4932 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\windows\system32\DRIVERS\tunnel.sys
18:29:42.0717 4932 tunnel - ok
18:29:42.0764 4932 [ 550B567F9364D8F7684C3FB3EA665A72 ] TVALZ C:\windows\system32\DRIVERS\TVALZ_O.SYS
18:29:42.0779 4932 TVALZ - ok
18:29:42.0795 4932 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\windows\system32\drivers\uagp35.sys
18:29:42.0842 4932 uagp35 - ok
18:29:42.0889 4932 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\windows\system32\DRIVERS\udfs.sys
18:29:42.0998 4932 udfs - ok
18:29:43.0045 4932 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\windows\system32\UI0Detect.exe
18:29:43.0076 4932 UI0Detect - ok
18:29:43.0107 4932 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\windows\system32\drivers\uliagpkx.sys
18:29:43.0138 4932 uliagpkx - ok
18:29:43.0169 4932 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\windows\system32\DRIVERS\umbus.sys
18:29:43.0216 4932 umbus - ok
18:29:43.0247 4932 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\windows\system32\drivers\umpass.sys
18:29:43.0310 4932 UmPass - ok
18:29:43.0466 4932 [ 2C16648A12999AE69A9EBF41974B0BA2 ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
18:29:43.0528 4932 UNS - ok
18:29:43.0575 4932 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\windows\System32\upnphost.dll
18:29:43.0637 4932 upnphost - ok
18:29:43.0700 4932 [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64 C:\windows\system32\Drivers\usbaapl64.sys
18:29:43.0825 4932 USBAAPL64 - ok
18:29:43.0840 4932 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\windows\system32\DRIVERS\usbccgp.sys
18:29:43.0918 4932 usbccgp - ok
18:29:43.0949 4932 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\windows\system32\drivers\usbcir.sys
18:29:43.0981 4932 usbcir - ok
18:29:44.0012 4932 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\windows\system32\DRIVERS\usbehci.sys
18:29:44.0043 4932 usbehci - ok
18:29:44.0105 4932 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\windows\system32\DRIVERS\usbhub.sys
18:29:44.0168 4932 usbhub - ok
18:29:44.0199 4932 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\windows\system32\drivers\usbohci.sys
18:29:44.0261 4932 usbohci - ok
18:29:44.0293 4932 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\windows\system32\drivers\usbprint.sys
18:29:44.0371 4932 usbprint - ok
18:29:44.0386 4932 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\windows\system32\DRIVERS\USBSTOR.SYS
18:29:44.0480 4932 USBSTOR - ok
18:29:44.0495 4932 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\windows\system32\drivers\usbuhci.sys
18:29:44.0558 4932 usbuhci - ok
18:29:44.0605 4932 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\windows\system32\Drivers\usbvideo.sys
18:29:44.0636 4932 usbvideo - ok
18:29:44.0651 4932 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\windows\System32\uxsms.dll
18:29:44.0745 4932 UxSms - ok
18:29:44.0776 4932 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\windows\system32\lsass.exe
18:29:44.0792 4932 VaultSvc - ok
18:29:44.0807 4932 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\windows\system32\drivers\vdrvroot.sys
18:29:44.0823 4932 vdrvroot - ok
18:29:44.0870 4932 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\windows\System32\vds.exe
18:29:44.0979 4932 vds - ok
18:29:45.0010 4932 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\windows\system32\DRIVERS\vgapnp.sys
18:29:45.0057 4932 vga - ok
18:29:45.0073 4932 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\windows\System32\drivers\vga.sys
18:29:45.0135 4932 VgaSave - ok
18:29:45.0166 4932 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\windows\system32\drivers\vhdmp.sys
18:29:45.0182 4932 vhdmp - ok
18:29:45.0197 4932 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\windows\system32\drivers\viaide.sys
18:29:45.0213 4932 viaide - ok
18:29:45.0244 4932 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\windows\system32\drivers\volmgr.sys
18:29:45.0260 4932 volmgr - ok
18:29:45.0275 4932 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\windows\system32\drivers\volmgrx.sys
18:29:45.0291 4932 volmgrx - ok
18:29:45.0307 4932 [ DF8126BD41180351A093A3AD2FC8903B ] volsnap C:\windows\system32\drivers\volsnap.sys
18:29:45.0322 4932 volsnap - ok
18:29:45.0369 4932 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\windows\system32\drivers\vsmraid.sys
18:29:45.0385 4932 vsmraid - ok
18:29:45.0431 4932 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\windows\system32\vssvc.exe
18:29:45.0587 4932 VSS - ok
18:29:45.0619 4932 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\windows\system32\DRIVERS\vwifibus.sys
18:29:45.0681 4932 vwifibus - ok
18:29:45.0728 4932 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\windows\system32\DRIVERS\vwififlt.sys
18:29:45.0775 4932 vwififlt - ok
18:29:45.0790 4932 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\windows\system32\w32time.dll
18:29:45.0837 4932 W32Time - ok
18:29:45.0868 4932 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\windows\system32\drivers\wacompen.sys
18:29:45.0915 4932 WacomPen - ok
18:29:45.0946 4932 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\windows\system32\DRIVERS\wanarp.sys
18:29:46.0024 4932 WANARP - ok
18:29:46.0024 4932 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\windows\system32\DRIVERS\wanarp.sys
18:29:46.0071 4932 Wanarpv6 - ok
18:29:46.0149 4932 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\windows\system32\Wat\WatAdminSvc.exe
18:29:46.0243 4932 WatAdminSvc - ok
18:29:46.0305 4932 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\windows\system32\wbengine.exe
18:29:46.0430 4932 wbengine - ok
18:29:46.0461 4932 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\windows\System32\wbiosrvc.dll
18:29:46.0523 4932 WbioSrvc - ok
18:29:46.0570 4932 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\windows\System32\wcncsvc.dll
18:29:46.0633 4932 wcncsvc - ok
18:29:46.0664 4932 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll
18:29:46.0726 4932 WcsPlugInService - ok
18:29:46.0757 4932 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\windows\system32\drivers\wd.sys
18:29:46.0789 4932 Wd - ok
18:29:46.0835 4932 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\windows\system32\drivers\Wdf01000.sys
18:29:46.0867 4932 Wdf01000 - ok
18:29:46.0882 4932 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\windows\system32\wdi.dll
18:29:46.0976 4932 WdiServiceHost - ok
18:29:46.0976 4932 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\windows\system32\wdi.dll
18:29:46.0991 4932 WdiSystemHost - ok
18:29:47.0038 4932 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\windows\System32\webclnt.dll
18:29:47.0101 4932 WebClient - ok
18:29:47.0132 4932 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\windows\system32\wecsvc.dll
18:29:47.0225 4932 Wecsvc - ok
18:29:47.0257 4932 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\windows\System32\wercplsupport.dll
18:29:47.0319 4932 wercplsupport - ok
18:29:47.0350 4932 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\windows\System32\WerSvc.dll
18:29:47.0444 4932 WerSvc - ok
18:29:47.0459 4932 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\windows\system32\DRIVERS\wfplwf.sys
18:29:47.0506 4932 WfpLwf - ok
18:29:47.0522 4932 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\windows\system32\drivers\wimmount.sys
18:29:47.0522 4932 WIMMount - ok
18:29:47.0537 4932 WinDefend - ok
18:29:47.0553 4932 WinHttpAutoProxySvc - ok
18:29:47.0631 4932 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\windows\system32\wbem\WMIsvc.dll
18:29:47.0693 4932 Winmgmt - ok
18:29:47.0756 4932 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\windows\system32\WsmSvc.dll
18:29:47.0818 4932 WinRM - ok
18:29:47.0881 4932 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\windows\System32\wlansvc.dll
18:29:47.0959 4932 Wlansvc - ok
18:29:48.0083 4932 [ 357CABBF155AFD1D3926E62539D2A3A7 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
18:29:48.0146 4932 wlidsvc - ok
18:29:48.0177 4932 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\windows\system32\DRIVERS\wmiacpi.sys
18:29:48.0224 4932 WmiAcpi - ok
18:29:48.0271 4932 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\windows\system32\wbem\WmiApSrv.exe
18:29:48.0317 4932 wmiApSrv - ok
18:29:48.0349 4932 WMPNetworkSvc - ok
18:29:48.0364 4932 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\windows\System32\wpcsvc.dll
18:29:48.0442 4932 WPCSvc - ok
18:29:48.0473 4932 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\windows\system32\wpdbusenum.dll
18:29:48.0489 4932 WPDBusEnum - ok
18:29:48.0520 4932 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\windows\system32\drivers\ws2ifsl.sys
18:29:48.0551 4932 ws2ifsl - ok
18:29:48.0583 4932 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\windows\system32\wscsvc.dll
18:29:48.0629 4932 wscsvc - ok
18:29:48.0629 4932 WSearch - ok
18:29:48.0723 4932 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\windows\system32\wuaueng.dll
18:29:48.0785 4932 wuauserv - ok
18:29:48.0832 4932 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\windows\system32\drivers\WudfPf.sys
18:29:48.0957 4932 WudfPf - ok
18:29:49.0004 4932 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\windows\system32\DRIVERS\WUDFRd.sys
18:29:49.0097 4932 WUDFRd - ok
18:29:49.0144 4932 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\windows\System32\WUDFSvc.dll
18:29:49.0222 4932 wudfsvc - ok
18:29:49.0269 4932 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\windows\System32\wwansvc.dll
18:29:49.0316 4932 WwanSvc - ok
18:29:49.0331 4932 ================ Scan global ===============================
18:29:49.0363 4932 [ BA0CD8C393E8C9F83354106093832C7B ] C:\windows\system32\basesrv.dll
18:29:49.0409 4932 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\windows\system32\winsrv.dll
18:29:49.0425 4932 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\windows\system32\winsrv.dll
18:29:49.0456 4932 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\windows\system32\sxssrv.dll
18:29:49.0472 4932 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\windows\system32\services.exe
18:29:49.0487 4932 [Global] - ok
18:29:49.0487 4932 ================ Scan MBR ==================================
18:29:49.0503 4932 [ 5B5E648D12FCADC244C1EC30318E1EB9 ] \Device\Harddisk0\DR0
18:29:49.0877 4932 \Device\Harddisk0\DR0 - ok
18:29:50.0345 4932 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
18:29:50.0595 4932 \Device\Harddisk1\DR1 - ok
18:29:50.0611 4932 ================ Scan VBR ==================================
18:29:50.0626 4932 [ 9CA4803AA10E7B14FD929B8082DF0620 ] \Device\Harddisk0\DR0\Partition1
18:29:50.0626 4932 \Device\Harddisk0\DR0\Partition1 - ok
18:29:50.0626 4932 [ 1893FDA9EFAD0EBF6166572C9F2F7426 ] \Device\Harddisk1\DR1\Partition1
18:29:50.0626 4932 \Device\Harddisk1\DR1\Partition1 - ok
18:29:50.0626 4932 ============================================================
18:29:50.0626 4932 Scan finished
18:29:50.0626 4932 ============================================================
18:29:50.0642 1820 Detected object count: 0
18:29:50.0642 1820 Actual detected object count: 0
18:30:06.0554 1748 Deinitialize success

ComboFix Log:

ComboFix 13-04-17.01 - Mike 04/18/2013 17:27:17.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4008.2335 [GMT -5:00]
Running from: c:\users\Mike\Desktop\ComboFix.exe.exe
Command switches used :: c:\users\Mike\Desktop\CFScript.txt
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-03-18 to 2013-04-18 )))))))))))))))))))))))))))))))
.
.
2013-04-18 23:13 . 2013-04-18 23:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-04-17 16:28 . 2013-04-17 17:26 -------- d-----w- c:\program files (x86)\BackgammonMasters
2013-04-17 15:02 . 2013-04-17 23:29 -------- d-----w- C:\TDSSKiller_Quarantine
2013-04-16 01:43 . 2013-04-16 01:43 -------- d-----w- C:\FRST
2013-04-13 16:26 . 2013-04-13 16:26 -------- d-----w- c:\users\Mike\AppData\Roaming\Malwarebytes
2013-04-13 16:26 . 2013-04-13 16:26 -------- d-----w- c:\programdata\Malwarebytes
2013-04-13 16:26 . 2013-04-14 14:48 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-13 16:26 . 2013-04-04 19:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-04-13 16:26 . 2013-04-13 16:26 -------- d-----w- c:\users\Mike\AppData\Local\Programs
2013-04-01 00:02 . 2013-04-01 00:02 -------- d-----w- c:\programdata\McAfee
2013-03-26 00:50 . 2013-02-12 04:12 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-03-24 22:10 . 2013-04-14 03:20 -------- d-----w- c:\programdata\Vizzed
2013-03-24 21:31 . 2013-03-24 21:31 963488 ----a-w- c:\windows\system32\deployJava1.dll
2013-03-24 21:31 . 2013-03-24 21:31 310688 ----a-w- c:\windows\system32\javaws.exe
2013-03-24 21:31 . 2013-03-24 21:31 1085344 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-03-24 21:31 . 2013-03-24 21:31 188832 ----a-w- c:\windows\system32\javaw.exe
2013-03-24 21:31 . 2013-03-24 21:31 188320 ----a-w- c:\windows\system32\java.exe
2013-03-24 21:31 . 2013-03-24 21:31 108448 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2013-03-24 21:31 . 2013-03-24 21:31 -------- d-----w- c:\program files\Java
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-18 08:02 . 2011-12-24 16:41 72702784 ----a-w- c:\windows\system32\MRT.exe
2013-03-13 16:38 . 2012-04-30 23:49 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-13 16:38 . 2011-07-27 03:34 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-14 06:54 . 2012-01-27 01:51 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2013-02-14 06:54 . 2012-02-22 06:17 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-02-14 06:54 . 2012-02-22 06:17 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-02-12 05:45 . 2013-03-13 20:39 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-13 20:39 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45 . 2013-03-13 20:39 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-13 20:39 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48 . 2013-03-13 20:39 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-13 20:39 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Spotify Web Helper"="c:\users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-03-29 1104280]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2011-07-12 1298816]
"NortonOnlineBackupReminder"="c:\program files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" [2011-06-22 3218864]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
c:\users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
RollerCoaster Tycoon 3 Registration.lnk - c:\users\Mike\AppData\Local\Temp\{0FD194DB-0062-449A-A8F3-A4DBDDEF87CC}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
CineForm Status.lnk - c:\program files (x86)\CineForm\Tools\GoProCineFormStatusViewer.exe [2012-10-28 152064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-10-30 250984]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2011-07-12 57216]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2011-06-10 138152]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-12-24 1255736]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1309010.00E\SYMDS64.SYS [2011-05-16 451192]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1309010.00E\SYMEFA64.SYS [2012-05-22 1129120]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2009-06-24 482384]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20130412.001\BHDrvx64.sys [2013-04-12 1390680]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys [2012-06-07 167072]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20130417.001\IDSvia64.sys [2013-04-16 513184]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1309010.00E\Ironx64.SYS [2012-04-18 190072]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1309010.00E\SYMNETS.SYS [2012-04-18 405624]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 GFNEXSrv;GFNEX Service;c:\windows\System32\GFNEXSrv.exe [2010-09-10 162824]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [2012-06-16 138272]
S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files (x86)\PC Checkup\SymcPCCULaunchSvc.exe [2012-11-22 132056]
S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [2011-07-19 126392]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe [2012-04-24 390632]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-21 2656280]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-10-26 138912]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2011-02-09 38096]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-14 413800]
S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [2010-11-03 1103464]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-30 16:38]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-08 167256]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-08 391000]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-08 418136]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-07 12558440]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2011-06-10 710560]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"TosNC"="c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe" [BU]
"TosReelTimeMonitor"="c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [BU]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://search.mytool.co/?babsrc=home&s=web&as=0&isid=9848
mLocal Page = c:\windows\SysWOW64\blank.htm
Trusted Zone: vizzed.com\www
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.9.1.14\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr]
"ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\diMaster.dll\" /prefetch:1"
"ImagePath"="\"c:\program files\CyberLink\Shared files\RichVideo64.exe\"\00Z
[\]^_Ä\00\00Ä\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~Ä\00\00Ä\00\00\00\00r\00\00\00\00\00\00\00''""
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:f6,9a,6d,0b,60,52,cd,01
.
[HKEY_USERS\S-1-5-21-902127083-3053317369-3274058323-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-902127083-3053317369-3274058323-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-902127083-3053317369-3274058323-1000\Software\SecuROM\License information*]
"datasecu"=hex:ef,44,bc,e7,18,e4,3c,74,1b,a0,5c,1a,8b,90,e1,fb,b9,57,a9,6b,19,
0a,23,de,dc,f6,c9,a3,ee,2b,4c,b7,a1,d0,b9,92,1b,e0,e8,5c,ef,76,9a,b8,7d,3e,\
"rkeysecu"=hex:f4,d8,36,e9,9d,8d,46,6c,39,82,4c,ed,3c,2b,7b,26
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2013-04-18 18:23:57 - machine was rebooted
ComboFix-quarantined-files.txt 2013-04-18 23:23
ComboFix2.txt 2013-04-18 00:12
.
Pre-Run: 163,193,430,016 bytes free
Post-Run: 163,178,647,552 bytes free
.
- - End Of File - - 5FBE0D092BECBEFEA3AEF34B62864F16


----------



## Mark1956 (May 7, 2011)

Ok, the logs are clean. How well is the system running now?

As ADWCleaner found such a lot of Adware it would be wise to run it again just to be sure no Adware is returning. Please also see if RogueKiller will now run and post that log also.

Please also run this:

Download Security Check by screen317 from Here or Here.
Save it to your Desktop.
Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please Copy & Paste the contents of that document into your next reply.


----------



## shadowandmike (Apr 9, 2013)

It is running great!  Thanks again for all the help!

I was able to run RougeKiller also, as well as the other two scans above.

All three logs are posted below:

# AdwCleaner v2.200 - Logfile created 04/20/2013 at 12:20:37
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Mike - MIKE-PC
# Boot Mode : Normal
# Running from : C:\Users\Mike\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16476
[OK] Registry is clean.
-\\ Mozilla Firefox v [Unable to get version]
File : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\ce182gal.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [862 octets] - [20/04/2013 12:20:07]
AdwCleaner[S1].txt - [6947 octets] - [13/04/2013 07:56:14]
AdwCleaner[S2].txt - [794 octets] - [20/04/2013 12:20:37]
########## EOF - C:\AdwCleaner[S2].txt - [853 octets] ##########

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Mike [Admin rights]
Mode : Scan -- Date : 04/20/2013 12:29:49
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 5 ¤¤¤
[STARTUP][SUSP PATH] RollerCoaster Tycoon 3 Registration.lnk @Mike : C:\Users\Mike\AppData\Local\Temp\{0FD194DB-0062-449A-A8F3-A4DBDDEF87CC}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe [x] -> FOUND
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\windows\system32\drivers\etc\hosts
127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS543232A7A384 +++++
--- User ---
[MBR] 800b1b87c6bcadc9a7c6a1b96370a7e0
[BSP] f0f85a548376c86bef995acd1b276c12 : Windows Vista MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 288986 Mo
2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 594917376 | Size: 14757 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: WD 10EACS External USB Device +++++
--- User ---
[MBR] 5aee61013ae6488c453c479839636521
[BSP] fa16a06a2ea7b157a8d72ab2bf439ad5 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 953867 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Finished : << RKreport[2]_S_04202013_02d1229.txt >>
RKreport[1]_S_04142013_02d1218.txt ; RKreport[2]_S_04202013_02d1229.txt

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Mike [Admin rights]
Mode : Scan -- Date : 04/20/2013 12:29:49
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 5 ¤¤¤
[STARTUP][SUSP PATH] RollerCoaster Tycoon 3 Registration.lnk @Mike : C:\Users\Mike\AppData\Local\Temp\{0FD194DB-0062-449A-A8F3-A4DBDDEF87CC}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe [x] -> FOUND
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\windows\system32\drivers\etc\hosts
127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS543232A7A384 +++++
--- User ---
[MBR] 800b1b87c6bcadc9a7c6a1b96370a7e0
[BSP] f0f85a548376c86bef995acd1b276c12 : Windows Vista MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 288986 Mo
2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 594917376 | Size: 14757 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: WD 10EACS External USB Device +++++
--- User ---
[MBR] 5aee61013ae6488c453c479839636521
[BSP] fa16a06a2ea7b157a8d72ab2bf439ad5 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 953867 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Finished : << RKreport[2]_S_04202013_02d1229.txt >>
RKreport[1]_S_04142013_02d1218.txt ; RKreport[2]_S_04202013_02d1229.txt

Results of screen317's Security Check version 0.99.62 
Windows 7 Service Pack 1 x64 (UAC is enabled) 
Internet Explorer 9 
*``````````````Antivirus/Firewall Check:``````````````* 
Windows Firewall Enabled! 
Norton Internet Security 
WMI entry may not exist for antivirus; attempting automatic update. 
*`````````Anti-malware/Other Utilities Check:`````````* 
Malwarebytes Anti-Malware version 1.75.0.1300 
Java(TM) 6 Update 25 
*Java version out of Date!* 
Adobe Flash Player 11.6.602.180 
Adobe Reader 10.1.6 *Adobe Reader out of Date!* 
*````````Process Check: objlist.exe by Laurent````````* 
Norton ccSvcHst.exe 
*`````````````````System Health check`````````````````* 
Total Fragmentation on Drive C: 0% 
*````````````````````End of Log``````````````````````*


----------



## Mark1956 (May 7, 2011)

Ok, everything is looking and sounding good so we can clean up the tools used and update Java and Adobe.

*STEP 1*
Download Temporary file cleaner and save it to the desktop.
Double click on the icon to run it (it appears as a dark grey dustbin). For Windows 7 and Vista right click the icon and select *Run as Administrator*.
When the window opens click on* Start*. It will close all running programs and clear the desktop icons.
When complete you may be asked to reboot, if so accept the request and your PC will reboot automatically.

*STEP 2*
To re-enable your CD Emulation drivers if you disabled them, double click *DeFogger.exe* to run the tool again.


The application window will appear.
Click the *Re-enable* button to re-enable your CD Emulation drivers.
Click *Yes* to continue.
A *'Finished!*' message will appear.
Click *OK*.
DeFogger will now ask to reboot the machine...click *OK*.

To uninstall ComboFix, press the *WINKEY + R* keys on your keyboard or click on Start







and type *Run* into the search box and hit *Enter*.
In the *Run* box type: *ComboFix /Uninstall* (Be sure to leave a space before the forward slash).











Click on *OK*.
If you encounter any problems using the switch from the Run dialog box, just rename ComboFix.exe to *Uninstall.exe*, then double-click on it to remove.
This will delete ComboFix's related folders/files, reset the clock settings, hide file extensions/system files, clear the System Restore cache to prevent possible reinfection and *create a new Restore point.*
When it has finished you will see a dialog box stating that _"ComboFix has been uninstalled". _
After that, you can delete the ComboFix.exe program from your computer (Desktop).

*Next*


Download *OTC* by OldTimer and save it to your *desktop.*
Double click







icon to start the program. 
If you are using Vista or Windows 7, please right-click and choose *Run as Administrator*
Then Click the big







button.
You will get a prompt saying "_Begin Cleanup Process_". Please select *Yes*.
Restart your computer when prompted.

-- Doing this will *remove* any specialized tools downloaded and used. If OTC does not delete itself, then delete the file manually when done.
-- Any leftover folders/files related to ComboFix or other tools which OTC did not remove can be deleted manually (right-click on it and choose delete).

*Please post back when this is complete and let me know if you have had any problems.*

*STEP 3*
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. 
Please follow these steps to remove older version of Java and update.

*How to update Java:*
Be aware that the act of downloading any Java installer means that you have read and agree to abide by the end users license agreement. 
End user licence agreement

First uninstall all existing versions of Java.


Go to Start > Control Panel double-click on *Add/Remove programs *(or Programs and Features) and click on any item with *Java, Java(TM), JRE* or *J2SE* in the name.
Click the *Uninstall*, *Remove* or *Change/Remove* button and allow it to uninstall. 
If a *User Account Control* warning appears click on *Allow*.
Repeat as many times as necessary to remove each and every item. 
Reboot your computer once all Java components are removed. 

*NOTE:* If you have a 64bit version of Windows and are using the 64bit version of Internet Explorer the Java site will automatically give you the correct Java version using the instructions below, 
but it is recommended that you use only 32bit browsers and versions of Java. Please read this for further information: Which Java download should I choose for my 64bit operating system?. 
If you install Java for the 64bit version of Internet Explorer and you use any other browser you will also need to repeat the installation while using your other browser which will most likely be 32bit. If in doubt please ask.

*How to install the latest version.*


Open the browser that you normally use and click on this link: Java Download
Click on the big red button *Free Java Download*
On the next page click on the big red button *Agree and Start Free Download*
Select *Run* whenever the option appears. If no *Run* option appears click on *Save* and then when the download completes click on *Run*. If a *User Account Control* warning appears click on *Continue*.
When the *Welcome to Java* window appears click on* Install*.
It may takes several minutes to download the installer depending on the speed of your connection, allow it to complete.
If any error messages appear click on OK and then click on the *Agree and start free download* button again.
Please wait for the *Java Setup* window to appear. Uncheck the box to install the *Ask Toolbar* and then click on *Next*.
*NOTE: *The Ask Toolbar option may change without notice to something different, please make sure you uncheck the box for anything else that is offered. On some systems this offer may not appear, in which case, continue with the next instruction.
You will then see the *Java Setup Progress* window and another will appear for *JavaFX* (on some systems the JavaFX will not appear or be installed). Finally the *Java Setup Complete* window will appear, click on *Close*.
If a Java page then appears with a button to *Verify Java Version* click on it and it will verify the installation.
The Installation is now complete, please reboot the system.
*NOTE:* The JavaFX component is not required unless you are developing Java applications. It is perfectly safe to keep on your system, but if you wish to uninstall it please do so.

*STEP 4*
*Adobe*
Close any programs you may have running - especially your web browser.
Click on Start







> *Control Panel*, double-click on Programs and Features and uninstall the following Adobe entries:

*Adobe Reader 10.1.6*

*NOTE:* For *XP* click on







> *Control Panel*, double-click on *Add or Remove Programs* and continue as above.

Then go to this link Adobe Downloads and select the latest version to download and install. You will see this page below, click on the appropriate button for for the Adobe product that was just removed.










You will now see a page similar to this one:










All four Adobe products, Reader, Flash Player, Air and Shockwave Player are set by default to download the version for *Windows* Operating Systems and for *Internet Explorer* in *English*. If you are using a Macintosh, or you want to use the Adobe product with a different Browser or language you must click on the line (as indicated in the above image) to make further selections to meet your requirements.

As you will see in the above image the Adobe Reader is set for Windows 7, please click (as indicated) if you are using a different version of *Windows* to make further selections. All the other Adobe products are universal and you will only need to change the selection for different Browsers, Languages or for Macintosh.
NOTE: In all the downloads look out for any Add-ons like Google Toolbar, McAfee products, etc. and uncheck the box to exclude them. The above image shows the Google Toolbar being offered but this will change from time to time for other products.

Some additional instructions may appear for XP installations. In all cases save the download to your desktop, then close your browser and double click on the Adobe icon on your desktop to install it. If you have any problems installing, disconnect from the internet and disable your Anti Virus and any other security software, instructions for most AV's, etc. can be found here: How to disable security software.


----------



## shadowandmike (Apr 9, 2013)

Thanks!

I had no problem uninstalling ComboFix or running DeFogger or OTC. Everything seems to be back to normal!


----------



## Mark1956 (May 7, 2011)

You're most welcome. I shall now mark this thread as Solved and leave you with some security advice, but please feel free to post back if you have any remaining issues or concerns.

There are many places where you will find security advice, but most are biased towards a particular item of software that they are trying to promote. I have given some unbiased advice below that should help keep you better protected. Unfortunately there is no "best protection", new Malware is being produced every minute of the day so it is a cat & mouse game for all security software vendors to keep up with the latest infections.

It has always been the case that what one Anti Virus program will detect another one will miss and vice versa. That being said, never be tempted to install more than one Anti Virus program thinking that will give you better protection as in fact the reverse is true. Two or more AV programs will (in most cases) conflict with each other, slow your system down and actually reduce your security level. Don't assume that your present Anti Virus is no good on the grounds that you got infected, if I have seen you are using a poor Anti Virus I will have advised you earlier in the thread. There are a lot of nasty infections out there waiting to jump onto a PC and with some of the newest infections there is very little that will block them. Fortunately there are those who dedicate their spare time, for little reward, in making the tools we use here to remove these infections. It is those people that we have to thank as without them a reinstall would often be the only way out.

*Some additional security measures.*
If your present security software does not include a third party Firewall or AntiSpyware.

Go Here for a selection of third party Firewalls.

Go Here or Here for Anti Spyware.

Malwarebytes free version (which you may have used during this thread) is worth having for regular scans of your system, always check for updates before using it. If you can afford the Malwarebytes Pro version it will provide even better protection with a full time active scanner. Never have more than one active anti virus, anti spyware or firewall running on your system as it can cause conflicts and slow down the PC. You can safely run the Pro version of *Malwarebytes* with any Anti Virus software.

WOT (Web OF Trust) Will warn you (in most cases) about dangerous web sites. (This is only available for use with Internet Explorer).

Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Attacks exploiting vulnerable programs and plug-ins are rarely blocked by traditional anti-virus and are therefore increasingly "popular"among criminals.

WinPatrol is a useful facility to have. *WinPatrol* takes snapshots of your critical system resources and alerts you to any changes that may occur without your knowledge. It can also be used to control all your *start up* programs.

Finally, make sure that Windows Update is turned on as many updates are to fix newly discovered security holes in the Windows Operating System. You should also make sure that any Java or Adobe products are kept up to date and any old versions are uninstalled. Never use Registry Cleaners as they can and do damage the systems registry and stay well clear of P2P file sharing sites as these are one of the best places to get your PC infected.


----------

