Инфектиран компютър(мисля че е Zero.Access rootkit) [решен]

2 ноември 201114 г.

Здравейте,

Компютъра ми се инфектира и сега като го включа ми излиза грешка от антивирусната(Error communicating with kernel), и след малко антивирусната се изключва сама.

Опитах да стартирам Malwarebytes' Anti-Malware, но ми показва това:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 9/8/2011 1:01:48 PM

System Uptime: 11/2/2011 9:41:02 PM (1 hours ago)

.

Motherboard: ASUSTeK Computer INC. | | P5KPL/1600

Processor: Intel® Pentium® Dual CPU E2160 @ 1.80GHz | Socket 775 | 1799/200mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 20 GiB total, 10.154 GiB free.

D: is FIXED (NTFS) - 189 GiB total, 128.409 GiB free.

E: is FIXED (NTFS) - 24 GiB total, 22.244 GiB free.

F: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: Ethernet Controller

Device ID: PCI\VEN_10EC&DEV_8169&SUBSYS_816910EC&REV_10\4&CF81C54&0&28F0

Manufacturer:

Name: Ethernet Controller

PNP Device ID: PCI\VEN_10EC&DEV_8169&SUBSYS_816910EC&REV_10\4&CF81C54&0&28F0

Service:

.

==== System Restore Points ===================

.

RP1: 9/8/2011 1:05:55 PM - System Checkpoint

RP2: 9/8/2011 1:12:19 PM - Installed Platform

RP3: 9/8/2011 1:19:29 PM - Installed DirectX 9.0

RP4: 9/8/2011 1:19:59 PM - Installed ATI AVIVO Codecs

RP5: 9/8/2011 1:20:30 PM - Installed Microsoft Visual C++ 2005 Redistributable

RP6: 9/8/2011 1:20:50 PM - Installed ATI Catalyst Control Center

RP7: 9/8/2011 1:23:16 PM - Installed ATI Parental Control & Encoder

RP8: 9/8/2011 1:23:32 PM - Installed ATI Problem Report Wizard

RP9: 9/9/2011 2:49:13 PM - Installed ESET Smart Security

RP10: 9/10/2011 6:46:30 PM - System Checkpoint

RP11: 9/12/2011 6:56:20 PM - System Checkpoint

RP12: 9/14/2011 1:14:13 PM - System Checkpoint

RP13: 9/19/2011 10:26:58 AM - System Checkpoint

RP14: 9/23/2011 5:43:40 PM - System Checkpoint

RP15: 9/24/2011 6:28:14 PM - Installed ACDSee 9 Photo Manager

RP16: 9/29/2011 11:16:37 AM - System Checkpoint

RP17: 10/6/2011 3:28:22 PM - System Checkpoint

RP18: 10/7/2011 5:49:50 PM - System Checkpoint

RP19: 10/11/2011 3:46:05 PM - System Checkpoint

RP20: 10/11/2011 5:01:06 PM - Installed Windows Internet Explorer 8.

RP21: 10/13/2011 6:04:20 PM - System Checkpoint

RP22: 10/14/2011 6:31:09 PM - System Checkpoint

RP23: 10/17/2011 5:38:13 PM - Installed Microsoft Office Professional Plus 2010

RP24: 10/17/2011 5:46:33 PM - Configured Microsoft Office Professional Plus 2010

RP25: 10/18/2011 9:19:04 PM - System Checkpoint

RP26: 10/21/2011 4:17:48 PM - System Checkpoint

RP27: 10/22/2011 6:06:18 PM - System Checkpoint

RP28: 10/24/2011 3:05:47 PM - System Checkpoint

RP29: 10/27/2011 3:43:34 PM - System Checkpoint

RP30: 10/30/2011 5:08:33 PM - System Checkpoint

RP31: 11/1/2011 2:58:27 PM - System Checkpoint

RP32: 11/2/2011 10:05:49 PM - Removed Ask Toolbar.

.

==== Installed Programs ======================

.

µTorrent

ACDSee 9 Photo Manager

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

AIDA64 Extreme Edition v2.00

ATI - Software Uninstall Utility

ATI AVIVO Codecs

ATI Catalyst Control Center

ATI Display Driver

ATI Parental Control & Encoder

ATI Problem Report Wizard

Canon Inkjet Printer/Scanner/Fax Extended Survey Program

Canon MP Navigator EX 3.0

Canon MP490 series MP Drivers

Canon MP490 series User Registration

Canon Utilities Easy-PhotoPrint EX

Canon Utilities My Printer

Canon Utilities Solution Menu

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Common

Catalyst Control Center Localization Chinese Standard

Catalyst Control Center Localization Chinese Traditional

Catalyst Control Center Localization Czech

Catalyst Control Center Localization Danish

Catalyst Control Center Localization Dutch

Catalyst Control Center Localization Finnish

Catalyst Control Center Localization French

Catalyst Control Center Localization German

Catalyst Control Center Localization Greek

Catalyst Control Center Localization Hungarian

Catalyst Control Center Localization Italian

Catalyst Control Center Localization Japanese

Catalyst Control Center Localization Korean

Catalyst Control Center Localization Norwegian

Catalyst Control Center Localization Polish

Catalyst Control Center Localization Portuguese

Catalyst Control Center Localization Russian

Catalyst Control Center Localization Spanish

Catalyst Control Center Localization Swedish

Catalyst Control Center Localization Thai

Catalyst Control Center Localization Turkish

ccc-core-preinstall

ccc-core-static

ccc-utility

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

CCleaner

ESET Smart Security

Foxit Reader

Google Chrome

ImgBurn

Malwarebytes' Anti-Malware version 1.51.2.1300

Microsoft .NET Framework 2.0

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Groove MUI (English) 2010

Microsoft Office InfoPath MUI (English) 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Professional Plus 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Word MUI (English) 2010

Microsoft Software Update for Web Folders (English) 14

Microsoft Visual C++ 2005 Redistributable

Mozilla Firefox 7.0.1 (x86 en-US)

Night_Raven Codec Pack

Notepad++

Opera 11.51

Phonetic Cyrillic for Windows 2000 v1.0

Platform

Skins

Skype™ 3.8

SVD

The KMPlayer (remove only)

VIA Platform Device Manager

WebFldrs XP

Winamp

Windows Internet Explorer 8

WinRAR archiver

.

==== Event Viewer Messages From Past Week ========

.

11/2/2011 9:19:43 PM, error: Service Control Manager [7031] - The ESET Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

11/2/2011 9:19:43 PM, error: Service Control Manager [7000] - The ESET Service service failed to start due to the following error: Access is denied.

11/1/2011 11:46:59 AM, error: ati2mtag [43038] -

.

==== End Of File ===========================

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Nike at 22:12:04 on 2011-11-02

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1257 [GMT 2:00]

.

AV: ESET Smart Security 5.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: ESET Personal firewall *Enabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\3579033198:2437524522.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://google.bg/

uWinlogon: Shell=c:\documents and settings\nike\local settings\application data\6eb653d5\X

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [Google Update] "c:\documents and settings\nike\local settings\application data\google\update\GoogleUpdate.exe" /c

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe"

mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

LSP: mswsock.dll

TCP: DhcpNameServer = 78.130.178.130 78.130.178.129

TCP: Interfaces\{3B997C73-BD95-4CBF-80D8-3D323ED3CD93} : DhcpNameServer = 78.130.178.130 78.130.178.129

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\nike\application data\mozilla\firefox\profiles\kjrtvtlf.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - plugin: c:\documents and settings\nike\local settings\application data\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\progra~1\micros~2\office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\micros~2\office14\NPSPWRAP.DLL

FF - plugin: c:\program files\canon\easy-photoprint ex\NPEZFFPI.DLL

FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll

.

============= SERVICES / DRIVERS ===============

.

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-12-21 118104]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-11-2 366152]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-11-2 22216]

R3 SirefefRemover;SirefefRemover;\??\c:\docume~1\nike\locals~1\temp\70de3820.tmp --> c:\docume~1\nike\locals~1\temp\70de3820.tmp [?]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2011-9-8 845184]

S2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2011-9-22 974944]

S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]

.

=============== Created Last 30 ================

.

2011-11-02 20:06:03 -------- d-----w- c:\windows\system32\appmgmt

2011-11-02 19:41:21 48016 --sha-w- c:\windows\system32\c_32835.nl_

2011-11-02 19:40:17 456576 ----a-w- c:\windows\system32\drivers\mrxsmb.sys.vir

2011-11-02 19:35:34 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2011-11-02 19:35:34 -------- d-----w- c:\program files\Hitman Pro 3.5

2011-11-02 19:35:15 -------- d-----w- c:\documents and settings\all users\application data\Hitman Pro

2011-11-02 19:34:15 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-11-02 19:34:01 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-02 19:34:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-02 19:19:43 -------- d-sh--w- c:\documents and settings\nike\local settings\application data\6eb653d5

2011-10-27 13:38:18 -------- d-----w- c:\program files\FinalWire

2011-10-22 09:29:43 -------- d-----w- c:\program files\SVD

2011-10-22 09:28:45 622592 ----a-w- c:\windows\system32\mmaacd.ax

2011-10-22 09:28:38 80384 ----a-w- c:\windows\system32\mkzlib.dll

2011-10-22 09:28:38 552960 ----a-w- c:\windows\system32\splitter.ax

2011-10-22 09:28:38 348160 ----a-w- c:\windows\system32\CoreVorbis.ax

2011-10-22 09:28:38 141824 ----a-w- c:\windows\system32\mp4.dll

2011-10-22 09:28:38 123392 ----a-w- c:\windows\system32\ogm.dll

2011-10-22 09:28:37 249856 ----a-w- c:\windows\system32\dxr.dll

2011-10-22 09:28:37 24576 ----a-w- c:\windows\system32\mkunicode.dll

2011-10-22 09:28:37 150528 ----a-w- c:\windows\system32\mkx.dll

2011-10-22 09:27:46 797184 ----a-w- c:\windows\system32\ac3filter.ax

2011-10-22 09:27:46 645632 ----a-w- c:\windows\system32\xvidcore.dll

2011-10-22 09:27:46 573440 ----a-w- c:\windows\system32\mpg123dsf.ax

2011-10-22 09:27:46 315392 ----a-w- c:\windows\system32\mp3parse.ax

2011-10-22 09:27:46 240640 ----a-w- c:\windows\system32\xvidvfw.dll

2011-10-22 09:27:46 143872 ----a-w- c:\windows\system32\xvid.ax

2011-10-22 09:27:45 -------- d-----w- c:\program files\NR-CP

2011-10-22 09:25:25 -------- d-----w- c:\program files\CCleaner

2011-10-22 09:11:43 -------- d-----w- c:\documents and settings\nike\local settings\application data\Google

2011-10-18 19:13:42 -------- d-----w- c:\documents and settings\nike\application data\BSplayer Pro

2011-10-18 19:13:34 -------- d-----w- c:\program files\Webteh

2011-10-17 14:40:51 -------- d-----w- c:\documents and settings\all users\Microsoft

2011-10-17 14:38:55 -------- d-----w- c:\program files\Microsoft Analysis Services

2011-10-17 14:38:45 -------- d-----w- c:\windows\SHELLNEW

2011-10-17 14:38:29 -------- d-----w- c:\documents and settings\nike\local settings\application data\Microsoft Help

2011-10-17 12:09:00 -------- d-----w- c:\program files\ESET

2011-10-14 18:36:43 -------- d-----w- c:\documents and settings\nike\application data\Malwarebytes

2011-10-14 18:36:38 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-10-13 09:43:22 -------- d-----w- c:\program files\uTorrent

2011-10-13 09:43:02 -------- d-----w- c:\documents and settings\nike\local settings\application data\uTorrent

2011-10-13 09:43:02 -------- d-----w- c:\documents and settings\nike\application data\uTorrent

2011-10-11 16:14:47 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll

2011-10-11 16:14:46 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll

2011-10-11 14:15:11 -------- d-sh--w- c:\documents and settings\nike\PrivacIE

2011-10-11 14:14:30 -------- d-sh--w- c:\documents and settings\nike\IETldCache

2011-10-11 14:01:03 26144 ----a-w- c:\windows\system32\spupdsvc.exe

2011-10-11 14:00:29 -------- dc-h--w- c:\windows\ie8

2011-10-11 13:27:37 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

.

==================== Find3M ====================

.

2011-11-02 19:40:17 456576 ----a-w- c:\windows\system32\drivers\mrxsmb.sys.org

2011-09-24 15:28:15 10368 ----a-w- c:\windows\system32\drivers\pfc.sys

2011-08-09 11:24:52 154136 ----a-w- c:\windows\system32\drivers\eamon.sys

2011-08-09 06:37:28 39824 ----a-w- c:\windows\system32\drivers\epfwndis.sys

.

============= FINISH: 22:12:26.68 ===============

3 ноември 201114 г.

Съжалявам, че пиша токова късно. Наистина имате Zero Access. Нека дa опитаме това:

1. Изтеглете ComboFix от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. Ако получите предупреждение от UAC, съгласете се.

5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне.

По време на сканирането не използвайте компютъра си !

3 ноември 201114 г.

Автор

Забравих да спомена вчера, че и интернета започна дазарежда по-бавно сайтовете.

ComboFix 11-11-02.03 - Nike 11/03/2011 8:17.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1721 [GMT 2:00]

Running from: c:\documents and settings\Nike\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Nike\Local Settings\Application Data\6eb653d5

c:\documents and settings\Nike\Local Settings\Application Data\6eb653d5\@

c:\documents and settings\Nike\Local Settings\Application Data\6eb653d5\U\80000000.@

c:\documents and settings\Nike\Local Settings\Application Data\6eb653d5\U\800000cb.@

c:\documents and settings\Nike\Local Settings\Application Data\6eb653d5\X

c:\documents and settings\Nike\Start Menu\Internet Explorer.lnk

c:\windows\$NtUninstallKB49820$

c:\windows\$NtUninstallKB49820$\1857442773\@

c:\windows\$NtUninstallKB49820$\1857442773\L\ndpjwuow

c:\windows\$NtUninstallKB49820$\1857442773\loader.tlb

c:\windows\$NtUninstallKB49820$\1857442773\U\@00000001

c:\windows\$NtUninstallKB49820$\1857442773\U\@000000c0

c:\windows\$NtUninstallKB49820$\1857442773\U\@000000cb

c:\windows\$NtUninstallKB49820$\1857442773\U\@000000cf

c:\windows\$NtUninstallKB49820$\1857442773\U\@80000000

c:\windows\$NtUninstallKB49820$\1857442773\U\@800000c0

c:\windows\$NtUninstallKB49820$\1857442773\U\@800000cb

c:\windows\$NtUninstallKB49820$\1857442773\U\@800000cf

c:\windows\$NtUninstallKB49820$\4139294687

c:\windows\system32\

c:\windows\system32\c_32835.nls

.

Infected copy of c:\windows\system32\drivers\ipsec.sys was found and disinfected

Restored copy from - The cat found it

Infected copy of c:\windows\system32\Ati2evxx.exe was found and disinfected

Restored copy from - c:\system volume information\_restore{41971A17-F4CE-4C7C-BF0D-0CE54AC39A48}\RP31\A0015918.exe

.

Infected copy of c:\program files\Canon\IJPLM\IJPLMSVC.EXE was found and disinfected

Restored copy from - c:\system volume information\_restore{41971A17-F4CE-4C7C-BF0D-0CE54AC39A48}\RP31\A0015919.exe

.

Infected copy of c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe was found and disinfected

Restored copy from - c:\system volume information\_restore{41971A17-F4CE-4C7C-BF0D-0CE54AC39A48}\RP31\A0015927.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_6eb653d5

.

((((((((((((((((((((((((( Files Created from 2011-10-03 to 2011-11-03 )))))))))))))))))))))))))))))))

.

2011-11-03 06:15 . 2008-04-14 12:00 75264 -c--a-w- c:\windows\system32\dllcache\ipsec.sys

2011-11-03 06:15 . 2008-04-14 12:00 75264 ----a-w- c:\windows\system32\drivers\ipsec.sys

2011-11-02 19:41 . 2011-11-02 19:41 48016 --sha-w- c:\windows\system32\c_32835.nl_

2011-11-02 19:40 . 2011-11-02 19:40 456576 ----a-w- c:\windows\system32\drivers\mrxsmb.sys.vir

2011-11-02 19:35 . 2011-11-02 19:35 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2011-11-02 19:35 . 2011-11-02 19:35 -------- d-----w- c:\program files\Hitman Pro 3.5

2011-11-02 19:35 . 2011-11-02 19:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro

2011-11-02 19:34 . 2011-11-02 19:34 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-11-02 19:34 . 2011-11-03 06:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-02 19:34 . 2011-08-31 15:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-10-27 13:38 . 2011-10-27 13:38 -------- d-----w- c:\program files\FinalWire

2011-10-26 13:26 . 2011-10-26 13:26 -------- d-----w- c:\documents and settings\Nike\Application Data\ImgBurn

2011-10-26 13:25 . 2011-10-26 13:25 -------- d-----w- c:\program files\ImgBurn

2011-10-22 09:29 . 2011-10-23 16:01 -------- d-----w- c:\program files\SVD

2011-10-22 09:28 . 2009-03-08 07:52 622592 ----a-w- c:\windows\system32\mmaacd.ax

2011-10-22 09:28 . 2011-03-03 10:40 552960 ----a-w- c:\windows\system32\splitter.ax

2011-10-22 09:28 . 2011-03-03 10:39 141824 ----a-w- c:\windows\system32\mp4.dll

2011-10-22 09:25 . 2011-10-22 09:25 -------- d-----w- c:\program files\CCleaner

2011-10-22 09:11 . 2011-10-22 09:11 -------- d-----w- c:\documents and settings\Nike\Local Settings\Application Data\Google

2011-10-18 19:13 . 2011-10-18 19:13 -------- d-----w- c:\documents and settings\Nike\Application Data\BSplayer Pro

2011-10-18 19:13 . 2011-10-18 19:13 -------- d-----w- c:\program files\Webteh

2011-10-17 14:40 . 2011-10-17 14:40 -------- d-----w- c:\program files\Microsoft.NET

2011-10-17 14:40 . 2011-10-17 14:40 -------- d-----w- c:\program files\Microsoft Sync Framework

2011-10-17 14:40 . 2011-10-17 14:40 -------- d-----w- c:\documents and settings\All Users\Microsoft

2011-10-17 14:38 . 2011-10-17 14:38 -------- d-----w- c:\program files\Microsoft Analysis Services

2011-10-17 14:38 . 2011-10-17 14:38 -------- d-----w- c:\windows\SHELLNEW

2011-10-17 14:38 . 2011-10-17 14:38 -------- d-----w- c:\documents and settings\Nike\Local Settings\Application Data\Microsoft Help

2011-10-17 14:38 . 2011-10-17 14:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2011-10-17 14:38 . 2011-10-17 14:38 -------- d-----r- C:\MSOCache

2011-10-17 12:09 . 2011-11-03 05:56 -------- d-----w- c:\program files\ESET

2011-10-17 12:09 . 2011-10-17 12:09 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET

2011-10-14 18:36 . 2011-10-14 18:36 -------- d-----w- c:\documents and settings\Nike\Application Data\Malwarebytes

2011-10-14 18:36 . 2011-10-14 18:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-10-13 09:43 . 2011-11-02 08:07 -------- d-----w- c:\program files\uTorrent

2011-10-13 09:43 . 2011-11-02 19:48 -------- d-----w- c:\documents and settings\Nike\Application Data\uTorrent

2011-10-13 09:43 . 2011-10-13 09:43 -------- d-----w- c:\documents and settings\Nike\Local Settings\Application Data\uTorrent

2011-10-11 16:14 . 2011-10-11 16:14 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll

2011-10-11 16:14 . 2011-10-11 16:14 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll

2011-10-11 14:15 . 2011-10-11 14:15 -------- d-sh--w- c:\documents and settings\Nike\PrivacIE

2011-10-11 14:14 . 2011-10-11 14:14 -------- d-sh--w- c:\documents and settings\Nike\IETldCache

2011-10-11 14:05 . 2011-11-03 05:56 -------- d-----w- c:\documents and settings\Nike\Application Data\skypePM

2011-10-11 14:01 . 2009-01-07 15:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe

2011-10-11 14:00 . 2011-10-11 14:01 -------- dc-h--w- c:\windows\ie8

2011-10-11 13:51 . 2011-10-11 15:35 -------- d-----w- c:\program files\Opera

2011-10-11 13:27 . 2011-10-11 14:16 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-11 13:27 . 2011-10-11 13:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-02 19:40 . 2011-11-02 19:40 456576 ----a-w- c:\windows\system32\drivers\mrxsmb.sys.org

2011-09-24 15:28 . 2011-09-24 15:28 10368 ----a-w- c:\windows\system32\drivers\pfc.sys

2011-08-09 11:24 . 2010-12-21 12:04 154136 ----a-w- c:\windows\system32\drivers\eamon.sys

2011-08-09 06:37 . 2010-12-21 10:47 39824 ----a-w- c:\windows\system32\drivers\epfwndis.sys

2011-10-11 16:14 . 2011-09-08 10:29 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]

"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-22 3080264]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Opera\\opera.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

.

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/2/2011 9:34 PM 366152]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/2/2011 9:34 PM 22216]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [9/8/2011 12:12 PM 845184]

S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 8:37 PM 4640000]

S3 SirefefRemover;SirefefRemover;\??\c:\docume~1\Nike\LOCALS~1\Temp\70de3820.tmp --> c:\docume~1\Nike\LOCALS~1\Temp\70de3820.tmp [?]

.

Contents of the 'Scheduled Tasks' folder

.

2011-11-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-562591055-1801674531-1003Core.job

- c:\documents and settings\Nike\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-10-22 09:11]

.

2011-11-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-562591055-1801674531-1003UA.job

- c:\documents and settings\Nike\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-10-22 09:11]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.bg/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 78.130.178.130 78.130.178.129

FF - ProfilePath - c:\documents and settings\Nike\Application Data\Mozilla\Firefox\Profiles\kjrtvtlf.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

.

- - - - ORPHANS REMOVED - - - -

.

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-11-03 08:24

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SirefefRemover]

"ImagePath"="\??\c:\docume~1\Nike\LOCALS~1\Temp\70de3820.tmp"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(528)

c:\windows\system32\Ati2evxx.dll

.

- - - - - - - > 'explorer.exe'(2936)

c:\windows\system32\ieframe.dll

c:\windows\system32\OneX.DLL

c:\windows\system32\eappprxy.dll

c:\windows\system32\webcheck.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Canon\IJPLM\IJPLMSVC.EXE

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

c:\windows\system32\wscntfy.exe

c:\program files\Skype\Plugin Manager\skypePM.exe

.

**************************************************************************

.

Completion time: 2011-11-03 08:26:25 - machine was rebooted

ComboFix-quarantined-files.txt 2011-11-03 06:26

.

Pre-Run: 10,813,730,816 bytes free

Post-Run: 11,757,625,344 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

.

- - End Of File - - 518C8C07382ABE2596C115CE6AFF04AB

Редактирано 3 ноември 201114 г. от qnmen (преглед на промените)

3 ноември 201114 г.

Сега изтеглете The Avenger и го разархивирайте на десктопа. Стартирайте avenger.exe, копирайте (Copy) следния текст и го поставете (Paste) в текстовото поле на програмата:

Files to delete:
c:\windows\system32\c_32835.nl_
c:\windows\system32\drivers\mrxsmb.sys.org

Уверете се, че Scan for rootkits и Automatically disable any rootkits found имат отметки.

След това изберете Execute и при въпрос от страна на програмата, кликнете върху Yes, при което компютъра ще се рестартира. След рестартта копирайте и поставете съдържанието на лог файла от програмата, намиращ се в C:\avenger.txt в следващия си коментар в тази тема.

P.S. Вероятно сте опитали да махнете рууткита с Sirefef Remover на ESET, като гледам без успех. Това ли сте използвали: ESETSirefefRemover.exe, виж How do I remove Zero.Access rootkit?

3 ноември 201114 г.

Автор

Да опитах с Sirefef Remover на ESET, не стана(помислих, че може да е друг рууткит) и за това се обърнах към вас.

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

No rootkits found!

File "c:\windows\system32\c_32835.nl_" deleted successfully.

File "c:\windows\system32\drivers\mrxsmb.sys.org" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

3 ноември 201114 г.

Добре. Сега изтеглете TDSSKiller от тук и я запазете на вашия декстоп.

Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.
Сложете отметки пред Verify Driver Digital Signature и Detect TDLFS file system и натиснете ОК.
Натиснете бутона Start Scan.
Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.
Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.

Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.
Изберете skip за услугата sptd.
Лог файл ще бъде създаден в свободната директория на дял C:\ . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

P.S. Не се притеснявайте, че правим толкова много сканирания. Това е нормално, трябва да оправим системата.

3 ноември 201114 г.

Автор

Програмата намери един обект, но нямаше cure и затова го оставих на skip.

21:10:57.0703 2568 TDSS rootkit removing tool 2.6.15.0 Nov 3 2011 17:15:49

21:10:57.0812 2568 ============================================================

21:10:57.0812 2568 Current date / time: 2011/11/03 21:10:57.0812

21:10:57.0812 2568 SystemInfo:

21:10:57.0812 2568

21:10:57.0812 2568 OS Version: 5.1.2600 ServicePack: 3.0

21:10:57.0812 2568 Product type: Workstation

21:10:57.0812 2568 ComputerName: G5

21:10:57.0812 2568 UserName: Nike

21:10:57.0812 2568 Windows directory: C:\WINDOWS

21:10:57.0812 2568 System windows directory: C:\WINDOWS

21:10:57.0812 2568 Processor architecture: Intel x86

21:10:57.0812 2568 Number of processors: 2

21:10:57.0812 2568 Page size: 0x1000

21:10:57.0812 2568 Boot type: Normal boot

21:10:57.0812 2568 ============================================================

21:10:58.0609 2568 Initialize success

21:11:21.0984 2808 ============================================================

21:11:21.0984 2808 Scan started

21:11:21.0984 2808 Mode: Manual; SigCheck; TDLFS;

21:11:21.0984 2808 ============================================================

21:11:22.0250 2808 Abiosdsk - ok

21:11:22.0265 2808 abp480n5 - ok

21:11:22.0281 2808 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

21:11:23.0187 2808 ACPI - ok

21:11:23.0218 2808 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

21:11:23.0359 2808 ACPIEC - ok

21:11:23.0359 2808 adpu160m - ok

21:11:23.0375 2808 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

21:11:23.0484 2808 aec - ok

21:11:23.0515 2808 AFD (322d0e36693d6e24a2398bee62a268cd) C:\WINDOWS\System32\drivers\afd.sys

21:11:23.0609 2808 AFD - ok

21:11:23.0625 2808 Aha154x - ok

21:11:23.0640 2808 aic78u2 - ok

21:11:23.0640 2808 aic78xx - ok

21:11:23.0656 2808 AliIde - ok

21:11:23.0656 2808 amsint - ok

21:11:23.0671 2808 asc - ok

21:11:23.0671 2808 asc3350p - ok

21:11:23.0671 2808 asc3550 - ok

21:11:23.0703 2808 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

21:11:23.0812 2808 AsyncMac - ok

21:11:23.0843 2808 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

21:11:23.0953 2808 atapi - ok

21:11:23.0953 2808 Atdisk - ok

21:11:24.0046 2808 ati2mtag (a336d8719f477860ab7298fe4f27723a) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

21:11:24.0140 2808 ati2mtag - ok

21:11:24.0187 2808 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

21:11:24.0312 2808 Atmarpc - ok

21:11:24.0343 2808 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

21:11:24.0453 2808 audstub - ok

21:11:24.0468 2808 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

21:11:24.0578 2808 Beep - ok

21:11:24.0578 2808 catchme - ok

21:11:24.0625 2808 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

21:11:24.0750 2808 cbidf2k - ok

21:11:24.0750 2808 cd20xrnt - ok

21:11:24.0765 2808 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

21:11:24.0859 2808 Cdaudio - ok

21:11:24.0890 2808 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

21:11:25.0000 2808 Cdfs - ok

21:11:25.0015 2808 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

21:11:25.0140 2808 Cdrom - ok

21:11:25.0171 2808 Changer - ok

21:11:25.0187 2808 CmdIde - ok

21:11:25.0203 2808 Cpqarray - ok

21:11:25.0203 2808 dac2w2k - ok

21:11:25.0203 2808 dac960nt - ok

21:11:25.0218 2808 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

21:11:25.0343 2808 Disk - ok

21:11:25.0375 2808 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

21:11:25.0500 2808 dmboot - ok

21:11:25.0515 2808 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

21:11:25.0640 2808 dmio - ok

21:11:25.0671 2808 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

21:11:25.0765 2808 dmload - ok

21:11:25.0796 2808 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

21:11:25.0921 2808 DMusic - ok

21:11:25.0921 2808 dpti2o - ok

21:11:25.0937 2808 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

21:11:26.0031 2808 drmkaud - ok

21:11:26.0062 2808 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

21:11:26.0187 2808 Fastfat - ok

21:11:26.0203 2808 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

21:11:26.0328 2808 Fdc - ok

21:11:26.0375 2808 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

21:11:26.0484 2808 Fips - ok

21:11:26.0515 2808 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

21:11:26.0625 2808 Flpydisk - ok

21:11:26.0656 2808 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys

21:11:26.0765 2808 FltMgr - ok

21:11:26.0781 2808 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

21:11:26.0890 2808 Fs_Rec - ok

21:11:26.0890 2808 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

21:11:27.0015 2808 Ftdisk - ok

21:11:27.0031 2808 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

21:11:27.0156 2808 Gpc - ok

21:11:27.0171 2808 HdAudAddService (56bf27d7a539f9e6bbc1de201aba0edf) C:\WINDOWS\system32\drivers\AtiHdAud.sys

21:11:27.0203 2808 HdAudAddService - ok

21:11:27.0234 2808 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

21:11:27.0328 2808 HDAudBus - ok

21:11:27.0343 2808 hpn - ok

21:11:27.0375 2808 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys

21:11:27.0484 2808 HTTP - ok

21:11:27.0500 2808 i2omgmt - ok

21:11:27.0500 2808 i2omp - ok

21:11:27.0531 2808 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

21:11:27.0640 2808 i8042prt - ok

21:11:27.0656 2808 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

21:11:27.0781 2808 Imapi - ok

21:11:27.0781 2808 ini910u - ok

21:11:27.0796 2808 IntelIde - ok

21:11:27.0812 2808 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

21:11:27.0921 2808 intelppm - ok

21:11:27.0937 2808 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys

21:11:28.0046 2808 Ip6Fw - ok

21:11:28.0078 2808 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

21:11:28.0203 2808 IpFilterDriver - ok

21:11:28.0218 2808 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

21:11:28.0312 2808 IpInIp - ok

21:11:28.0328 2808 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

21:11:28.0437 2808 IpNat - ok

21:11:28.0453 2808 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

21:11:28.0562 2808 IPSec - ok

21:11:28.0593 2808 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

21:11:28.0656 2808 IRENUM - ok

21:11:28.0687 2808 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

21:11:28.0781 2808 isapnp - ok

21:11:28.0796 2808 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

21:11:28.0921 2808 Kbdclass - ok

21:11:28.0968 2808 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

21:11:29.0062 2808 kmixer - ok

21:11:29.0093 2808 KSecDD (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys

21:11:29.0203 2808 KSecDD - ok

21:11:29.0203 2808 lbrtfdc - ok

21:11:29.0218 2808 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\WINDOWS\system32\drivers\mbam.sys

21:11:29.0265 2808 MBAMProtector - ok

21:11:29.0296 2808 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

21:11:29.0406 2808 mnmdd - ok

21:11:29.0421 2808 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

21:11:29.0546 2808 Modem - ok

21:11:29.0593 2808 monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\monfilt.sys

21:11:29.0656 2808 monfilt - ok

21:11:29.0687 2808 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

21:11:29.0796 2808 Mouclass - ok

21:11:29.0828 2808 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

21:11:29.0953 2808 MountMgr - ok

21:11:29.0968 2808 mraid35x - ok

21:11:29.0968 2808 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

21:11:30.0078 2808 MRxDAV - ok

21:11:30.0109 2808 MRxSmb (68755f0ff16070178b54674fe5b847b0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

21:11:30.0234 2808 MRxSmb - ok

21:11:30.0234 2808 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

21:11:30.0359 2808 Msfs - ok

21:11:30.0390 2808 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

21:11:30.0515 2808 MSKSSRV - ok

21:11:30.0515 2808 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

21:11:30.0625 2808 MSPCLOCK - ok

21:11:30.0640 2808 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

21:11:30.0750 2808 MSPQM - ok

21:11:30.0765 2808 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

21:11:30.0859 2808 mssmbios - ok

21:11:30.0906 2808 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys

21:11:30.0937 2808 MTsensor - ok

21:11:30.0968 2808 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

21:11:31.0062 2808 Mup - ok

21:11:31.0093 2808 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

21:11:31.0203 2808 NDIS - ok

21:11:31.0234 2808 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

21:11:31.0359 2808 NdisTapi - ok

21:11:31.0375 2808 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

21:11:31.0468 2808 Ndisuio - ok

21:11:31.0484 2808 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

21:11:31.0593 2808 NdisWan - ok

21:11:31.0609 2808 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

21:11:31.0718 2808 NDProxy - ok

21:11:31.0734 2808 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

21:11:31.0843 2808 NetBIOS - ok

21:11:31.0875 2808 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

21:11:31.0984 2808 NetBT - ok

21:11:32.0015 2808 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

21:11:32.0140 2808 Npfs - ok

21:11:32.0187 2808 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

21:11:32.0296 2808 Ntfs - ok

21:11:32.0312 2808 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

21:11:32.0421 2808 Null - ok

21:11:32.0437 2808 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

21:11:32.0546 2808 NwlnkFlt - ok

21:11:32.0578 2808 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

21:11:32.0671 2808 NwlnkFwd - ok

21:11:32.0703 2808 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

21:11:32.0796 2808 Parport - ok

21:11:32.0828 2808 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

21:11:32.0921 2808 PartMgr - ok

21:11:32.0937 2808 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

21:11:33.0046 2808 ParVdm - ok

21:11:33.0078 2808 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

21:11:33.0187 2808 PCI - ok

21:11:33.0203 2808 PCIDump - ok

21:11:33.0203 2808 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

21:11:33.0312 2808 PCIIde - ok

21:11:33.0343 2808 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

21:11:33.0437 2808 Pcmcia - ok

21:11:33.0453 2808 PDCOMP - ok

21:11:33.0453 2808 PDFRAME - ok

21:11:33.0453 2808 PDRELI - ok

21:11:33.0468 2808 PDRFRAME - ok

21:11:33.0468 2808 perc2 - ok

21:11:33.0484 2808 perc2hib - ok

21:11:33.0515 2808 pfc (957b82ec80ad7ead64e5e47df6b0dc40) C:\WINDOWS\system32\drivers\pfc.sys

21:11:33.0531 2808 pfc ( UnsignedFile.Multi.Generic ) - warning

21:11:33.0531 2808 pfc - detected UnsignedFile.Multi.Generic (1)

21:11:33.0578 2808 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

21:11:33.0687 2808 PptpMiniport - ok

21:11:33.0703 2808 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

21:11:33.0828 2808 PSched - ok

21:11:33.0828 2808 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

21:11:33.0921 2808 Ptilink - ok

21:11:33.0937 2808 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys

21:11:33.0953 2808 PxHelp20 - ok

21:11:33.0968 2808 ql1080 - ok

21:11:33.0968 2808 Ql10wnt - ok

21:11:33.0984 2808 ql12160 - ok

21:11:33.0984 2808 ql1240 - ok

21:11:33.0984 2808 ql1280 - ok

21:11:34.0000 2808 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

21:11:34.0109 2808 RasAcd - ok

21:11:34.0140 2808 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

21:11:34.0250 2808 Rasl2tp - ok

21:11:34.0265 2808 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

21:11:34.0375 2808 RasPppoe - ok

21:11:34.0406 2808 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

21:11:34.0500 2808 Raspti - ok

21:11:34.0515 2808 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

21:11:34.0625 2808 Rdbss - ok

21:11:34.0656 2808 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

21:11:34.0750 2808 RDPCDD - ok

21:11:34.0781 2808 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

21:11:34.0890 2808 rdpdr - ok

21:11:34.0921 2808 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

21:11:35.0015 2808 RDPWD - ok

21:11:35.0031 2808 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

21:11:35.0140 2808 redbook - ok

21:11:35.0187 2808 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS

21:11:35.0296 2808 rtl8139 - ok

21:11:35.0328 2808 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

21:11:35.0375 2808 Secdrv - ok

21:11:35.0406 2808 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

21:11:35.0515 2808 serenum - ok

21:11:35.0546 2808 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

21:11:35.0640 2808 Serial - ok

21:11:35.0640 2808 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

21:11:35.0734 2808 Sfloppy - ok

21:11:35.0750 2808 Simbad - ok

21:11:35.0781 2808 SirefefRemover - ok

21:11:35.0781 2808 Sparrow - ok

21:11:35.0812 2808 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

21:11:35.0921 2808 splitter - ok

21:11:35.0953 2808 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

21:11:35.0984 2808 sr - ok

21:11:36.0000 2808 Srv (5252605079810904e31c332e241cd59b) C:\WINDOWS\system32\DRIVERS\srv.sys

21:11:36.0125 2808 Srv - ok

21:11:36.0156 2808 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

21:11:36.0281 2808 swenum - ok

21:11:36.0312 2808 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

21:11:36.0406 2808 swmidi - ok

21:11:36.0406 2808 symc810 - ok

21:11:36.0421 2808 symc8xx - ok

21:11:36.0421 2808 sym_hi - ok

21:11:36.0437 2808 sym_u3 - ok

21:11:36.0453 2808 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

21:11:36.0562 2808 sysaudio - ok

21:11:36.0609 2808 Tcpip (93ea8d04ec73a85db02eb8805988f733) C:\WINDOWS\system32\DRIVERS\tcpip.sys

21:11:36.0718 2808 Tcpip - ok

21:11:36.0750 2808 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

21:11:36.0859 2808 TDPIPE - ok

21:11:36.0890 2808 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

21:11:36.0984 2808 TDTCP - ok

21:11:37.0000 2808 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

21:11:37.0093 2808 TermDD - ok

21:11:37.0109 2808 TosIde - ok

21:11:37.0125 2808 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

21:11:37.0234 2808 Udfs - ok

21:11:37.0250 2808 ultra - ok

21:11:37.0281 2808 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

21:11:37.0375 2808 Update - ok

21:11:37.0406 2808 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

21:11:37.0515 2808 usbccgp - ok

21:11:37.0531 2808 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

21:11:37.0625 2808 usbehci - ok

21:11:37.0640 2808 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

21:11:37.0750 2808 usbhub - ok

21:11:37.0796 2808 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

21:11:37.0890 2808 usbprint - ok

21:11:37.0921 2808 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

21:11:38.0015 2808 usbscan - ok

21:11:38.0031 2808 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

21:11:38.0140 2808 USBSTOR - ok

21:11:38.0171 2808 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

21:11:38.0265 2808 usbuhci - ok

21:11:38.0281 2808 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

21:11:38.0375 2808 VgaSave - ok

21:11:38.0421 2808 VIAHdAudAddService (51b24990850076f659d1d1daefbed6f1) C:\WINDOWS\system32\drivers\viahduaa.sys

21:11:38.0468 2808 VIAHdAudAddService - ok

21:11:38.0484 2808 ViaIde - ok

21:11:38.0500 2808 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

21:11:38.0609 2808 VolSnap - ok

21:11:38.0640 2808 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

21:11:38.0750 2808 Wanarp - ok

21:11:38.0781 2808 WDICA - ok

21:11:38.0796 2808 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

21:11:38.0906 2808 wdmaud - ok

21:11:38.0937 2808 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0

21:11:39.0156 2808 \Device\Harddisk0\DR0 - ok

21:11:39.0187 2808 Boot (0x1200) (19e523e8c3200a3a7b32da69b7faecec) \Device\Harddisk0\DR0\Partition0

21:11:39.0187 2808 \Device\Harddisk0\DR0\Partition0 - ok

21:11:39.0203 2808 Boot (0x1200) (781a50a9a1c457a99bc97a4802c83620) \Device\Harddisk0\DR0\Partition1

21:11:39.0203 2808 \Device\Harddisk0\DR0\Partition1 - ok

21:11:39.0218 2808 Boot (0x1200) (801fbf6bbc0b8a7fc02dbb0bb462b44c) \Device\Harddisk0\DR0\Partition2

21:11:39.0234 2808 \Device\Harddisk0\DR0\Partition2 - ok

21:11:39.0234 2808 ============================================================

21:11:39.0234 2808 Scan finished

21:11:39.0234 2808 ============================================================

21:11:39.0375 2800 Detected object count: 1

21:11:39.0375 2800 Actual detected object count: 1

21:11:52.0062 2800 pfc ( UnsignedFile.Multi.Generic ) - skipped by user

21:11:52.0062 2800 pfc ( UnsignedFile.Multi.Generic ) - User select action: Skip

21:12:14.0187 2996 ============================================================

21:12:14.0187 2996 Scan started

21:12:14.0187 2996 Mode: Manual; SigCheck; TDLFS;

21:12:14.0187 2996 ============================================================

21:12:14.0359 2996 Abiosdsk - ok

21:12:14.0375 2996 abp480n5 - ok

21:12:14.0390 2996 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

21:12:14.0500 2996 ACPI - ok

21:12:14.0531 2996 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

21:12:14.0625 2996 ACPIEC - ok

21:12:14.0656 2996 adpu160m - ok

21:12:14.0671 2996 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

21:12:14.0765 2996 aec - ok

21:12:14.0796 2996 AFD (322d0e36693d6e24a2398bee62a268cd) C:\WINDOWS\System32\drivers\afd.sys

21:12:14.0890 2996 AFD - ok

21:12:14.0890 2996 Aha154x - ok

21:12:14.0906 2996 aic78u2 - ok

21:12:14.0906 2996 aic78xx - ok

21:12:14.0921 2996 AliIde - ok

21:12:14.0921 2996 amsint - ok

21:12:14.0937 2996 asc - ok

21:12:14.0937 2996 asc3350p - ok

21:12:14.0953 2996 asc3550 - ok

21:12:14.0984 2996 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

21:12:15.0078 2996 AsyncMac - ok

21:12:15.0125 2996 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

21:12:15.0234 2996 atapi - ok

21:12:15.0234 2996 Atdisk - ok

21:12:15.0312 2996 ati2mtag (a336d8719f477860ab7298fe4f27723a) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

21:12:15.0375 2996 ati2mtag - ok

21:12:15.0421 2996 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

21:12:15.0531 2996 Atmarpc - ok

21:12:15.0562 2996 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

21:12:15.0656 2996 audstub - ok

21:12:15.0687 2996 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

21:12:15.0796 2996 Beep - ok

21:12:15.0796 2996 catchme - ok

21:12:15.0843 2996 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

21:12:15.0953 2996 cbidf2k - ok

21:12:15.0953 2996 cd20xrnt - ok

21:12:15.0968 2996 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

21:12:16.0046 2996 Cdaudio - ok

21:12:16.0078 2996 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

21:12:16.0171 2996 Cdfs - ok

21:12:16.0187 2996 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

21:12:16.0296 2996 Cdrom - ok

21:12:16.0312 2996 Changer - ok

21:12:16.0328 2996 CmdIde - ok

21:12:16.0343 2996 Cpqarray - ok

21:12:16.0359 2996 dac2w2k - ok

21:12:16.0375 2996 dac960nt - ok

21:12:16.0375 2996 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

21:12:16.0484 2996 Disk - ok

21:12:16.0515 2996 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

21:12:16.0640 2996 dmboot - ok

21:12:16.0671 2996 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

21:12:16.0781 2996 dmio - ok

21:12:16.0796 2996 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

21:12:16.0890 2996 dmload - ok

21:12:16.0906 2996 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

21:12:17.0031 2996 DMusic - ok

21:12:17.0046 2996 dpti2o - ok

21:12:17.0046 2996 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

21:12:17.0140 2996 drmkaud - ok

21:12:17.0187 2996 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

21:12:17.0281 2996 Fastfat - ok

21:12:17.0296 2996 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

21:12:17.0406 2996 Fdc - ok

21:12:17.0437 2996 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

21:12:17.0546 2996 Fips - ok

21:12:17.0578 2996 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

21:12:17.0671 2996 Flpydisk - ok

21:12:17.0703 2996 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys

21:12:17.0796 2996 FltMgr - ok

21:12:17.0812 2996 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

21:12:17.0921 2996 Fs_Rec - ok

21:12:17.0921 2996 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

21:12:18.0031 2996 Ftdisk - ok

21:12:18.0062 2996 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

21:12:18.0156 2996 Gpc - ok

21:12:18.0187 2996 HdAudAddService (56bf27d7a539f9e6bbc1de201aba0edf) C:\WINDOWS\system32\drivers\AtiHdAud.sys

21:12:18.0187 2996 HdAudAddService - ok

21:12:18.0218 2996 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

21:12:18.0312 2996 HDAudBus - ok

21:12:18.0328 2996 hpn - ok

21:12:18.0343 2996 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys

21:12:18.0453 2996 HTTP - ok

21:12:18.0453 2996 i2omgmt - ok

21:12:18.0468 2996 i2omp - ok

21:12:18.0484 2996 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

21:12:18.0593 2996 i8042prt - ok

21:12:18.0609 2996 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

21:12:18.0703 2996 Imapi - ok

21:12:18.0718 2996 ini910u - ok

21:12:18.0734 2996 IntelIde - ok

21:12:18.0750 2996 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

21:12:18.0843 2996 intelppm - ok

21:12:18.0859 2996 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys

21:12:18.0953 2996 Ip6Fw - ok

21:12:18.0984 2996 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

21:12:19.0093 2996 IpFilterDriver - ok

21:12:19.0109 2996 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

21:12:19.0187 2996 IpInIp - ok

21:12:19.0203 2996 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

21:12:19.0296 2996 IpNat - ok

21:12:19.0312 2996 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

21:12:19.0406 2996 IPSec - ok

21:12:19.0453 2996 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

21:12:19.0515 2996 IRENUM - ok

21:12:19.0531 2996 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

21:12:19.0625 2996 isapnp - ok

21:12:19.0640 2996 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

21:12:19.0750 2996 Kbdclass - ok

21:12:19.0796 2996 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

21:12:19.0875 2996 kmixer - ok

21:12:19.0906 2996 KSecDD (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys

21:12:20.0000 2996 KSecDD - ok

21:12:20.0000 2996 lbrtfdc - ok

21:12:20.0031 2996 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\WINDOWS\system32\drivers\mbam.sys

21:12:20.0031 2996 MBAMProtector - ok

21:12:20.0062 2996 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

21:12:20.0156 2996 mnmdd - ok

21:12:20.0203 2996 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

21:12:20.0296 2996 Modem - ok

21:12:20.0343 2996 monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\monfilt.sys

21:12:20.0406 2996 monfilt - ok

21:12:20.0437 2996 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

21:12:20.0531 2996 Mouclass - ok

21:12:20.0562 2996 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

21:12:20.0671 2996 MountMgr - ok

21:12:20.0671 2996 mraid35x - ok

21:12:20.0687 2996 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

21:12:20.0781 2996 MRxDAV - ok

21:12:20.0796 2996 MRxSmb (68755f0ff16070178b54674fe5b847b0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

21:12:20.0906 2996 MRxSmb - ok

21:12:20.0921 2996 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

21:12:21.0015 2996 Msfs - ok

21:12:21.0062 2996 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

21:12:21.0156 2996 MSKSSRV - ok

21:12:21.0171 2996 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

21:12:21.0250 2996 MSPCLOCK - ok

21:12:21.0265 2996 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

21:12:21.0359 2996 MSPQM - ok

21:12:21.0375 2996 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

21:12:21.0468 2996 mssmbios - ok

21:12:21.0484 2996 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys

21:12:21.0500 2996 MTsensor - ok

21:12:21.0546 2996 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

21:12:21.0640 2996 Mup - ok

21:12:21.0656 2996 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

21:12:21.0750 2996 NDIS - ok

21:12:21.0765 2996 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

21:12:21.0859 2996 NdisTapi - ok

21:12:21.0875 2996 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

21:12:21.0968 2996 Ndisuio - ok

21:12:22.0000 2996 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

21:12:22.0078 2996 NdisWan - ok

21:12:22.0093 2996 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

21:12:22.0187 2996 NDProxy - ok

21:12:22.0187 2996 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

21:12:22.0281 2996 NetBIOS - ok

21:12:22.0296 2996 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

21:12:22.0375 2996 NetBT - ok

21:12:22.0406 2996 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

21:12:22.0484 2996 Npfs - ok

21:12:22.0515 2996 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

21:12:22.0609 2996 Ntfs - ok

21:12:22.0640 2996 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

21:12:22.0718 2996 Null - ok

21:12:22.0734 2996 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

21:12:22.0828 2996 NwlnkFlt - ok

21:12:22.0859 2996 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

21:12:22.0937 2996 NwlnkFwd - ok

21:12:22.0968 2996 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

21:12:23.0046 2996 Parport - ok

21:12:23.0062 2996 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

21:12:23.0140 2996 PartMgr - ok

21:12:23.0156 2996 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

21:12:23.0234 2996 ParVdm - ok

21:12:23.0250 2996 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

21:12:23.0343 2996 PCI - ok

21:12:23.0343 2996 PCIDump - ok

21:12:23.0343 2996 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

21:12:23.0437 2996 PCIIde - ok

21:12:23.0468 2996 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

21:12:23.0546 2996 Pcmcia - ok

21:12:23.0578 2996 PDCOMP - ok

21:12:23.0578 2996 PDFRAME - ok

21:12:23.0593 2996 PDRELI - ok

21:12:23.0593 2996 PDRFRAME - ok

21:12:23.0609 2996 perc2 - ok

21:12:23.0609 2996 perc2hib - ok

21:12:23.0656 2996 pfc (957b82ec80ad7ead64e5e47df6b0dc40) C:\WINDOWS\system32\drivers\pfc.sys

21:12:23.0656 2996 pfc ( UnsignedFile.Multi.Generic ) - warning

21:12:23.0656 2996 pfc - detected UnsignedFile.Multi.Generic (1)

21:12:23.0671 2996 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

21:12:23.0765 2996 PptpMiniport - ok

21:12:23.0781 2996 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

21:12:23.0859 2996 PSched - ok

21:12:23.0875 2996 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

21:12:23.0968 2996 Ptilink - ok

21:12:23.0984 2996 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys

21:12:23.0984 2996 PxHelp20 - ok

21:12:24.0000 2996 ql1080 - ok

21:12:24.0015 2996 Ql10wnt - ok

21:12:24.0015 2996 ql12160 - ok

21:12:24.0031 2996 ql1240 - ok

21:12:24.0031 2996 ql1280 - ok

21:12:24.0046 2996 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

21:12:24.0125 2996 RasAcd - ok

21:12:24.0140 2996 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

21:12:24.0234 2996 Rasl2tp - ok

21:12:24.0234 2996 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

21:12:24.0328 2996 RasPppoe - ok

21:12:24.0328 2996 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

21:12:24.0421 2996 Raspti - ok

21:12:24.0437 2996 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

21:12:24.0515 2996 Rdbss - ok

21:12:24.0531 2996 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

21:12:24.0609 2996 RDPCDD - ok

21:12:24.0640 2996 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

21:12:24.0718 2996 rdpdr - ok

21:12:24.0765 2996 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

21:12:24.0843 2996 RDPWD - ok

21:12:24.0875 2996 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

21:12:24.0968 2996 redbook - ok

21:12:24.0984 2996 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS

21:12:25.0078 2996 rtl8139 - ok

21:12:25.0093 2996 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

21:12:25.0140 2996 Secdrv - ok

21:12:25.0171 2996 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

21:12:25.0250 2996 serenum - ok

21:12:25.0265 2996 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

21:12:25.0343 2996 Serial - ok

21:12:25.0375 2996 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

21:12:25.0453 2996 Sfloppy - ok

21:12:25.0484 2996 Simbad - ok

21:12:25.0515 2996 SirefefRemover - ok

21:12:25.0531 2996 Sparrow - ok

21:12:25.0546 2996 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

21:12:25.0640 2996 splitter - ok

21:12:25.0671 2996 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

21:12:25.0718 2996 sr - ok

21:12:25.0734 2996 Srv (5252605079810904e31c332e241cd59b) C:\WINDOWS\system32\DRIVERS\srv.sys

21:12:25.0812 2996 Srv - ok

21:12:25.0843 2996 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

21:12:25.0937 2996 swenum - ok

21:12:25.0968 2996 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

21:12:26.0046 2996 swmidi - ok

21:12:26.0062 2996 symc810 - ok

21:12:26.0062 2996 symc8xx - ok

21:12:26.0078 2996 sym_hi - ok

21:12:26.0078 2996 sym_u3 - ok

21:12:26.0093 2996 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

21:12:26.0187 2996 sysaudio - ok

21:12:26.0218 2996 Tcpip (93ea8d04ec73a85db02eb8805988f733) C:\WINDOWS\system32\DRIVERS\tcpip.sys

21:12:26.0312 2996 Tcpip - ok

21:12:26.0343 2996 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

21:12:26.0421 2996 TDPIPE - ok

21:12:26.0453 2996 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

21:12:26.0531 2996 TDTCP - ok

21:12:26.0546 2996 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

21:12:26.0640 2996 TermDD - ok

21:12:26.0656 2996 TosIde - ok

21:12:26.0671 2996 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

21:12:26.0765 2996 Udfs - ok

21:12:26.0781 2996 ultra - ok

21:12:26.0812 2996 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

21:12:26.0906 2996 Update - ok

21:12:26.0921 2996 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

21:12:27.0015 2996 usbccgp - ok

21:12:27.0031 2996 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

21:12:27.0125 2996 usbehci - ok

21:12:27.0140 2996 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

21:12:27.0234 2996 usbhub - ok

21:12:27.0250 2996 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

21:12:27.0343 2996 usbprint - ok

21:12:27.0375 2996 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

21:12:27.0453 2996 usbscan - ok

21:12:27.0484 2996 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

21:12:27.0562 2996 USBSTOR - ok

21:12:27.0593 2996 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

21:12:27.0671 2996 usbuhci - ok

21:12:27.0703 2996 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

21:12:27.0796 2996 VgaSave - ok

21:12:27.0828 2996 VIAHdAudAddService (51b24990850076f659d1d1daefbed6f1) C:\WINDOWS\system32\drivers\viahduaa.sys

21:12:27.0859 2996 VIAHdAudAddService - ok

21:12:27.0875 2996 ViaIde - ok

21:12:27.0875 2996 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

21:12:27.0968 2996 VolSnap - ok

21:12:28.0015 2996 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

21:12:28.0093 2996 Wanarp - ok

21:12:28.0109 2996 WDICA - ok

21:12:28.0125 2996 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

21:12:28.0203 2996 wdmaud - ok

21:12:28.0250 2996 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0

21:12:28.0468 2996 \Device\Harddisk0\DR0 - ok

21:12:28.0468 2996 Boot (0x1200) (19e523e8c3200a3a7b32da69b7faecec) \Device\Harddisk0\DR0\Partition0

21:12:28.0468 2996 \Device\Harddisk0\DR0\Partition0 - ok

21:12:28.0500 2996 Boot (0x1200) (781a50a9a1c457a99bc97a4802c83620) \Device\Harddisk0\DR0\Partition1

21:12:28.0500 2996 \Device\Harddisk0\DR0\Partition1 - ok

21:12:28.0531 2996 Boot (0x1200) (801fbf6bbc0b8a7fc02dbb0bb462b44c) \Device\Harddisk0\DR0\Partition2

21:12:28.0531 2996 \Device\Harddisk0\DR0\Partition2 - ok

21:12:28.0531 2996 ============================================================

21:12:28.0531 2996 Scan finished

21:12:28.0531 2996 ============================================================

21:12:28.0546 3120 Detected object count: 1

21:12:28.0546 3120 Actual detected object count: 1

21:14:16.0187 3120 pfc ( UnsignedFile.Multi.Generic ) - skipped by user

21:14:16.0187 3120 pfc ( UnsignedFile.Multi.Generic ) - User select action: Skip

21:14:43.0937 3236 Deinitialize success

3 ноември 201114 г.

Много добре. Ще трябва да отключим малко файлове. Ето как:

Моля изтеглете Junction.zip и го запазете на вашия десктоп. Разархивирайте файла и го копирайте файла junction.exe в C:\Windows.
Изтеглете следния файл:
Разархивирайте fix.zip и стартирайте стартирайте файла fix.bat с десен бутон → Run as administrator
Изчакайте да завърши проверката и да се появи лог файла (този лог файл ще се намира на С:\ с име log.txt).
Копирайте съдържанието му в следващия си коментар.

3 ноември 201114 г.

Автор

Ето го: Junction v1.06 - Windows junction creator and reparse point viewer Copyright © 2000-2010 Mark Russinovich Sysinternals - www.sysinternals.com Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process. Failed to open \\?\c:\\System Volume Information: Access is denied. ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... .. Failed to open \\?\c:\\Program Files\ESET\ESET Smart Security\ekrn.exe: Access is denied. Failed to open \\?\c:\\Program Files\Malwarebytes' Anti-Malware\mbam.exe: Access is denied. . ... ... .. Failed to open \\?\c:\\Qoobox\BackEnv: Access is denied. . ... ... ... ... ... ... ... ... No reparse points found.

3 ноември 201114 г.

Сега изтеглете GrantPerms.zip и го разархивирайте в папка по избор. Стартирайте GrantPerms.exe и въведете следната информация:

c:\Program Files\ESET\ESET Smart Security\ekrn.exe
c:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

Натиснете Unlock и след това List Permissions. Публикувайте лог файла в следващия си пост.

3 ноември 201114 г.

Автор

GrantPerms by Farbar Ran by Nike at 2011-11-03 22:07:25 =============================================== \\?\c:\Program Files\ESET\ESET Smart Security\ekrn.exe Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI) \\?\c:\Program Files\Malwarebytes' Anti-Malware\mbam.exe Owner: BUILTIN\Administrators DACL(P)(AI): BUILTIN\Administrators FULL ALLOW (NI) NT AUTHORITY\SYSTEM FULL ALLOW (NI) BUILTIN\Users READ/EXECUTE ALLOW (NI)

3 ноември 201114 г.

Следва сканиране с MBAM:

Стартирайте Malwarebytes' Anti-Malware, обновете я и изберете Perform Quick Scan (Бързо сканиране), след това кликнете на Scan (Сканиране).
Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

P.S. Преинсталирайте ESET Smart Security, защото е повредена от рууткита. Пишете дали има проблем с преинсталацията на ESS.

3 ноември 201114 г.

Автор

Преинсталирах ESET Smart Security (нямаше проблем с преинсталирането) сега заработи нормално. Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 8079 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 11/3/2011 10:44:42 PM mbam-log-2011-11-03 (22-44-42).txt Scan type: Quick scan Objects scanned: 153094 Time elapsed: 6 minute(s), 11 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

3 ноември 201114 г.

Супер! Следва:

1. Деинсталирайте ComboFix:

Start → Run → Копирайте (copy) и поставете (Paste) следния текст, маркиран в синьо:

Combofix /Uninstall

после OK

2.Изтеглете OTCleanIt , стартирайте го и натиснете CleanUp

Изтрийте програмите и логовете, които използвахме в темата, ако има останали.

Пуснете сканиране с ESS и пишете за резултата.

3 ноември 201114 г.

Автор

Деинсталирах ComboFix, и изтрих програмите и логовете, които използвахме. Сканирах с ESS, нищо не откри. Нещо друго трябва ли да правя?

3 ноември 201114 г.

Не, нямаме повече работа. Има ли някакви други проблеми с Windows?

3 ноември 201114 г.

Автор

Много благодаря, че ми отделихте време и ми помогнахте да изчистя компютъра ми. P.S. Няма никакви проблеми с Windows.

3 ноември 201114 г.

В такъв случай маркирам проблема като решен. Приятна вечер и успех!

Добре дошли!

Инфектиран компютър(мисля че е Zero.Access rootkit) [решен]

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)