10:50:35.0312 0764 TDSS rootkit removing tool 2.7.23.0 Mar 26 2012 13:40:18 10:50:35.0500 0764 ============================================================ 10:50:35.0500 0764 Current date / time: 2012/04/01 10:50:35.0500 10:50:35.0500 0764 SystemInfo: 10:50:35.0500 0764 10:50:35.0500 0764 OS Version: 5.1.2600 ServicePack: 3.0 10:50:35.0500 0764 Product type: Workstation 10:50:35.0500 0764 ComputerName: DOM-64737011F72 10:50:35.0500 0764 UserName: Administrator 10:50:35.0500 0764 Windows directory: C:\WINDOWS 10:50:35.0500 0764 System windows directory: C:\WINDOWS 10:50:35.0500 0764 Processor architecture: Intel x86 10:50:35.0500 0764 Number of processors: 1 10:50:35.0500 0764 Page size: 0x1000 10:50:35.0500 0764 Boot type: Normal boot 10:50:35.0500 0764 ============================================================ 10:50:36.0734 0764 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x11EE4, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000054 10:50:36.0750 0764 Drive \Device\Harddisk1\DR1 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050 10:50:36.0750 0764 \Device\Harddisk0\DR0: 10:50:36.0750 0764 MBR used 10:50:36.0750 0764 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x13, BlocksNum 0x61A7D6D 10:50:36.0781 0764 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x61A7D93, BlocksNum 0xC87004D 10:50:36.0781 0764 \Device\Harddisk1\DR1: 10:50:36.0781 0764 MBR used 10:50:36.0796 0764 \Device\Harddisk1\DR1\Partition0: MBR, Type 0xB, StartLBA 0x3F00, BlocksNum 0x2730C3F 10:50:36.0812 0764 \Device\Harddisk1\DR1\Partition1: MBR, Type 0xB, StartLBA 0x2734B7E, BlocksNum 0x639D9A7 10:50:36.0812 0764 \Device\Harddisk1\DR1\Partition2: MBR, Type 0xB, StartLBA 0x8AD2564, BlocksNum 0x752C5A1 10:50:36.0937 0764 Initialize success 10:50:36.0937 0764 ============================================================ 10:50:40.0750 1740 ============================================================ 10:50:40.0750 1740 Scan started 10:50:40.0750 1740 Mode: Manual; 10:50:40.0750 1740 ============================================================ 10:50:41.0375 1740 ABBYY.Licensing.FineReader.Corporate.10.0 (d5934c8b21c2bbbdd259b691defe33ba) C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\CE\NetworkLicenseServer.exe 10:50:41.0390 1740 ABBYY.Licensing.FineReader.Corporate.10.0 - ok 10:50:41.0468 1740 Abiosdsk - ok 10:50:41.0484 1740 abp480n5 - ok 10:50:41.0531 1740 ACPI (05118282f5d039595a2b92b4a4afe197) C:\WINDOWS\system32\DRIVERS\ACPI.sys 10:50:41.0531 1740 ACPI - ok 10:50:41.0578 1740 ACPIEC (66a42b7db194e24b973bbcce840a0f3f) C:\WINDOWS\system32\drivers\ACPIEC.sys 10:50:41.0578 1740 ACPIEC - ok 10:50:41.0609 1740 ADIHdAudAddService (70b64d0706d089466bdbc814f0fe6663) C:\WINDOWS\system32\drivers\ADIHdAud.sys 10:50:41.0609 1740 ADIHdAudAddService - ok 10:50:41.0640 1740 adpu160m - ok 10:50:41.0671 1740 AEAudioService (f932a37fff15d1b35289213089e9c78d) C:\WINDOWS\system32\drivers\AEAudio.sys 10:50:41.0671 1740 AEAudioService - ok 10:50:41.0703 1740 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 10:50:41.0703 1740 aec - ok 10:50:41.0750 1740 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys 10:50:41.0750 1740 AFD - ok 10:50:41.0765 1740 Aha154x - ok 10:50:41.0781 1740 aic78u2 - ok 10:50:41.0796 1740 aic78xx - ok 10:50:41.0843 1740 Alerter (27af056d8c42f0ab3cf1dfdcbbeb3243) C:\WINDOWS\system32\alrsvc.dll 10:50:41.0843 1740 Alerter - ok 10:50:41.0875 1740 ALG (d1738dddff196c5cee6d867c136af745) C:\WINDOWS\System32\alg.exe 10:50:41.0875 1740 ALG - ok 10:50:41.0906 1740 AliIde - ok 10:50:41.0921 1740 amsint - ok 10:50:42.0015 1740 AntiVirSchedulerService (72709089a54bdc1c5b16bc4a4b926567) C:\Program Files\Avira\AntiVir Desktop\sched.exe 10:50:42.0015 1740 AntiVirSchedulerService - ok 10:50:42.0046 1740 AntiVirService (42f88bfbb76f7a63e381829479b18518) C:\Program Files\Avira\AntiVir Desktop\avguard.exe 10:50:42.0046 1740 AntiVirService - ok 10:50:42.0093 1740 AppMgmt (1561430da2f2ab81cc0ce71af95a778d) C:\WINDOWS\System32\appmgmts.dll 10:50:42.0093 1740 AppMgmt - ok 10:50:42.0109 1740 asc - ok 10:50:42.0140 1740 asc3350p - ok 10:50:42.0156 1740 asc3550 - ok 10:50:42.0234 1740 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 10:50:42.0265 1740 aspnet_state - ok 10:50:42.0296 1740 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 10:50:42.0296 1740 AsyncMac - ok 10:50:42.0328 1740 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 10:50:42.0328 1740 atapi - ok 10:50:42.0343 1740 Atdisk - ok 10:50:42.0390 1740 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 10:50:42.0390 1740 Atmarpc - ok 10:50:42.0437 1740 AudioSrv (3a28d3e7bad0eed3810cd918b2525b54) C:\WINDOWS\System32\audiosrv.dll 10:50:42.0437 1740 AudioSrv - ok 10:50:42.0468 1740 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 10:50:42.0468 1740 audstub - ok 10:50:42.0500 1740 avgntflt (7713e4eb0276702faa08e52a6e23f2a6) C:\WINDOWS\system32\DRIVERS\avgntflt.sys 10:50:42.0500 1740 avgntflt - ok 10:50:42.0546 1740 avipbb (13b02b9b969dde270cd7c351203dad3c) C:\WINDOWS\system32\DRIVERS\avipbb.sys 10:50:42.0546 1740 avipbb - ok 10:50:42.0578 1740 avkmgr (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys 10:50:42.0578 1740 avkmgr - ok 10:50:42.0609 1740 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 10:50:42.0609 1740 Beep - ok 10:50:42.0640 1740 BITS (78200faa6fd9c69394134c238c87fb7f) C:\WINDOWS\system32\qmgr.dll 10:50:42.0718 1740 BITS - ok 10:50:42.0812 1740 BlueSoleilCS (aa770326dbf8518c632f02b0f85e0087) C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe 10:50:42.0828 1740 BlueSoleilCS - ok 10:50:42.0906 1740 Browser (b98ed6d85339a66a73f32fb569eb6c01) C:\WINDOWS\System32\browser.dll 10:50:42.0906 1740 Browser - ok 10:50:42.0921 1740 BsHelpCS (0a22897fc9c4ff67e4fe2fe39cf8bfc2) C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe 10:50:42.0921 1740 BsHelpCS - ok 10:50:42.0953 1740 BsMobileCS (881c86c4b8f2359318e0e6d7ec844d13) C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe 10:50:42.0953 1740 BsMobileCS - ok 10:50:43.0015 1740 BT (8e2d9ece59dfe7d310201e0d65d97ecb) C:\WINDOWS\system32\DRIVERS\btnetdrv.sys 10:50:43.0015 1740 BT - ok 10:50:43.0031 1740 BTCOM - ok 10:50:43.0046 1740 BTCOMBUS - ok 10:50:43.0093 1740 Btcsrusb (942c602296119d758547808221c85a2c) C:\WINDOWS\system32\Drivers\btcusb.sys 10:50:43.0093 1740 Btcsrusb - ok 10:50:43.0140 1740 BthEnum (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys 10:50:43.0140 1740 BthEnum - ok 10:50:43.0187 1740 BtHidBus (ce441ccd98c5ecb10cb12fcaf97322ec) C:\WINDOWS\system32\Drivers\BtHidBus.sys 10:50:43.0187 1740 BtHidBus - ok 10:50:43.0218 1740 BthPan (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys 10:50:43.0218 1740 BthPan - ok 10:50:43.0265 1740 BTHPORT (58d5250a872f2466ebcbdd9e6643525c) C:\WINDOWS\system32\Drivers\BTHport.sys 10:50:43.0281 1740 BTHPORT - ok 10:50:43.0312 1740 BthServ (ec29de6460a4d6aeb3e928d2611d7c55) C:\WINDOWS\System32\bthserv.dll 10:50:43.0312 1740 BthServ - ok 10:50:43.0343 1740 BTHUSB (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys 10:50:43.0343 1740 BTHUSB - ok 10:50:43.0375 1740 btnetBUs (d3c277a51ef9e2ec972d6221f99c0b6d) C:\WINDOWS\system32\Drivers\btnetBus.sys 10:50:43.0375 1740 btnetBUs - ok 10:50:43.0468 1740 BTNetFilter (4f26303becbb7cc5ca8ff39593124cf2) C:\Program Files\IVT Corporation\BlueSoleil\Device\Win2k\BTNetFilter.sys 10:50:43.0468 1740 BTNetFilter - ok 10:50:43.0546 1740 catchme - ok 10:50:43.0593 1740 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 10:50:43.0593 1740 cbidf2k - ok 10:50:43.0640 1740 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 10:50:43.0640 1740 CCDECODE - ok 10:50:43.0656 1740 cd20xrnt - ok 10:50:43.0687 1740 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 10:50:43.0687 1740 Cdaudio - ok 10:50:43.0718 1740 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 10:50:43.0718 1740 Cdfs - ok 10:50:43.0750 1740 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 10:50:43.0750 1740 Cdrom - ok 10:50:43.0765 1740 Changer - ok 10:50:43.0796 1740 CiSvc (45b63df2fb498d219fcbb4425cade676) C:\WINDOWS\system32\cisvc.exe 10:50:43.0796 1740 CiSvc - ok 10:50:43.0828 1740 ClipSrv (c94f1b6f61858d6389c0fa06954fb9c4) C:\WINDOWS\system32\clipsrv.exe 10:50:43.0828 1740 ClipSrv - ok 10:50:43.0890 1740 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 10:50:43.0921 1740 clr_optimization_v2.0.50727_32 - ok 10:50:43.0953 1740 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 10:50:43.0968 1740 clr_optimization_v4.0.30319_32 - ok 10:50:44.0000 1740 CmdIde - ok 10:50:44.0015 1740 COMSysApp - ok 10:50:44.0046 1740 Cpqarray - ok 10:50:44.0078 1740 CryptSvc (6b105fe95f2e9f0b6346044ba59d41c9) C:\WINDOWS\System32\cryptsvc.dll 10:50:44.0078 1740 CryptSvc - ok 10:50:44.0109 1740 dac2w2k - ok 10:50:44.0125 1740 dac960nt - ok 10:50:44.0171 1740 DcomLaunch (a37311d9d628c1042a2836731787f0f3) C:\WINDOWS\system32\rpcss.dll 10:50:44.0187 1740 DcomLaunch - ok 10:50:44.0218 1740 Dhcp (6b4afe7c676cff3eff2dc06a4ee945f7) C:\WINDOWS\System32\dhcpcsvc.dll 10:50:44.0218 1740 Dhcp - ok 10:50:44.0265 1740 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 10:50:44.0265 1740 Disk - ok 10:50:44.0281 1740 dmadmin - ok 10:50:44.0328 1740 dmboot (bc9219abc5696942e6f9ac8a9b28670f) C:\WINDOWS\system32\drivers\dmboot.sys 10:50:44.0359 1740 dmboot - ok 10:50:44.0375 1740 dmio (5fa232e3ba6e1346f9f5a7e519320cb0) C:\WINDOWS\system32\drivers\dmio.sys 10:50:44.0375 1740 dmio - ok 10:50:44.0406 1740 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 10:50:44.0406 1740 dmload - ok 10:50:44.0437 1740 dmserver (d858920a05076914d34b0388e8d96cc0) C:\WINDOWS\System32\dmserver.dll 10:50:44.0437 1740 dmserver - ok 10:50:44.0453 1740 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 10:50:44.0453 1740 DMusic - ok 10:50:44.0500 1740 Dnscache (082be13166a3354f25f78e0b2601012b) C:\WINDOWS\System32\dnsrslvr.dll 10:50:44.0500 1740 Dnscache - ok 10:50:44.0546 1740 Dot3svc (e0b7d66cf29d9adccf873c77821cd4ca) C:\WINDOWS\System32\dot3svc.dll 10:50:44.0546 1740 Dot3svc - ok 10:50:44.0578 1740 dpti2o - ok 10:50:44.0609 1740 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 10:50:44.0609 1740 drmkaud - ok 10:50:44.0640 1740 dtsoftbus01 (c0c7ceccb6c85994c2bc92d58e52d3f2) C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys 10:50:44.0656 1740 dtsoftbus01 - ok 10:50:44.0687 1740 EapHost (5f256c1ad50fefdc442cd5aab58c7dd8) C:\WINDOWS\System32\eapsvc.dll 10:50:44.0687 1740 EapHost - ok 10:50:44.0703 1740 ERSvc (ed1b71382c31fd2cf3cdc4672efad6ea) C:\WINDOWS\System32\ersvc.dll 10:50:44.0703 1740 ERSvc - ok 10:50:44.0750 1740 Eventlog (02a467e27af55f7064c5b251e587315f) C:\WINDOWS\system32\services.exe 10:50:44.0750 1740 Eventlog - ok 10:50:44.0796 1740 EventSystem (6aff804839c85859e0247164fbe5f5bb) C:\WINDOWS\system32\es.dll 10:50:44.0796 1740 EventSystem - ok 10:50:44.0828 1740 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 10:50:44.0828 1740 Fastfat - ok 10:50:44.0875 1740 FastUserSwitchingCompatibility (55aae86c7c2cadf6972acd1d76c24a98) C:\WINDOWS\System32\shsvcs.dll 10:50:44.0890 1740 FastUserSwitchingCompatibility - ok 10:50:44.0906 1740 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 10:50:44.0906 1740 Fdc - ok 10:50:44.0937 1740 Fips (09e2a4d33f81a06a8aab2ba0a0b5d235) C:\WINDOWS\system32\drivers\Fips.sys 10:50:44.0937 1740 Fips - ok 10:50:44.0968 1740 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys 10:50:44.0968 1740 Flpydisk - ok 10:50:45.0015 1740 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys 10:50:45.0015 1740 FltMgr - ok 10:50:45.0078 1740 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 10:50:45.0078 1740 FontCache3.0.0.0 - ok 10:50:45.0109 1740 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 10:50:45.0109 1740 Fs_Rec - ok 10:50:45.0125 1740 Ftdisk (ed6d921d8ab423138fb35beee6d6a6cb) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 10:50:45.0140 1740 Ftdisk - ok 10:50:45.0171 1740 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 10:50:45.0171 1740 Gpc - ok 10:50:45.0203 1740 HdAudAddService (2a013e7530beab6e569faa83f517e836) C:\WINDOWS\system32\drivers\HdAudio.sys 10:50:45.0203 1740 HdAudAddService - ok 10:50:45.0234 1740 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 10:50:45.0234 1740 HDAudBus - ok 10:50:45.0281 1740 helpsvc (af752014f7eb61542e3f35b9374d7e76) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 10:50:45.0281 1740 helpsvc - ok 10:50:45.0296 1740 HidServ - ok 10:50:45.0328 1740 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 10:50:45.0343 1740 hidusb - ok 10:50:45.0390 1740 hkmsvc (f0273916da6fb64cc88e0bd77619554f) C:\WINDOWS\System32\kmsvc.dll 10:50:45.0390 1740 hkmsvc - ok 10:50:45.0421 1740 hpn - ok 10:50:45.0468 1740 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 10:50:45.0468 1740 HTTP - ok 10:50:45.0500 1740 HTTPFilter (aa268079ac119f3a596e5e27aee4bd17) C:\WINDOWS\System32\w3ssl.dll 10:50:45.0500 1740 HTTPFilter - ok 10:50:45.0515 1740 i2omgmt - ok 10:50:45.0531 1740 i2omp - ok 10:50:45.0562 1740 i8042prt (177b372af55c4460d0968b5f1d02aa1c) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 10:50:45.0562 1740 i8042prt - ok 10:50:45.0671 1740 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 10:50:45.0687 1740 idsvc - ok 10:50:45.0718 1740 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 10:50:45.0718 1740 Imapi - ok 10:50:45.0765 1740 ImapiService (9125af650608a921f98a789e5c5ba864) C:\WINDOWS\system32\imapi.exe 10:50:45.0765 1740 ImapiService - ok 10:50:45.0796 1740 ini910u - ok 10:50:45.0812 1740 IntelIde - ok 10:50:45.0859 1740 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys 10:50:45.0859 1740 Ip6Fw - ok 10:50:45.0890 1740 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 10:50:45.0890 1740 IpFilterDriver - ok 10:50:45.0921 1740 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 10:50:45.0921 1740 IpInIp - ok 10:50:45.0953 1740 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 10:50:45.0968 1740 IpNat - ok 10:50:45.0984 1740 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 10:50:45.0984 1740 IPSec - ok 10:50:46.0015 1740 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 10:50:46.0015 1740 IRENUM - ok 10:50:46.0046 1740 isapnp (c8eef2e93835b81bd335de2123121283) C:\WINDOWS\system32\DRIVERS\isapnp.sys 10:50:46.0062 1740 isapnp - ok 10:50:46.0109 1740 IvtBtBUs (71e1fc547cc488d5cd7bf0860c96f5af) C:\WINDOWS\system32\Drivers\IvtBtBus.sys 10:50:46.0109 1740 IvtBtBUs - ok 10:50:46.0171 1740 JavaQuickStarterService (e731921db2e17dcd3db472fad5549c57) C:\Program Files\Java\jre6\bin\jqs.exe 10:50:46.0187 1740 JavaQuickStarterService - ok 10:50:46.0625 1740 Kbdclass (2aeca45d4aeaacbdcb77ad11184e4601) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 10:50:46.0625 1740 Kbdclass - ok 10:50:46.0671 1740 kbdhid (f718dcddac2544bc693f22977d06f78b) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 10:50:46.0671 1740 kbdhid - ok 10:50:46.0703 1740 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 10:50:46.0703 1740 kmixer - ok 10:50:46.0750 1740 KMService (4635935fc972c582632bf45c26bfcb0e) C:\WINDOWS\system32\srvany.exe 10:50:46.0750 1740 KMService - ok 10:50:46.0812 1740 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 10:50:46.0812 1740 KSecDD - ok 10:50:46.0843 1740 lanmanserver (061a4bb67c324ac8c176e0d77923b212) C:\WINDOWS\System32\srvsvc.dll 10:50:46.0843 1740 lanmanserver - ok 10:50:46.0875 1740 lanmanworkstation (fa17019da45c5d6464776a639a5a9abb) C:\WINDOWS\System32\wkssvc.dll 10:50:46.0875 1740 lanmanworkstation - ok 10:50:46.0906 1740 lbrtfdc - ok 10:50:46.0937 1740 LmHosts (437aa83d68f9fac234ca68dbd40db705) C:\WINDOWS\System32\lmhsvc.dll 10:50:46.0937 1740 LmHosts - ok 10:50:46.0968 1740 Messenger (36f3ab18b1be303da51de90a67de3942) C:\WINDOWS\System32\msgsvc.dll 10:50:46.0968 1740 Messenger - ok 10:50:47.0046 1740 Microsoft SharePoint Workspace Audit Service - ok 10:50:47.0093 1740 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 10:50:47.0093 1740 mnmdd - ok 10:50:47.0140 1740 mnmsrvc (845814a8cb9d704d030f076e1bce83f3) C:\WINDOWS\system32\mnmsrvc.exe 10:50:47.0140 1740 mnmsrvc - ok 10:50:47.0187 1740 Modem (4a068db7dc37d5afedb6512d2931d7b3) C:\WINDOWS\system32\drivers\Modem.sys 10:50:47.0187 1740 Modem - ok 10:50:47.0250 1740 Mouclass (a30e5b8319af34d313e9aeb8ae075d47) C:\WINDOWS\system32\DRIVERS\mouclass.sys 10:50:47.0250 1740 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\mouclass.sys. Real md5: a30e5b8319af34d313e9aeb8ae075d47, Fake md5: fbed3df6b884f8cf00447b73507f2c48 10:50:47.0250 1740 Mouclass ( Rootkit.Win32.TDSS.tdl3 ) - infected 10:50:47.0250 1740 Mouclass - detected Rootkit.Win32.TDSS.tdl3 (0) 10:50:47.0312 1740 mouhid (ecec1e6cd558ab80f944f31326e9d3b5) C:\WINDOWS\system32\DRIVERS\mouhid.sys 10:50:47.0312 1740 mouhid - ok 10:50:47.0343 1740 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 10:50:47.0343 1740 MountMgr - ok 10:50:47.0359 1740 mraid35x - ok 10:50:47.0390 1740 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 10:50:47.0390 1740 MRxDAV - ok 10:50:47.0437 1740 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 10:50:47.0453 1740 MRxSmb - ok 10:50:47.0484 1740 MSDTC (a54c5eecc7d3424824410bae0aa6c371) C:\WINDOWS\system32\msdtc.exe 10:50:47.0484 1740 MSDTC - ok 10:50:47.0515 1740 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 10:50:47.0515 1740 Msfs - ok 10:50:47.0531 1740 MSIServer - ok 10:50:47.0562 1740 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 10:50:47.0562 1740 MSKSSRV - ok 10:50:47.0593 1740 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 10:50:47.0593 1740 MSPCLOCK - ok 10:50:47.0609 1740 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 10:50:47.0609 1740 MSPQM - ok 10:50:47.0656 1740 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 10:50:47.0656 1740 mssmbios - ok 10:50:47.0671 1740 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys 10:50:47.0671 1740 MSTEE - ok 10:50:47.0718 1740 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys 10:50:47.0718 1740 MTsensor - ok 10:50:47.0750 1740 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 10:50:47.0750 1740 Mup - ok 10:50:47.0781 1740 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 10:50:47.0781 1740 NABTSFEC - ok 10:50:47.0828 1740 napagent (14cb8528e17d1221c50fc8ca88b1795f) C:\WINDOWS\System32\qagentrt.dll 10:50:47.0843 1740 napagent - ok 10:50:47.0875 1740 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 10:50:47.0875 1740 NDIS - ok 10:50:47.0906 1740 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 10:50:47.0906 1740 NdisIP - ok 10:50:47.0953 1740 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 10:50:47.0953 1740 NdisTapi - ok 10:50:47.0984 1740 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 10:50:47.0984 1740 Ndisuio - ok 10:50:48.0000 1740 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 10:50:48.0015 1740 NdisWan - ok 10:50:48.0062 1740 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 10:50:48.0062 1740 NDProxy - ok 10:50:48.0078 1740 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 10:50:48.0078 1740 NetBIOS - ok 10:50:48.0109 1740 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 10:50:48.0109 1740 NetBT - ok 10:50:48.0140 1740 NetDDE (cbb409b314309fcffce5e682e91338c6) C:\WINDOWS\system32\netdde.exe 10:50:48.0156 1740 NetDDE - ok 10:50:48.0156 1740 NetDDEdsdm (cbb409b314309fcffce5e682e91338c6) C:\WINDOWS\system32\netdde.exe 10:50:48.0171 1740 NetDDEdsdm - ok 10:50:48.0187 1740 Netlogon (88296f7943f30a1ee3af735440b92268) C:\WINDOWS\system32\lsass.exe 10:50:48.0187 1740 Netlogon - ok 10:50:48.0218 1740 Netman (4fe97d0b1b182df2a9bdd4c02155ef5e) C:\WINDOWS\System32\netman.dll 10:50:48.0234 1740 Netman - ok 10:50:48.0312 1740 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 10:50:48.0328 1740 NetTcpPortSharing - ok 10:50:48.0375 1740 Nla (9d1f13706fb5f02d0e8795fb2d03971d) C:\WINDOWS\System32\mswsock.dll 10:50:48.0375 1740 Nla - ok 10:50:48.0421 1740 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 10:50:48.0421 1740 Npfs - ok 10:50:48.0468 1740 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 10:50:48.0484 1740 Ntfs - ok 10:50:48.0500 1740 NtLmSsp (88296f7943f30a1ee3af735440b92268) C:\WINDOWS\system32\lsass.exe 10:50:48.0500 1740 NtLmSsp - ok 10:50:48.0562 1740 NtmsSvc (3fb5399dbb7001a80d58edad64c98225) C:\WINDOWS\system32\ntmssvc.dll 10:50:48.0562 1740 NtmsSvc - ok 10:50:48.0609 1740 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 10:50:48.0609 1740 Null - ok 10:50:48.0921 1740 nv (ed9816dbaf6689542ea7d022631906a1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 10:50:49.0171 1740 nv - ok 10:50:49.0281 1740 nvata (ef9941593b2e9b436f64a87ddb570d1a) C:\WINDOWS\system32\DRIVERS\nvata.sys 10:50:49.0281 1740 nvata - ok 10:50:49.0312 1740 NVENETFD (d8151977e2a20df13c3d30146fd4e542) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys 10:50:49.0312 1740 NVENETFD - ok 10:50:49.0359 1740 nvnetbus (13a6ccf5f60a55f2ed2658b736d65c8b) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys 10:50:49.0359 1740 nvnetbus - ok 10:50:49.0390 1740 NVSvc (36032035fa55f030d55237d5c639a81d) C:\WINDOWS\system32\nvsvc32.exe 10:50:49.0390 1740 NVSvc - ok 10:50:49.0437 1740 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 10:50:49.0437 1740 NwlnkFlt - ok 10:50:49.0468 1740 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 10:50:49.0468 1740 NwlnkFwd - ok 10:50:49.0531 1740 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 10:50:49.0531 1740 ose - ok 10:50:49.0703 1740 osppsvc (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 10:50:49.0812 1740 osppsvc - ok 10:50:49.0906 1740 PAC207 - ok 10:50:49.0953 1740 Parport (2d4cdaebced17743aa9e25d3016dc229) C:\WINDOWS\system32\DRIVERS\parport.sys 10:50:49.0953 1740 Parport - ok 10:50:49.0968 1740 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 10:50:49.0984 1740 PartMgr - ok 10:50:50.0015 1740 ParVdm (453ec2c2a20a1382f564541918520eeb) C:\WINDOWS\system32\drivers\ParVdm.sys 10:50:50.0015 1740 ParVdm - ok 10:50:50.0062 1740 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys 10:50:50.0062 1740 pccsmcfd - ok 10:50:50.0078 1740 PCI (6862c69168d787b85a7d95ccd33c694e) C:\WINDOWS\system32\DRIVERS\pci.sys 10:50:50.0078 1740 PCI - ok 10:50:50.0109 1740 PCIDump - ok 10:50:50.0125 1740 PCIIde (548cf2d6369eae441a4c6baa75bc4f0a) C:\WINDOWS\system32\DRIVERS\pciide.sys 10:50:50.0125 1740 PCIIde - ok 10:50:50.0156 1740 Pcmcia (8db27f1ae9593c94095485305a583862) C:\WINDOWS\system32\drivers\Pcmcia.sys 10:50:50.0156 1740 Pcmcia - ok 10:50:50.0171 1740 PDCOMP - ok 10:50:50.0203 1740 PDFRAME - ok 10:50:50.0218 1740 PDRELI - ok 10:50:50.0234 1740 PDRFRAME - ok 10:50:50.0250 1740 perc2 - ok 10:50:50.0281 1740 perc2hib - ok 10:50:50.0328 1740 PlugPlay (02a467e27af55f7064c5b251e587315f) C:\WINDOWS\system32\services.exe 10:50:50.0343 1740 PlugPlay - ok 10:50:50.0375 1740 PolicyAgent (88296f7943f30a1ee3af735440b92268) C:\WINDOWS\system32\lsass.exe 10:50:50.0375 1740 PolicyAgent - ok 10:50:50.0421 1740 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 10:50:50.0421 1740 PptpMiniport - ok 10:50:50.0453 1740 Processor (7a1367d250502c6416a4d3a19ef155f5) C:\WINDOWS\system32\DRIVERS\processr.sys 10:50:50.0453 1740 Processor - ok 10:50:50.0468 1740 ProtectedStorage (88296f7943f30a1ee3af735440b92268) C:\WINDOWS\system32\lsass.exe 10:50:50.0468 1740 ProtectedStorage - ok 10:50:50.0500 1740 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 10:50:50.0500 1740 PSched - ok 10:50:50.0515 1740 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 10:50:50.0515 1740 Ptilink - ok 10:50:50.0546 1740 QCDonner (fddd1aeb9f81ef1e6e48ae1edc2a97d6) C:\WINDOWS\system32\DRIVERS\OVCD.sys 10:50:50.0546 1740 QCDonner - ok 10:50:50.0562 1740 ql1080 - ok 10:50:50.0593 1740 Ql10wnt - ok 10:50:50.0609 1740 ql12160 - ok 10:50:50.0625 1740 ql1240 - ok 10:50:50.0640 1740 ql1280 - ok 10:50:50.0671 1740 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 10:50:50.0671 1740 RasAcd - ok 10:50:50.0703 1740 RasAuto (bc22c5e1238d4d36d65679e249c483c3) C:\WINDOWS\System32\rasauto.dll 10:50:50.0703 1740 RasAuto - ok 10:50:50.0734 1740 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 10:50:50.0734 1740 Rasl2tp - ok 10:50:50.0765 1740 RasMan (0c392e397b8d34aaaf19ec6119cbb788) C:\WINDOWS\System32\rasmans.dll 10:50:50.0781 1740 RasMan - ok 10:50:50.0796 1740 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 10:50:50.0796 1740 RasPppoe - ok 10:50:50.0812 1740 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 10:50:50.0812 1740 Raspti - ok 10:50:50.0859 1740 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 10:50:50.0859 1740 Rdbss - ok 10:50:50.0890 1740 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 10:50:50.0890 1740 RDPCDD - ok 10:50:50.0921 1740 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 10:50:50.0921 1740 rdpdr - ok 10:50:50.0968 1740 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys 10:50:50.0984 1740 RDPWD - ok 10:50:51.0015 1740 RDSessMgr (f83907a9a038db2e35329b039628d293) C:\WINDOWS\system32\sessmgr.exe 10:50:51.0015 1740 RDSessMgr - ok 10:50:51.0062 1740 redbook (e0c7bbd18040b58651bac700c804861d) C:\WINDOWS\system32\DRIVERS\redbook.sys 10:50:51.0062 1740 redbook - ok 10:50:51.0093 1740 RemoteAccess (b3f57e6115bcd4dbade9874f300655e3) C:\WINDOWS\System32\mprdim.dll 10:50:51.0109 1740 RemoteAccess - ok 10:50:51.0140 1740 RemoteRegistry (b472b59ef98469c91651b751d3442cb8) C:\WINDOWS\system32\regsvc.dll 10:50:51.0140 1740 RemoteRegistry - ok 10:50:51.0187 1740 RFCOMM (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys 10:50:51.0187 1740 RFCOMM - ok 10:50:51.0218 1740 RpcLocator (6bc4d5a70f46ea27ddc14e5414c862a5) C:\WINDOWS\system32\locator.exe 10:50:51.0234 1740 RpcLocator - ok 10:50:51.0296 1740 RpcSs (a37311d9d628c1042a2836731787f0f3) C:\WINDOWS\System32\rpcss.dll 10:50:51.0296 1740 RpcSs - ok 10:50:51.0343 1740 RSVP (9acee3313020a01235336c2a483afd1a) C:\WINDOWS\system32\rsvp.exe 10:50:51.0343 1740 RSVP - ok 10:50:51.0390 1740 SamSs (88296f7943f30a1ee3af735440b92268) C:\WINDOWS\system32\lsass.exe 10:50:51.0390 1740 SamSs - ok 10:50:51.0406 1740 SCardSvr (c6f479218e94896738c06af5ba6ab3d3) C:\WINDOWS\System32\SCardSvr.exe 10:50:51.0421 1740 SCardSvr - ok 10:50:51.0468 1740 Schedule (dd73c11a5c4d14945846384b90a61a4b) C:\WINDOWS\system32\schedsvc.dll 10:50:51.0468 1740 Schedule - ok 10:50:51.0515 1740 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 10:50:51.0515 1740 Secdrv - ok 10:50:51.0546 1740 seclogon (2aad9026648120fffe2a8d871bb2bbc7) C:\WINDOWS\System32\seclogon.dll 10:50:51.0546 1740 seclogon - ok 10:50:51.0609 1740 SenFiltService (23228966244cdd9627bde4141b3be1f0) C:\WINDOWS\system32\drivers\Senfilt.sys 10:50:51.0609 1740 SenFiltService - ok 10:50:51.0640 1740 SENS (9d01e29d59723eb73b72107b208dafe6) C:\WINDOWS\system32\sens.dll 10:50:51.0640 1740 SENS - ok 10:50:51.0671 1740 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys 10:50:51.0671 1740 serenum - ok 10:50:51.0703 1740 Serial (d07b02f88165e69b9f17162cf592c8a6) C:\WINDOWS\system32\DRIVERS\serial.sys 10:50:51.0703 1740 Serial - ok 10:50:51.0796 1740 ServiceLayer (2d841b7b7f6dec32162edfcc69d61f42) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe 10:50:51.0796 1740 ServiceLayer - ok 10:50:51.0843 1740 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 10:50:51.0843 1740 Sfloppy - ok 10:50:51.0906 1740 SharedAccess (da5c015911f68f22ed821e9ee49ab233) C:\WINDOWS\System32\ipnathlp.dll 10:50:51.0906 1740 SharedAccess - ok 10:50:51.0953 1740 ShellHWDetection (55aae86c7c2cadf6972acd1d76c24a98) C:\WINDOWS\System32\shsvcs.dll 10:50:51.0953 1740 ShellHWDetection - ok 10:50:51.0984 1740 Simbad - ok 10:50:52.0015 1740 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys 10:50:52.0015 1740 SLIP - ok 10:50:52.0046 1740 Sparrow - ok 10:50:52.0078 1740 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 10:50:52.0078 1740 splitter - ok 10:50:52.0109 1740 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe 10:50:52.0109 1740 Spooler - ok 10:50:52.0140 1740 sr (eb032822be406ef220d546ddffcf0002) C:\WINDOWS\system32\DRIVERS\sr.sys 10:50:52.0140 1740 sr - ok 10:50:52.0187 1740 srservice (316d0e66074ae4cde641c50d3a1c5148) C:\WINDOWS\system32\srsvc.dll 10:50:52.0187 1740 srservice - ok 10:50:52.0234 1740 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 10:50:52.0250 1740 Srv - ok 10:50:52.0312 1740 ssadbus (64e44acd8c238fcbbb78f0ba4bdc4b05) C:\WINDOWS\system32\DRIVERS\ssadbus.sys 10:50:52.0312 1740 ssadbus - ok 10:50:52.0343 1740 ssadmdfl (bb2c84a15c765da89fd832b0e73f26ce) C:\WINDOWS\system32\DRIVERS\ssadmdfl.sys 10:50:52.0343 1740 ssadmdfl - ok 10:50:52.0390 1740 ssadmdm (6d0d132ddc6f43eda00dced6d8b1ca31) C:\WINDOWS\system32\DRIVERS\ssadmdm.sys 10:50:52.0390 1740 ssadmdm - ok 10:50:52.0421 1740 SSDPSRV (2c0b1224aa36b4ca1753302baa855882) C:\WINDOWS\System32\ssdpsrv.dll 10:50:52.0421 1740 SSDPSRV - ok 10:50:52.0468 1740 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys 10:50:52.0468 1740 ssmdrv - ok 10:50:52.0515 1740 STI Simulator (ed78dfad8efcdfbc89500492c4d14645) C:\WINDOWS\System32\PAStiSvc.exe 10:50:52.0515 1740 STI Simulator - ok 10:50:52.0562 1740 StillCam (0bc9fa598331328ea33b68f7cf01ce97) C:\WINDOWS\system32\DRIVERS\serscan.sys 10:50:52.0562 1740 StillCam - ok 10:50:52.0625 1740 stisvc (41508ea375c97dc2b56e5f1afc067187) C:\WINDOWS\system32\wiaservc.dll 10:50:52.0640 1740 stisvc - ok 10:50:52.0671 1740 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 10:50:52.0671 1740 streamip - ok 10:50:52.0703 1740 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 10:50:52.0703 1740 swenum - ok 10:50:52.0734 1740 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 10:50:52.0734 1740 swmidi - ok 10:50:52.0750 1740 SwPrv - ok 10:50:52.0765 1740 symc810 - ok 10:50:52.0796 1740 symc8xx - ok 10:50:52.0812 1740 sym_hi - ok 10:50:52.0828 1740 sym_u3 - ok 10:50:52.0875 1740 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 10:50:52.0875 1740 sysaudio - ok 10:50:52.0906 1740 SysmonLog (e42048198518f9162027a9984cbb7b5c) C:\WINDOWS\system32\smlogsvc.exe 10:50:52.0906 1740 SysmonLog - ok 10:50:52.0937 1740 TapiSrv (2340e6977548038c88e39a9ecbb3fadc) C:\WINDOWS\System32\tapisrv.dll 10:50:52.0953 1740 TapiSrv - ok 10:50:53.0000 1740 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 10:50:53.0000 1740 Tcpip - ok 10:50:53.0046 1740 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 10:50:53.0046 1740 TDPIPE - ok 10:50:53.0078 1740 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 10:50:53.0078 1740 TDTCP - ok 10:50:53.0109 1740 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 10:50:53.0109 1740 TermDD - ok 10:50:53.0140 1740 TermService (52e0505408edd4ab5ccc7f83b67b4299) C:\WINDOWS\System32\termsrv.dll 10:50:53.0156 1740 TermService - ok 10:50:53.0203 1740 Themes (55aae86c7c2cadf6972acd1d76c24a98) C:\WINDOWS\System32\shsvcs.dll 10:50:53.0203 1740 Themes - ok 10:50:53.0250 1740 TlntSvr (b17551ab6eaa71dca530632c15fa3d9a) C:\WINDOWS\system32\tlntsvr.exe 10:50:53.0250 1740 TlntSvr - ok 10:50:53.0359 1740 TomTomHOMEService (572a16fbad52ab1ac8e3d44baaf99694) e:\Program Files\TomTom HOME 2\TomTomHOMEService.exe 10:50:53.0359 1740 TomTomHOMEService - ok 10:50:53.0390 1740 TosIde - ok 10:50:53.0437 1740 TrkWks (9e70eb419d7785c286dc458a019bab9b) C:\WINDOWS\system32\trkwks.dll 10:50:53.0437 1740 TrkWks - ok 10:50:53.0500 1740 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 10:50:53.0500 1740 Udfs - ok 10:50:53.0515 1740 ultra - ok 10:50:53.0578 1740 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 10:50:53.0578 1740 Update - ok 10:50:53.0609 1740 upnphost (e96a6baee0b2a14a38b45830d6e30697) C:\WINDOWS\System32\upnphost.dll 10:50:53.0625 1740 upnphost - ok 10:50:53.0640 1740 UPS (eb90e28b28541ec845e5345609355ca7) C:\WINDOWS\System32\ups.exe 10:50:53.0656 1740 UPS - ok 10:50:53.0687 1740 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 10:50:53.0687 1740 usbehci - ok 10:50:53.0718 1740 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 10:50:53.0718 1740 usbhub - ok 10:50:53.0734 1740 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys 10:50:53.0734 1740 usbohci - ok 10:50:53.0781 1740 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 10:50:53.0781 1740 usbprint - ok 10:50:53.0812 1740 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 10:50:53.0812 1740 usbscan - ok 10:50:53.0843 1740 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 10:50:53.0843 1740 USBSTOR - ok 10:50:53.0890 1740 VComm (0955553090e0a88614e5b8a02af9324c) C:\WINDOWS\system32\DRIVERS\VComm.sys 10:50:53.0890 1740 VComm - ok 10:50:53.0937 1740 VcommMgr (ea0d7c68dc77b478f1c08022b8afe8ca) C:\WINDOWS\system32\Drivers\VcommMgr.sys 10:50:53.0937 1740 VcommMgr - ok 10:50:53.0953 1740 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 10:50:53.0953 1740 VgaSave - ok 10:50:53.0968 1740 ViaIde - ok 10:50:54.0000 1740 VolSnap (56b191ac5fc0df219949c95a6c87afe7) C:\WINDOWS\system32\drivers\VolSnap.sys 10:50:54.0015 1740 VolSnap - ok 10:50:54.0062 1740 VSS (7f2d7bffc4554e1c742dd3629fd1fb1b) C:\WINDOWS\System32\vssvc.exe 10:50:54.0062 1740 VSS - ok 10:50:54.0093 1740 W32Time (a672ca3981352f8e9c30fea056e80a62) C:\WINDOWS\system32\w32time.dll 10:50:54.0093 1740 W32Time - ok 10:50:54.0125 1740 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 10:50:54.0125 1740 Wanarp - ok 10:50:54.0171 1740 wceusbsh (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys 10:50:54.0171 1740 wceusbsh - ok 10:50:54.0187 1740 WDICA - ok 10:50:54.0218 1740 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 10:50:54.0218 1740 wdmaud - ok 10:50:54.0250 1740 WebClient (81fb88b975e25d76e00b69879d8a434c) C:\WINDOWS\System32\webclnt.dll 10:50:54.0250 1740 WebClient - ok 10:50:54.0312 1740 winmgmt (70c22297534a88b0ad0568900ab5a6d9) C:\WINDOWS\system32\wbem\WMIsvc.dll 10:50:54.0312 1740 winmgmt - ok 10:50:54.0359 1740 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll 10:50:54.0359 1740 WmdmPmSN - ok 10:50:54.0421 1740 Wmi (afce55c392a9676bd24a287d5ed1c777) C:\WINDOWS\System32\advapi32.dll 10:50:54.0421 1740 Wmi - ok 10:50:54.0468 1740 WmiApSrv (a2b12d80a1670511b047a7d8bb647598) C:\WINDOWS\system32\wbem\wmiapsrv.exe 10:50:54.0468 1740 WmiApSrv - ok 10:50:54.0515 1740 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys 10:50:54.0531 1740 WpdUsb - ok 10:50:54.0625 1740 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 10:50:54.0640 1740 WPFFontCache_v0400 - ok 10:50:54.0687 1740 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 10:50:54.0687 1740 WS2IFSL - ok 10:50:54.0734 1740 wscsvc (b6669f49d42e09bc0f9889faa0f3336d) C:\WINDOWS\system32\wscsvc.dll 10:50:54.0734 1740 wscsvc - ok 10:50:54.0781 1740 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 10:50:54.0781 1740 WSTCODEC - ok 10:50:54.0812 1740 wuauserv (04550d5eb7ee82c115db547c01df09fd) C:\WINDOWS\system32\wuauserv.dll 10:50:54.0828 1740 wuauserv - ok 10:50:54.0859 1740 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 10:50:54.0859 1740 WudfPf - ok 10:50:54.0906 1740 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 10:50:54.0906 1740 WudfRd - ok 10:50:54.0937 1740 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll 10:50:54.0937 1740 WudfSvc - ok 10:50:55.0000 1740 WZCSVC (c2842273aaa77ac031edb87fa19a2147) C:\WINDOWS\System32\wzcsvc.dll 10:50:55.0031 1740 WZCSVC - ok 10:50:55.0046 1740 xmlprov (24ed6935771359a5aef1fe8bf0c56f39) C:\WINDOWS\System32\xmlprov.dll 10:50:55.0062 1740 xmlprov - ok 10:50:55.0093 1740 MBR (0x1B8) (32052574bf9f325ae309abc7bfd04460) \Device\Harddisk0\DR0 10:50:55.0234 1740 \Device\Harddisk0\DR0 - ok 10:50:55.0250 1740 MBR (0x1B8) (671b81004fdd1588fa9ed1331c9ceca9) \Device\Harddisk1\DR1 10:50:55.0250 1740 \Device\Harddisk1\DR1 - ok 10:50:55.0265 1740 Boot (0x1200) (cb12110f5be096a1903f660350eedfa7) \Device\Harddisk0\DR0\Partition0 10:50:55.0265 1740 \Device\Harddisk0\DR0\Partition0 - ok 10:50:55.0281 1740 Boot (0x1200) (b00a861dfa6e1f2a660db0c4a746fe44) \Device\Harddisk0\DR0\Partition1 10:50:55.0281 1740 \Device\Harddisk0\DR0\Partition1 - ok 10:50:55.0296 1740 Boot (0x1200) (d54253ff25f920f87d47b1123575e508) \Device\Harddisk1\DR1\Partition0 10:50:55.0296 1740 \Device\Harddisk1\DR1\Partition0 - ok 10:50:55.0312 1740 Boot (0x1200) (ed594e507f472b117943fa44be968106) \Device\Harddisk1\DR1\Partition1 10:50:55.0312 1740 \Device\Harddisk1\DR1\Partition1 - ok 10:50:55.0343 1740 Boot (0x1200) (e11869b31cd84ffeb8c7ba0aaeca2f3b) \Device\Harddisk1\DR1\Partition2 10:50:55.0343 1740 \Device\Harddisk1\DR1\Partition2 - ok 10:50:55.0343 1740 ============================================================ 10:50:55.0343 1740 Scan finished 10:50:55.0343 1740 ============================================================ 10:50:55.0359 2796 Detected object count: 1 10:50:55.0359 2796 Actual detected object count: 1 10:51:04.0656 2796 C:\WINDOWS\system32\DRIVERS\mouclass.sys - copied to quarantine 10:51:04.0687 2796 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine 10:51:04.0687 2796 \Device\Harddisk0\DR0\TDLFS\tdl - copied to quarantine 10:51:04.0687 2796 \Device\Harddisk0\DR0\TDLFS\rsrc.dat - copied to quarantine 10:51:04.0687 2796 \Device\Harddisk0\DR0\TDLFS\bckfg.tmp - copied to quarantine 10:51:04.0703 2796 \Device\Harddisk0\DR0\TDLFS\tdlcmd.dll - copied to quarantine 10:51:11.0031 2796 Backup copy found, using it.. 10:51:11.0031 2796 C:\WINDOWS\system32\DRIVERS\mouclass.sys - will be cured on reboot 10:51:11.0031 2796 Mouclass ( Rootkit.Win32.TDSS.tdl3 ) - User select action: Cure