WiredWX Hobby Weather ToolsLog in

 


Root Kit....Zero Access

4 posters

descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

more_horiz
we will be running a fix to deal with a proxy that might be causing the redirects and I will also try to get rid of the AVIRA remnants.

  • Please run OTL.exe again
  • Under the Custom Scans/Fixes box at the bottom, copy and paste in the following:

Code:


:otl
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 54828

:services
AntiVirService
AntiVirSchedulerService
avipbb
avgntflt
ssmdrv

:commands
[reboot]

  • CAREFUL NOW! You must click the Run Fix button, NOT the Run Scan!
  • If it asks to reboot the computer, please allow that.
  • Finally, post the contents of the log. (Located at C:\_OTL\Moved Files)


====================

Please download SpiderKill by DragonMaster Jay and save it to your Desktop.
  • Right-click on SpiderKill.zip and click Extract All. Follow the prompts and read carefully, to save it to your Desktop.
  • Double-click on the SpiderKill folder, and then double-click on SpiderKill.bat and follow all the prompts in the program.
  • Within a minute, it will save its log titled SpiderKill.txt. Please post that in your next reply. You may have to use two or three posts to be able to fit the information in.


====================

Download and run SVCHOST Diag by DragonMaster Jay.

Post the log from it when it launches.

descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

more_horiz
========== OTL ==========
Prefs.js: "127.0.0.1" removed from network.proxy.http
Prefs.js: 54828 removed from network.proxy.http_port
File boot] not found.

OTL by OldTimer - Version 3.2.45.0 log created on 06132012_101954



SpiderKill by DragonMaster Jay


Microsoft Windows [Version 6.0.6001]

********************Drivers list********************


Volume in drive C is SQ004585V03
Volume Serial Number is 90D3-0EF7

Directory of C:\Windows\System32\Drivers

06/10/2012 03:03 PM .
06/10/2012 03:03 PM ..
11/06/2007 04:42 PM 2 1179_Toshiba_Satellite A200-A205_26890.MRK
11/02/2006 04:55 AM 53,376 1394bus.sys
01/19/2008 12:43 AM 266,808 acpi.sys
11/02/2006 05:51 AM 420,968 adp94xx.sys
11/02/2006 05:51 AM 297,576 adpahci.sys
11/02/2006 05:50 AM 98,408 adpu160m.sys
11/02/2006 05:51 AM 147,048 adpu320.sys
04/21/2011 09:16 AM 273,408 afd.sys
11/02/2006 05:49 AM 53,864 AGP440.sys
11/28/2006 07:11 PM 1,161,888 AGRSM.sys
11/02/2006 05:49 AM 14,952 aliide.sys
11/02/2006 05:49 AM 54,888 AMDAGP.SYS
11/02/2006 05:49 AM 15,464 amdide.sys
11/02/2006 04:30 AM 38,912 amdk7.sys
11/02/2006 04:30 AM 40,960 amdk8.sys
11/02/2006 05:50 AM 67,688 arc.sys
11/02/2006 05:50 AM 67,688 arcsas.sys
03/06/2012 07:01 PM 20,696 aswFsBlk.sys
03/06/2012 07:01 PM 57,688 aswMonFlt.sys
03/06/2012 07:02 PM 35,672 aswRdr.sys
03/06/2012 07:03 PM 612,184 aswSnx.sys
03/06/2012 07:03 PM 337,880 aswSP.sys
03/06/2012 07:01 PM 53,848 aswTdi.sys
01/18/2008 10:56 PM 17,408 asyncmac.sys
01/19/2008 12:41 AM 21,560 atapi.sys
01/19/2008 12:43 AM 110,136 ataport.sys
05/11/2009 12:49 PM 51,992 avgntdd.sys
06/30/2011 01:20 PM 66,616 avgntflt.sys
05/11/2009 12:49 PM 17,016 avgntmgr.sys
06/30/2011 01:20 PM 138,192 avipbb.sys
01/19/2008 12:41 AM 28,216 battc.sys
01/18/2008 10:53 PM 12,288 bdasup.sys
01/18/2008 10:49 PM 6,144 beep.sys
02/22/2011 08:51 AM 69,632 bowser.sys
11/02/2006 04:24 AM 13,568 BrFiltLo.sys
11/02/2006 04:24 AM 5,248 BrFiltUp.sys
01/18/2008 11:58 PM 93,696 bridge.sys
11/02/2006 04:25 AM 71,808 BrSerId.sys
11/02/2006 04:24 AM 62,336 BrSerWdm.sys
11/02/2006 04:24 AM 12,160 BrUsbMdm.sys
11/02/2006 04:24 AM 11,904 BrUsbSer.sys
11/02/2006 04:55 AM 39,936 bthmodem.sys
01/18/2008 10:28 PM 70,144 cdfs.sys
10/04/2006 10:42 PM 2,432 cdr4_xp.sys
10/04/2006 10:42 PM 2,560 cdralw2k.sys
01/18/2008 10:49 PM 67,072 cdrom.sys
11/02/2006 04:55 AM 35,328 circlass.sys
01/19/2008 12:43 AM 127,544 Classpnp.sys
01/18/2008 10:32 PM 14,208 CmBatt.sys
11/02/2006 05:49 AM 16,488 cmdide.sys
01/19/2008 12:41 AM 20,792 compbatt.sys
01/19/2008 12:42 AM 36,408 crashdmp.sys
11/02/2006 05:49 AM 22,632 crcdisk.sys
11/02/2006 04:30 AM 38,912 crusoe.sys
12/11/2007 05:47 PM 50 DCX.LOG
04/14/2011 10:24 AM 75,264 dfsc.sys
01/19/2008 12:42 AM 55,352 disk.sys
01/18/2008 10:49 PM 19,968 Diskdump.sys
11/02/2006 05:50 AM 71,272 djsvs.sys
01/18/2008 11:53 PM 130,048 drmk.sys
01/18/2008 10:53 PM 5,632 drmkaud.sys
01/19/2008 12:41 AM 29,240 Dumpata.sys
01/18/2008 10:36 PM 13,312 dxapi.sys
01/18/2008 10:36 PM 76,288 dxg.sys
08/01/2008 09:01 PM 625,152 dxgkrnl.sys
11/02/2006 03:30 AM 117,760 E1G60I32.sys
01/19/2008 12:42 AM 143,416 ecache.sys
11/02/2006 05:51 AM 316,520 elxstor.sys
01/28/2011 05:00 PM en-US
06/08/2012 01:18 AM etc
01/18/2008 10:28 PM 136,192 exfat.sys
01/18/2008 10:28 PM 143,360 fastfat.sys
11/02/2006 04:51 AM 25,088 fdc.sys
01/19/2008 12:42 AM 58,936 fileinfo.sys
01/18/2008 10:30 PM 27,648 filetrace.sys
11/02/2006 04:51 AM 20,480 flpydisk.sys
01/19/2008 12:42 AM 192,056 fltMgr.sys
01/18/2008 10:27 PM 12,800 fs_rec.sys
11/20/2006 02:11 AM 7,168 FwLnk.sys
01/19/2008 12:43 AM 101,432 FWPKCLNT.SYS
11/02/2006 05:50 AM 58,984 GAGP30KX.SYS
09/18/2006 05:26 PM 3,440,660 gm.dls
09/18/2006 05:26 PM 646 gmreadme.txt
01/18/2008 09:30 PM 53,760 hdaudbus.sys
11/02/2006 03:36 AM 235,520 HdAudio.sys
11/02/2006 04:55 AM 29,184 hidbth.sys
01/18/2008 10:53 PM 38,912 hidclass.sys
11/02/2006 04:55 AM 21,504 hidir.sys
01/18/2008 10:53 PM 25,472 hidparse.sys
01/18/2008 10:53 PM 12,288 hidusb.sys
11/02/2006 05:50 AM 37,480 HpCISSs.sys
02/20/2010 05:18 PM 411,136 http.sys
11/02/2006 05:49 AM 16,488 i2omgmt.sys
11/02/2006 05:49 AM 27,752 i2omp.sys
01/18/2008 10:49 PM 54,784 i8042prt.sys
11/02/2006 05:51 AM 232,040 iaStorV.sys
09/13/2007 07:23 PM 1,925,632 igdkmd32.sys
11/02/2006 05:50 AM 41,576 iirsp.sys
01/19/2008 12:41 AM 17,976 intelide.sys
01/18/2008 10:27 PM 41,472 intelppm.sys
01/18/2008 10:56 PM 47,616 ipfltdrv.sys
11/02/2006 04:42 AM 65,536 IPMIDrv.sys
01/18/2008 10:56 PM 100,864 ipnat.sys
01/18/2008 10:55 PM 95,744 irda.sys
01/18/2008 10:55 PM 13,312 irenum.sys
11/02/2006 05:50 AM 47,208 isapnp.sys
11/02/2006 05:50 AM 35,944 iteatapi.sys
11/02/2006 05:50 AM 35,944 iteraid.sys
01/19/2008 12:41 AM 35,384 kbdclass.sys
01/18/2008 10:49 PM 15,872 kbdhid.sys
11/09/2006 02:32 AM 219,264 KR10I.sys
11/09/2006 02:31 AM 211,072 KR10N.sys
09/27/2006 08:06 AM 479,488 kr3npxp.sys
01/18/2008 10:49 PM 148,992 ks.sys
06/15/2009 02:20 PM 439,896 ksecdd.sys
01/18/2008 10:55 PM 47,104 lltdio.sys
11/02/2006 05:50 AM 65,640 lsi_fc.sys
11/02/2006 05:50 AM 65,640 lsi_sas.sys
11/02/2006 05:50 AM 65,640 lsi_scsi.sys
01/18/2008 10:30 PM 84,480 luafv.sys
04/04/2012 03:56 PM 22,344 mbam.sys
01/18/2008 10:50 PM 18,944 mcd.sys
11/02/2006 05:49 AM 28,776 megasas.sys
01/18/2008 10:57 PM 31,744 modem.sys
01/18/2008 10:52 PM 41,984 monitor.sys
01/19/2008 12:41 AM 34,360 mouclass.sys
01/18/2008 10:49 PM 15,872 mouhid.sys
01/19/2008 12:42 AM 57,400 mountmgr.sys
11/02/2006 05:50 AM 78,952 mpio.sys
01/18/2008 10:54 PM 64,000 mpsdrv.sys
11/02/2006 05:49 AM 33,384 Mraid35x.sys
01/18/2008 10:28 PM 110,080 mrxdav.sys
04/29/2011 08:49 AM 105,984 mrxsmb.sys
07/06/2011 10:56 AM 213,504 mrxsmb10.sys
04/29/2011 08:49 AM 79,360 mrxsmb20.sys
01/19/2008 12:41 AM 28,728 msahci.sys
11/02/2006 05:50 AM 80,488 msdsm.sys
01/18/2008 10:28 PM 22,528 msfs.sys
01/05/2008 04:31 AM 3 MsftWdf_Kernel_01007_Inbox_Critical.Wdf
11/06/2007 06:30 PM 0 Msft_Kernel_SynTP_01000.Wdf
03/01/2011 03:45 PM 0 Msft_User_WpdFs_01_00_00.Wdf
01/19/2008 12:41 AM 16,440 msisadrv.sys
01/19/2008 12:42 AM 181,304 msiscsi.sys
01/18/2008 10:49 PM 8,192 mskssrv.sys
01/18/2008 10:49 PM 5,888 mspclock.sys
01/18/2008 10:49 PM 5,504 mspqm.sys
01/19/2008 12:42 AM 163,384 msrpc.sys
01/19/2008 12:41 AM 31,288 mssmbios.sys
01/18/2008 10:49 PM 6,016 mstee.sys
01/19/2008 12:42 AM 49,720 mup.sys
01/19/2008 12:43 AM 529,464 ndis.sys
01/18/2008 10:56 PM 20,992 ndistapi.sys
01/18/2008 10:55 PM 16,896 ndisuio.sys
01/18/2008 10:56 PM 121,344 ndiswan.sys
01/18/2008 10:56 PM 49,664 ndproxy.sys
01/18/2008 10:55 PM 35,840 netbios.sys
01/18/2008 10:55 PM 184,320 netbt.sys
01/19/2008 12:42 AM 223,288 netio.sys
11/02/2006 05:50 AM 45,160 nfrd960.sys
01/18/2008 10:28 PM 34,816 npfs.sys
01/18/2008 10:55 PM 16,384 nsiproxy.sys
01/19/2008 12:43 AM 1,081,912 ntfs.sys
11/02/2006 03:36 AM 20,608 ntrigdigi.sys
01/18/2008 10:49 PM 4,608 null.sys
11/02/2006 05:50 AM 88,680 nvraid.sys
11/02/2006 05:50 AM 40,040 nvstor.sys
11/02/2006 05:50 AM 106,600 NV_AGP.SYS
05/19/2008 10:07 PM 148,480 nwifi.sys
11/02/2006 04:55 AM 62,080 ohci1394.sys
04/04/2008 09:21 PM 72,192 pacer.sys
11/02/2006 04:51 AM 79,360 parport.sys
01/19/2008 12:42 AM 56,376 partmgr.sys
11/02/2006 04:51 AM 8,704 parvdm.sys
01/19/2008 12:42 AM 151,096 pci.sys
11/02/2006 05:49 AM 13,416 pciide.sys
01/19/2008 12:42 AM 45,112 pciidex.sys
11/02/2006 05:51 AM 167,528 pcmcia.sys
11/02/2006 05:04 AM 878,080 PEAuth.sys
01/18/2008 10:53 PM 167,936 portcls.sys
11/02/2006 04:30 AM 38,400 processr.sys
09/27/2006 05:53 PM 36,560 pxhelp20.sys
11/02/2006 05:51 AM 900,712 ql2300.sys
11/02/2006 05:50 AM 106,088 ql40xx.sys
01/18/2008 10:56 PM 31,232 qwavedrv.sys
01/18/2008 10:56 PM 11,776 rasacd.sys
01/18/2008 10:56 PM 76,288 rasl2tp.sys
01/18/2008 10:56 PM 41,472 raspppoe.sys
01/18/2008 10:56 PM 62,976 raspptp.sys
01/18/2008 10:56 PM 69,120 rassstp.sys
01/18/2008 10:28 PM 224,768 rdbss.sys
01/18/2008 11:01 PM 6,144 RDPCDD.sys
11/02/2006 05:03 AM 242,688 rdpdr.sys
01/18/2008 11:01 PM 6,144 RDPENCDD.sys
01/18/2008 11:01 PM 181,248 rdpwd.sys
05/09/2008 09:33 PM 113,664 rmcast.sys
01/18/2008 10:56 PM 33,280 RNDISMP.sys
01/18/2008 10:57 PM 8,192 rootmdm.sys
01/18/2008 10:55 PM 60,416 rspndr.sys
03/12/2007 01:27 PM 176 RTHDAEQ0.dat
03/12/2007 01:27 PM 176 RTHDAEQ1.dat
03/15/2007 01:29 PM 176 RTHDAEQ2.dat
03/15/2007 01:29 PM 176 RTHDAEQ3.dat
04/25/2007 09:03 PM 1,771,944 RTKVHDA.sys
06/01/2007 05:07 PM 252,416 rtl8187B.sys
11/02/2006 03:30 AM 44,544 Rtlh86.sys
11/02/2006 05:50 AM 76,392 sbp2port.sys
01/19/2008 12:42 AM 142,904 scsiport.sys
11/06/2007 06:02 PM 82,432 sdbus.sys
11/02/2006 02:37 AM 20,480 secdrv.sys
11/02/2006 04:51 AM 17,920 serenum.sys
11/02/2006 04:51 AM 83,456 serial.sys
01/18/2008 10:49 PM 19,968 sermouse.sys
11/02/2006 04:51 AM 13,312 sffdisk.sys
11/02/2006 04:51 AM 12,800 sffp_mmc.sys
11/02/2006 04:51 AM 12,800 sffp_sd.sys
11/02/2006 04:51 AM 13,312 sfloppy.sys
10/01/2011 09:30 AM 579,944 Sftfslh.sys
10/01/2011 09:30 AM 194,408 Sftplaylh.sys
10/01/2011 09:30 AM 21,864 Sftredirlh.sys
10/01/2011 09:30 AM 19,304 Sftvollh.sys
11/02/2006 05:49 AM 53,352 SISAGP.SYS
11/02/2006 05:50 AM 38,504 sisraid2.sys
11/02/2006 05:50 AM 71,784 sisraid4.sys
01/18/2008 10:55 PM 66,560 smb.sys
01/18/2008 10:49 PM 17,408 smclib.sys
01/19/2008 12:41 AM 21,048 spldr.sys
01/18/2008 09:10 PM 681,984 spsys.sys
02/18/2011 09:31 AM 304,640 srv.sys
04/29/2011 08:49 AM 146,432 srv2.sys
04/29/2011 08:49 AM 102,400 srvnet.sys
05/11/2009 10:12 AM 28,520 ssmdrv.sys
01/19/2008 12:43 AM 123,960 Storport.sys
01/18/2008 10:53 PM 52,992 stream.sys
01/19/2008 12:41 AM 15,288 swenum.sys
11/02/2006 05:50 AM 35,944 symc8xx.sys
11/02/2006 05:49 AM 31,848 sym_hi.sys
11/02/2006 05:50 AM 34,920 sym_u3.sys
08/15/2007 09:03 PM 190,384 SynTP.sys
01/18/2008 10:49 PM 24,576 tape.sys
06/16/2010 11:59 AM 898,952 tcpip.sys
01/18/2008 10:56 PM 30,208 tcpipreg.sys
10/18/2006 03:50 PM 16,128 tdcmdpst.sys
01/18/2008 10:57 PM 20,992 tdi.sys
01/18/2008 11:01 PM 17,920 tdpipe.sys
01/18/2008 11:01 PM 29,184 tdtcp.sys
01/18/2008 10:56 PM 71,680 tdx.sys
01/19/2008 12:42 AM 54,328 termdd.sys
01/24/2007 06:44 PM 290,304 tifm21.sys
09/19/2007 02:59 PM 285,184 tos_sps32.sys
01/18/2008 11:01 PM 23,552 tssecsrv.sys
01/19/2008 01:55 AM 15,360 TUNMP.SYS
02/18/2010 07:52 AM 25,088 tunnel.sys
10/06/2006 02:22 AM 16,768 TVALZ_O.SYS
11/02/2006 05:49 AM 56,936 UAGP35.SYS
01/18/2008 10:28 PM 226,816 udfs.sys
11/02/2006 05:50 AM 58,472 ULIAGPKX.SYS
11/02/2006 05:51 AM 235,112 uliahci.sys
11/02/2006 05:50 AM 98,408 ulsata.sys
11/02/2006 05:50 AM 115,816 ulsata2.sys
01/18/2008 10:53 PM 34,816 umbus.sys
01/28/2011 04:51 PM UMDF
01/18/2008 10:53 PM 7,680 umpass.sys
01/18/2008 10:56 PM 15,872 usb8023.sys
01/18/2008 10:53 PM 25,728 USBCAMD.sys
01/18/2008 10:53 PM 25,728 USBCAMD2.sys
01/18/2008 10:53 PM 73,216 usbccgp.sys
11/02/2006 04:55 AM 68,608 usbcir.sys
01/18/2008 10:53 PM 5,888 usbd.sys
01/18/2008 10:53 PM 39,424 usbehci.sys
01/18/2008 10:53 PM 194,560 usbhub.sys
11/02/2006 04:55 AM 19,456 usbohci.sys
01/18/2008 10:53 PM 226,304 usbport.sys
01/18/2008 11:14 PM 18,944 usbprint.sys
01/18/2008 11:14 PM 35,328 usbscan.sys
01/18/2008 10:53 PM 55,296 USBSTOR.SYS
01/18/2008 10:53 PM 23,552 usbuhci.sys
11/02/2006 04:55 AM 132,352 usbvideo.sys
01/18/2008 10:52 PM 25,088 vga.sys
01/18/2008 10:52 PM 26,112 vgapnp.sys
11/02/2006 05:49 AM 54,376 VIAAGP.SYS
11/02/2006 04:30 AM 39,424 viac7.sys
11/02/2006 05:49 AM 17,512 viaide.sys
01/18/2008 10:52 PM 110,080 videoprt.sys
01/19/2008 12:42 AM 52,792 volmgr.sys
01/19/2008 12:43 AM 294,456 volmgrx.sys
01/19/2008 12:42 AM 227,896 volsnap.sys
11/02/2006 05:50 AM 112,232 vsmraid.sys
11/02/2006 04:52 AM 20,608 wacompen.sys
01/18/2008 10:56 PM 62,464 wanarp.sys
01/18/2008 10:35 PM 32,768 watchdog.sys
11/02/2006 05:49 AM 19,560 wd.sys
01/19/2008 12:43 AM 503,864 Wdf01000.sys
01/19/2008 12:42 AM 35,896 WdfLdr.sys
11/02/2006 04:35 AM 11,264 wmiacpi.sys
01/19/2008 12:41 AM 17,976 wmilib.sys
01/18/2008 11:04 PM 39,936 WpdUsb.sys
01/18/2008 10:56 PM 15,872 ws2ifsl.sys
01/18/2008 10:52 PM 51,200 WUDFPf.sys
01/18/2008 10:53 PM 83,328 WUDFRd.sys
01/09/2007 02:00 PM 221,696 yk60x86.sys
297 File(s) 36,292,705 bytes

Directory of C:\Windows\System32\Drivers\en-US

01/28/2011 05:00 PM .
01/28/2011 05:00 PM ..
11/02/2006 08:41 AM 9,728 acpi.sys.mui
11/02/2006 08:41 AM 8,704 afd.sys.mui
11/02/2006 08:41 AM 3,072 AGP440.sys.mui
11/02/2006 08:41 AM 3,072 AMDAGP.SYS.mui
11/02/2006 08:40 AM 2,560 amdide.sys.mui
11/02/2006 08:40 AM 14,848 amdk7.sys.mui
11/02/2006 08:40 AM 14,848 amdk8.sys.mui
11/02/2006 08:41 AM 3,072 ati2mpad.sys.mui
11/02/2006 08:41 AM 3,584 ati2mtag.sys.mui
11/02/2006 08:40 AM 3,072 atikmdag.sys.mui
01/19/2008 12:30 AM 5,120 b57nd60x.sys.mui
11/02/2006 08:40 AM 7,680 battc.sys.mui
11/02/2006 08:40 AM 5,120 bcm4sbxp.sys.mui
11/02/2006 08:40 AM 2,560 BrParwdm.sys.mui
11/02/2006 08:41 AM 10,240 BrSerId.sys.mui
11/02/2006 08:40 AM 5,120 bthpan.sys.mui
11/02/2006 08:41 AM 7,168 bthport.sys.mui
11/02/2006 08:41 AM 3,072 cmbp0wdm.sys.mui
11/02/2006 08:40 AM 14,848 crusoe.sys.mui
11/02/2006 08:41 AM 3,072 cxbp0wdm.sys.mui
11/02/2006 08:40 AM 3,072 Dot4usb.sys.mui
11/02/2006 08:40 AM 4,096 dxgkrnl.sys.mui
11/02/2006 08:41 AM 5,120 e100b325.sys.mui
01/19/2008 12:37 AM 19,968 e1e6032.sys.mui
01/19/2008 12:40 AM 16,896 E1G60I32.sys.mui
11/02/2006 08:40 AM 5,120 fltmgr.sys.mui
11/02/2006 08:40 AM 3,072 GAGP30KX.SYS.mui
11/02/2006 08:41 AM 3,584 gpr400.sys.mui
11/02/2006 08:41 AM 4,096 grserial.sys.mui
11/02/2006 08:41 AM 3,584 hidbth.sys.mui
11/03/2009 06:18 PM 36,864 http.sys.mui
11/02/2006 08:41 AM 10,752 i8042prt.sys.mui
11/02/2006 08:40 AM 14,848 intelppm.sys.mui
11/02/2006 08:41 AM 6,144 IPMIDrv.sys.mui
11/02/2006 08:41 AM 4,096 ipnat.sys.mui
11/02/2006 08:41 AM 4,096 isapnp.sys.mui
11/02/2006 08:41 AM 4,608 kbdclass.sys.mui
11/02/2006 08:41 AM 3,072 kbdhid.sys.mui
11/02/2006 08:41 AM 9,728 ltmdmnt.sys.mui
01/19/2008 12:30 AM 6,656 luafv.sys.mui
11/02/2006 08:41 AM 4,096 modem.sys.mui
11/02/2006 08:41 AM 4,608 mouclass.sys.mui
11/02/2006 08:41 AM 3,072 mouhid.sys.mui
01/19/2008 12:44 AM 20,480 mpio.sys.mui
11/02/2006 08:41 AM 4,096 msdsm.sys.mui
11/02/2006 08:41 AM 3,584 mssmbios.sys.mui
11/02/2006 08:41 AM 65,536 ntfs.sys.mui
11/02/2006 08:40 AM 4,096 ntrigdigi.sys.mui
11/02/2006 08:41 AM 5,120 nv4_mini.sys.mui
11/02/2006 08:41 AM 3,072 NV_AGP.SYS.mui
11/02/2006 08:40 AM 12,288 ohci1394.sys.mui
11/02/2006 08:41 AM 3,584 pacer.sys.mui
11/02/2006 08:40 AM 4,096 parport.sys.mui
11/02/2006 08:40 AM 3,072 parvdm.sys.mui
11/02/2006 08:41 AM 8,704 pci.sys.mui
11/02/2006 08:41 AM 4,608 pcmcia.sys.mui
11/02/2006 08:41 AM 3,072 pnpmem.sys.mui
11/02/2006 08:40 AM 14,848 processr.sys.mui
11/02/2006 08:41 AM 4,096 pscr.sys.mui
11/02/2006 08:41 AM 3,072 qwavedrv.sys.mui
11/02/2006 08:40 AM 3,584 RNDISMP.sys.mui
11/02/2006 08:41 AM 3,584 rndismpx.sys.mui
11/02/2006 08:41 AM 4,096 scmstcs.sys.mui
11/02/2006 08:41 AM 4,096 SCR111.sys.mui
11/02/2006 08:41 AM 3,584 scsiport.sys.mui
11/02/2006 08:40 AM 10,752 serial.sys.mui
11/02/2006 08:41 AM 5,632 sermouse.sys.mui
11/02/2006 08:41 AM 3,072 serscan.sys.mui
11/02/2006 08:41 AM 3,072 SISAGP.SYS.mui
11/02/2006 08:41 AM 3,072 srv.sys.mui
11/02/2006 08:41 AM 3,072 stcusb.sys.mui
01/19/2008 12:34 AM 5,120 tpm.sys.mui
11/02/2006 08:40 AM 3,072 UAGP35.SYS.mui
11/02/2006 08:41 AM 3,072 ULIAGPKX.SYS.mui
11/02/2006 08:40 AM 3,584 umbus.sys.mui
11/02/2006 08:41 AM 3,072 VIAAGP.SYS.mui
11/02/2006 08:40 AM 14,848 viac7.sys.mui
01/19/2008 12:36 AM 32,768 volsnap.sys.mui
11/02/2006 08:41 AM 4,608 wacompen.sys.mui
11/02/2006 08:41 AM 2,560 wd.sys.mui
01/19/2008 12:33 AM 3,072 wdf01000.sys.mui
11/02/2006 08:41 AM 5,632 yk60x86.sys.mui
82 File(s) 608,256 bytes

Directory of C:\Windows\System32\Drivers\etc

06/08/2012 01:18 AM .
06/08/2012 01:18 AM ..
06/08/2012 01:18 AM 27 hosts
09/18/2006 05:41 PM 3,683 lmhosts.sam
09/18/2006 05:41 PM 407 networks
09/18/2006 05:41 PM 1,358 protocol
09/18/2006 05:41 PM 17,244 services
5 File(s) 22,719 bytes

Directory of C:\Windows\System32\Drivers\UMDF

01/28/2011 04:51 PM .
01/28/2011 04:51 PM ..
11/02/2006 08:42 AM en-US
11/11/2007 11:13 AM 0 Msft_User_WpdFs_01_00_00.Wdf
03/24/2010 02:24 PM 0 Msft_User_WpdMtpDr_01_00_00.Wdf
01/19/2008 12:37 AM 220,160 WpdFs.dll
01/19/2008 12:37 AM 664,576 WpdMtpDr.dll
4 File(s) 884,736 bytes

Directory of C:\Windows\System32\Drivers\UMDF\en-US

11/02/2006 08:42 AM .
11/02/2006 08:42 AM ..
11/02/2006 08:40 AM 6,144 WpdMtpDr.dll.mui
1 File(s) 6,144 bytes

Total Files Listed:
389 File(s) 37,814,560 bytes
14 Dir(s) 64,430,985,216 bytes free


***********************Hidden Drivers********************
Volume in drive C is SQ004585V03
Volume Serial Number is 90D3-0EF7

Directory of C:\Windows\System32\Drivers

03/31/2008 03:55 PM 4 taishop.sys
1 File(s) 4 bytes
0 Dir(s) 64,430,993,408 bytes free


*********************Processes*******************


PROCESS PID PRIO PATH
Dwm.exe 1796 High C:\Windows\system32\Dwm.exe
Explorer.EXE 1816 Normal C:\Windows\Explorer.EXE
taskeng.exe 2040 Normal C:\Windows\system32\taskeng.exe
igfxpers.exe 472 Normal C:\Windows\System32\igfxpers.exe
RtHDVCpl.exe 896 Normal C:\Windows\RtHDVCpl.exe
SynTPStart.exe 2452 Normal C:\Program Files\Synaptics\SynTP\SynTPStart.exe
GoogleDesktop.exe 2868 Normal C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
realsched.exe 3040 Normal C:\Program Files\Common Files\Real\Update_OB\realsched.exe
AvastUI.exe 3100 Normal C:\Program Files\AVAST Software\Avast\AvastUI.exe
ONENOTEM.EXE 3116 Normal C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
SynToshiba.exe 3544 Normal C:\Program Files\Synaptics\SynTP\SynToshiba.exe
unsecapp.exe 3940 Normal C:\Windows\system32\wbem\unsecapp.exe
firefox.exe 3852 Normal C:\Program Files\Mozilla Firefox\firefox.exe
plugin-container.exe 2808 Normal C:\Program Files\Mozilla Firefox\plugin-container.exe
RealPlay.exe 2788 Idle C:\Program Files\Real\RealPlayer\RealPlay.exe
wuauclt.exe 1216 Normal C:\Windows\system32\wuauclt.exe
cmd.exe 544 Normal C:\Windows\system32\cmd.exe
processes.exe 2340 Normal C:\Users\JonEJet\Desktop\SpiderKill\SpiderKill\processes.exe


*********************Modules of explorer.exe and svchost.exe*******************
Module information for 'Explorer.EXE'(1816)
MODULE BASE SIZE PATH
Explorer.EXE 490000 2936832 C:\Windows\Explorer.EXE 6.0.6000.16386 (vista_rtm.061101-2205) Windows Explorer
ntdll.dll 77600000 1212416 C:\Windows\system32\ntdll.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) NT Layer DLL
kernel32.dll 77380000 901120 C:\Windows\system32\kernel32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows NT BASE API Client DLL
snxhk.dll 75d00000 225280 C:\Program Files\AVAST Software\Avast\snxhk.dll 7.0.1426.0 avast! snxhk
ADVAPI32.dll 77070000 811008 C:\Windows\system32\ADVAPI32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Advanced Windows 32 Base API
RPCRT4.dll 77530000 794624 C:\Windows\system32\RPCRT4.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Remote Procedure Call Runtime
GDI32.dll 75e70000 307200 C:\Windows\system32\GDI32.dll 6.0.6001.18159 (vistasp1_gdr.081020-1655) GDI Client DLL
USER32.dll 76fb0000 643072 C:\Windows\system32\USER32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Multi-User Windows USER API Client DLL
msvcrt.dll 769d0000 696320 C:\Windows\system32\msvcrt.dll 7.0.6001.18000 (longhorn_rtm.080118-1840) Windows NT CRT DLL
SHLWAPI.dll 76f50000 360448 C:\Windows\system32\SHLWAPI.dll 6.0.6000.16386 (vista_rtm.061101-2205) Shell Light-weight Utility Library
SHELL32.dll 75ec0000 11599872 C:\Windows\system32\SHELL32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Shell Common Dll
ole32.dll 76d40000 1327104 C:\Windows\system32\ole32.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft OLE for Windows
OLEAUT32.dll 76b10000 577536 C:\Windows\system32\OLEAUT32.dll 6.0.6001.18565 6.0.6001.18565
SHDOCVW.dll 6ff50000 1077248 C:\Windows\system32\SHDOCVW.dll 6.0.6000.16386 (vista_rtm.061101-2205) Shell Doc Object and Control Library
UxTheme.dll 74bd0000 258048 C:\Windows\system32\UxTheme.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft UxTheme Library
POWRPROF.dll 75130000 106496 C:\Windows\system32\POWRPROF.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Power Profile Helper DLL
dwmapi.dll 71780000 49152 C:\Windows\system32\dwmapi.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Microsoft Desktop Window Manager API
gdiplus.dll 73830000 1748992 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll 5.2.6001.18551 (vistasp1_gdr.101104-0637) Microsoft GDI+
slc.dll 75710000 237568 C:\Windows\system32\slc.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Software Licensing Client Dll
PROPSYS.dll 736f0000 765952 C:\Windows\system32\PROPSYS.dll 7.0.6001.16503 (longhorn(wmbla).080526-2159) Microsoft Property System
BROWSEUI.dll 6fd70000 1335296 C:\Windows\system32\BROWSEUI.dll 6.0.6000.16386 (vista_rtm.061101-2205) Shell Browser UI Library
IMM32.dll 77050000 122880 C:\Windows\system32\IMM32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Multi-User Windows IMM32 API Client DLL
MSCTF.dll 77460000 819200 C:\Windows\system32\MSCTF.dll 6.0.6000.16386 (vista_rtm.061101-2205) MSCTF Server DLL
DUser.dll 74fc0000 196608 C:\Windows\system32\DUser.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows DirectUser Engine
LPK.DLL 76e90000 36864 C:\Windows\system32\LPK.DLL 6.0.6001.18000 (longhorn_rtm.080118-1840) Language Pack
USP10.dll 76a80000 512000 C:\Windows\system32\USP10.dll 1.0626.6001.18461 (vistasp1_gdr.100416-0345) Uniscribe Unicode script processor
comctl32.dll 74c10000 1695744 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll 5.82 (longhorn_rtm.080118-1840) Common Controls Library
WindowsCodecs.dll 71ce0000 733184 C:\Windows\system32\WindowsCodecs.dll 6.0.6001.18131 (vistasp1_gdr.080827-1507) Microsoft Windows Codecs Library
apphelp.dll 75be0000 180224 C:\Windows\system32\apphelp.dll 6.0.6000.16386 (vista_rtm.061101-2205) Application Compatibility Client Library
CLBCatQ.DLL 77730000 540672 C:\Windows\system32\CLBCatQ.DLL 2001.12.6931.18000 (longhorn_rtm.080118-1840) COM+ Configuration Catalog
ashShell.dll 6fce0000 139264 C:\Program Files\AVAST Software\Avast\ashShell.dll 7.0.1426.0 avast! Shell Extension
msi.dll 6fad0000 2105344 C:\Windows\system32\msi.dll 4.0.6001.18000 Windows Installer
IconCodecService.dll 6fab0000 24576 C:\Windows\system32\IconCodecService.dll 6.0.6000.16386 (vista_rtm.061101-2205) Converts a PNG part of the icon to a legacy bmp icon
Secur32.dll 75cc0000 81920 C:\Windows\system32\Secur32.dll 6.0.6001.18272 (vistasp1_gdr.090615-0258) Security Support Provider Interface
rsaenh.dll 751d0000 241664 C:\Windows\system32\rsaenh.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Microsoft Enhanced Cryptographic Provider
timedate.cpl 6f770000 729088 C:\Windows\system32\timedate.cpl 6.0.6001.18000 (longhorn_rtm.080118-1840) Time Date Control Panel Applet
ATL.DLL 736a0000 81920 C:\Windows\system32\ATL.DLL 3.05.2284 ATL Module for Windows XP (Unicode)
NETAPI32.dll 75950000 479232 C:\Windows\system32\NETAPI32.dll 6.0.6001.18157 (vistasp1_gdr.081015-1604) Net Win32 API DLL
PSAPI.DLL 75e60000 28672 C:\Windows\system32\PSAPI.DLL 6.0.6000.16386 (vista_rtm.061101-2205) Process Status Helper
OLEACC.dll 737f0000 233472 C:\Windows\system32\OLEACC.dll 4.2.5406.0 (longhorn_rtm.080118-1840) Active Accessibility Core Component
actxprxy.dll 6f660000 339968 C:\Windows\System32\actxprxy.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) ActiveX Interface Marshaling Library
USERENV.dll 75ce0000 122880 C:\Windows\system32\USERENV.dll 6.0.6000.16386 (vista_rtm.061101-2205) Userenv
wmpband.dll 6fd20000 110592 C:\PROGRA~1\WI4EB4~1\wmpband.dll 11.0.6000.6324 (vista_rtm.061101-2205) Windows Media Player Deskband
MPR.dll 75860000 81920 C:\Windows\system32\MPR.dll 6.0.6000.16386 (vista_rtm.061101-2205) Multiple Provider Router DLL
WINBRAND.dll 75290000 880640 C:\Windows\system32\WINBRAND.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Branding Resources
shacct.dll 737b0000 90112 C:\Windows\System32\shacct.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Shell Accounts Classes
SAMLIB.dll 758e0000 69632 C:\Windows\System32\SAMLIB.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) SAM Library DLL
msshsq.dll 6f9b0000 245760 C:\Windows\System32\msshsq.dll 7.00.6001.18528 (vistasp1_gdr_oobsvc.100919-1500) Structured Query
NaturalLanguage6.dll 6f150000 811008 C:\Windows\System32\NaturalLanguage6.dll 6.0.6001.18098 (vistasp1_gdr.080625-1507) Natural Language Development Platform 6
CRYPT32.dll 75760000 987136 C:\Windows\System32\CRYPT32.dll 6.0.6000.16386 (vista_rtm.061101-2205) Crypto API32
MSASN1.dll 758c0000 73728 C:\Windows\System32\MSASN1.dll 6.0.6001.18326 (vistasp1_gdr.090903-2340) ASN.1 Runtime APIs
authui.dll 73b90000 1998848 C:\Windows\system32\authui.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Authentication UI
MSIMG32.dll 750a0000 20480 C:\Windows\system32\MSIMG32.dll 6.0.6000.16386 (vista_rtm.061101-2205) GDIEXT Client DLL
LINKINFO.dll 6fd50000 36864 C:\Windows\system32\LINKINFO.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Volume Tracking
urlmon.dll 77250000 1220608 C:\Windows\system32\urlmon.dll 7.00.6001.18000 (longhorn_rtm.080118-1840) OLE32 Extensions for Win32
iertutil.dll 77810000 286720 C:\Windows\system32\iertutil.dll 7.00.6001.18639 (vistasp1_gdr.110421-0338) Run time utility for Internet Explorer
NTMARTA.DLL 75150000 135168 C:\Windows\system32\NTMARTA.DLL 6.0.6000.16386 (vista_rtm.061101-2205) Windows NT MARTA provider
WLDAP32.dll 777c0000 303104 C:\Windows\system32\WLDAP32.dll 6.0.6000.16386 (vista_rtm.061101-2205) Win32 LDAP API DLL
WS2_32.dll 76ea0000 184320 C:\Windows\system32\WS2_32.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Socket 2.0 32-Bit DLL
NSI.dll 76b00000 24576 C:\Windows\system32\NSI.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) NSI User-mode interface DLL
ieframe.dll 6d9c0000 6094848 C:\Windows\system32\ieframe.dll 7.00.6000.16386 (vista_rtm.061101-2205) Internet Explorer
WINMM.dll 73a10000 204800 C:\Windows\system32\WINMM.dll 6.0.6000.16386 (vista_rtm.061101-2205) MCI API DLL
wdmaud.drv 739e0000 192512 C:\Windows\system32\wdmaud.drv 6.0.6000.16386 (vista_rtm.061101-2205) Winmm audio system driver
ksuser.dll 74b10000 16384 C:\Windows\system32\ksuser.dll 6.0.6000.16386 (vista_rtm.061101-2205) User CSA Library
MMDevAPI.DLL 74ba0000 159744 C:\Windows\system32\MMDevAPI.DLL 6.0.6000.16386 (vista_rtm.061101-2205) MMDevice API
AVRT.dll 75090000 28672 C:\Windows\system32\AVRT.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Multimedia Realtime Runtime
thumbcache.dll 6d610000 90112 C:\Windows\system32\thumbcache.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft Thumbnail Cache
ntshrui.dll 6d390000 303104 C:\Windows\system32\ntshrui.dll 6.0.6000.16386 (vista_rtm.061101-2205) Shell extensions for sharing
SETUPAPI.dll 76bb0000 1613824 C:\Windows\system32\SETUPAPI.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Setup API
cscapi.dll 6f520000 45056 C:\Windows\system32\cscapi.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Offline Files Win32 API
WINTRUST.dll 74b40000 184320 C:\Windows\system32\WINTRUST.dll 6.0.6001.18387 (vistasp1_gdr.091222-2238) Microsoft Trust Verification APIs
imagehlp.dll 77220000 167936 C:\Windows\system32\imagehlp.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows NT Image Helper
msiltcfg.dll 6df90000 28672 C:\Windows\system32\msiltcfg.dll 4.0.6000.16386 (vista_rtm.061101-2205) Windows Installer Configuration API Stub
VERSION.dll 75110000 32768 C:\Windows\system32\VERSION.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Version Checking and File Installation Libraries
ExplorerFrame.dll 6d7a0000 36864 C:\Windows\system32\ExplorerFrame.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) ExplorerFrame
WININET.dll 77140000 856064 C:\Windows\system32\WININET.dll 7.00.6000.16386 (vista_rtm.061101-2205) Internet Extensions for Win32
Normaliz.dll 76ba0000 12288 C:\Windows\system32\Normaliz.dll 6.0.6000.16386 (vista_rtm.061101-2205) Unicode Normalization DLL
AUDIOSES.DLL 736c0000 135168 C:\Windows\system32\AUDIOSES.DLL 6.0.6001.18000 (longhorn_rtm.080118-1840) Audio Session
audioeng.dll 720e0000 417792 C:\Windows\system32\audioeng.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Audio Engine
msacm32.drv 73af0000 36864 C:\Windows\system32\msacm32.drv 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft Sound Mapper
MSACM32.dll 735b0000 81920 C:\Windows\system32\MSACM32.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft ACM Audio Filter
midimap.dll 73690000 28672 C:\Windows\system32\midimap.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft MIDI Mapper
NLSData0009.dll 6c8f0000 4886528 C:\Windows\System32\NLSData0009.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Microsoft English Natural Language Server Data and Code
NLSLexicons0009.dll 6c660000 2650112 C:\Windows\System32\NLSLexicons0009.dll 6.0.6001.18098 (vistasp1_gdr.080625-1507) Microsoft English Natural Language Server Data and Code
stobject.dll 6e870000 598016 C:\Windows\system32\stobject.dll 6.0.6000.16386 (vista_rtm.061101-2205) Systray shell service object
BatMeter.dll 6e7b0000 745472 C:\Windows\system32\BatMeter.dll 6.0.6000.16386 (vista_rtm.061101-2205) Battery Meter Helper DLL
WTSAPI32.dll 750c0000 40960 C:\Windows\system32\WTSAPI32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Terminal Server SDK APIs
WINSTA.dll 75550000 151552 C:\Windows\system32\WINSTA.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Winstation Library
es.dll 71fc0000 290816 C:\Windows\system32\es.dll 2001.12.6931.18057 (vistasp1_gdr.080417-1550) COM+
SndVolSSO.dll 6e610000 196608 C:\Windows\System32\SndVolSSO.dll 6.0.6000.16386 (vista_rtm.061101-2205) SCA Volume
ehSSO.dll 6c420000 135168 C:\Windows\ehome\ehSSO.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Media Center Shell Service Object
HID.DLL 720d0000 36864 C:\Windows\system32\HID.DLL 6.0.6000.16386 (vista_rtm.061101-2205) Hid User Library
netshell.dll 6b680000 3190784 C:\Windows\System32\netshell.dll 6.0.6000.16386 (vista_rtm.061101-2205) Network Connections Shell
IPHLPAPI.DLL 75650000 102400 C:\Windows\System32\IPHLPAPI.DLL 6.0.6000.16386 (vista_rtm.061101-2205) IP Helper API
dhcpcsvc.DLL 75690000 217088 C:\Windows\System32\dhcpcsvc.DLL 6.0.6000.16386 (vista_rtm.061101-2205) DHCP Client Service
DNSAPI.dll 75920000 180224 C:\Windows\System32\DNSAPI.dll 6.0.6000.16386 (vista_rtm.061101-2205) DNS Client API DLL
WINNSI.DLL 75750000 28672 C:\Windows\System32\WINNSI.DLL 6.0.6001.18000 (longhorn_rtm.080118-1840) Network Store Information RPC interface
dhcpcsvc6.DLL 75620000 135168 C:\Windows\System32\dhcpcsvc6.DLL 6.0.6000.16386 (vista_rtm.061101-2205) DHCPv6 Client
nlaapi.dll 74660000 61440 C:\Windows\System32\nlaapi.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Network Location Awareness 2
FirewallAPI.dll 74db0000 417792 C:\Windows\system32\FirewallAPI.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Firewall API
pnidui.dll 6bf00000 1830912 C:\Windows\system32\pnidui.dll 6.0.6000.16386 (vista_rtm.061101-2205) Network System Icon
QUtil.dll 6f130000 94208 C:\Windows\system32\QUtil.dll 6.0.6000.16386 (vista_rtm.061101-2205) Quarantine Utilities
wevtapi.dll 756d0000 262144 C:\Windows\system32\wevtapi.dll 6.0.6000.16386 (vista_rtm.061101-2205) Eventing Consumption and Configuration API
wlanutil.dll 71b60000 24576 C:\Windows\system32\wlanutil.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Wireless LAN 802.11 Utility DLL
FunDisc.dll 6d800000 159744 C:\Windows\system32\FunDisc.dll 6.0.6000.16386 (vista_rtm.061101-2205) Function Discovery Dll
fdproxy.dll 737d0000 36864 C:\Windows\system32\fdproxy.dll 6.0.6000.16386 (vista_rtm.061101-2205) Function Discovery Proxy Dll
msxml3.dll 6d4c0000 1269760 C:\Windows\System32\msxml3.dll 8.100.4002.0 MSXML 3.0 SP10
SXS.DLL 75c40000 389120 C:\Windows\system32\SXS.DLL 6.0.6000.16386 (vista_rtm.061101-2205) Fusion 2.5
oobefldr.dll 6bca0000 2162688 C:\Windows\system32\oobefldr.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Welcome Center
toolband.dll 10000000 380928 C:\Program Files\Lexmark Toolbar\toolband.dll
WINSPOOL.DRV 6e470000 270336 C:\Windows\system32\WINSPOOL.DRV 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Spooler Driver
resource.dll 6fe0000 466944 C:\Program Files\Lexmark Toolbar\resource.dll
npmproxy.dll 6eb80000 32768 C:\Windows\System32\npmproxy.dll 6.0.6000.16386 (vista_rtm.061101-2205) Network List Manager Proxy
Wlanapi.dll 6ed20000 73728 C:\Windows\system32\Wlanapi.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows WLAN AutoConfig Client Side API DLL
OneX.DLL 718f0000 1556480 C:\Windows\system32\OneX.DLL 6.0.6001.18000 (longhorn_rtm.080118-1840) IEEE 802.1X supplicant library
eappprxy.dll 71c90000 57344 C:\Windows\system32\eappprxy.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Microsoft EAPHost Peer Client DLL
eappcfg.dll 71b70000 147456 C:\Windows\system32\eappcfg.dll 6.0.6000.16386 (vista_rtm.061101-2205) Eap Peer Config
bcrypt.dll 75590000 282624 C:\Windows\system32\bcrypt.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Cryptographic Primitives Library
AltTab.dll 69ef0000 53248 C:\Windows\System32\AltTab.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Shell Alt Tab
wpdshserviceobj.dll 69bc0000 143360 C:\Windows\system32\wpdshserviceobj.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Portable Device Shell Service Object
WINHTTP.dll 6f540000 393216 C:\Windows\system32\WINHTTP.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows HTTP Services
srchadmin.dll 69320000 315392 C:\Windows\System32\srchadmin.dll 7.0.6001.16503 (longhorn(wmbla).080526-2159) Indexing Options
webcheck.dll 69a30000 245760 C:\Windows\system32\webcheck.dll 7.00.6000.16386 (vista_rtm.061101-2205) Web Site Monitor
mssprxy.dll 6a670000 45056 C:\Windows\system32\mssprxy.dll 7.0.6001.16503 (longhorn(wmbla).080526-2159) Microsoft Search Proxy
SyncCenter.dll 69810000 2211840 C:\Windows\System32\SyncCenter.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft Sync Center
bthprops.cpl 69050000 1019904 C:\Windows\system32\bthprops.cpl 6.0.6000.16386 (vista_rtm.061101-2205) Bluetooth Control Panel Applet
imapi2.dll 69260000 331776 C:\Windows\system32\imapi2.dll 6.0.6000.16386 (vista_rtm.061101-2205) Image Mastering API v2
PortableDeviceTypes.dll 69a80000 176128 C:\Windows\system32\PortableDeviceTypes.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Portable Device (Parameter) Types Component
PortableDeviceApi.dll 6cdc0000 253952 C:\Windows\system32\PortableDeviceApi.dll 6.0.6001.18160 (vistasp1_gdr.081021-1528) Windows Portable Device API Components
ntlanman.dll 69d70000 77824 C:\Windows\System32\ntlanman.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft® Lan Manager
drprov.dll 69eb0000 32768 C:\Windows\System32\drprov.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft Terminal Server Network Provider
davclnt.dll 69df0000 61440 C:\Windows\System32\davclnt.dll 6.0.6000.16386 (vista_rtm.061101-2205) Web DAV Client DLL
MLANG.dll 69e20000 196608 C:\Windows\system32\MLANG.dll 6.0.6000.16386 (vista_rtm.061101-2205) Multi Language Support DLL
mscms.dll 6b9f0000 401408 C:\Windows\system32\mscms.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft Color Matching System DLL
WinSATAPI.dll 67e60000 393216 C:\Windows\system32\WinSATAPI.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows System Assessment Tool API
msxml6.dll 70a50000 1417216 C:\Windows\System32\msxml6.dll 6.20.4001.0 MSXML 6.0 SP2
Cabinet.dll 74a60000 86016 C:\Windows\system32\Cabinet.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Microsoft® Cabinet File API
QAgent.dll 6f0f0000 188416 C:\Windows\System32\QAgent.dll 6.0.6000.16386 (vista_rtm.061101-2205) Quarantine Agent Proxy
fwpuclnt.dll 6ed60000 614400 C:\Windows\System32\fwpuclnt.dll 6.0.6000.16386 (vista_rtm.061101-2205) FWP/IPsec User-Mode API
wbemprox.dll 6e910000 45056 C:\Windows\system32\wbem\wbemprox.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) WMI
wbemcomn.dll 6e040000 372736 C:\Windows\system32\wbemcomn.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) WMI
wbemsvc.dll 6bab0000 65536 C:\Windows\system32\wbem\wbemsvc.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) WMI
fastprox.dll 6a6d0000 626688 C:\Windows\system32\wbem\fastprox.dll 6.0.6001.18226 (vistasp1_gdr.090302-1506) WMI Custom Marshaller
NTDSAPI.dll 758a0000 98304 C:\Windows\system32\NTDSAPI.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Active Directory Domain Services API
tquery.dll 6b080000 1593344 C:\Windows\system32\tquery.dll 7.0.6001.16503 (longhorn(wmbla).080526-2159) tquery.dll
zipfldr.dll 6e930000 356352 C:\Windows\system32\zipfldr.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Compressed (zipped) Folders
mbamext.dll 6d840000 98304 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll 1.61.0.0000 Malwarebytes Anti-Malware
syncui.dll 68b90000 188416 C:\Windows\system32\syncui.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Briefcase
SYNCENG.dll 6a530000 90112 C:\Windows\system32\SYNCENG.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Briefcase Engine
MpOav.dll 6d420000 90112 C:\Program Files\Windows Defender\MpOav.dll 1.1.1600.0 IOfficeAntiVirus Module
tiptsf.dll 68ce0000 393216 C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll 6.0.6000.16386 (vista_rtm.061101-2205) Tablet PC Input Panel Text Services Framework
AcroIEHelper.dll 2a30000 65536 C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 8.3.1.289 Adobe PDF Helper for Internet Explorer
MSVCR80.dll 74eb0000 634880 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.3053_none_d08d7bba442a9b36\MSVCR80.dll 8.00.50727.3053 Microsoft® C Runtime Library
xmllite.dll 74b70000 192512 C:\Windows\system32\xmllite.dll 1.2.1009.0 Microsoft XmlLite Library




******************************************
EOF

descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

more_horiz
SVCHOST Diag



~~~~~Services loaded under SVCHOST~~~~~


Image Name: svchost.exe
PID: 900
Services: DcomLaunch
PlugPlay

Image Name: svchost.exe
PID: 1020
Services: RpcSs

Image Name: svchost.exe
PID: 1060
Services: Audiosrv
Dhcp
Eventlog
lmhosts
wscsvc

Image Name: svchost.exe
PID: 1152
Services: AudioEndpointBuilder
EMDMgmt
hidserv
Netman
PcaSvc
SysMain
TabletInputService
TrkWks
UxSms
WdiSystemHost
Wlansvc
WPDBusEnum
wudfsvc

Image Name: svchost.exe
PID: 1168
Services: AeLookupSvc
Appinfo
BITS
Browser
EapHost
gpsvc
iphlpsvc
LanmanServer
MMCSS
ProfSvc
RasMan
Schedule
seclogon
SENS
ShellHWDetection
Themes
Winmgmt
wuauserv

Image Name: svchost.exe
PID: 1372
Services: EventSystem
fdPHost
FDResPub
LanmanWorkstation
netprofm
nsi
SSDPSRV
SstpSvc
W32Time
WebClient
WinHttpAutoProxySvc

Image Name: svchost.exe
PID: 1556
Services: CryptSvc
Dnscache
KtmRm
NlaSvc
TapiSrv
TermService

Image Name: svchost.exe
PID: 2100
Services: DPS

Image Name: svchost.exe
PID: 2780
Services: stisvc

Image Name: svchost.exe
PID: 3300
Services: WerSvc


~~~~~Modules loaded under SVCHOST~~~~~


Image Name: svchost.exe
PID: 900
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
umpnpmgr.dll
USER32.dll
GDI32.dll
USERENV.dll
Secur32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
POWRPROF.dll
GPAPI.dll
slc.dll
rpcss.dll
WS2_32.dll
NSI.dll
FirewallAPI.dll
OLEAUT32.dll
ole32.dll
VERSION.dll
CRYPT32.dll
MSASN1.dll
credssp.dll
schannel.dll
NETAPI32.dll
PSAPI.DLL
SETUPAPI.dll
Cabinet.dll
NTMARTA.DLL
WLDAP32.dll
SAMLIB.dll
WINSTA.dll
CLBCatQ.DLL
apphelp.dll
WTSAPI32.dll

Image Name: svchost.exe
PID: 1020
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
rpcss.dll
WS2_32.dll
NSI.dll
Secur32.dll
FirewallAPI.dll
USER32.dll
GDI32.dll
OLEAUT32.dll
ole32.dll
VERSION.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
CRYPT32.dll
MSASN1.dll
USERENV.dll
credssp.dll
schannel.dll
NETAPI32.dll
PSAPI.DLL
rsaenh.dll
mswsock.dll
wshtcpip.dll
wship6.dll
CLBCatQ.DLL
WTSAPI32.dll
WINSTA.dll

Image Name: svchost.exe
PID: 1060
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
wevtsvc.dll
USERENV.dll
Secur32.dll
USER32.dll
GDI32.dll
VERSION.dll
GPAPI.dll
slc.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
CRYPT32.dll
MSASN1.dll
credssp.dll
schannel.dll
NETAPI32.dll
PSAPI.DLL
WS2_32.dll
NSI.dll
mswsock.dll
wshtcpip.dll
wship6.dll
audiosrv.dll
ole32.dll
OLEAUT32.dll
MMDevAPI.DLL
SHLWAPI.dll
WTSAPI32.dll
WINSTA.dll
comctl32.dll
CLBCatQ.DLL
SETUPAPI.dll
WINTRUST.dll
imagehlp.dll
rsaenh.dll
audioses.dll
audioeng.dll
AVRT.dll
lmhsvc.dll
IPHLPAPI.DLL
dhcpcsvc.DLL
DNSAPI.dll
WINNSI.DLL
dhcpcsvc6.DLL
wscsvc.dll
FirewallAPI.dll
dbghelp.dll
wbemprox.dll
wbemcomn.dll
wbemsvc.dll
fastprox.dll
NTDSAPI.dll
WLDAP32.dll
ncrypt.dll
BCRYPT.dll
wuapi.dll
Cabinet.dll

Image Name: svchost.exe
PID: 1152
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
NTMARTA.DLL
USER32.dll
GDI32.dll
WLDAP32.dll
WS2_32.dll
NSI.dll
PSAPI.DLL
SAMLIB.dll
ole32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
audiosrv.dll
OLEAUT32.dll
MMDevAPI.DLL
SHLWAPI.dll
WTSAPI32.dll
WINSTA.dll
comctl32.dll
CLBCatQ.DLL
SETUPAPI.dll
WINTRUST.dll
CRYPT32.dll
MSASN1.dll
USERENV.dll
Secur32.dll
imagehlp.dll
uxsms.dll
tabsvc.dll
HID.DLL
slc.dll
wudfsvc.dll
WUDFPlatform.dll
VERSION.dll
wevtapi.dll
wlansvc.dll
NETAPI32.dll
SHELL32.dll
WLANMSM.DLL
WLANSEC.dll
OneX.DLL
eappprxy.dll
eappcfg.dll
gdiplus.dll
DUser.dll
UxTheme.dll
OLEACC.dll
AUTHZ.dll
dhcpcsvc.DLL
DNSAPI.dll
WINNSI.DLL
wlgpclnt.dll
l2gpstore.dll
wlanutil.dll
SYSNTFY.dll
WinSCard.dll
IPHLPAPI.DLL
dhcpcsvc6.DLL
bcrypt.dll
msxml6.dll
rsaenh.dll
credssp.dll
schannel.dll
kerberos.dll
cryptdll.dll
apphelp.dll
netcfgx.dll
Cabinet.dll
emdmgmt.dll
WDSCORE.dll
SLWGA.dll
urlmon.dll
iertutil.dll
hidserv.dll
pcasvc.dll
netman.dll
RASAPI32.dll
rasman.dll
TAPI32.dll
rtutils.dll
WINMM.dll
sysmain.dll
trkwks.dll
netshell.dll
nlaapi.dll
wpdbusenum.dll
GPAPI.dll
PortableDeviceApi.dll
wdi.dll
pcadm.dll
RASDLG.dll
MPRAPI.dll
ACTIVEDS.dll
adsldpc.dll
credui.dll
ATL.DLL
hnetcfg.dll
WINHTTP.dll
mswsock.dll
wshtcpip.dll
upnp.dll
SSDPAPI.dll
SXS.DLL
msxml3.dll
wbemprox.dll
wbemcomn.dll
wbemsvc.dll
fastprox.dll
NTDSAPI.dll
radardt.dll

Image Name: svchost.exe
PID: 1168
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
NTMARTA.DLL
USER32.dll
GDI32.dll
WLDAP32.dll
WS2_32.dll
NSI.dll
PSAPI.DLL
SAMLIB.dll
ole32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
mmcss.dll
AVRT.dll
gpsvc.dll
Secur32.dll
NETAPI32.dll
NTDSAPI.dll
DNSAPI.dll
WTSAPI32.dll
OLEAUT32.dll
USERENV.dll
GPAPI.dll
slc.dll
AUTHZ.dll
SYSNTFY.dll
WINSTA.dll
nlaapi.dll
IPHLPAPI.DLL
dhcpcsvc.DLL
WINNSI.DLL
dhcpcsvc6.DLL
profsvc.dll
ATL.DLL
shsvcs.dll
sens.dll
UxTheme.dll
rsaenh.dll
eapsvc.dll
eapphost.dll
CLBCatQ.DLL
umb.dll
SETUPAPI.dll
WINTRUST.dll
CRYPT32.dll
MSASN1.dll
imagehlp.dll
PROPSYS.dll
SXS.DLL
COMCTL32.dll
schedsvc.dll
SHLWAPI.dll
wevtapi.dll
ktmw32.dll
comctl32.dll
credssp.dll
schannel.dll
wiarpc.dll
taskcomp.dll
VERSION.dll
mswsock.dll
wshtcpip.dll
wship6.dll
apphelp.dll
tschannel.dll
srvsvc.dll
SSCORE.DLL
FirewallAPI.DLL
CLUSAPI.DLL
cryptdll.dll
ACTIVEDS.dll
adsldpc.dll
credui.dll
SHELL32.dll
RESUTILS.DLL
browser.dll
aelupsvc.dll
seclogon.dll
wmisvc.dll
wbemcomn.dll
iphlpsvc.dll
fwpuclnt.dll
rtutils.dll
sqmapi.dll
bcrypt.dll
rasmans.dll
Cabinet.dll
rastapi.dll
TAPI32.dll
WINMM.dll
OLEACC.dll
rasppp.dll
MPRAPI.dll
RASAPI32.dll
rasman.dll
kerberos.dll
RASQEC.DLL
QUtil.dll
raschap.dll
rastls.dll
CRYPTUI.dll
MSIMG32.dll
WinSCard.dll
VSSAPI.DLL
vsstrace.dll
XmlLite.dll
MPR.dll
wbemcore.dll
esscli.dll
FastProx.dll
wbemsvc.dll
wmiutils.dll
repdrvfs.dll
wmiprvsd.dll
NCObjAPI.DLL
wbemess.dll
napinsp.dll
pnrpnsp.dll
winrnr.dll
rasadhlp.dll
appinfo.dll
ncprov.dll
qmgr.dll
SHFOLDER.dll
WINHTTP.dll
bitsperf.dll
bitsigd.dll
upnp.dll
SSDPAPI.dll
msxml3.dll
urlmon.dll
iertutil.dll
wuaueng.dll
ESENT.dll
WINSPOOL.DRV
mspatcha.dll
WMsgAPI.dll
wer.dll
SensApi.dll
ncrypt.dll
wups2.dll
dssenh.dll
qmgrprxy.dll

Image Name: svchost.exe
PID: 1372
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
NTMARTA.DLL
USER32.dll
GDI32.dll
WLDAP32.dll
WS2_32.dll
NSI.dll
PSAPI.DLL
SAMLIB.dll
ole32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
es.dll
OLEAUT32.dll
PROPSYS.dll
rsaenh.dll
CLBCatQ.DLL
nsisvc.dll
secur32.dll
CRYPT32.dll
MSASN1.dll
USERENV.dll
credssp.dll
schannel.dll
NETAPI32.dll
SXS.DLL
webclnt.dll
WINHTTP.dll
SHLWAPI.dll
urlmon.dll
iertutil.dll
comctl32.dll
shell32.dll
WinInet.dll
Normaliz.dll
wkssvc.dll
IPHLPAPI.DLL
dhcpcsvc.DLL
DNSAPI.dll
WINNSI.DLL
dhcpcsvc6.DLL
NTDSAPI.dll
WINBRAND.dll
fdrespub.dll
wsdapi.dll
HTTPAPI.dll
WINTRUST.dll
imagehlp.dll
XmlLite.dll
FirewallAPI.dll
VERSION.dll
FunDisc.dll
ATL.DLL
SETUPAPI.dll
mswsock.dll
wshtcpip.dll
wship6.dll
msxml3.dll
sstpsvc.dll
rtutils.dll
w32time.dll
cryptdll.dll
GPAPI.dll
slc.dll
netprofm.dll
nlaapi.dll
npmproxy.dll
fdphost.dll
fdwsd.dll
MLANG.dll
fdssdp.dll
SSDPAPI.dll
fdproxy.dll
ssdpsrv.dll
napinsp.dll
pnrpnsp.dll
winrnr.dll
rasadhlp.dll

Image Name: svchost.exe
PID: 1556
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
NTMARTA.DLL
USER32.dll
GDI32.dll
WLDAP32.dll
WS2_32.dll
NSI.dll
PSAPI.DLL
SAMLIB.dll
ole32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
dnsrslvr.dll
DNSAPI.dll
dhcpcsvc.DLL
Secur32.dll
WINNSI.DLL
dhcpcsvc6.DLL
IPHLPAPI.DLL
mswsock.dll
wship6.dll
wshtcpip.dll
cryptsvc.dll
OLEAUT32.dll
VSSAPI.DLL
ATL.DLL
vsstrace.dll
AUTHZ.dll
XmlLite.dll
NETAPI32.dll
MPR.dll
SETUPAPI.dll
CRYPT32.dll
MSASN1.dll
USERENV.dll
nlasvc.dll
wevtapi.dll
ncsi.dll
WINHTTP.dll
SHLWAPI.dll
WTSAPI32.dll
bcrypt.dll
CFGMGR32.dll
comctl32.dll
rsaenh.dll
credssp.dll
schannel.dll
CLBCatQ.DLL
es.dll
PROPSYS.dll
ssdpapi.dll
tapisrv.dll
ACTIVEDS.dll
adsldpc.dll
credui.dll
SHELL32.dll
rtutils.dll
WINMM.dll
OLEACC.dll
termsrv.dll
ICAAPI.dll
WINTRUST.dll
imagehlp.dll
WINSTA.dll
unimdm.tsp
uniplat.dll
unimdmat.dll
VERSION.dll
modemui.dll
kmddsp.tsp
ndptsp.tsp
hidphone.tsp
HID.DLL
napinsp.dll
pnrpnsp.dll
winrnr.dll
rasadhlp.dll
msdtckrm.dll
ktmw32.dll
CLUSAPI.dll
NTDSAPI.dll
cryptdll.dll
CRYPTNET.dll
SensApi.dll
ESENT.dll

Image Name: svchost.exe
PID: 2100
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
dps.dll
wdi.dll
USER32.dll
GDI32.dll
USERENV.dll
Secur32.dll
OLEAUT32.dll
ole32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
CLBCatQ.DLL
taskschd.dll
SHLWAPI.dll
XmlLite.dll
comctl32.dll
GPAPI.dll
slc.dll
diagperf.dll
SHELL32.dll
pnpts.dll
VERSION.dll
iphlpapi.dll
dhcpcsvc.DLL
DNSAPI.dll
WS2_32.dll
NSI.dll
WINNSI.DLL
dhcpcsvc6.DLL
WINTRUST.dll
CRYPT32.dll
MSASN1.dll
imagehlp.dll

Image Name: svchost.exe
PID: 2780
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
wiaservc.dll
USER32.dll
GDI32.dll
OLEAUT32.dll
ole32.dll
VERSION.dll
COMDLG32.dll
SHLWAPI.dll
COMCTL32.dll
SHELL32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
comctl32.dll
wiatrace.dll
secur32.dll
CRYPT32.dll
MSASN1.dll
USERENV.dll
credssp.dll
schannel.dll
NETAPI32.dll
PSAPI.DLL
msv1_0.dll
cryptdll.dll
WS2_32.dll
NSI.dll
WSDCHNGR.DLL
CLBCatQ.DLL
FunDisc.dll
ATL.DLL
SETUPAPI.dll
msxml3.dll
WINTRUST.dll
imagehlp.dll
rsaenh.dll
CFGMGR32.dll

Image Name: svchost.exe
PID: 3300
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
wersvc.dll


~~~~~SVCHOST service~~~~~

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"LocalService"=hex(7):6e,00,73,00,69,00,00,00,6c,00,6c,00,74,00,64,00,73,00,76,\
00,63,00,00,00,53,00,53,00,44,00,50,00,53,00,52,00,56,00,00,00,75,00,70,00,\
6e,00,70,00,68,00,6f,00,73,00,74,00,00,00,53,00,43,00,61,00,72,00,64,00,53,\
00,76,00,72,00,00,00,77,00,33,00,32,00,74,00,69,00,6d,00,65,00,00,00,45,00,\
76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,52,00,65,\
00,6d,00,6f,00,74,00,65,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,00,\
00,00,57,00,69,00,6e,00,48,00,74,00,74,00,70,00,41,00,75,00,74,00,6f,00,50,\
00,72,00,6f,00,78,00,79,00,53,00,76,00,63,00,00,00,6c,00,61,00,6e,00,6d,00,\
61,00,6e,00,77,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,\
00,00,00,54,00,42,00,53,00,00,00,53,00,4c,00,55,00,49,00,4e,00,6f,00,74,00,\
69,00,66,00,79,00,00,00,54,00,48,00,52,00,45,00,41,00,44,00,4f,00,52,00,44,\
00,45,00,52,00,00,00,66,00,64,00,72,00,65,00,73,00,70,00,75,00,62,00,00,00,\
6e,00,65,00,74,00,70,00,72,00,6f,00,66,00,6d,00,00,00,66,00,64,00,70,00,68,\
00,6f,00,73,00,74,00,00,00,77,00,63,00,6e,00,63,00,73,00,76,00,63,00,00,00,\
51,00,57,00,41,00,56,00,45,00,00,00,4d,00,63,00,78,00,32,00,53,00,76,00,63,\
00,00,00,57,00,65,00,62,00,43,00,6c,00,69,00,65,00,6e,00,74,00,00,00,53,00,\
73,00,74,00,70,00,53,00,76,00,63,00,00,00,00,00
"LocalSystemNetworkRestricted"=hex(7):68,00,69,00,64,00,73,00,65,00,72,00,76,\
00,00,00,55,00,78,00,53,00,6d,00,73,00,00,00,57,00,64,00,69,00,53,00,79,00,\
73,00,74,00,65,00,6d,00,48,00,6f,00,73,00,74,00,00,00,4e,00,65,00,74,00,6d,\
00,61,00,6e,00,00,00,74,00,72,00,6b,00,77,00,6b,00,73,00,00,00,41,00,75,00,\
64,00,69,00,6f,00,45,00,6e,00,64,00,70,00,6f,00,69,00,6e,00,74,00,42,00,75,\
00,69,00,6c,00,64,00,65,00,72,00,00,00,57,00,55,00,44,00,46,00,53,00,76,00,\
63,00,00,00,69,00,72,00,6d,00,6f,00,6e,00,00,00,73,00,79,00,73,00,6d,00,61,\
00,69,00,6e,00,00,00,49,00,50,00,42,00,75,00,73,00,45,00,6e,00,75,00,6d,00,\
00,00,64,00,6f,00,74,00,33,00,73,00,76,00,63,00,00,00,50,00,63,00,61,00,53,\
00,76,00,63,00,00,00,45,00,4d,00,44,00,4d,00,67,00,6d,00,74,00,00,00,54,00,\
61,00,62,00,6c,00,65,00,74,00,49,00,6e,00,70,00,75,00,74,00,53,00,65,00,72,\
00,76,00,69,00,63,00,65,00,00,00,77,00,6c,00,61,00,6e,00,73,00,76,00,63,00,\
00,00,57,00,50,00,44,00,42,00,75,00,73,00,45,00,6e,00,75,00,6d,00,00,00,00,\
00
"NetworkServiceNetworkRestricted"=hex(7):50,00,6f,00,6c,00,69,00,63,00,79,00,\
41,00,67,00,65,00,6e,00,74,00,00,00,00,00
"LocalServiceNoNetwork"=hex(7):50,00,4c,00,41,00,00,00,44,00,50,00,53,00,00,00,\
42,00,46,00,45,00,00,00,6d,00,70,00,73,00,73,00,76,00,63,00,00,00,65,00,68,\
00,73,00,74,00,61,00,72,00,74,00,00,00,00,00
"NetworkService"=hex(7):43,00,72,00,79,00,70,00,74,00,53,00,76,00,63,00,00,00,\
44,00,48,00,43,00,50,00,00,00,54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,\
00,69,00,63,00,65,00,00,00,4b,00,74,00,6d,00,52,00,6d,00,00,00,44,00,4e,00,\
53,00,43,00,61,00,63,00,68,00,65,00,00,00,4e,00,61,00,70,00,41,00,67,00,65,\
00,6e,00,74,00,00,00,6e,00,6c,00,61,00,73,00,76,00,63,00,00,00,57,00,69,00,\
6e,00,52,00,4d,00,00,00,57,00,45,00,43,00,53,00,56,00,43,00,00,00,54,00,61,\
00,70,00,69,00,73,00,72,00,76,00,00,00,00,00
"termsvcs"=hex(7):54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,69,00,63,00,\
65,00,00,00,00,00
"WerSvcGroup"=hex(7):77,00,65,00,72,00,73,00,76,00,63,00,00,00,00,00
"netsvcs"=hex(7):41,00,65,00,4c,00,6f,00,6f,00,6b,00,75,00,70,00,53,00,76,00,\
63,00,00,00,77,00,65,00,72,00,63,00,70,00,6c,00,73,00,75,00,70,00,70,00,6f,\
00,72,00,74,00,00,00,54,00,68,00,65,00,6d,00,65,00,73,00,00,00,43,00,65,00,\
72,00,74,00,50,00,72,00,6f,00,70,00,53,00,76,00,63,00,00,00,53,00,43,00,50,\
00,6f,00,6c,00,69,00,63,00,79,00,53,00,76,00,63,00,00,00,6c,00,61,00,6e,00,\
6d,00,61,00,6e,00,73,00,65,00,72,00,76,00,65,00,72,00,00,00,67,00,70,00,73,\
00,76,00,63,00,00,00,49,00,4b,00,45,00,45,00,58,00,54,00,00,00,41,00,75,00,\
64,00,69,00,6f,00,53,00,72,00,76,00,00,00,46,00,61,00,73,00,74,00,55,00,73,\
00,65,00,72,00,53,00,77,00,69,00,74,00,63,00,68,00,69,00,6e,00,67,00,43,00,\
6f,00,6d,00,70,00,61,00,74,00,69,00,62,00,69,00,6c,00,69,00,74,00,79,00,00,\
00,49,00,61,00,73,00,00,00,49,00,72,00,6d,00,6f,00,6e,00,00,00,4e,00,6c,00,\
61,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,00,00,00,4e,00,57,00,43,\
00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,00,00,00,\
4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,00,74,00,00,00,52,00,61,\
00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,73,00,6d,00,61,00,6e,00,\
00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,00,63,00,65,00,73,00,73,\
00,00,00,53,00,45,00,4e,00,53,00,00,00,53,00,68,00,61,00,72,00,65,00,64,00,\
61,00,63,00,63,00,65,00,73,00,73,00,00,00,53,00,52,00,53,00,65,00,72,00,76,\
00,69,00,63,00,65,00,00,00,54,00,61,00,70,00,69,00,73,00,72,00,76,00,00,00,\
57,00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,70,00,00,\
00,54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00,\
77,00,75,00,61,00,75,00,73,00,65,00,72,00,76,00,00,00,42,00,49,00,54,00,53,\
00,00,00,53,00,68,00,65,00,6c,00,6c,00,48,00,57,00,44,00,65,00,74,00,65,00,\
63,00,74,00,69,00,6f,00,6e,00,00,00,4c,00,6f,00,67,00,6f,00,6e,00,48,00,6f,\
00,75,00,72,00,73,00,00,00,50,00,43,00,41,00,75,00,64,00,69,00,74,00,00,00,\
68,00,65,00,6c,00,70,00,73,00,76,00,63,00,00,00,75,00,70,00,6c,00,6f,00,61,\
00,64,00,6d,00,67,00,72,00,00,00,69,00,70,00,68,00,6c,00,70,00,73,00,76,00,\
63,00,00,00,73,00,65,00,63,00,6c,00,6f,00,67,00,6f,00,6e,00,00,00,41,00,70,\
00,70,00,49,00,6e,00,66,00,6f,00,00,00,6d,00,73,00,69,00,73,00,63,00,73,00,\
69,00,00,00,4d,00,4d,00,43,00,53,00,53,00,00,00,50,00,72,00,6f,00,66,00,53,\
00,76,00,63,00,00,00,45,00,61,00,70,00,48,00,6f,00,73,00,74,00,00,00,77,00,\
69,00,6e,00,6d,00,67,00,6d,00,74,00,00,00,73,00,63,00,68,00,65,00,64,00,75,\
00,6c,00,65,00,00,00,53,00,65,00,73,00,73,00,69,00,6f,00,6e,00,45,00,6e,00,\
76,00,00,00,62,00,72,00,6f,00,77,00,73,00,65,00,72,00,00,00,68,00,6b,00,6d,\
00,73,00,76,00,63,00,00,00,00,00
"swprv"=hex(7):73,00,77,00,70,00,72,00,76,00,00,00,00,00
"LocalServiceNetworkRestricted"=hex(7):44,00,48,00,43,00,50,00,00,00,65,00,76,\
00,65,00,6e,00,74,00,6c,00,6f,00,67,00,00,00,41,00,75,00,64,00,69,00,6f,00,\
53,00,72,00,76,00,00,00,4c,00,6d,00,48,00,6f,00,73,00,74,00,73,00,00,00,77,\
00,73,00,63,00,73,00,76,00,63,00,00,00,70,00,32,00,70,00,69,00,6d,00,73,00,\
76,00,63,00,00,00,50,00,4e,00,52,00,50,00,53,00,76,00,63,00,00,00,70,00,32,\
00,70,00,73,00,76,00,63,00,00,00,57,00,50,00,43,00,53,00,76,00,63,00,00,00,\
50,00,6e,00,72,00,70,00,41,00,75,00,74,00,6f,00,52,00,65,00,67,00,00,00,00,\
00
"rpcss"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"regsvc"=hex(7):52,00,65,00,6d,00,6f,00,74,00,65,00,52,00,65,00,67,00,69,00,73,\
00,74,00,72,00,79,00,00,00,00,00
"wcssvc"=hex(7):57,00,63,00,73,00,50,00,6c,00,75,00,67,00,49,00,6e,00,53,00,65,\
00,72,00,76,00,69,00,63,00,65,00,00,00,00,00
"DcomLaunch"=hex(7):50,00,6c,00,75,00,67,00,50,00,6c,00,61,00,79,00,00,00,44,\
00,63,00,6f,00,6d,00,4c,00,61,00,75,00,6e,00,63,00,68,00,00,00,00,00
"wdisvc"=hex(7):57,00,64,00,69,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,48,\
00,6f,00,73,00,74,00,00,00,00,00
"sdrsvc"=hex(7):73,00,64,00,72,00,73,00,76,00,63,00,00,00,00,00
"imgsvc"=hex(7):53,00,74,00,69,00,53,00,76,00,63,00,00,00,00,00
"secsvcs"=hex(7):57,00,69,00,6e,00,44,00,65,00,66,00,65,00,6e,00,64,00,00,00,\
00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService]
"AuthenticationCapabilities"=dword:00002000
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNetworkRestricted]
"DefaultRpcStackSize"=dword:00000040

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalSystemNetworkRestricted]
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
"AuthenticationCapabilities"=dword:00003020
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkService]
"CoInitializeSecurityParam"=dword:00000001
"DefaultRpcStackSize"=dword:0000001c

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\SDRSVC]
"CoInitializeSecurityParam"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\swprv]
"CoInitializeSecurityParam"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs]
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\wcssvc]
"CoInitializeSecurityParam"=dword:00000001
"CoInitializeSecurityAppID"="{CD11FAB6-1C0E-45e1-BA31-5C6008EF2607}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\wercplsupport]
"AuthenticationCapabilities"=dword:00003020
"CoInitializeSecurityParam"=dword:00000001



~~~~~SVCHOST MD5~~~~~

3794B461C45882E06856F282EEF025AF C:\Windows\system32\svchost.exe


~~~~~END OF FILE!~~~~~

descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

more_horiz
While we look at these logs, we scan a file that is most likely legit, but gotta make sure.

  • Please go to the Virustotal website by clicking here
  • Click the Choose File button and in the Name field paste:
    c:\windows\system32\wbem\wbemess.dll

  • Click Open and click Scan It!
  • If Virustotal informs you that "File already analysed", click Reanalyse
  • An analysis report will appear. Copy and paste the url (something like http://www.virustotal.com/analisis/blabla) into your next reply.


descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

more_horiz
FYI I am still being redirected...woooohooooo this is fun...lol


https://www.virustotal.com/file/2d283a83359584defed9dd7c10649c560acc588e56086c04aa455bde84ee3b89/analysis/1339601834/

descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

more_horiz
Hello!

I'm going to step in for a moment to ask a few random questions, so we can further diagnose this together...

1. How are you using the search engines? Are you being redirected in normal browsing on any website, or just a search engine? What is your usual web browser?

2. Post the following information from this tool:


  1. Download Win32kDiag from any of the following locations and save it to your Desktop.

    • Download Win32kDiag (Win32kDiag.exe) - #1
    • Download Win32kDiag (Win32kDiag.exe) - #2
    • Download Win32kDiag (Win32kDiag.exe) - #3

  • Double-click Win32kDiag.exe to run Win32kDiag and let it finish.
  • When it states "Finished! Press any key to exit...", press any key on your keyboard to close the program.
  • Double-click on the Win32kDiag.txt file that is located on your Desktop and post the entire contents of that log as a reply to this topic.


  • descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

    more_horiz
    My normal web browser is google....and yes, anytime I use this feature I get redirected under most searches....like this

    hxxp://8.26.70.252/see/display.php?q=pogo&affsub=7095258_46938-12780&subid=e10

    Doing scan now

    descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

    more_horiz
    Just searches?

    Where did you download Google Chrome? ((Google.com?) Or another source?)

    After you post the scan log from Win32kDiag, post a Quick Scan from OTL please.

    I think we got this wrapped up here...

    descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

    more_horiz
    Don't remember about the gooogle chrome....don't need it, never use it

    descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

    more_horiz
    Okay. How's it going on the scan logs? Post them whenever done, please.

    descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

    more_horiz
    scan still going...been a few hours

    descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

    more_horiz
    It shouldn't take more than 30 minutes at the max.!

    Cancel the scan and try again, please...

    descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

    more_horiz
    I stopped it at this point....will try new scan again

    Running from: C:\Users\JonEJet\Desktop\Win32kDiag.exe

    Log file at : C:\Users\JonEJet\Desktop\Win32kDiag.txt

    WARNING: Could not get backup privileges!

    Searching 'C:\Windows'...



    Cannot access: C:\Windows\System32\catroot2\edb00286.log

    [1] 2012-06-08 01:22:59 65536 C:\Windows\System32\catroot2\edb00286.log ()



    Cannot access: C:\Windows\System32\config\BCD-Template

    [1] 2008-01-05 07:22:50 262144 C:\Windows\SoftwareDistribution\Download\b1d48c0a5500e900499764daaa6a0385\x86_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.0.6001.18000_none_282474660318747d\BCD-Template ()

    [1] 2007-11-06 16:41:23 262144 C:\Windows\System32\config\BCD-Template ()

    [1] 2006-11-02 08:34:29 262144 C:\Windows\winsxs\x86_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.0.6000.16386_none_25edb26a062d63a9\BCD-Template ()

    [1] 2008-01-05 04:22:52 262144 C:\Windows\winsxs\x86_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.0.6001.18000_none_282474660318747d\BCD-Template ()



    Cannot access: C:\Windows\System32\config\BCD-Template.LOG

    [1] 2007-11-06 16:41:23 37888 C:\Windows\System32\config\BCD-Template.LOG ()



    Cannot access: C:\Windows\System32\config\BCD-Template.LOG1

    [1] 2006-11-02 08:43:50 0 C:\Windows\System32\config\BCD-Template.LOG1 ()



    Cannot access: C:\Windows\System32\config\BCD-Template.LOG2

    [1] 2006-11-02 08:43:50 0 C:\Windows\System32\config\BCD-Template.LOG2 ()



    Cannot access: C:\Windows\System32\config\COMPONENTS.LOG

    [1] 2006-11-02 06:43:16 1024 C:\Windows\System32\config\COMPONENTS.LOG ()



    Cannot access: C:\Windows\System32\config\COMPONENTS.SAV

    [1] 2007-11-06 16:41:12 6602752 C:\Windows\System32\config\COMPONENTS.SAV ()



    Cannot access: C:\Windows\System32\config\DEFAULT.LOG

    [1] 2006-11-02 11:28:20 1024 C:\Windows\System32\config\DEFAULT.LOG ()



    Cannot access: C:\Windows\System32\config\DEFAULT.SAV

    [1] 2007-11-06 16:41:11 102400 C:\Windows\System32\config\DEFAULT.SAV ()



    Cannot access: C:\Windows\System32\config\RegBack\COMPONENTS.LOG1

    [1] 2012-06-13 10:26:31 262144 C:\Windows\System32\config\COMPONENTS.LOG1 ()

    [1] 2012-02-11 00:09:09 262144 C:\Windows\System32\config\RegBack\COMPONENTS.LOG1 ()



    Cannot access: C:\Windows\System32\config\RegBack\COMPONENTS.LOG2

    [1] 2006-11-02 08:33:34 0 C:\Windows\System32\config\COMPONENTS.LOG2 ()

    [1] 2006-11-02 09:07:24 0 C:\Windows\System32\config\RegBack\COMPONENTS.LOG2 ()



    Cannot access: C:\Windows\System32\config\RegBack\DEFAULT.LOG1

    [1] 2012-06-13 10:48:06 262144 C:\Windows\System32\config\DEFAULT.LOG1 ()

    [1] 2012-05-28 15:08:24 262144 C:\Windows\System32\config\RegBack\DEFAULT.LOG1 ()



    Cannot access: C:\Windows\System32\config\RegBack\DEFAULT.LOG2

    [1] 2006-11-02 08:33:34 0 C:\Windows\System32\config\DEFAULT.LOG2 ()

    [1] 2006-11-02 09:07:11 0 C:\Windows\System32\config\RegBack\DEFAULT.LOG2 ()



    Cannot access: C:\Windows\System32\config\RegBack\SAM.LOG1

    [1] 2011-01-28 17:18:38 262144 C:\Windows\System32\config\RegBack\SAM.LOG1 ()

    [1] 2012-06-13 10:24:16 262144 C:\Windows\System32\config\SAM.LOG1 ()



    Cannot access: C:\Windows\System32\config\RegBack\SAM.LOG2

    [1] 2006-11-02 09:07:11 0 C:\Windows\System32\config\RegBack\SAM.LOG2 ()

    [1] 2006-11-02 08:33:34 0 C:\Windows\System32\config\SAM.LOG2 ()



    Cannot access: C:\Windows\System32\config\RegBack\SECURITY.LOG1

    [1] 2012-05-28 15:08:03 262144 C:\Windows\System32\config\RegBack\SECURITY.LOG1 ()

    [1] 2012-06-13 10:26:16 262144 C:\Windows\System32\config\SECURITY.LOG1 ()



    Cannot access: C:\Windows\System32\config\RegBack\SECURITY.LOG2

    [1] 2006-11-02 09:06:26 0 C:\Windows\System32\config\RegBack\SECURITY.LOG2 ()

    [1] 2006-11-02 08:33:34 0 C:\Windows\System32\config\SECURITY.LOG2 ()



    Cannot access: C:\Windows\System32\config\RegBack\SOFTWARE.LOG1

    [1] 2012-05-28 15:08:17 262144 C:\Windows\System32\config\RegBack\SOFTWARE.LOG1 ()

    [1] 2012-06-13 14:19:00 262144 C:\Windows\System32\config\SOFTWARE.LOG1 ()



    Cannot access: C:\Windows\System32\config\RegBack\SOFTWARE.LOG2

    [1] 2006-11-02 09:06:57 0 C:\Windows\System32\config\RegBack\SOFTWARE.LOG2 ()

    [1] 2012-05-26 23:38:30 262144 C:\Windows\System32\config\SOFTWARE.LOG2 ()



    Cannot access: C:\Windows\System32\config\RegBack\SYSTEM.LOG1

    [1] 2012-05-28 15:08:22 1310720 C:\Windows\System32\config\RegBack\SYSTEM.LOG1 ()

    [1] 2012-06-13 13:56:05 262144 C:\Windows\System32\config\SYSTEM.LOG1 ()



    Cannot access: C:\Windows\System32\config\RegBack\SYSTEM.LOG2

    [1] 2006-11-02 09:07:11 0 C:\Windows\System32\config\RegBack\SYSTEM.LOG2 ()

    [1] 2006-11-02 08:33:34 0 C:\Windows\System32\config\SYSTEM.LOG2 ()



    Cannot access: C:\Windows\System32\config\SAM.LOG

    [1] 2007-11-06 16:59:48 0 C:\Windows\Debug\sam.log ()

    [1] 2006-11-02 06:35:37 1024 C:\Windows\System32\config\SAM.LOG ()



    Cannot access: C:\Windows\System32\config\SECURITY.LOG

    [1] 2006-11-02 06:35:37 1024 C:\Windows\System32\config\SECURITY.LOG ()



    Cannot access: C:\Windows\System32\config\SECURITY.SAV

    [1] 2007-11-06 16:41:13 20480 C:\Windows\System32\config\SECURITY.SAV ()



    Cannot access: C:\Windows\System32\config\SOFTWARE.LOG

    [1] 2012-06-04 13:06:26 1024 C:\Windows\System32\config\SOFTWARE.LOG ()



    Cannot access: C:\Windows\System32\config\SOFTWARE.SAV

    [1] 2007-11-06 16:41:20 15556608 C:\Windows\System32\config\SOFTWARE.SAV ()



    Cannot access: C:\Windows\System32\config\SYSTEM.LOG

    [1] 2012-06-04 13:06:26 1024 C:\Windows\System32\config\SYSTEM.LOG ()



    Cannot access: C:\Windows\System32\config\SYSTEM.SAV

    [1] 2007-11-06 16:41:21 6012928 C:\Windows\System32\config\SYSTEM.SAV ()



    Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat

    [1] 2012-06-13 10:26:47 262144 C:\Windows\ServiceProfiles\LocalService\ntuser.dat ()

    [1] 2012-06-13 10:26:55 524288 C:\Windows\ServiceProfiles\NetworkService\ntuser.dat ()

    [1] 2012-06-08 04:47:06 262144 C:\Windows\System32\config\systemprofile\ntuser.dat ()



    Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat.LOG

    [1] 2006-11-02 11:28:20 1024 C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG ()

    [1] 2006-11-02 11:28:20 1024 C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG ()

    [1] 2006-11-02 11:28:20 1024 C:\Windows\System32\config\systemprofile\ntuser.dat.LOG ()



    Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat.LOG1

    [1] 2012-06-13 10:26:46 136192 C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 ()

    [1] 2012-06-13 10:26:53 262144 C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 ()

    [1] 2011-04-05 22:43:31 9216 C:\Windows\System32\config\systemprofile\ntuser.dat.LOG1 ()



    Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat.LOG2

    [1] 2006-11-02 08:47:53 0 C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG2 ()

    [1] 2006-11-02 08:47:52 0 C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG2 ()

    [1] 2006-11-02 08:43:31 0 C:\Windows\System32\config\systemprofile\ntuser.dat.LOG2 ()



    Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TM.blf

    [1] 2011-04-05 22:43:31 65536 C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TM.blf ()



    Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms

    [1] 2011-04-05 22:43:31 524288 C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms ()



    Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms

    [1] 2007-11-06 16:54:22 524288 C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms ()



    Cannot access: C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.0.regtrans-ms

    [1] 2011-06-16 08:57:17 5242880 C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.0.regtrans-ms ()



    Cannot access: C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.1.regtrans-ms

    [1] 2011-01-30 07:36:13 5242880 C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.1.regtrans-ms ()



    Cannot access: C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.2.regtrans-ms

    [1] 2011-02-26 10:14:26 5242880 C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.2.regtrans-ms ()



    Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101A}.TxR.3.regtrans-ms

    [1] 2012-06-13 10:23:18 5242880 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101A}.TxR.3.regtrans-ms ()



    Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101A}.TxR.4.regtrans-ms

    [1] 2011-01-30 07:36:13 5242880 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101A}.TxR.4.regtrans-ms ()



    Cannot access: C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.blf

    [1] 2012-06-13 10:23:18 65536 C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.blf ()



    Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf

    [1] 2012-06-13 10:23:02 65536 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf ()



    Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms

    [1] 2011-05-03 03:49:39 524288 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms ()



    Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms

    [1] 2012-06-13 10:23:02 524288 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms ()



    Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000003.regtrans-ms

    [1] 2011-07-14 03:28:39 524288 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000003.regtrans-ms ()



    Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000004.regtrans-ms

    [1] 2012-06-05 10:49:40 524288 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000004.regtrans-ms ()



    Cannot access: C:\Windows\System32\DriverStore\FileRepository\netrtx32.inf_f093b1d0\netrtx32.PNF

    [1] 2012-06-02 11:05:33 24256 C:\Windows\inf\netrtx32.PNF ()

    [1] 2012-06-02 11:05:32 24256 C:\Windows\System32\DriverStore\FileRepository\netrtx32.inf_f093b1d0\netrtx32.PNF ()



    Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl

    [1] 2012-06-13 10:24:43 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl ()



    Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl

    [1] 2012-06-13 10:24:10 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl ()



    Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl

    [1] 2012-06-13 10:24:10 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl ()



    Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl

    [1] 2012-06-13 10:24:10 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl ()



    Cannot access: C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_16.bin

    [1] 2012-04-21 19:48:23 1112 C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_16.bin ()



    Cannot access: C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_24.bin

    [1] 2012-04-21 19:48:23 2456 C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_24.bin ()



    Cannot access: C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_32.bin

    [1] 2012-04-21 19:48:23 4280 C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_32.bin ()



    Cannot access: C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_48.bin

    [1] 2012-04-21 19:48:23 9560 C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_48.bin ()



    Cannot access: C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_16.bin

    [1] 2012-06-09 19:42:09 1112 C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_16.bin ()



    Cannot access: C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_24.bin

    [1] 2012-06-09 19:42:09 2456 C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_24.bin ()



    Cannot access: C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_32.bin

    [1] 2012-06-09 19:42:09 4280 C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_32.bin ()



    Cannot access: C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_48.bin

    [1] 2012-06-09 19:42:09 9560 C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_48.bin ()



    Cannot access: C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_16.bin

    [1] 2012-05-05 20:05:59 1112 C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_16.bin ()



    Cannot access: C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_24.bin

    [1] 2012-05-05 20:05:59 2456 C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_24.bin ()



    Cannot access: C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_32.bin

    [1] 2012-05-05 20:05:59 4280 C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_32.bin ()



    Cannot access: C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_48.bin

    [1] 2012-05-05 20:05:59 9560 C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_48.bin ()



    Cannot access: C:\Windows\System32\spool\drivers\w32x86\3\msonpdrv.dll

    [1] 2006-10-26 23:56:16 864080 C:\Windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSONPDRV.DLL (Microsoft Corporation)

    [1] 2009-02-27 04:42:02 863128 C:\Windows\System32\spool\drivers\w32x86\3\msonpdrv.dll ()

    [1] 2009-02-27 04:42:02 863128 C:\Windows\System32\spool\drivers\w32x86\msonpdrv.dll (Microsoft Corporation)



    Cannot access: C:\Windows\System32\spool\drivers\w32x86\3\msonpui.dll

    [1] 2006-10-26 23:56:14 67408 C:\Windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSONPUI.DLL (Microsoft Corporation)

    [1] 2009-02-27 04:42:04 66440 C:\Windows\System32\spool\drivers\w32x86\3\msonpui.dll ()

    [1] 2009-02-27 04:42:04 66440 C:\Windows\System32\spool\drivers\w32x86\msonpui.dll (Microsoft Corporation)



    Cannot access: C:\Windows\System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan

    [1] 2012-06-12 10:24:42 3504 C:\Windows\System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan ()



    Cannot access: C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

    [1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



    Cannot access: C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

    [1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



    Cannot access: C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

    [1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



    Cannot access: C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

    [1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



    Cannot access: C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

    [1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



    Cannot access: C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

    [1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

    [1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



    Cannot access: C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{47cb6cb0-c5ff-493a-a179-954101c9ee05}\krundown.etl

    [1] 2012-06-13 10:32:55 2359296 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{47cb6cb0-c5ff-493a-a179-954101c9ee05}\krundown.etl ()

    [1] 2012-06-12 20:56:14 2424832 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{eab453ee-1a8e-43ff-87ae-974ec71eff1c}\krundown.etl ()

    [1] 2012-06-11 20:19:04 2949120 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{f5603adf-9ef2-4cdb-b34e-9962801dccc1}\krundown.etl ()



    Cannot access: C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{47cb6cb0-c5ff-493a-a179-954101c9ee05}\ksnapshot.etl

    [1] 2012-06-13 10:32:56 4128768 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{47cb6cb0-c5ff-493a-a179-954101c9ee05}\ksnapshot.etl ()

    [1] 2012-06-12 20:56:15 4128768 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{eab453ee-1a8e-43ff-87ae-974ec71eff1c}\ksnapshot.etl ()

    [1] 2012-06-11 20:19:05 4128768 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{f5603adf-9ef2-4cdb-b34e-9962801dccc1}\ksnapshot.etl ()



    Cannot access: C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{eab453ee-1a8e-43ff-87ae-974ec71eff1c}\krundown.etl

    [1] 2012-06-13 10:32:55 2359296 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{47cb6cb0-c5ff-493a-a179-954101c9ee05}\krundown.etl ()

    [1] 2012-06-12 20:56:14 2424832 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{eab453ee-1a8e-43ff-87ae-974ec71eff1c}\krundown.etl ()

    [1] 2012-06-11 20:19:04 2949120 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{f5603adf-9ef2-4cdb-b34e-9962801dccc1}\krundown.etl ()



    Cannot access: C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{eab453ee-1a8e-43ff-87ae-974ec71eff1c}\ksnapshot.etl


    descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

    more_horiz
    Well, I'm 30 minutes in on the new scan, and it's giving me the same exact scan....same results, but still scanning

    descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

    more_horiz
    Let's go to OTL at this time. Post a new log please.

    descriptionRoot Kit....Zero Access - Page 7 EmptyRe: Root Kit....Zero Access

    more_horiz
    privacy_tip Permissions in this forum:
    You cannot reply to topics in this forum