Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

Взлом Разходки...

18 февруари 201313 г.

Здравейте колеги съфорумци. За трети път пиша тук в този форум.

Причината поради която правя това сега се корени във следното нещо....

Тази сутрин се получи една доста интересна аномалия с машината ми. Стартира се без намеса от моя страна без да е стартиран wake on lan от биос и без да съм правил каквото и да е по нея. След това незнайно как в режим на Уиндоус ми се зареди калкулатор пак без моя намеса, след което няколко пъти работната ми станция се самозаключи с режима win+l без пак да е имало такова нещо подавано от мен като команда. Можем ли да направим едно проучване за шпионски софутер и за други твари които да се крият

във операционната система и ли на другите дялове на хард диска?

Съдържанието на Attach.txt...

.UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2011-09-30.01).Microsoft Windows 7 Ultimate Boot Device: DeviceHarddiskVolume1Install Date: 18.2.2013 г. 14:47:54System Uptime: 18.2.2013 г. 17:29:13 (1 hours ago)==== Disk Partitions =========================.C: is FIXED (NTFS) - 83 GiB total, 57,088 GiB free.D: is FIXED (NTFS) - 454 GiB total, 409,318 GiB free.E: is FIXED (NTFS) - 394 GiB total, 345,511 GiB free.F: is CDROM ().==== Disabled Device Manager Items =============.==== System Restore Points ===================.RP3: 18.2.2013 г. 14:51:51 - Windows UpdateRP4: 18.2.2013 г. 14:52:24 - Installed Skype™ 6.1RP5: 18.2.2013 г. 14:54:23 - Windows UpdateRP6: 18.2.2013 г. 14:57:35 - Windows UpdateRP7: 18.2.2013 г. 16:17:44 - Installed Waterfox.==== Installed Programs ======================.Adobe Flash Player 11 Pluginfoobar2000 v1.2.3 beta 3HaoZipqBittorrent 3.0.8Realtek High Definition Audio DriverSkype™ 6.1Waterfox.==== Event Viewer Messages From Past Week ========.18.2.2013 г. 15:07:54, Error: Service Control Manager [7023]  - 18.2.2013 г. 15:04:51, Error: Microsoft-Windows-WindowsUpdateClient [20]  - Installation Failure: Windows failed to install the following update with error 0x800705b4: Realtek Semiconductor Corp. - Network - Realtek RTL8139/810x Family Fast Ethernet NIC.18.2.2013 г. 14:10:25, Error: Service Control Manager [7023]  - The Windows Time service terminated with the following error:  The system cannot find the file specified.18.2.2013 г. 14:06:34, Error: volmgr [46]  - Crash dump initialization failed!.==== End Of File ===========================

Съдържанието на DDS.txt:

DDS (Ver_2011-09-30.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16421Run by R2-D2 at 18:34:15 on 2013-02-18#Option Extended Search is enabled.Microsoft Windows 7 Ultimate   6.1.7601.1.1251.359.1033.18.8190.6608 [GMT 2:00].SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:Windowssystem32wininit.exeC:Windowssystem32lsm.exeC:Windowssystem32svchost.exe -k DcomLaunchC:Windowssystem32svchost.exe -k RPCSSC:Windowssystem32atiesrxx.exeC:WindowsSystem32svchost.exe -k LocalServiceNetworkRestrictedC:WindowsSystem32svchost.exe -k LocalSystemNetworkRestrictedC:Windowssystem32svchost.exe -k netsvcsC:Windowssystem32svchost.exe -k GPSvcGroupC:Windowssystem32svchost.exe -k LocalServiceC:Windowssystem32svchost.exe -k NetworkServiceC:WindowsSystem32spoolsv.exeC:Windowssystem32svchost.exe -k LocalServiceNoNetworkC:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonationC:Windowssystem32atieclxx.exeC:Windowssystem32taskhost.exeC:Windowssystem32Dwm.exeC:WindowsExplorer.EXEC:Program FilesRealtekAudioHDARAVCpl64.exeC:Program Files (x86)SkypePhoneSkype.exeC:Windowssystem32SearchIndexer.exeC:Program FilesWindows Media Playerwmpnetwk.exeC:Windowssystem32sppsvc.exeC:WindowsSystem32svchost.exe -k secsvcsC:Program FilesWaterfoxwaterfox.exeC:Windowssystem32wuauclt.exeC:Program FilesWaterfoxplugin-container.exeC:Windowssystem32wbemwmiprvse.exeC:Windowssystem32SearchProtocolHost.exeC:Windowssystem32NOTEPAD.EXEC:Windowssystem32wbemwmiprvse.exeC:Windowssystem32conhost.exeC:WindowsSystem32cscript.exe.============== Pseudo HJT Report ===============.mWinlogon: Userinit = userinit.exeuRun: [Skype] "C:Program Files (x86)SkypePhoneSkype.exe" /minimized /regrunuPolicies-Explorer: NoResolveTrack = dword:1mPolicies-Explorer: NoActiveDesktop = dword:1mPolicies-Explorer: NoActiveDesktopChanges = dword:1mPolicies-System: ConsentPromptBehaviorAdmin = dword:5mPolicies-System: ConsentPromptBehaviorUser = dword:3mPolicies-System: EnableUIADesktopToggle = dword:0TCP: NameServer = 46.40.72.13 46.40.72.9TCP: Interfaces{43BAD2D5-3A09-4910-9C5F-51F1063D1383} : DHCPNameServer = 46.40.72.13 46.40.72.9Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:Program Files (x86)Common FilesSkypeSkype4COM.dllSSODL: WebCheck - <orphaned>x64-Run: [RTHDVCPL] C:Program FilesRealtekAudioHDARAVCpl64.exe -sx64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>x64-SSODL: WebCheck - <orphaned>.============= SERVICES / DRIVERS ===============.R2 AMD External Events Utility;AMD External Events Utility;C:WindowsSystem32atiesrxx.exe [2011-4-20 203776]R3 amdkmdag;amdkmdag;C:WindowsSystem32driversatikmdag.sys [2011-4-20 9319936]R3 amdkmdap;amdkmdap;C:WindowsSystem32driversatikmpag.sys [2011-4-20 306176]R3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;C:WindowsSystem32driversRtnic64.sys [2008-7-22 60416]R3 RTL8167;Realtek 8167 NT Driver;C:WindowsSystem32driversRt64win7.sys [2009-3-1 187392]S3 dmvsc;dmvsc;C:WindowsSystem32driversdmvsc.sys [2010-11-21 71168]S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:WindowsSystem32driversrdpvideominiport.sys [2012-11-14 19456]S3 Synth3dVsc;Synth3dVsc;C:WindowsSystem32driversSynth3dVsc.sys [2010-11-21 88960]S3 terminpt;Microsoft Remote Desktop Input Driver;C:WindowsSystem32driversterminpt.sys [2012-11-14 29696]S3 TsUsbFlt;TsUsbFlt;C:WindowsSystem32driversTsUsbFlt.sys [2012-11-14 57856]S3 TsUsbGD;Remote Desktop Generic USB Device;C:WindowsSystem32driversTsUsbGD.sys [2012-11-14 30208]S3 tsusbhub;tsusbhub;C:WindowsSystem32driverstsusbhub.sys [2010-11-21 117248]S3 WatAdminSvc;Windows Activation Technologies Service;C:WindowsSystem32WatWatAdminSvc.exe [2012-11-14 1255736].=============== Created Last 60 ================.2013-02-18 22:05:56	--------	d-----w-	C:WindowsPanther2013-02-18 15:00:59	71024	----a-w-	C:WindowsSysWow64FlashPlayerCPLApp.cpl2013-02-18 15:00:59	691568	----a-w-	C:WindowsSysWow64FlashPlayerApp.exe2013-02-18 14:32:01	--------	d-----w-	C:UsersR2-D2AppDataLocalMozilla2013-02-18 14:17:56	--------	d-----w-	C:Program FilesWaterfox2013-02-18 14:17:35	--------	d-----w-	C:UsersR2-D2AppDataRoamingWaterfox Limited2013-02-18 13:07:24	0	----a-w-	C:Windowsativpsrm.bin2013-02-18 12:58:48	996352	----a-w-	C:Program FilesCommon FilesMicrosoft SharedVGXVGX.dll2013-02-18 12:58:48	768000	----a-w-	C:Program Files (x86)Common FilesMicrosoft SharedVGXVGX.dll2013-02-18 12:55:55	5553512	----a-w-	C:WindowsSystem32ntoskrnl.exe2013-02-18 12:54:35	9161176	----a-w-	C:ProgramDataMicrosoftWindows DefenderDefinition Updates{C02A87CA-DA61-4D3F-A730-9D0FDA81C1F1}mpengine.dll2013-02-18 12:53:45	--------	d-----w-	C:Program Files (x86)foobar20002013-02-18 12:53:08	--------	d-----w-	C:UsersR2-D2AppDataRoamingHaoZip2013-02-18 12:53:08	--------	d-----w-	C:Program FilesHaoZip2013-02-18 12:47:51	9291768	----a-w-	C:ProgramDataMicrosoftWindows DefenderDefinition UpdatesBackupmpengine.dll2013-02-18 12:47:47	9291768	------w-	C:ProgramDataMicrosoftWindows DefenderDefinition UpdatesUpdatesmpengine.dll2013-02-18 12:47:13	--------	d-sh--w-	C:Recovery2013-01-29 09:02:09	731	----a-w-	C:WindowsSystem32RTSLCS.dll2013-01-29 09:01:55	800768	----a-w-	C:WindowsSystem32usp10.dll2013-01-29 09:01:55	626688	----a-w-	C:WindowsSysWow64usp10.dll2013-01-29 09:01:35	68608	----a-w-	C:WindowsSystem32taskhost.exe2013-01-29 09:01:15	307200	----a-w-	C:WindowsSystem32ncrypt.dll2013-01-29 09:01:15	220160	----a-w-	C:WindowsSysWow64ncrypt.dll2013-01-29 09:00:46	2048	----a-w-	C:WindowsSysWow64tzres.dll2013-01-29 09:00:46	2048	----a-w-	C:WindowsSystem32tzres.dll2013-01-29 08:56:44	478208	----a-w-	C:WindowsSystem32dpnet.dll2013-01-29 08:56:44	376832	----a-w-	C:WindowsSysWow64dpnet.dll2013-01-29 08:56:23	750592	----a-w-	C:WindowsSystem32win32spl.dll2013-01-29 08:56:23	492032	----a-w-	C:WindowsSysWow64win32spl.dll2013-01-29 08:51:49	2002432	----a-w-	C:WindowsSystem32msxml6.dll2013-01-29 08:51:49	1882624	----a-w-	C:WindowsSystem32msxml3.dll2013-01-29 08:51:49	1389568	----a-w-	C:WindowsSysWow64msxml6.dll2013-01-29 08:51:49	1236992	----a-w-	C:WindowsSysWow64msxml3.dll2013-01-29 08:50:30	46080	----a-w-	C:WindowsSystem32atmlib.dll2013-01-29 08:50:30	367616	----a-w-	C:WindowsSystem32atmfd.dll2013-01-29 08:50:30	34304	----a-w-	C:WindowsSysWow64atmlib.dll2013-01-29 08:50:30	295424	----a-w-	C:WindowsSysWow64atmfd.dll2013-01-29 08:47:00	243200	----a-w-	C:WindowsSystem32wow64.dll2013-01-29 08:47:00	16384	----a-w-	C:WindowsSystem32ntvdm64.dll2013-01-29 08:47:00	13312	----a-w-	C:WindowsSystem32wow64cpu.dll2013-01-29 08:44:54	87040	----a-w-	C:WindowsSystem32driversWUDFPf.sys2013-01-29 08:44:54	84992	----a-w-	C:WindowsSystem32WUDFSvc.dll2013-01-29 08:44:54	744448	----a-w-	C:WindowsSystem32WUDFx.dll2013-01-29 08:44:54	45056	----a-w-	C:WindowsSystem32WUDFCoinstaller.dll2013-01-29 08:44:54	229888	----a-w-	C:WindowsSystem32WUDFHost.exe2013-01-29 08:44:54	198656	----a-w-	C:WindowsSystem32driversWUDFRd.sys2013-01-29 08:44:54	194048	----a-w-	C:WindowsSystem32WUDFPlatform.dll2013-01-29 08:44:17	9728	----a-w-	C:WindowsSystem32Wdfres.dll2013-01-29 08:44:17	785512	----a-w-	C:WindowsSystem32driversWdf01000.sys2013-01-29 08:44:17	54376	----a-w-	C:WindowsSystem32driversWdfLdr.sys2013-01-29 08:44:17	2560	----a-w-	C:WindowsSystem32driversen-USwdf01000.sys.mui2013-01-29 08:43:56	294912	----a-w-	C:WindowsSystem32browserchoice.exe.==================== Find6M  ====================.2013-01-29 08:56:00	561664	----a-w-	C:WindowsapppatchAcLayers.dll2013-01-29 08:56:00	350208	----a-w-	C:WindowsapppatchAppPatch64AcLayers.dll2013-01-29 08:56:00	135168	----a-w-	C:WindowsapppatchAppPatch64AcXtrnal.dll2013-01-29 08:47:00	362496	----a-w-	C:WindowsSystem32wow64win.dll2013-01-16 23:28:58	273840	------w-	C:WindowsSystem32MpSigStub.exe2013-01-09 01:19:09	2312704	----a-w-	C:WindowsSystem32jscript9.dll2013-01-09 01:12:03	1392128	----a-w-	C:WindowsSystem32wininet.dll2013-01-09 01:11:06	1494528	----a-w-	C:WindowsSystem32inetcpl.cpl2013-01-09 01:07:51	173056	----a-w-	C:WindowsSystem32ieUnatt.exe2013-01-09 01:07:47	599040	----a-w-	C:WindowsSystem32vbscript.dll2013-01-09 01:04:42	2382848	----a-w-	C:WindowsSystem32mshtml.tlb2013-01-08 22:11:21	1800704	----a-w-	C:WindowsSysWow64jscript9.dll2013-01-08 22:03:20	1129472	----a-w-	C:WindowsSysWow64wininet.dll2013-01-08 22:03:12	1427968	----a-w-	C:WindowsSysWow64inetcpl.cpl2013-01-08 21:59:02	142848	----a-w-	C:WindowsSysWow64ieUnatt.exe2013-01-08 21:58:29	420864	----a-w-	C:WindowsSysWow64vbscript.dll2013-01-08 21:56:23	2382848	----a-w-	C:WindowsSysWow64mshtml.tlb2013-01-05 05:00:15	3967848	----a-w-	C:WindowsSysWow64ntkrnlpa.exe2013-01-05 05:00:11	3913064	----a-w-	C:WindowsSysWow64ntoskrnl.exe2013-01-04 05:46:09	215040	----a-w-	C:WindowsSystem32winsrv.dll2013-01-04 04:51:16	5120	----a-w-	C:WindowsSysWow64wow32.dll2013-01-04 04:43:21	44032	----a-w-	C:Windowsapppatchacwow64.dll2013-01-04 03:26:48	3153408	----a-w-	C:WindowsSystem32win32k.sys2013-01-04 02:47:35	25600	----a-w-	C:WindowsSysWow64setup16.exe2013-01-04 02:47:34	7680	----a-w-	C:WindowsSysWow64instnm.exe2013-01-04 02:47:34	2048	----a-w-	C:WindowsSysWow64user.exe2013-01-04 02:47:33	14336	----a-w-	C:WindowsSysWow64ntvdm64.dll2013-01-03 06:00:54	1913192	----a-w-	C:WindowsSystem32driverstcpip.sys2013-01-03 06:00:42	288088	----a-w-	C:WindowsSystem32driversFWPKCLNT.SYS2012-11-14 18:03:05	70656	----a-w-	C:WindowsSystem32nlaapi.dll2012-11-14 18:03:05	569344	----a-w-	C:WindowsSystem32iphlpsvc.dll2012-11-14 18:03:05	52224	----a-w-	C:WindowsSysWow64nlaapi.dll2012-11-14 18:03:05	45568	----a-w-	C:WindowsSystem32driverstcpipreg.sys2012-11-14 18:03:05	303104	----a-w-	C:WindowsSystem32nlasvc.dll2012-11-14 18:03:05	246272	----a-w-	C:WindowsSystem32netcorehc.dll2012-11-14 18:03:05	216576	----a-w-	C:WindowsSystem32ncsi.dll2012-11-14 18:03:05	18944	----a-w-	C:WindowsSysWow64netevent.dll2012-11-14 18:03:05	18944	----a-w-	C:WindowsSystem32netevent.dll2012-11-14 18:03:05	175104	----a-w-	C:WindowsSysWow64netcorehc.dll2012-11-14 18:03:05	156672	----a-w-	C:WindowsSysWow64ncsi.dll2012-11-14 18:02:41	220160	----a-w-	C:WindowsSystem32wintrust.dll2012-11-14 18:02:41	172544	----a-w-	C:WindowsSysWow64wintrust.dll2012-11-14 18:02:22	715776	----a-w-	C:WindowsSystem32kerberos.dll2012-11-14 18:02:22	542208	----a-w-	C:WindowsSysWow64kerberos.dll2012-11-14 18:02:02	574464	----a-w-	C:WindowsSystem32d3d10level9.dll2012-11-14 18:02:02	490496	----a-w-	C:WindowsSysWow64d3d10level9.dll2012-11-14 18:01:43	1659760	----a-w-	C:WindowsSystem32driversntfs.sys2012-11-14 18:01:04	376688	----a-w-	C:WindowsSystem32driversnetio.sys2012-11-14 18:00:44	503808	----a-w-	C:WindowsSystem32srcore.dll2012-11-14 18:00:44	43008	----a-w-	C:WindowsSysWow64srclient.dll2012-11-14 18:00:06	245760	----a-w-	C:WindowsSystem32OxpsConverter.exe2012-11-14 17:58:21	95744	----a-w-	C:WindowsSystem32synceng.dll2012-11-14 17:58:21	78336	----a-w-	C:WindowsSysWow64synceng.dll2012-11-14 17:57:35	2048	----a-w-	C:WindowsSysWow64msxml3r.dll2012-11-14 17:57:35	2048	----a-w-	C:WindowsSystem32msxml3r.dll2012-11-14 17:57:13	950128	----a-w-	C:WindowsSystem32driversndis.sys2012-11-14 17:57:13	41472	----a-w-	C:WindowsSystem32driversRNDISMP.sys2012-11-14 17:56:33	956928	----a-w-	C:WindowsSystem32localspl.dll2012-11-14 17:56:14	514560	----a-w-	C:WindowsSysWow64qdvd.dll2012-11-14 17:56:14	366592	----a-w-	C:WindowsSystem32qdvd.dll2012-11-14 17:55:55	209920	----a-w-	C:WindowsSystem32profsvc.dll2012-11-14 17:55:36	59392	----a-w-	C:WindowsSystem32browcli.dll2012-11-14 17:55:36	41984	----a-w-	C:WindowsSysWow64browcli.dll2012-11-14 17:55:36	136704	----a-w-	C:WindowsSystem32browser.dll2012-11-14 17:55:15	3216384	----a-w-	C:WindowsSystem32msi.dll2012-11-14 17:55:15	2342400	----a-w-	C:WindowsSysWow64msi.dll2012-11-14 17:54:52	805376	----a-w-	C:WindowsSysWow64cdosys.dll2012-11-14 17:54:52	1133568	----a-w-	C:WindowsSystem32cdosys.dll2012-11-14 17:53:38	75120	----a-w-	C:WindowsSystem32driverspartmgr.sys2012-11-14 17:52:35	210944	----a-w-	C:WindowsSystem32driversrdpwd.sys2012-11-14 17:51:02	9216	----a-w-	C:WindowsSystem32rdrmemptylst.exe2012-11-14 17:51:02	77312	----a-w-	C:WindowsSystem32rdpwsx.dll2012-11-14 17:51:02	149504	----a-w-	C:WindowsSystem32rdpcorekmts.dll2012-11-14 17:50:40	184320	----a-w-	C:WindowsSystem32cryptsvc.dll2012-11-14 17:50:40	1464320	----a-w-	C:WindowsSystem32crypt32.dll2012-11-14 17:50:40	140288	----a-w-	C:WindowsSysWow64cryptsvc.dll2012-11-14 17:50:40	140288	----a-w-	C:WindowsSystem32cryptnet.dll2012-11-14 17:50:40	1159680	----a-w-	C:WindowsSysWow64crypt32.dll2012-11-14 17:50:40	103936	----a-w-	C:WindowsSysWow64cryptnet.dll2012-11-14 17:49:47	515584	----a-w-	C:WindowsSystem32timedate.cpl2012-11-14 17:49:47	478720	----a-w-	C:WindowsSysWow64timedate.cpl2012-11-14 17:49:06	1544704	----a-w-	C:WindowsSystem32DWrite.dll2012-11-14 17:49:06	1077248	----a-w-	C:WindowsSysWow64DWrite.dll2012-11-14 17:47:17	690688	----a-w-	C:WindowsSysWow64msvcrt.dll2012-11-14 17:47:17	634880	----a-w-	C:WindowsSystem32msvcrt.dll2012-11-14 17:46:57	81408	----a-w-	C:WindowsSystem32imagehlp.dll2012-11-14 17:46:57	5120	----a-w-	C:WindowsSysWow64wmi.dll2012-11-14 17:46:57	5120	----a-w-	C:WindowsSystem32wmi.dll2012-11-14 17:46:57	23408	----a-w-	C:WindowsSystem32driversfs_rec.sys2012-11-14 17:46:57	159232	----a-w-	C:WindowsSysWow64imagehlp.dll2012-11-14 17:46:37	67072	----a-w-	C:Windowssplwow64.exe2012-11-14 17:46:37	559104	----a-w-	C:WindowsSystem32spoolsv.exe2012-11-14 17:45:55	498688	----a-w-	C:WindowsSystem32driversafd.sys2012-11-14 17:45:36	1731920	----a-w-	C:WindowsSystem32ntdll.dll2012-11-14 17:45:36	1292080	----a-w-	C:WindowsSysWow64ntdll.dll2012-11-14 17:44:51	509952	----a-w-	C:WindowsSystem32ntshrui.dll2012-11-14 17:44:51	442880	----a-w-	C:WindowsSysWow64ntshrui.dll2012-11-14 17:44:25	1572864	----a-w-	C:WindowsSystem32quartz.dll2012-11-14 17:44:25	1328128	----a-w-	C:WindowsSysWow64quartz.dll2012-11-14 17:44:05	826880	----a-w-	C:WindowsSysWow64rdpcore.dll.============= FINISH: 18:34:23,38 ===============

Моля колегите от съфорумци от отдела за антивирусна профилактика разгледат логовте и да ми помогнат във отрастраняването на проблема който ме мъчи.

Ако има злворедна гадина на някой от дяловете и някой я ползва да се разхожда из машината ми чрез нея нека да я открием и отстраним. Мерси предварително.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

18 февруари 201313 г.

Здравейте..!

Моля, изтеглете последната версия на TDSSKiller оттук и я запазете на вашия декстоп.

[*]Стартирайте TDSSKiller.exe за да стартирате приложението. След това кликнете върху бутона Change parameters.

[*]Сложете отметка през Loaded Modules.

[*]Необходим е рестарт за осъществяване на промените. Направете го!

[*]TDSSKiller ще стартира автоматично след рестарта. Важно е да се отбележи, че вашия компютър може да изглежда по-бавен, на моменти неизползваем и с по-ниска производителност. Това е нормално и ще трае само един рестарт. Дайте му достатъчно време да зареди приложенията стартиращи с Операционната Система във фонов режим.

[*]След това натиснете Change parameters в TDSSKiller отново.

[*]Сложете всички отметки (този път рестарт не се изисква).

[*]

[*]Натиснете бутона Start Scan.

[*]Проверката не би трябвало да отмене повече от 2 minutes.

[*]Ако подозрителен обект бъде засечен, действието по подразбиране ще бъде Skip, кликнете върху Continue.

[*]Ако зловредни обекти бъдат намерени, тогава от падащото меню ще имате три възможности.

Бъдете сигурни, че избраното действие е Cure и натиснете върху Continue > Рестартирайте за да бъде завършена поправката.

Забележка: Ако Cure бутона не е наличен от възможностите, тогава моля изберете Skip бутона, не избирайте Delete освен ако не сте инструктирани затова.

[*]Лог файл ще бъде създаден в свободната директория на дял C: . Потърсете за лог с името "TDSSKiller.[Version]_[Date]_[Time]_log.txt" и копирайте съдържанието му в следващия си пост.

Изтеглете Gmer или от тук.

* Временно спрете Интернета си,всички работещи програми,както и антивирусната си програма.

* Стартирате програмата.

* След завършването на автомаичната експрес-проверка,махнете отметките от следните позиции:

- Sections

- IAT/EAT

- Show all

* От всички локални дискове маркирайте само системния дял (обикновенно това е C: )

[*]Натиснете бутона Scan

[*]Изчакайте програмата да завърши сканирането,след което натиснете бутона Save и запишете (save as) резултатите на десктопа с име Gmer.log.

[*]Включете Интернета си и прикачете Gmer.log в следващия си коментар.

Забележка:

* Ако бъде открит Rootkit, ще последва въпрос дали желаете пълно сканиране на системата. Изберете NO.

* Не предприемайте никакви действия върху редовете маркирани с "<--- ROOТKIT" ,защото това може да доведе до грешки.

19 февруари 201313 г.

Автор

Здравейте отново... Тдс лога:

10:51:29.0231 1604 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
10:51:29.0649 1604 ============================================================
10:51:29.0649 1604 Current date / time: 2013/02/19 10:51:29.0649
10:51:29.0649 1604 SystemInfo:
10:51:29.0649 1604
10:51:29.0649 1604 OS Version: 6.1.7601 ServicePack: 1.0
10:51:29.0649 1604 Product type: Workstation
10:51:29.0649 1604 ComputerName: WORKSTATION
10:51:29.0651 1604 UserName: R2-D2
10:51:29.0651 1604 Windows directory: C:Windows
10:51:29.0651 1604 System windows directory: C:Windows
10:51:29.0651 1604 Running under WOW64
10:51:29.0651 1604 Processor architecture: Intel x64
10:51:29.0651 1604 Number of processors: 2
10:51:29.0651 1604 Page size: 0x1000
10:51:29.0651 1604 Boot type: Normal boot
10:51:29.0651 1604 ============================================================
10:51:30.0294 1604 BG loaded
10:51:30.0519 1604 Drive DeviceHarddisk0DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
10:51:30.0521 1604 ============================================================
10:51:30.0521 1604 DeviceHarddisk0DR0:
10:51:30.0521 1604 MBR partitions:
10:51:30.0521 1604 DeviceHarddisk0DR0Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2F0CD
10:51:30.0521 1604 DeviceHarddisk0DR0Partition2: MBR, Type 0x7, StartLBA 0x2F10C, BlocksNum 0xA604154
10:51:30.0521 1604 DeviceHarddisk0DR0Partition3: MBR, Type 0x7, StartLBA 0xA636800, BlocksNum 0x38C01800
10:51:30.0521 1604 DeviceHarddisk0DR0Partition4: MBR, Type 0x7, StartLBA 0x43238000, BlocksNum 0x314CE000
10:51:30.0521 1604 ============================================================
10:51:30.0536 1604 C: <-> DeviceHarddisk0DR0Partition2
10:51:30.0561 1604 D: <-> DeviceHarddisk0DR0Partition3
10:51:30.0591 1604 E: <-> DeviceHarddisk0DR0Partition4
10:51:30.0591 1604 ============================================================
10:51:30.0591 1604 Initialize success
10:51:30.0591 1604 ============================================================
10:51:32.0349 1696 ============================================================
10:51:32.0349 1696 Scan started
10:51:32.0349 1696 Mode: Manual;
10:51:32.0349 1696 ============================================================
10:51:33.0249 1696 ================ Scan system memory ========================
10:51:33.0249 1696 System memory - ok
10:51:33.0251 1696 ================ Scan services =============================
10:51:33.0491 1696 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:Windowssystem32drivers1394ohci.sys
10:51:33.0494 1696 1394ohci - ok
10:51:33.0501 1696 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:Windowssystem32driversACPI.sys
10:51:33.0504 1696 ACPI - ok
10:51:33.0506 1696 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:Windowssystem32driversacpipmi.sys
10:51:33.0509 1696 AcpiPmi - ok
10:51:33.0521 1696 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:Windowssystem32driversadp94xx.sys
10:51:33.0524 1696 adp94xx - ok
10:51:33.0534 1696 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:Windowssystem32driversadpahci.sys
10:51:33.0536 1696 adpahci - ok
10:51:33.0544 1696 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:Windowssystem32driversadpu320.sys
10:51:33.0544 1696 adpu320 - ok
10:51:33.0564 1696 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:WindowsSystem32aelupsvc.dll
10:51:33.0566 1696 AeLookupSvc - ok
10:51:33.0579 1696 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:Windowssystem32driversafd.sys
10:51:33.0581 1696 AFD - ok
10:51:33.0586 1696 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:Windowssystem32driversagp440.sys
10:51:33.0586 1696 agp440 - ok
10:51:33.0591 1696 [ 3290D6946B5E30E70414990574883DDB ] ALG C:WindowsSystem32alg.exe
10:51:33.0591 1696 ALG - ok
10:51:33.0596 1696 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:Windowssystem32driversaliide.sys
10:51:33.0596 1696 aliide - ok
10:51:33.0619 1696 [ A359974EAAC83A435497C52F62A2E590 ] AMD External Events Utility C:Windowssystem32atiesrxx.exe
10:51:33.0621 1696 AMD External Events Utility - ok
10:51:33.0629 1696 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:Windowssystem32driversamdide.sys
10:51:33.0629 1696 amdide - ok
10:51:33.0634 1696 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:Windowssystem32driversamdk8.sys
10:51:33.0636 1696 AmdK8 - ok
10:51:33.0779 1696 [ 60216B0E704584DE6D5A9F59E9C34C47 ] amdkmdag C:Windowssystem32DRIVERSatikmdag.sys
10:51:33.0819 1696 amdkmdag - ok
10:51:33.0829 1696 [ 6B4E9261B613B047A9A145F328889968 ] amdkmdap C:Windowssystem32DRIVERSatikmpag.sys
10:51:33.0831 1696 amdkmdap - ok
10:51:33.0834 1696 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:Windowssystem32driversamdppm.sys
10:51:33.0836 1696 AmdPPM - ok
10:51:33.0841 1696 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:Windowssystem32driversamdsata.sys
10:51:33.0841 1696 amdsata - ok
10:51:33.0849 1696 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:Windowssystem32driversamdsbs.sys
10:51:33.0849 1696 amdsbs - ok
10:51:33.0854 1696 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:Windowssystem32driversamdxata.sys
10:51:33.0854 1696 amdxata - ok
10:51:33.0859 1696 [ 89A69C3F2F319B43379399547526D952 ] AppID C:Windowssystem32driversappid.sys
10:51:33.0859 1696 AppID - ok
10:51:33.0869 1696 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:WindowsSystem32appidsvc.dll
10:51:33.0869 1696 AppIDSvc - ok
10:51:33.0874 1696 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:WindowsSystem32appinfo.dll
10:51:33.0874 1696 Appinfo - ok
10:51:33.0881 1696 [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt C:WindowsSystem32appmgmts.dll
10:51:33.0881 1696 AppMgmt - ok
10:51:33.0899 1696 [ C484F8CEB1717C540242531DB7845C4E ] arc C:Windowssystem32driversarc.sys
10:51:33.0899 1696 arc - ok
10:51:33.0919 1696 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:Windowssystem32driversarcsas.sys
10:51:33.0919 1696 arcsas - ok
10:51:33.0936 1696 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:Windowssystem32DRIVERSasyncmac.sys
10:51:33.0936 1696 AsyncMac - ok
10:51:33.0941 1696 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:Windowssystem32driversatapi.sys
10:51:33.0941 1696 atapi - ok
10:51:33.0966 1696 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:WindowsSystem32Audiosrv.dll
10:51:33.0971 1696 AudioEndpointBuilder - ok
10:51:33.0979 1696 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:WindowsSystem32Audiosrv.dll
10:51:33.0984 1696 AudioSrv - ok
10:51:33.0994 1696 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:WindowsSystem32AxInstSV.dll
10:51:33.0994 1696 AxInstSV - ok
10:51:34.0011 1696 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:Windowssystem32driversbxvbda.sys
10:51:34.0014 1696 b06bdrv - ok
10:51:34.0036 1696 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:Windowssystem32DRIVERSb57nd60a.sys
10:51:34.0036 1696 b57nd60a - ok
10:51:34.0046 1696 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:WindowsSystem32bdesvc.dll
10:51:34.0049 1696 BDESVC - ok
10:51:34.0054 1696 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:Windowssystem32driversBeep.sys
10:51:34.0054 1696 Beep - ok
10:51:34.0066 1696 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:WindowsSystem32bfe.dll
10:51:34.0069 1696 BFE - ok
10:51:34.0106 1696 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:WindowsSystem32qmgr.dll
10:51:34.0111 1696 BITS - ok
10:51:34.0116 1696 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:Windowssystem32DRIVERSblbdrive.sys
10:51:34.0116 1696 blbdrive - ok
10:51:34.0121 1696 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:Windowssystem32DRIVERSbowser.sys
10:51:34.0124 1696 bowser - ok
10:51:34.0126 1696 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:Windowssystem32driversBrFiltLo.sys
10:51:34.0126 1696 BrFiltLo - ok
10:51:34.0131 1696 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:Windowssystem32driversBrFiltUp.sys
10:51:34.0134 1696 BrFiltUp - ok
10:51:34.0146 1696 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:WindowsSystem32browser.dll
10:51:34.0149 1696 Browser - ok
10:51:34.0154 1696 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:WindowsSystem32DriversBrserid.sys
10:51:34.0156 1696 Brserid - ok
10:51:34.0161 1696 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:WindowsSystem32DriversBrSerWdm.sys
10:51:34.0161 1696 BrSerWdm - ok
10:51:34.0164 1696 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:WindowsSystem32DriversBrUsbMdm.sys
10:51:34.0166 1696 BrUsbMdm - ok
10:51:34.0171 1696 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:WindowsSystem32DriversBrUsbSer.sys
10:51:34.0171 1696 BrUsbSer - ok
10:51:34.0176 1696 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:Windowssystem32driversbthmodem.sys
10:51:34.0176 1696 BTHMODEM - ok
10:51:34.0186 1696 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:Windowssystem32bthserv.dll
10:51:34.0186 1696 bthserv - ok
10:51:34.0191 1696 [ B8BD2BB284668C84865658C77574381A ] cdfs C:Windowssystem32DRIVERScdfs.sys
10:51:34.0191 1696 cdfs - ok
10:51:34.0199 1696 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:Windowssystem32DRIVERScdrom.sys
10:51:34.0199 1696 cdrom - ok
10:51:34.0206 1696 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:WindowsSystem32certprop.dll
10:51:34.0209 1696 CertPropSvc - ok
10:51:34.0216 1696 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:Windowssystem32driverscirclass.sys
10:51:34.0216 1696 circlass - ok
10:51:34.0229 1696 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:Windowssystem32CLFS.sys
10:51:34.0231 1696 CLFS - ok
10:51:34.0321 1696 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:WindowsMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe
10:51:34.0321 1696 clr_optimization_v2.0.50727_32 - ok
10:51:34.0389 1696 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:WindowsMicrosoft.NETFramework64v2.0.50727mscorsvw.exe
10:51:34.0389 1696 clr_optimization_v2.0.50727_64 - ok
10:51:34.0519 1696 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe
10:51:34.0521 1696 clr_optimization_v4.0.30319_32 - ok
10:51:34.0569 1696 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:WindowsMicrosoft.NETFramework64v4.0.30319mscorsvw.exe
10:51:34.0571 1696 clr_optimization_v4.0.30319_64 - ok
10:51:34.0574 1696 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:Windowssystem32driversCmBatt.sys
10:51:34.0574 1696 CmBatt - ok
10:51:34.0579 1696 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:Windowssystem32driverscmdide.sys
10:51:34.0581 1696 cmdide - ok
10:51:34.0601 1696 [ 1EBE690301AB165E9602381F69A6C7F7 ] CNG C:Windowssystem32Driverscng.sys
10:51:34.0604 1696 CNG - ok
10:51:34.0606 1696 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:Windowssystem32driverscompbatt.sys
10:51:34.0609 1696 Compbatt - ok
10:51:34.0611 1696 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:Windowssystem32DRIVERSCompositeBus.sys
10:51:34.0614 1696 CompositeBus - ok
10:51:34.0619 1696 COMSysApp - ok
10:51:34.0624 1696 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:Windowssystem32driverscrcdisk.sys
10:51:34.0624 1696 crcdisk - ok
10:51:34.0639 1696 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:Windowssystem32cryptsvc.dll
10:51:34.0641 1696 CryptSvc - ok
10:51:34.0649 1696 [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC C:Windowssystem32driverscsc.sys
10:51:34.0651 1696 CSC - ok
10:51:34.0671 1696 [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService C:WindowsSystem32cscsvc.dll
10:51:34.0674 1696 CscService - ok
10:51:34.0699 1696 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:Windowssystem32rpcss.dll
10:51:34.0701 1696 DcomLaunch - ok
10:51:34.0716 1696 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:WindowsSystem32defragsvc.dll
10:51:34.0719 1696 defragsvc - ok
10:51:34.0724 1696 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:Windowssystem32Driversdfsc.sys
10:51:34.0726 1696 DfsC - ok
10:51:34.0746 1696 [ 3249F4E4DBF1BD24B40DFF385F2511D4 ] Dhcp C:Windowssystem32dhcpcore.dll
10:51:34.0749 1696 Dhcp - ok
10:51:34.0751 1696 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:Windowssystem32driversdiscache.sys
10:51:34.0754 1696 discache - ok
10:51:34.0759 1696 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:Windowssystem32driversdisk.sys
10:51:34.0759 1696 Disk - ok
10:51:34.0764 1696 [ 5DB085A8A6600BE6401F2B24EECB5415 ] dmvsc C:Windowssystem32driversdmvsc.sys
10:51:34.0766 1696 dmvsc - ok
10:51:34.0781 1696 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:WindowsSystem32dnsrslvr.dll
10:51:34.0781 1696 Dnscache - ok
10:51:34.0789 1696 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:WindowsSystem32dot3svc.dll
10:51:34.0791 1696 dot3svc - ok
10:51:34.0799 1696 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:Windowssystem32dps.dll
10:51:34.0801 1696 DPS - ok
10:51:34.0831 1696 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:Windowssystem32driversdrmkaud.sys
10:51:34.0831 1696 drmkaud - ok
10:51:34.0851 1696 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:WindowsSystem32driversdxgkrnl.sys
10:51:34.0856 1696 DXGKrnl - ok
10:51:34.0869 1696 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:WindowsSystem32eapsvc.dll
10:51:34.0871 1696 EapHost - ok
10:51:34.0926 1696 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:Windowssystem32driversevbda.sys
10:51:34.0941 1696 ebdrv - ok
10:51:34.0956 1696 [ 9E3E3E092B01D89A742FF65549929BF4 ] EFS C:WindowsSystem32lsass.exe
10:51:34.0956 1696 EFS - ok
10:51:35.0021 1696 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:WindowsehomeehRecvr.exe
10:51:35.0026 1696 ehRecvr - ok
10:51:35.0034 1696 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:Windowsehomeehsched.exe
10:51:35.0034 1696 ehSched - ok
10:51:35.0044 1696 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:Windowssystem32driverselxstor.sys
10:51:35.0046 1696 elxstor - ok
10:51:35.0051 1696 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:Windowssystem32driverserrdev.sys
10:51:35.0051 1696 ErrDev - ok
10:51:35.0071 1696 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:Windowssystem32es.dll
10:51:35.0074 1696 EventSystem - ok
10:51:35.0081 1696 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:Windowssystem32driversexfat.sys
10:51:35.0081 1696 exfat - ok
10:51:35.0086 1696 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:Windowssystem32driversfastfat.sys
10:51:35.0089 1696 fastfat - ok
10:51:35.0104 1696 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:Windowssystem32fxssvc.exe
10:51:35.0109 1696 Fax - ok
10:51:35.0114 1696 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:Windowssystem32driversfdc.sys
10:51:35.0114 1696 fdc - ok
10:51:35.0124 1696 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:Windowssystem32fdPHost.dll
10:51:35.0124 1696 fdPHost - ok
10:51:35.0129 1696 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:Windowssystem32fdrespub.dll
10:51:35.0129 1696 FDResPub - ok
10:51:35.0134 1696 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:Windowssystem32driversfileinfo.sys
10:51:35.0136 1696 FileInfo - ok
10:51:35.0139 1696 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:Windowssystem32driversfiletrace.sys
10:51:35.0141 1696 Filetrace - ok
10:51:35.0144 1696 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:Windowssystem32driversflpydisk.sys
10:51:35.0146 1696 flpydisk - ok
10:51:35.0154 1696 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:Windowssystem32driversfltmgr.sys
10:51:35.0154 1696 FltMgr - ok
10:51:35.0174 1696 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:Windowssystem32FntCache.dll
10:51:35.0181 1696 FontCache - ok
10:51:35.0214 1696 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:WindowsMicrosoft.NetFramework64v3.0WPFPresentationFontCache.exe
10:51:35.0216 1696 FontCache3.0.0.0 - ok
10:51:35.0219 1696 [ D43703496149971890703B4B1B723EAC ] FsDepends C:Windowssystem32driversFsDepends.sys
10:51:35.0221 1696 FsDepends - ok
10:51:35.0224 1696 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:Windowssystem32driversFs_Rec.sys
10:51:35.0226 1696 Fs_Rec - ok
10:51:35.0231 1696 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:Windowssystem32DRIVERSfvevol.sys
10:51:35.0234 1696 fvevol - ok
10:51:35.0241 1696 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:Windowssystem32driversgagp30kx.sys
10:51:35.0244 1696 gagp30kx - ok
10:51:35.0266 1696 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:WindowsSystem32gpsvc.dll
10:51:35.0271 1696 gpsvc - ok
10:51:35.0289 1696 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:Windowssystem32drivershcw85cir.sys
10:51:35.0289 1696 hcw85cir - ok
10:51:35.0304 1696 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:Windowssystem32driversHdAudio.sys
10:51:35.0306 1696 HdAudAddService - ok
10:51:35.0311 1696 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:Windowssystem32DRIVERSHDAudBus.sys
10:51:35.0314 1696 HDAudBus - ok
10:51:35.0316 1696 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:Windowssystem32driversHidBatt.sys
10:51:35.0319 1696 HidBatt - ok
10:51:35.0324 1696 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:Windowssystem32drivershidbth.sys
10:51:35.0324 1696 HidBth - ok
10:51:35.0339 1696 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:Windowssystem32drivershidir.sys
10:51:35.0339 1696 HidIr - ok
10:51:35.0361 1696 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:Windowssystem32hidserv.dll
10:51:35.0361 1696 hidserv - ok
10:51:35.0366 1696 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:Windowssystem32DRIVERShidusb.sys
10:51:35.0366 1696 HidUsb - ok
10:51:35.0384 1696 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:Windowssystem32kmsvc.dll
10:51:35.0384 1696 hkmsvc - ok
10:51:35.0401 1696 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:Windowssystem32ListSvc.dll
10:51:35.0404 1696 HomeGroupListener - ok
10:51:35.0434 1696 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:Windowssystem32provsvc.dll
10:51:35.0436 1696 HomeGroupProvider - ok
10:51:35.0441 1696 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:Windowssystem32driversHpSAMD.sys
10:51:35.0444 1696 HpSAMD - ok
10:51:35.0454 1696 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:Windowssystem32driversHTTP.sys
10:51:35.0456 1696 HTTP - ok
10:51:35.0466 1696 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:Windowssystem32drivershwpolicy.sys
10:51:35.0469 1696 hwpolicy - ok
10:51:35.0476 1696 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:Windowssystem32driversi8042prt.sys
10:51:35.0476 1696 i8042prt - ok
10:51:35.0489 1696 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:Windowssystem32driversiaStorV.sys
10:51:35.0491 1696 iaStorV - ok
10:51:35.0519 1696 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:WindowsMicrosoft.NETFramework64v3.0Windows Communication Foundationinfocard.exe
10:51:35.0524 1696 idsvc - ok
10:51:35.0529 1696 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:Windowssystem32driversiirsp.sys
10:51:35.0529 1696 iirsp - ok
10:51:35.0556 1696 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:WindowsSystem32ikeext.dll
10:51:35.0561 1696 IKEEXT - ok
10:51:35.0636 1696 [ C2F868881D48A568B525255F084EF063 ] IntcAzAudAddService C:Windowssystem32driversRTKVHD64.sys
10:51:35.0656 1696 IntcAzAudAddService - ok
10:51:35.0664 1696 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:Windowssystem32driversintelide.sys
10:51:35.0664 1696 intelide - ok
10:51:35.0671 1696 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:Windowssystem32DRIVERSintelppm.sys
10:51:35.0671 1696 intelppm - ok
10:51:35.0686 1696 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:Windowssystem32ipbusenum.dll
10:51:35.0689 1696 IPBusEnum - ok
10:51:35.0699 1696 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:Windowssystem32DRIVERSipfltdrv.sys
10:51:35.0699 1696 IpFilterDriver - ok
10:51:35.0709 1696 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:WindowsSystem32iphlpsvc.dll
10:51:35.0711 1696 iphlpsvc - ok
10:51:35.0721 1696 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:Windowssystem32driversIPMIDrv.sys
10:51:35.0721 1696 IPMIDRV - ok
10:51:35.0726 1696 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:Windowssystem32driversipnat.sys
10:51:35.0729 1696 IPNAT - ok
10:51:35.0731 1696 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:Windowssystem32driversirenum.sys
10:51:35.0734 1696 IRENUM - ok
10:51:35.0739 1696 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:Windowssystem32driversisapnp.sys
10:51:35.0739 1696 isapnp - ok
10:51:35.0751 1696 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:Windowssystem32driversmsiscsi.sys
10:51:35.0751 1696 iScsiPrt - ok
10:51:35.0761 1696 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:Windowssystem32DRIVERSkbdclass.sys
10:51:35.0761 1696 kbdclass - ok
10:51:35.0766 1696 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:Windowssystem32DRIVERSkbdhid.sys
10:51:35.0766 1696 kbdhid - ok
10:51:35.0781 1696 [ 9E3E3E092B01D89A742FF65549929BF4 ] KeyIso C:Windowssystem32lsass.exe
10:51:35.0784 1696 KeyIso - ok
10:51:35.0794 1696 [ F71589852FC3F86F866F1A66065BB237 ] KSecDD C:Windowssystem32Driversksecdd.sys
10:51:35.0794 1696 KSecDD - ok
10:51:35.0804 1696 [ 59480712518BB50798B000980F6E626D ] KSecPkg C:Windowssystem32Driversksecpkg.sys
10:51:35.0806 1696 KSecPkg - ok
10:51:35.0811 1696 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:Windowssystem32driversksthunk.sys
10:51:35.0814 1696 ksthunk - ok
10:51:35.0829 1696 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:Windowssystem32msdtckrm.dll
10:51:35.0831 1696 KtmRm - ok
10:51:35.0849 1696 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:Windowssystem32srvsvc.dll
10:51:35.0851 1696 LanmanServer - ok
10:51:35.0891 1696 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:WindowsSystem32wkssvc.dll
10:51:35.0894 1696 LanmanWorkstation - ok
10:51:35.0911 1696 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:Windowssystem32DRIVERSlltdio.sys
10:51:35.0911 1696 lltdio - ok
10:51:35.0919 1696 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:WindowsSystem32lltdsvc.dll
10:51:35.0921 1696 lltdsvc - ok
10:51:35.0926 1696 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:WindowsSystem32lmhsvc.dll
10:51:35.0926 1696 lmhosts - ok
10:51:35.0936 1696 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:Windowssystem32driverslsi_fc.sys
10:51:35.0936 1696 LSI_FC - ok
10:51:35.0941 1696 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:Windowssystem32driverslsi_sas.sys
10:51:35.0944 1696 LSI_SAS - ok
10:51:35.0949 1696 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:Windowssystem32driverslsi_sas2.sys
10:51:35.0949 1696 LSI_SAS2 - ok
10:51:35.0954 1696 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:Windowssystem32driverslsi_scsi.sys
10:51:35.0956 1696 LSI_SCSI - ok
10:51:35.0961 1696 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:Windowssystem32driversluafv.sys
10:51:35.0961 1696 luafv - ok
10:51:35.0979 1696 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:Windowssystem32Mcx2Svc.dll
10:51:35.0981 1696 Mcx2Svc - ok
10:51:35.0986 1696 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:Windowssystem32driversmegasas.sys
10:51:35.0986 1696 megasas - ok
10:51:35.0994 1696 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:Windowssystem32driversMegaSR.sys
10:51:35.0994 1696 MegaSR - ok
10:51:36.0001 1696 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:Windowssystem32mmcss.dll
10:51:36.0004 1696 MMCSS - ok
10:51:36.0009 1696 [ BFFB0C93D9FB43CA42EF11C9240BFF7F ] Modem C:Windowssystem32driversmodem.sys
10:51:36.0011 1696 Modem - ok
10:51:36.0016 1696 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:Windowssystem32DRIVERSmonitor.sys
10:51:36.0016 1696 monitor - ok
10:51:36.0024 1696 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:Windowssystem32DRIVERSmouclass.sys
10:51:36.0024 1696 mouclass - ok
10:51:36.0034 1696 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:Windowssystem32DRIVERSmouhid.sys
10:51:36.0034 1696 mouhid - ok
10:51:36.0039 1696 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:Windowssystem32driversmountmgr.sys
10:51:36.0041 1696 mountmgr - ok
10:51:36.0046 1696 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:Windowssystem32driversmpio.sys
10:51:36.0046 1696 mpio - ok
10:51:36.0054 1696 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:Windowssystem32driversmpsdrv.sys
10:51:36.0056 1696 mpsdrv - ok
10:51:36.0079 1696 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:Windowssystem32mpssvc.dll
10:51:36.0084 1696 MpsSvc - ok
10:51:36.0091 1696 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:Windowssystem32driversmrxdav.sys
10:51:36.0091 1696 MRxDAV - ok
10:51:36.0106 1696 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:Windowssystem32DRIVERSmrxsmb.sys
10:51:36.0106 1696 mrxsmb - ok
10:51:36.0119 1696 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:Windowssystem32DRIVERSmrxsmb10.sys
10:51:36.0119 1696 mrxsmb10 - ok
10:51:36.0129 1696 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:Windowssystem32DRIVERSmrxsmb20.sys
10:51:36.0131 1696 mrxsmb20 - ok
10:51:36.0136 1696 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:Windowssystem32driversmsahci.sys
10:51:36.0136 1696 msahci - ok
10:51:36.0141 1696 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:Windowssystem32driversmsdsm.sys
10:51:36.0144 1696 msdsm - ok
10:51:36.0159 1696 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:WindowsSystem32msdtc.exe
10:51:36.0161 1696 MSDTC - ok
10:51:36.0171 1696 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:Windowssystem32driversMsfs.sys
10:51:36.0171 1696 Msfs - ok
10:51:36.0176 1696 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:WindowsSystem32driversmshidkmdf.sys
10:51:36.0176 1696 mshidkmdf - ok
10:51:36.0181 1696 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:Windowssystem32driversmsisadrv.sys
10:51:36.0184 1696 msisadrv - ok
10:51:36.0199 1696 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:Windowssystem32iscsiexe.dll
10:51:36.0199 1696 MSiSCSI - ok
10:51:36.0206 1696 msiserver - ok
10:51:36.0219 1696 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:Windowssystem32driversMSKSSRV.sys
10:51:36.0221 1696 MSKSSRV - ok
10:51:36.0226 1696 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:Windowssystem32driversMSPCLOCK.sys
10:51:36.0226 1696 MSPCLOCK - ok
10:51:36.0231 1696 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:Windowssystem32driversMSPQM.sys
10:51:36.0231 1696 MSPQM - ok
10:51:36.0241 1696 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:Windowssystem32driversMsRPC.sys
10:51:36.0244 1696 MsRPC - ok
10:51:36.0251 1696 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:Windowssystem32DRIVERSmssmbios.sys
10:51:36.0251 1696 mssmbios - ok
10:51:36.0256 1696 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:Windowssystem32driversMSTEE.sys
10:51:36.0256 1696 MSTEE - ok
10:51:36.0264 1696 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:Windowssystem32driversMTConfig.sys
10:51:36.0264 1696 MTConfig - ok
10:51:36.0269 1696 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:Windowssystem32Driversmup.sys
10:51:36.0269 1696 Mup - ok
10:51:36.0286 1696 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:Windowssystem32qagentRT.dll
10:51:36.0289 1696 napagent - ok
10:51:36.0301 1696 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:Windowssystem32DRIVERSnwifi.sys
10:51:36.0304 1696 NativeWifiP - ok
10:51:36.0334 1696 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:Windowssystem32driversndis.sys
10:51:36.0339 1696 NDIS - ok
10:51:36.0344 1696 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:Windowssystem32DRIVERSndiscap.sys
10:51:36.0344 1696 NdisCap - ok
10:51:36.0351 1696 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:Windowssystem32DRIVERSndistapi.sys
10:51:36.0351 1696 NdisTapi - ok
10:51:36.0356 1696 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:Windowssystem32DRIVERSndisuio.sys
10:51:36.0359 1696 Ndisuio - ok
10:51:36.0364 1696 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:Windowssystem32DRIVERSndiswan.sys
10:51:36.0366 1696 NdisWan - ok
10:51:36.0371 1696 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:Windowssystem32driversNDProxy.sys
10:51:36.0371 1696 NDProxy - ok
10:51:36.0376 1696 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:Windowssystem32DRIVERSnetbios.sys
10:51:36.0379 1696 NetBIOS - ok
10:51:36.0386 1696 [ 09594D1089C523423B32A4229263F068 ] NetBT C:Windowssystem32DRIVERSnetbt.sys
10:51:36.0386 1696 NetBT - ok
10:51:36.0391 1696 [ 9E3E3E092B01D89A742FF65549929BF4 ] Netlogon C:Windowssystem32lsass.exe
10:51:36.0394 1696 Netlogon - ok
10:51:36.0414 1696 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:WindowsSystem32netman.dll
10:51:36.0416 1696 Netman - ok
10:51:36.0426 1696 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:WindowsSystem32netprofm.dll
10:51:36.0429 1696 netprofm - ok
10:51:36.0441 1696 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:WindowsMicrosoft.NETFramework64v3.0Windows Communication FoundationSMSvcHost.exe
10:51:36.0444 1696 NetTcpPortSharing - ok
10:51:36.0449 1696 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:Windowssystem32driversnfrd960.sys
10:51:36.0451 1696 nfrd960 - ok
10:51:36.0481 1696 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:WindowsSystem32nlasvc.dll
10:51:36.0484 1696 NlaSvc - ok
10:51:36.0489 1696 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:Windowssystem32driversNpfs.sys
10:51:36.0489 1696 Npfs - ok
10:51:36.0506 1696 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:Windowssystem32nsisvc.dll
10:51:36.0506 1696 nsi - ok
10:51:36.0511 1696 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:Windowssystem32driversnsiproxy.sys
10:51:36.0511 1696 nsiproxy - ok
10:51:36.0536 1696 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:Windowssystem32driversNtfs.sys
10:51:36.0544 1696 Ntfs - ok
10:51:36.0549 1696 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:Windowssystem32driversNull.sys
10:51:36.0549 1696 Null - ok
10:51:36.0556 1696 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:Windowssystem32driversnvraid.sys
10:51:36.0559 1696 nvraid - ok
10:51:36.0564 1696 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:Windowssystem32driversnvstor.sys
10:51:36.0566 1696 nvstor - ok
10:51:36.0571 1696 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:Windowssystem32driversnv_agp.sys
10:51:36.0574 1696 nv_agp - ok
10:51:36.0681 1696 [ 1A008CBB313F7A6644B883AE1829393B ] OAcat C:Program Files (x86)Online ArmorOAcat.exe
10:51:36.0684 1696 OAcat - ok
10:51:36.0821 1696 [ 2C0A8F6920C65C81D9B7B0508D0428CC ] OADevice C:WindowsSysWow64DriversOADriver.sys
10:51:36.0821 1696 OADevice - ok
10:51:36.0836 1696 [ 677E8520C5F50F7067E44F4A4112A5D8 ] oahlpXX C:Windowssyswow64driversoahlp64.sys
10:51:36.0836 1696 oahlpXX - ok
10:51:36.0849 1696 [ 8E4A0034285BCAAB359B167C5390DAD6 ] OAmon C:WindowsSysWOW64DriversOAmon.sys
10:51:36.0851 1696 OAmon - ok
10:51:36.0864 1696 [ 4BFB280CEB67AFA806B7F8A606CCC06D ] OAnet C:Windowssystem32DRIVERSoanet.sys
10:51:36.0864 1696 OAnet - ok
10:51:36.0869 1696 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:Windowssystem32driversohci1394.sys
10:51:36.0871 1696 ohci1394 - ok
10:51:36.0891 1696 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:Windowssystem32pnrpsvc.dll
10:51:36.0894 1696 p2pimsvc - ok
10:51:36.0909 1696 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:Windowssystem32p2psvc.dll
10:51:36.0911 1696 p2psvc - ok
10:51:36.0921 1696 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:Windowssystem32DRIVERSparport.sys
10:51:36.0921 1696 Parport - ok
10:51:36.0926 1696 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:Windowssystem32driverspartmgr.sys
10:51:36.0929 1696 partmgr - ok
10:51:36.0934 1696 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:WindowsSystem32pcasvc.dll
10:51:36.0936 1696 PcaSvc - ok
10:51:36.0946 1696 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:Windowssystem32driverspci.sys
10:51:36.0946 1696 pci - ok
10:51:36.0951 1696 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:Windowssystem32driverspciide.sys
10:51:36.0954 1696 pciide - ok
10:51:36.0964 1696 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:Windowssystem32driverspcmcia.sys
10:51:36.0966 1696 pcmcia - ok
10:51:36.0971 1696 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:Windowssystem32driverspcw.sys
10:51:36.0974 1696 pcw - ok
10:51:36.0984 1696 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:Windowssystem32driverspeauth.sys
10:51:36.0986 1696 PEAUTH - ok
10:51:37.0014 1696 [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc C:Windowssystem32peerdistsvc.dll
10:51:37.0021 1696 PeerDistSvc - ok
10:51:37.0044 1696 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:WindowsSysWow64perfhost.exe
10:51:37.0044 1696 PerfHost - ok
10:51:37.0096 1696 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:Windowssystem32pla.dll
10:51:37.0106 1696 pla - ok
10:51:37.0136 1696 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:Windowssystem32umpnpmgr.dll
10:51:37.0141 1696 PlugPlay - ok
10:51:37.0154 1696 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:Windowssystem32pnrpauto.dll
10:51:37.0154 1696 PNRPAutoReg - ok
10:51:37.0166 1696 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:Windowssystem32pnrpsvc.dll
10:51:37.0169 1696 PNRPsvc - ok
10:51:37.0196 1696 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:WindowsSystem32ipsecsvc.dll
10:51:37.0214 1696 PolicyAgent - ok
10:51:37.0224 1696 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:Windowssystem32umpo.dll
10:51:37.0226 1696 Power - ok
10:51:37.0254 1696 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:Windowssystem32DRIVERSraspptp.sys
10:51:37.0256 1696 PptpMiniport - ok
10:51:37.0266 1696 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:Windowssystem32driversprocessr.sys
10:51:37.0266 1696 Processor - ok
10:51:37.0279 1696 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:Windowssystem32profsvc.dll
10:51:37.0281 1696 ProfSvc - ok
10:51:37.0289 1696 [ 9E3E3E092B01D89A742FF65549929BF4 ] ProtectedStorage C:Windowssystem32lsass.exe
10:51:37.0291 1696 ProtectedStorage - ok
10:51:37.0301 1696 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:Windowssystem32DRIVERSpacer.sys
10:51:37.0304 1696 Psched - ok
10:51:37.0336 1696 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:Windowssystem32driversql2300.sys
10:51:37.0341 1696 ql2300 - ok
10:51:37.0354 1696 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:Windowssystem32driversql40xx.sys
10:51:37.0356 1696 ql40xx - ok
10:51:37.0374 1696 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:Windowssystem32qwave.dll
10:51:37.0376 1696 QWAVE - ok
10:51:37.0381 1696 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:Windowssystem32driversqwavedrv.sys
10:51:37.0381 1696 QWAVEdrv - ok
10:51:37.0389 1696 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:Windowssystem32DRIVERSrasacd.sys
10:51:37.0389 1696 RasAcd - ok
10:51:37.0404 1696 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:Windowssystem32DRIVERSAgileVpn.sys
10:51:37.0404 1696 RasAgileVpn - ok
10:51:37.0421 1696 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:WindowsSystem32rasauto.dll
10:51:37.0421 1696 RasAuto - ok
10:51:37.0434 1696 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:Windowssystem32DRIVERSrasl2tp.sys
10:51:37.0434 1696 Rasl2tp - ok
10:51:37.0451 1696 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:WindowsSystem32rasmans.dll
10:51:37.0456 1696 RasMan - ok
10:51:37.0471 1696 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:Windowssystem32DRIVERSraspppoe.sys
10:51:37.0471 1696 RasPppoe - ok
10:51:37.0476 1696 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:Windowssystem32DRIVERSrassstp.sys
10:51:37.0479 1696 RasSstp - ok
10:51:37.0489 1696 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:Windowssystem32DRIVERSrdbss.sys
10:51:37.0491 1696 rdbss - ok
10:51:37.0501 1696 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:Windowssystem32DRIVERSrdpbus.sys
10:51:37.0501 1696 rdpbus - ok
10:51:37.0514 1696 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:Windowssystem32DRIVERSRDPCDD.sys
10:51:37.0514 1696 RDPCDD - ok
10:51:37.0524 1696 [ 1B6163C503398B23FF8B939C67747683 ] RDPDR C:Windowssystem32driversrdpdr.sys
10:51:37.0526 1696 RDPDR - ok
10:51:37.0531 1696 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:Windowssystem32driversrdpencdd.sys
10:51:37.0531 1696 RDPENCDD - ok
10:51:37.0541 1696 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:Windowssystem32driversrdprefmp.sys
10:51:37.0544 1696 RDPREFMP - ok
10:51:37.0559 1696 [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:Windowssystem32driversrdpvideominiport.sys
10:51:37.0559 1696 RdpVideoMiniport - ok
10:51:37.0571 1696 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:Windowssystem32driversRDPWD.sys
10:51:37.0571 1696 RDPWD - ok
10:51:37.0584 1696 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:Windowssystem32driversrdyboost.sys
10:51:37.0584 1696 rdyboost - ok
10:51:37.0609 1696 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:WindowsSystem32mprdim.dll
10:51:37.0611 1696 RemoteAccess - ok
10:51:37.0621 1696 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:Windowssystem32regsvc.dll
10:51:37.0624 1696 RemoteRegistry - ok
10:51:37.0641 1696 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:WindowsSystem32RpcEpMap.dll
10:51:37.0644 1696 RpcEptMapper - ok
10:51:37.0661 1696 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:Windowssystem32locator.exe
10:51:37.0664 1696 RpcLocator - ok
10:51:37.0689 1696 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:Windowssystem32rpcss.dll
10:51:37.0694 1696 RpcSs - ok
10:51:37.0704 1696 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:Windowssystem32DRIVERSrspndr.sys
10:51:37.0704 1696 rspndr - ok
10:51:37.0721 1696 [ 97B6D72C82B2632B3D1AD60DDAC38D46 ] RTL8023x64 C:Windowssystem32DRIVERSRtnic64.sys
10:51:37.0721 1696 RTL8023x64 - ok
10:51:37.0754 1696 [ ABCB5A38A0D85BDF69B7877E1AD1EED5 ] RTL8167 C:Windowssystem32DRIVERSRt64win7.sys
10:51:37.0754 1696 RTL8167 - ok
10:51:37.0771 1696 [ E60C0A09F997826C7627B244195AB581 ] s3cap C:Windowssystem32driversvms3cap.sys
10:51:37.0771 1696 s3cap - ok
10:51:37.0781 1696 [ 9E3E3E092B01D89A742FF65549929BF4 ] SamSs C:Windowssystem32lsass.exe
10:51:37.0784 1696 SamSs - ok
10:51:37.0789 1696 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:Windowssystem32driverssbp2port.sys
10:51:37.0791 1696 sbp2port - ok
10:51:37.0804 1696 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:WindowsSystem32SCardSvr.dll
10:51:37.0806 1696 SCardSvr - ok
10:51:37.0829 1696 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:Windowssystem32DRIVERSscfilter.sys
10:51:37.0829 1696 scfilter - ok
10:51:37.0859 1696 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:Windowssystem32schedsvc.dll
10:51:37.0866 1696 Schedule - ok
10:51:37.0891 1696 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:WindowsSystem32certprop.dll
10:51:37.0891 1696 SCPolicySvc - ok
10:51:37.0906 1696 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:WindowsSystem32SDRSVC.dll
10:51:37.0909 1696 SDRSVC - ok
10:51:37.0914 1696 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:Windowssystem32driverssecdrv.sys
10:51:37.0916 1696 secdrv - ok
10:51:37.0924 1696 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:Windowssystem32seclogon.dll
10:51:37.0926 1696 seclogon - ok
10:51:37.0939 1696 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:WindowsSystem32sens.dll
10:51:37.0941 1696 SENS - ok
10:51:37.0951 1696 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:Windowssystem32sensrsvc.dll
10:51:37.0954 1696 SensrSvc - ok
10:51:37.0959 1696 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:Windowssystem32DRIVERSserenum.sys
10:51:37.0959 1696 Serenum - ok
10:51:37.0971 1696 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:Windowssystem32DRIVERSserial.sys
10:51:37.0971 1696 Serial - ok
10:51:37.0976 1696 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:Windowssystem32driverssermouse.sys
10:51:37.0979 1696 sermouse - ok
10:51:37.0999 1696 [ 4D7226D0B485C8AE5BCD8E0DCC1066AB ] SessionEnv C:Windowssystem32sessenv.dll
10:51:37.0999 1696 SessionEnv - ok
10:51:38.0006 1696 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:Windowssystem32driverssffdisk.sys
10:51:38.0006 1696 sffdisk - ok
10:51:38.0014 1696 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:Windowssystem32driverssffp_mmc.sys
10:51:38.0014 1696 sffp_mmc - ok
10:51:38.0021 1696 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:Windowssystem32driverssffp_sd.sys
10:51:38.0021 1696 sffp_sd - ok
10:51:38.0026 1696 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:Windowssystem32driverssfloppy.sys
10:51:38.0029 1696 sfloppy - ok
10:51:38.0044 1696 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:WindowsSystem32ipnathlp.dll
10:51:38.0046 1696 SharedAccess - ok
10:51:38.0066 1696 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:WindowsSystem32shsvcs.dll
10:51:38.0069 1696 ShellHWDetection - ok
10:51:38.0076 1696 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:Windowssystem32driversSiSRaid2.sys
10:51:38.0076 1696 SiSRaid2 - ok
10:51:38.0084 1696 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:Windowssystem32driverssisraid4.sys
10:51:38.0084 1696 SiSRaid4 - ok
10:51:38.0091 1696 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:Windowssystem32DRIVERSsmb.sys
10:51:38.0094 1696 Smb - ok
10:51:38.0126 1696 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:WindowsSystem32snmptrap.exe
10:51:38.0129 1696 SNMPTRAP - ok
10:51:38.0134 1696 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:Windowssystem32driversspldr.sys
10:51:38.0136 1696 spldr - ok
10:51:38.0149 1696 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:WindowsSystem32spoolsv.exe
10:51:38.0154 1696 Spooler - ok
10:51:38.0209 1696 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:Windowssystem32sppsvc.exe
10:51:38.0226 1696 sppsvc - ok
10:51:38.0239 1696 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:Windowssystem32sppuinotify.dll
10:51:38.0241 1696 sppuinotify - ok
10:51:38.0261 1696 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:Windowssystem32DRIVERSsrv.sys
10:51:38.0264 1696 srv - ok
10:51:38.0276 1696 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:Windowssystem32DRIVERSsrv2.sys
10:51:38.0279 1696 srv2 - ok
10:51:38.0286 1696 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:Windowssystem32DRIVERSsrvnet.sys
10:51:38.0286 1696 srvnet - ok
10:51:38.0309 1696 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:WindowsSystem32ssdpsrv.dll
10:51:38.0311 1696 SSDPSRV - ok
10:51:38.0319 1696 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:Windowssystem32sstpsvc.dll
10:51:38.0321 1696 SstpSvc - ok
10:51:38.0326 1696 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:Windowssystem32driversstexstor.sys
10:51:38.0326 1696 stexstor - ok
10:51:38.0356 1696 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:WindowsSystem32wiaservc.dll
10:51:38.0359 1696 stisvc - ok
10:51:38.0371 1696 [ 7785DC213270D2FC066538DAF94087E7 ] storflt C:Windowssystem32driversvmstorfl.sys
10:51:38.0371 1696 storflt - ok
10:51:38.0379 1696 [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc C:Windowssystem32driversstorvsc.sys
10:51:38.0379 1696 storvsc - ok
10:51:38.0449 1696 [ A54B4FBC24C4EDE34BEB5F8D8974752A ] SvcOnlineArmor C:Program Files (x86)Online Armoroasrv.exe
10:51:38.0469 1696 SvcOnlineArmor - ok
10:51:38.0476 1696 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:Windowssystem32DRIVERSswenum.sys
10:51:38.0479 1696 swenum - ok
10:51:38.0494 1696 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:WindowsSystem32swprv.dll
10:51:38.0499 1696 swprv - ok
10:51:38.0506 1696 [ C3A39C4079305480972D29C44B868C78 ] Synth3dVsc C:Windowssystem32driverssynth3dvsc.sys
10:51:38.0506 1696 Synth3dVsc - ok
10:51:38.0539 1696 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:Windowssystem32sysmain.dll
10:51:38.0549 1696 SysMain - ok
10:51:38.0566 1696 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:WindowsSystem32TabSvc.dll
10:51:38.0569 1696 TabletInputService - ok
10:51:38.0579 1696 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:WindowsSystem32tapisrv.dll
10:51:38.0584 1696 TapiSrv - ok
10:51:38.0599 1696 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:WindowsSystem32tbssvc.dll
10:51:38.0601 1696 TBS - ok
10:51:38.0651 1696 [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip C:Windowssystem32driverstcpip.sys
10:51:38.0659 1696 Tcpip - ok
10:51:38.0716 1696 [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6 C:Windowssystem32DRIVERStcpip.sys
10:51:38.0726 1696 TCPIP6 - ok
10:51:38.0751 1696 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:Windowssystem32driverstcpipreg.sys
10:51:38.0751 1696 tcpipreg - ok
10:51:38.0769 1696 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:Windowssystem32driverstdpipe.sys
10:51:38.0771 1696 TDPIPE - ok
10:51:38.0776 1696 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:Windowssystem32driverstdtcp.sys
10:51:38.0779 1696 TDTCP - ok
10:51:38.0786 1696 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:Windowssystem32DRIVERStdx.sys
10:51:38.0786 1696 tdx - ok
10:51:38.0794 1696 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:Windowssystem32DRIVERStermdd.sys
10:51:38.0794 1696 TermDD - ok
10:51:38.0801 1696 [ EF4469AB69EB15E5D3754E6AEAFBCD3D ] terminpt C:Windowssystem32driversterminpt.sys
10:51:38.0801 1696 terminpt - ok
10:51:38.0824 1696 [ 2E648163254233755035B46DD7B89123 ] TermService C:WindowsSystem32termsrv.dll
10:51:38.0829 1696 TermService - ok
10:51:38.0849 1696 [ F0344071948D1A1FA732231785A0664C ] Themes C:Windowssystem32themeservice.dll
10:51:38.0849 1696 Themes - ok
10:51:38.0869 1696 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:Windowssystem32mmcss.dll
10:51:38.0869 1696 THREADORDER - ok
10:51:38.0896 1696 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:WindowsSystem32trkwks.dll
10:51:38.0899 1696 TrkWks - ok
10:51:38.0934 1696 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:WindowsservicingTrustedInstaller.exe
10:51:38.0934 1696 TrustedInstaller - ok
10:51:38.0954 1696 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:Windowssystem32DRIVERStssecsrv.sys
10:51:38.0954 1696 tssecsrv - ok
10:51:38.0964 1696 [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt C:Windowssystem32driverstsusbflt.sys
10:51:38.0964 1696 TsUsbFlt - ok
10:51:38.0971 1696 [ AD64450A4ABE076F5CB34CC08EEACB07 ] TsUsbGD C:Windowssystem32driversTsUsbGD.sys
10:51:38.0974 1696 TsUsbGD - ok
10:51:38.0981 1696 [ E1748D04AE40118B62BC18AC86032192 ] tsusbhub C:Windowssystem32driverstsusbhub.sys
10:51:38.0981 1696 tsusbhub - ok
10:51:39.0001 1696 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:Windowssystem32DRIVERStunnel.sys
10:51:39.0001 1696 tunnel - ok
10:51:39.0016 1696 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:Windowssystem32driversuagp35.sys
10:51:39.0016 1696 uagp35 - ok
10:51:39.0036 1696 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:Windowssystem32DRIVERSudfs.sys
10:51:39.0039 1696 udfs - ok
10:51:39.0071 1696 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:Windowssystem32UI0Detect.exe
10:51:39.0074 1696 UI0Detect - ok
10:51:39.0086 1696 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:Windowssystem32driversuliagpkx.sys
10:51:39.0086 1696 uliagpkx - ok
10:51:39.0099 1696 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:Windowssystem32DRIVERSumbus.sys
10:51:39.0099 1696 umbus - ok
10:51:39.0106 1696 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:Windowssystem32driversumpass.sys
10:51:39.0106 1696 UmPass - ok
10:51:39.0124 1696 [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService C:WindowsSystem32umrdp.dll
10:51:39.0126 1696 UmRdpService - ok
10:51:39.0141 1696 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:WindowsSystem32upnphost.dll
10:51:39.0146 1696 upnphost - ok
10:51:39.0154 1696 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:Windowssystem32DRIVERSusbccgp.sys
10:51:39.0154 1696 usbccgp - ok
10:51:39.0164 1696 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:Windowssystem32driversusbcir.sys
10:51:39.0164 1696 usbcir - ok
10:51:39.0174 1696 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:Windowssystem32DRIVERSusbehci.sys
10:51:39.0174 1696 usbehci - ok
10:51:39.0184 1696 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:Windowssystem32DRIVERSusbhub.sys
10:51:39.0186 1696 usbhub - ok
10:51:39.0194 1696 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:Windowssystem32driversusbohci.sys
10:51:39.0194 1696 usbohci - ok
10:51:39.0206 1696 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:Windowssystem32driversusbprint.sys
10:51:39.0206 1696 usbprint - ok
10:51:39.0224 1696 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:Windowssystem32DRIVERSUSBSTOR.SYS
10:51:39.0224 1696 USBSTOR - ok
10:51:39.0231 1696 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:Windowssystem32DRIVERSusbuhci.sys
10:51:39.0231 1696 usbuhci - ok
10:51:39.0244 1696 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:WindowsSystem32uxsms.dll
10:51:39.0244 1696 UxSms - ok
10:51:39.0264 1696 [ 9E3E3E092B01D89A742FF65549929BF4 ] VaultSvc C:Windowssystem32lsass.exe
10:51:39.0266 1696 VaultSvc - ok
10:51:39.0279 1696 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:Windowssystem32driversvdrvroot.sys
10:51:39.0279 1696 vdrvroot - ok
10:51:39.0306 1696 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:WindowsSystem32vds.exe
10:51:39.0311 1696 vds - ok
10:51:39.0319 1696 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:Windowssystem32DRIVERSvgapnp.sys
10:51:39.0319 1696 vga - ok
10:51:39.0326 1696 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:WindowsSystem32driversvga.sys
10:51:39.0326 1696 VgaSave - ok
10:51:39.0334 1696 VGPU - ok
10:51:39.0344 1696 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:Windowssystem32driversvhdmp.sys
10:51:39.0346 1696 vhdmp - ok
10:51:39.0354 1696 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:Windowssystem32driversviaide.sys
10:51:39.0354 1696 viaide - ok
10:51:39.0364 1696 [ 86EA3E79AE350FEA5331A1303054005F ] vmbus C:Windowssystem32driversvmbus.sys
10:51:39.0366 1696 vmbus - ok
10:51:39.0374 1696 [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID C:Windowssystem32driversVMBusHID.sys
10:51:39.0374 1696 VMBusHID - ok
10:51:39.0381 1696 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:Windowssystem32driversvolmgr.sys
10:51:39.0381 1696 volmgr - ok
10:51:39.0394 1696 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:Windowssystem32driversvolmgrx.sys
10:51:39.0394 1696 volmgrx - ok
10:51:39.0404 1696 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:Windowssystem32driversvolsnap.sys
10:51:39.0406 1696 volsnap - ok
10:51:39.0416 1696 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:Windowssystem32driversvsmraid.sys
10:51:39.0416 1696 vsmraid - ok
10:51:39.0449 1696 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:Windowssystem32vssvc.exe
10:51:39.0464 1696 VSS - ok
10:51:39.0479 1696 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:WindowsSystem32driversvwifibus.sys
10:51:39.0479 1696 vwifibus - ok
10:51:39.0489 1696 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:Windowssystem32w32time.dll
10:51:39.0491 1696 W32Time - ok
10:51:39.0511 1696 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:Windowssystem32driverswacompen.sys
10:51:39.0514 1696 WacomPen - ok
10:51:39.0526 1696 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:Windowssystem32DRIVERSwanarp.sys
10:51:39.0529 1696 WANARP - ok
10:51:39.0539 1696 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:Windowssystem32DRIVERSwanarp.sys
10:51:39.0541 1696 Wanarpv6 - ok
10:51:39.0584 1696 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:Windowssystem32WatWatAdminSvc.exe
10:51:39.0589 1696 WatAdminSvc - ok
10:51:39.0626 1696 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:Windowssystem32wbengine.exe
10:51:39.0634 1696 wbengine - ok
10:51:39.0651 1696 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:WindowsSystem32wbiosrvc.dll
10:51:39.0654 1696 WbioSrvc - ok
10:51:39.0664 1696 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:WindowsSystem32wcncsvc.dll
10:51:39.0669 1696 wcncsvc - ok
10:51:39.0676 1696 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:WindowsSystem32WcsPlugInService.dll
10:51:39.0676 1696 WcsPlugInService - ok
10:51:39.0684 1696 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:Windowssystem32driverswd.sys
10:51:39.0686 1696 Wd - ok
10:51:39.0699 1696 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:Windowssystem32driversWdf01000.sys
10:51:39.0704 1696 Wdf01000 - ok
10:51:39.0714 1696 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:Windowssystem32wdi.dll
10:51:39.0716 1696 WdiServiceHost - ok
10:51:39.0724 1696 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:Windowssystem32wdi.dll
10:51:39.0724 1696 WdiSystemHost - ok
10:51:39.0736 1696 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:WindowsSystem32webclnt.dll
10:51:39.0739 1696 WebClient - ok
10:51:39.0756 1696 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:Windowssystem32wecsvc.dll
10:51:39.0759 1696 Wecsvc - ok
10:51:39.0774 1696 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:WindowsSystem32wercplsupport.dll
10:51:39.0776 1696 wercplsupport - ok
10:51:39.0784 1696 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:WindowsSystem32WerSvc.dll
10:51:39.0786 1696 WerSvc - ok
10:51:39.0794 1696 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:Windowssystem32DRIVERSwfplwf.sys
10:51:39.0796 1696 WfpLwf - ok
10:51:39.0804 1696 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:Windowssystem32driverswimmount.sys
10:51:39.0804 1696 WIMMount - ok
10:51:39.0816 1696 WinDefend - ok
10:51:39.0826 1696 WinHttpAutoProxySvc - ok
10:51:39.0899 1696 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:Windowssystem32wbemWMIsvc.dll
10:51:39.0899 1696 Winmgmt - ok
10:51:39.0949 1696 [ BCB1310604AA415C4508708975B3931E ] WinRM C:Windowssystem32WsmSvc.dll
10:51:39.0959 1696 WinRM - ok
10:51:40.0004 1696 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:WindowsSystem32wlansvc.dll
10:51:40.0011 1696 Wlansvc - ok
10:51:40.0024 1696 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:Windowssystem32driverswmiacpi.sys
10:51:40.0024 1696 WmiAcpi - ok
10:51:40.0041 1696 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:Windowssystem32wbemWmiApSrv.exe
10:51:40.0044 1696 wmiApSrv - ok
10:51:40.0061 1696 WMPNetworkSvc - ok
10:51:40.0081 1696 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:WindowsSystem32wpcsvc.dll
10:51:40.0084 1696 WPCSvc - ok
10:51:40.0096 1696 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:Windowssystem32wpdbusenum.dll
10:51:40.0096 1696 WPDBusEnum - ok
10:51:40.0109 1696 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:Windowssystem32driversws2ifsl.sys
10:51:40.0111 1696 ws2ifsl - ok
10:51:40.0124 1696 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:WindowsSystem32wscsvc.dll
10:51:40.0126 1696 wscsvc - ok
10:51:40.0139 1696 WSearch - ok
10:51:40.0199 1696 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:Windowssystem32wuaueng.dll
10:51:40.0211 1696 wuauserv - ok
10:51:40.0234 1696 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:Windowssystem32driversWudfPf.sys
10:51:40.0234 1696 WudfPf - ok
10:51:40.0266 1696 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:Windowssystem32DRIVERSWUDFRd.sys
10:51:40.0269 1696 WUDFRd - ok
10:51:40.0289 1696 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:WindowsSystem32WUDFSvc.dll
10:51:40.0289 1696 wudfsvc - ok
10:51:40.0309 1696 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:WindowsSystem32wwansvc.dll
10:51:40.0311 1696 WwanSvc - ok
10:51:40.0341 1696 ================ Scan global ===============================
10:51:40.0359 1696 [ BA0CD8C393E8C9F83354106093832C7B ] C:Windowssystem32basesrv.dll
10:51:40.0376 1696 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:Windowssystem32winsrv.dll
10:51:40.0384 1696 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:Windowssystem32winsrv.dll
10:51:40.0399 1696 [ D6160F9D869BA3AF0B787F971DB56368 ] C:Windowssystem32sxssrv.dll
10:51:40.0424 1696 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:Windowssystem32services.exe
10:51:40.0429 1696 [Global] - ok
10:51:40.0431 1696 ================ Scan MBR ==================================
10:51:40.0444 1696 [ A36C5E4F47E84449FF07ED3517B43A31 ] DeviceHarddisk0DR0
10:51:40.0596 1696 DeviceHarddisk0DR0 - ok
10:51:40.0596 1696 ================ Scan VBR ==================================
10:51:40.0599 1696 [ 9A35D73F642E864B71F1FC46F34FA1E3 ] DeviceHarddisk0DR0Partition1
10:51:40.0599 1696 DeviceHarddisk0DR0Partition1 - ok
10:51:40.0606 1696 [ 598CD9C37E3A0AC12D9307E36FFFA79A ] DeviceHarddisk0DR0Partition2
10:51:40.0606 1696 DeviceHarddisk0DR0Partition2 - ok
10:51:40.0624 1696 [ 84FD7A9DD2639BED6629BC4316BC292E ] DeviceHarddisk0DR0Partition3
10:51:40.0624 1696 DeviceHarddisk0DR0Partition3 - ok
10:51:40.0646 1696 [ 79507487B038F4FDD63F2B9AD49F25E9 ] DeviceHarddisk0DR0Partition4
10:51:40.0649 1696 DeviceHarddisk0DR0Partition4 - ok
10:51:40.0651 1696 ============================================================
10:51:40.0651 1696 Scan finished
10:51:40.0651 1696 ============================================================
10:51:40.0661 3428 Detected object count: 0
10:51:40.0661 3428 Actual detected object count: 0

Пускам и Gmer да работи спрямо указанията които ми дадохте.

Гмер:

GMER 2.1.18952 - http://www.gmer.net
Rootkit scan 2013-02-19 11:23:56
Windows 6.1.7601 Service Pack 1 x64 DeviceHarddisk0DR0 -> DeviceIdeIdeDeviceP2T0L0-4 WDC_WD10EALX-009BA0 rev.15.01H15 931,51GB
Running: gmer.exe; Driver: C:UsersR2-D2AppDataLocalTempkglorpoc.sys

---- Threads - GMER 2.1 ----

Thread C:Program FilesWindows Media Playerwmpnetwk.exe [2752:572] 000007fefba82a7c
Thread C:Program FilesWindows Media Playerwmpnetwk.exe [2752:3252] 000007fefa405124
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:3696] 0000000076517587
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:3700] 0000000071bc0cb3
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:3704] 00000000776b2e25
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:4052] 00000000776b3e45
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:1732] 00000000776b3e45
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:852] 00000000776b3e45
Thread C:Program FilesWindows Media Playerwmpnetwk.exe [2752:572] 000007fefba82a7c
Thread C:Program FilesWindows Media Playerwmpnetwk.exe [2752:3252] 000007fefa405124
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:3696] 0000000076517587
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:3700] 0000000071bc0cb3
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:3704] 00000000776b2e25
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:4052] 00000000776b3e45
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:1732] 00000000776b3e45
Thread C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [3660:852] 00000000776b3e45

---- Files - GMER 2.1 ----

File C:UsersR2-D2AppDataLocalMicrosoftWindowsTemporary Internet FilesLowContent.IE5R1U1JWMHfastbutton[2].htm 38622 bytes
File C:UsersR2-D2AppDataLocalMicrosoftInternet ExplorerRecoveryLast Active{B88D63AD-7A70-11E2-AE19-1C6F65A45AEB}.dat 274944 bytes
File C:UsersR2-D2AppDataLocalMicrosoftInternet ExplorerRecoveryLast Active{B88D63AE-7A70-11E2-AE19-1C6F65A45AEB}.dat 218624 bytes
File C:UsersR2-D2AppDataLocalMicrosoftInternet ExplorerRecoveryLast Active{B88D63AF-7A70-11E2-AE19-1C6F65A45AEB}.dat 26112 bytes
File C:UsersR2-D2AppDataLocalMicrosoftInternet ExplorerRecoveryLast Active{B88D63B0-7A70-11E2-AE19-1C6F65A45AEB}.dat 57344 bytes
File C:UsersR2-D2AppDataLocalMicrosoftWindowsTemporary Internet FilesLowContent.IE5R1U1JWMHlike[4].htm 16623 bytes
File C:UsersR2-D2AppDataLocalMicrosoftWindowsTemporary Internet FilesLowContent.IE5R1U1JWMHxd_arbiter[1].htm 25477 bytes
File C:UsersR2-D2AppDataLocalMicrosoftWindowsTemporary Internet FilesLowContent.IE53FHB34J3likebox[3].htm 21532 bytes
File C:UsersR2-D2AppDataLocalMicrosoftWindowsTemporary Internet FilesLowContent.IE53FHB34J3like[4].htm 14812 bytes
File C:UsersR2-D2AppDataLocalMicrosoftWindowsTemporary Internet FilesLowContent.IE59LJPJ6S2207521-взлом-разходки[1].htm 116134 bytes
File C:UsersR2-D2AppDataLocalMicrosoftWindowsTemporary Internet FilesLowContent.IE59LJPJ6S2afr[1].htm 1794 bytes
File C:UsersR2-D2AppDataLocalTemp~DF9662170F30730277.TMP 102400 bytes
File C:UsersR2-D2AppDataLocalTemp~DFA61FD6D71013B48A.TMP 16384 bytes
File C:UsersR2-D2AppDataLocalMicrosoftWindowsTemporary Internet FilesLowContent.IE5R1U1JWMHfastbutton[2].htm 38622 bytes
File C:UsersR2-D2AppDataLocalMicrosoftWindowsTemporary Internet FilesLowContent.IE5R1U1JWMHlike[4].htm 16623 bytes
File C:UsersR2-D2AppDataLocalMicrosoftWindowsTemporary Internet FilesLowContent.IE5R1U1JWMHxd_arbiter[1].htm 25477 bytes

---- EOF - GMER 2.1 ----

Редактирано 19 февруари 201313 г. от КОЛЕЦ (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

19 февруари 201313 г.

До тук нищо притеснително от зловреден характер...!

Изтеглете TFC (Temp File Cleaner) от тук и го запишете на десктопа.

[*]Стартирайте

TFC.exe [*]Имайте търпение и изчакайте програмата да завърши работата си [*]Ако е необходимо, потвърдете с OK за рестартиране на Windows

Изтеглете Malwarebytes' Anti-Malware или от тук (не забравяйте да обновите програмата с нови дефиниции)
* Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата.
* Уверете се, че са поставени отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware. След това кликнете на Finish.
* Ако има намерени обновявания, тя ще ги изтегли и инсталира.
* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
* Сканирането ще отнеме малко време, затова моля да бъдете търпеливи.
* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата
* Уверете се, че на всички редове има отметки, и кликнете на Remove Selected.
* Когато всичко бъде премахнато, в Notepad ще бъде отворен лог.
Копирайте този лог и го публикувайте в следващия си коментар по темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

19 февруари 201313 г.

Автор

Здравейте. Направих описаното от вас. Мбам не намери заразени файлове. Не се сдържах и свалих от друга машина avira resuce cd, kaspersky rescue cd, bit defender rescue cd. И трите не намериха никакви заплахи и зарази по машината. Между другого държа да кажа че смених и клавиатурата със която работя и я поставих на друга машина. Оказа сеч

Здравейте. Проверката от Мбам не наери нищо. Тествах и със друг софтуер свален от неутрална машина създадох медии и направих тестове. Не се откриха зарази по машината. Между другото замених клавиатурата си със друга след проблема. Във началото на темата не уточних това, защото не се замслих над него но сега се замислих и си спомних че старата клавиатура която замених и хвърлих след като се опитах да стартирам със нея буут медия със антивирусен софтуер на нея при спрян мрежови адаптер сама си избираше какво да прави. Буут медията беше на двд така че пряка намеса на какъвто и да е вирус не смятам че мислима там. За съжаление днес преинсталирах машината след като я изтрих цялостно и не мога да ви предоставя логове. Та се замслих над идеята дали клавиатурата не е окъсявала и след всички направени проверки и след като я закачих на друга машина се оказа точно че наистина е правила точно това за което говоря.

Смятам проблема на този етап за решен. Благодаря ви за съдействието но просто не се сдържах и набих формата. Прощавайте ако съм ви загубил времето.

Редактирано 19 февруари 201313 г. от КОЛЕЦ (преглед на промените)

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.