What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Slow win7 rig + multiple lsass.exe instances

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Step 1. Please tell us what issues you're having with your computer:

I am experiencing continuous freezes and "grey outs" that seem to propagate from one program to another once they start until I have to hard reboot the machine, restart again and then I can work on it once more. Only to experience the issue again after a couple of hours.

Also I have found some suspicious processes in hijackthis I'd like to know what they are.

Step 2. Download DDS and post the scan results using Copy / Paste.
I have attached the hijackthis log to the post and the DDS is below as per instructions

These are the lines containing lsass.exe from my hijackthis log:
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

I wanted also to make a not that at the moment I am using an illegal patch that';s usually used to run pirated copies of Office 2010. In my case the copy of Office 2010 is legal, but it Doesn't work and I have been dealing with Microsoft for the past month. MS office won't open unless I run it as administrator and will not open from a file. I have to open all files from the program or it wants to install Office all over each time. Somehow using the pirated copy activation patch allows me to run Office normally while every fix from Microsoft hasn't worked so far.
I cannot function without MS office and opening all files from the program is a pain so IO have to run this patch which I think is a "demo extender". In hijackthis the line for that patch is:

O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe

This is reported as malware on some sites.

Here is the DDS, thank you very much for your help.


———————————————–
DDS (Ver_10-03-17.01) - NTFSX64
Run by [removed] at 21:01:56.22 on 2010-06-07
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_20
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.8126.581 [GMT -7:00]


============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Program Files (x86)\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files (x86)\Cobian Backup 10\cbVSCService.exe
C:\Windows\System32\M-AudioTaskBarIcon.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\Citrix\GoToMeeting\457\g2mstart.exe
C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Gladinet\Gladinet Cloud Desktop\GladFileMonSvc.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\MozyHome\mozybackup.exe
C:\Program Files (x86)\Citrix\GoToMeeting\457\g2mcomm.exe
C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe
C:\Program Files (x86)\Citrix\GoToMeeting\457\g2mlauncher.exe
c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Program Files\MozyHome\mozystat.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Gladinet\Gladinet Cloud Desktop\GladinetClient.exe
C:\Windows\system32\Wacom_Tablet.exe
C:\Windows\SysWOW64\Tweak7SystemService.exe
C:\Windows\system32\WTablet\Wacom_TabletUser.exe
C:\Windows\system32\Wacom_Tablet.exe
C:\Program Files (x86)\PhraseExpress\phraseexpress.exe
C:\Program Files (x86)\TechSmith\Snagit 10\Snagit32.exe
C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe
C:\Program Files\GPSoftware\Directory Opus\dopus.exe
C:\Program Files (x86)\BUFFALO\NASNAVI\nassche.exe
C:\Program Files (x86)\Java\jre6\launch4j-tmp\fanurio.exe
C:\Program Files (x86)\stickies\stickies.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
C:\Windows\SysWOW64\vmnat.exe
C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe
C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Cobian Backup 10\Cobian.exe
C:\Program Files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\GPSoftware\Directory Opus\dopusx64.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\TechSmith\Snagit 10\TSCHelp.exe
C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
C:\Program Files (x86)\Gladinet\Gladinet Cloud Desktop\GladinetPluginHost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\SysWOW64\vmnetdhcp.exe
C:\Program Files (x86)\Cobian Backup 10\cbInterface.exe
C:\Program Files\MozyHome\mozybackup.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\TechSmith\Snagit 10\SnagPriv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files (x86)\TechSmith\Snagit 10\snagiteditor.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Windows\splwow64.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\Norton Security Suite\Engine\4.0.0.127\ccSvcHst.exe
C:\Program Files (x86)\Norton Security Suite\Engine\4.0.0.127\ccSvcHst.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Siber Systems\GoodSync\GoodSync.exe
C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS4\Dreamweaver.exe
C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\msdtc.exe
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\GPSoftware\Directory Opus\Viewers\docsvw32.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Users\Conticreative\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
C:\Users\Conticreative\AppData\Local\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\Conticreative\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
C:\Windows\explorer.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\DeviceDisplayObjectProvider.exe
C:\Windows\system32\mmc.exe
C:\Windows\system32\vssvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Conticreative\Desktop\Antivir-rescue\Installation files\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.bing.com/
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\syswow64\blank.htm
uInternet Settings,ProxyOverride = *.local;127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mWinlogon: Userinit=c:\windows\syswow64\Userinit.exe
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files (x86)\techsmith\snagit 10\SnagitBHO.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files (x86)\adobe\/Adobe Contribute CS4/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files (x86)\norton security suite\engine\4.0.0.127\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files (x86)\norton security suite\engine\4.0.0.127\IPSBHO.DLL
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files (x86)\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files (x86)\siber systems\ai roboform\roboform.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~2\micros~1\office14\GROOVEEX.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: FoxmarksDLLBHO Class: {a2a71aba-3939-43b2-bd8f-8c1767ef9020} - c:\program files (x86)\xmarks\ie extension\foxmarksdll.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files (x86)\google\google toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files (x86)\google\googletoolbarnotifier\5.5.5126.1836\swg.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~2\micros~1\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files (x86)\google\google gears\internet explorer\0.5.36.0\gears.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files (x86)\windows live\toolbar\wltcore.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files (x86)\siber systems\ai roboform\roboform.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files (x86)\adobe\/Adobe Contribute CS4/contributeieplugin.dll
TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files (x86)\techsmith\snagit 10\SnagitIEAddin.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files (x86)\windows live\toolbar\wltcore.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files (x86)\google\google toolbar\GoogleToolbar_32.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files (x86)\norton security suite\engine\4.0.0.127\coIEPlg.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
EB: Developer Tools: {1a6fe369-f28c-4ad9-a3e6-2bcb50807cf1} - c:\program files (x86)\internet explorer\iedvtool.dll
{52e729d7-dffb-4011-97ee-d7e28212d901}
uRun: [RoboForm] "c:\program files (x86)\siber systems\ai roboform\RoboTaskBarIcon.exe"
uRun: [Directory Opus Desktop Dblclk] "c:\program files\gpsoftware\directory opus\dopusrt.exe" /dblclk
uRun: [Windows Live Sync] "c:\program files (x86)\windows live\sync\WindowsLiveSync.exe" /background
uRun: [Skype] "c:\program files (x86)\skype\phone\Skype.exe" /nosplash /minimized
uRun: [ISUSPM Startup] c:\progra~2\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [IJNetworkScanUtility] c:\program files (x86)\canon\canon ij network scan utility\CNMNSUT.EXE
mRun: [Carbonite Backup] c:\program files (x86)\carbonite\carbonite backup\CarboniteUI.exe
mRun: [Cobian Backup 10] "c:\program files (x86)\cobian backup 10\Cobian.exe"
mRun: [iTunesHelper] "c:\program files (x86)\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files (x86)\common files\java\java update\jusched.exe"
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files (x86)\malwarebytes' anti-malware\mbamgui.exe /install /silent
mRunOnce: [InnoSetupRegFile.0000000001] "c:\windows\is-S8689.exe" /REG
StartupFolder: c:\users\contic~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\buffal~1.lnk - c:\program files (x86)\buffalo\nasnavi\NasNavi.exe
StartupFolder: c:\users\contic~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\direct~1.lnk - c:\program files\gpsoftware\directory opus\dopus.exe
StartupFolder: c:\users\contic~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\fanuri~1.lnk - c:\program files (x86)\fanurio\fanurio.exe
StartupFolder: c:\users\contic~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\nassch~1.lnk - c:\program files (x86)\buffalo\nasnavi\nassche.exe
StartupFolder: c:\users\contic~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\stickies.lnk - c:\program files (x86)\stickies\stickies.exe
StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\gladin~1.lnk - c:\windows\installer\{21957126-965a-4135-90de-1ccb95034a78}\_316788159D3CE6442F7D94.exe
StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\mozyho~1.lnk - c:\program files\mozyhome\mozystat.exe
StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\phrase~1.lnk - c:\program files (x86)\phraseexpress\phraseexpress.exe
StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\snagit~1.lnk - c:\program files (x86)\techsmith\snagit 10\Snagit32.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-explorer: EnableShellExecuteHooks = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to &Evernote - c:\program files (x86)\evernote\evernote3.5\enbar.dll/2000
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~2\micros~1\office14\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files (x86)\siber systems\ai roboform\RoboFormComFillForms.html
IE: Google Sidewiki… - c:\program files (x86)\google\google toolbar\component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html
IE: Se&nd to OneNote - c:\progra~2\micros~1\office14\ONBttnIE.dll/105
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files (x86)\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files (x86)\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files (x86)\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files (x86)\google\google gears\internet explorer\0.5.36.0\gears.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files (x86)\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files (x86)\microsoft office\office14\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files (x86)\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - c:\program files (x86)\evernote\evernote3.5\enbar.dll
LSP: c:\program files (x86)\vmware\vmware player\vsocklib.dll
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~2\micros~1\office14\GROOVEEX.DLL
SEH: Directory Opus Shell Execute Hook: {ee761688-c137-4b04-8fab-3c9cdf0886f0} - c:\program files\gpsoftware\directory opus\dopuslib32.dll
LSA: Authentication Packages = msv1_0 relog_ap
BHO-X64: SnagIt Toolbar Loader: {00C6482D-C502-44C8-8409-FCE54AD9C208} - c:\program files (x86)\techsmith\snagit 10\dllx64\SnagitBHO64.dll
BHO-X64: Windows Live Family Safety Browser Helper Class: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - c:\program files\windows live\family safety\fssbho.dll
BHO-X64: Windows Live Family Safety Browser Helper - No File
BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\progra~1\micros~1\office14\GROOVEEX.DLL
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files (x86)\google\google toolbar\GoogleToolbar_64.dll
BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg64.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\progra~1\micros~1\office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
TB-X64: Snagit: {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - c:\program files (x86)\techsmith\snagit 10\dllx64\SnagitIEAddin64.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files (x86)\google\google toolbar\GoogleToolbar_64.dll
TB-X64: {724D43A0-0D85-11D4-9908-00400523E39A} - No File
TB-X64: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
TB-X64: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
TB-X64: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
EB-X64: {1A6FE369-F28C-4AD9-A3E6-2BCB50807CF1} - No File
EB-X64: {52E729D7-DFFB-4011-97EE-D7E28212D901} - No File
mRun-x64: [M-Audio Taskbar Icon] c:\windows\system32\M-AudioTaskBarIcon.exe
mRun-x64: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey
mRun-x64: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
STS-X64: FencesShlExt Class: {1984DD45-52CF-49cd-AB77-18F378FEA264} - c:\program files (x86)\stardock\fences\FencesMenu64.dll
SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\progra~1\micros~1\office14\GROOVEEX.DLL
SEH-X64: Directory Opus Shell Execute Hook: {3CF9ECE0-1A9F-11D2-8C73-00C06C2005DE} - c:\program files\gpsoftware\directory opus\dopuslib.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\contic~1\appdata\roaming\mozilla\firefox\profiles\kdnb6m5y.conticreative web dev\
FF - prefs.js: browser.startup.homepage - hxxp://mail.google.com/mail/#inbox
FF - component: c:\program files (x86)\google\google gears\firefox\lib\ff36\gears.dll
FF - component: c:\program files (x86)\siber systems\ai roboform\firefox\components\rfproxy_31.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\coffplgn\components\coFFPlgn.dll
FF - component: c:\users\conticreative\appdata\roaming\mozilla\firefox\profiles\kdnb6m5y.conticreative web dev\extensions\{16f796dd-a279-4548-9b3a-393d1eef31df}\platform\winnt\components\imageassistant.dll
FF - component: c:\users\conticreative\appdata\roaming\mozilla\firefox\profiles\kdnb6m5y.conticreative web dev\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\users\conticreative\appdata\roaming\mozilla\firefox\profiles\kdnb6m5y.conticreative web dev\extensions\{463f6ca5-ee3c-4be1-b7e6-7fee11953374}\platform\winnt\components\FoxyTunes.dll
FF - component: c:\users\conticreative\appdata\roaming\mozilla\firefox\profiles\kdnb6m5y.conticreative web dev\extensions\{81bf1d23-5f17-408d-ac6b-bd6df7caf670}\components\XpcomOpusConnector.dll
FF - component: c:\users\conticreative\appdata\roaming\mozilla\firefox\profiles\kdnb6m5y.conticreative web dev\extensions\{9ee802e8-c931-47ab-b570-aa8f791598ca}\components\FFExternalAlert.dll
FF - component: c:\users\conticreative\appdata\roaming\mozilla\firefox\profiles\kdnb6m5y.conticreative web dev\extensions\{9ee802e8-c931-47ab-b570-aa8f791598ca}\components\RadioWMPCore.dll
FF - component: c:\users\conticreative\appdata\roaming\mozilla\firefox\profiles\kdnb6m5y.conticreative web dev\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc_fireftp.dll
FF - component: c:\users\conticreative\appdata\roaming\mozilla\firefox\profiles\kdnb6m5y.conticreative web dev\extensions\{e0b8c461-f8fb-49b4-8373-fe32e9252800}\platform\winnt_x86-msvc\components\enbar3.dll
FF - component: c:\users\conticreative\appdata\roaming\mozilla\firefox\profiles\kdnb6m5y.conticreative web dev\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\winnt_x86-msvc\components\pagespeed.dll
FF - component: c:\users\conticreative\appdata\roaming\mozilla\firefox\profiles\kdnb6m5y.conticreative web dev\extensions\{eecba28f-b68b-4b3a-b501-6ce12e6b8696}\platform\winnt_x86-msvc\components\winprocess.dll
FF - plugin: c:\progra~2\micros~1\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~2\micros~1\office14\NPSPWRAP.DLL
FF - plugin: c:\program files (x86)\emusic download manager\plugin\npemusic.dll
FF - plugin: c:\program files (x86)\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files (x86)\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files (x86)\google\update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files (x86)\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files (x86)\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files (x86)\microsoft\office live\npOLW.dll
FF - plugin: c:\program files (x86)\opera\program\plugins\np_gp.dll
FF - plugin: c:\program files (x86)\tabletplugins\npwacom.dll
FF - plugin: c:\program files (x86)\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\conticreative\appdata\local\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\users\conticreative\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\windows\system32\wat\npWatWeb.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
user_pref('capability.policy.policynames', 'localfilelinks');user_pref('capability.policy.localfilelinks.sites', 'hxxp://www.webmynd.com http://www.bing.com http://search.yahoo.com http://www.google.com');user_pref('…ri.enabled', 'allAccess');c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 PxHlpa64;PxHlpa64;c:\windows\system32\drivers\PxHlpa64.sys [2009-10-25 55280]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360x64\0400000.07f\SymDS64.sys [2010-6-7 433200]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360x64\0400000.07f\SymEFA64.sys [2010-6-7 221232]
R1 BHDrvx64;BHDrvx64;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\bashdefs\20100429.001\BHDrvx64.sys [2010-4-29 678448]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360x64\0400000.07f\cchpx64.sys [2010-6-7 615040]
R1 IDSVia64;IDSVia64;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\ipsdefs\20100528.003\IDSviA64.sys [2010-5-28 463408]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-10-24 308296]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 173984]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360x64\0400000.07f\Ironx64.sys [2010-6-7 148528]
R1 SYMTDIV;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\n360x64\0400000.07f\symtdiv.sys [2010-6-7 451120]
R2 cbVSCService;Cobian Backup 10 Volume Shadow Copy service;c:\program files (x86)\cobian backup 10\cbVSCService.exe [2010-6-5 67584]
R2 GladFileMonSvc;GladFileMonSvc;c:\program files (x86)\gladinet\gladinet cloud desktop\GladFileMonSvc.exe [2010-5-8 26984]
R2 N360;Norton Security Suite;c:\program files (x86)\norton security suite\engine\4.0.0.127\ccSvcHst.exe [2010-6-7 126392]
R2 NasPmService;NAS PM Service;c:\program files (x86)\buffalo\nasnavi\nassvc.exe -service_execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 –> c:\program files (x86)\buffalo\nasnavi\nassvc.exe -Service_Execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 [?]
R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2009-10-29 6245744]
R2 Tweak7SystemService;Tweak7SystemService;c:\windows\system32\tweak7systemservice.exe –> c:\windows\system32\Tweak7SystemService.exe [?]
R2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\common files\vmware\usb\vmware-usbarbitrator.exe [2010-1-22 563760]
R3 gbridge;Gbridge Virtual Miniport;c:\windows\system32\drivers\gbridge64.sys [2009-10-12 48192]
R3 lvpepf64;Volume Adapter;c:\windows\system32\drivers\lv302a64.sys [2007-5-9 16032]
R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys [2007-5-9 50208]
R3 MAUSBMOBILEPRE;Service for M-Audio MobilePre;c:\windows\system32\drivers\MAudioMobilePre.sys [2009-9-2 187912]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2009-12-2 40832]
R3 RDPDISPM;RDPDISPM;c:\windows\system32\drivers\rdpdispm.sys [2010-5-22 10576]
R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2010-4-17 134760]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2009-10-29 18216]
R3 wlcrasvc;Live Mesh Remote Desktop;c:\program files\live mesh\remote desktop\wlcrasvc.exe [2010-5-22 51024]
R4 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-11-3 24664]
R4 MBAMService;MBAMService;c:\program files (x86)\malwarebytes' anti-malware\mbamservice.exe [2010-3-30 303952]
S2 gupdate;Google Update Service (gupdate);c:\program files (x86)\google\update\GoogleUpdate.exe [2010-1-7 135664]
S2 KMService;KMService;c:\windows\system32\srvany.exe –> c:\windows\system32\srvany.exe [?]
S3 cpudrv64;cpudrv64;c:\program files (x86)\systemrequirementslab\cpudrv64.sys [2009-12-18 17864]
S3 DrmRAudio;DrmRAudio;c:\windows\system32\drivers\DrmRAudio.sys [2009-12-24 33336]
S3 DrvAgent64;DrvAgent64;c:\windows\syswow64\drivers\DrvAgent64.SYS [2010-5-20 21712]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\common files\macrovision shared\flexnet publisher\FNPLicensingService64.exe [2009-10-25 1038088]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2009-11-23 61280]
S3 fsssvc;Windows Live Family Safety Service;c:\program files (x86)\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-10-24 102472]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-10-24 40904]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-10-24 49480]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\microsoft office\office14\GROOVE.EXE [2010-1-21 30963576]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 pbfilter;pbfilter;c:\program files\peerblock\pbfilter.sys [2010-4-3 19544]
S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\tuneup utilities 2010\TuneUpUtilitiesDriver64.sys [2009-10-14 11856]
S3 US122;US122 Driver;c:\windows\system32\drivers\US122x64.sys [2009-10-25 200320]
S3 US122DL;US122 Firmware Downloader;c:\windows\system32\drivers\US122DLx64.sys [2009-10-25 20224]
S3 US122WdmService;US122 Wdm Audio;c:\windows\system32\drivers\US122Wdmx64.sys [2009-10-25 62976]
S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl64.sys [2009-8-28 49152]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-3-3 1255736]
S4 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 284016]
S4 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\tuneup utilities 2010\TuneUpUtilitiesService64.exe [2010-5-7 1403208]

=============== Created Last 30 ================

2010-06-08 03:11:11 373 —-a-w- c:\windows\is-S8689.lst
2010-06-08 03:11:11 10562 —-a-w- c:\windows\is-S8689.msg
2010-06-08 03:11:10 711168 —-a-w- c:\windows\is-S8689.exe
2010-06-08 03:09:18 0 d—–w- c:\program files (x86)\eM Client
2010-06-07 20:25:38 0 d—–w- c:\program files (x86)\common files\Symantec Shared
2010-06-07 20:11:42 34152 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-06-07 20:11:42 126312 —-a-r- c:\windows\system32\GEARAspi64.dll
2010-06-07 20:11:42 107368 —-a-r- c:\windows\syswow64\GEARAspi.dll
2010-06-07 20:11:39 854 —-a-w- c:\windows\system32\drivers\SYMEVENT64x86.INF
2010-06-07 20:11:39 7440 —-a-w- c:\windows\system32\drivers\SYMEVENT64x86.CAT
2010-06-07 20:11:39 173104 —-a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2010-06-07 20:11:00 0 d—–w- c:\program files (x86)\Norton Security Suite
2010-06-07 20:10:55 0 d—–w- c:\program files (x86)\NortonInstaller
2010-06-07 05:31:31 10224 ——w- c:\windows\system32\drivers\cdralw2k.sys
2010-06-07 05:31:31 10224 ——w- c:\windows\system32\drivers\cdr4_xp.sys
2010-06-07 05:31:27 0 d—–w- c:\program files (x86)\My Company Name
2010-06-06 21:38:33 3304 ——w- C:\bootsqm.dat
2010-06-06 06:49:31 0 d—–w- c:\program files (x86)\TuneUpMedia
2010-06-06 04:57:54 0 d—–w- c:\users\contic~1\appdata\roaming\TuneUpMedia
2010-06-06 04:57:54 0 d—–w- c:\programdata\TuneUpMedia
2010-06-06 03:32:57 0 d—–w- c:\program files\iPod
2010-06-06 03:32:53 0 d—–w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2010-06-06 03:32:53 0 d—–w- c:\program files\iTunes
2010-06-06 03:32:53 0 d—–w- c:\program files (x86)\iTunes
2010-06-06 03:12:48 0 d—–w- c:\program files\Bonjour
2010-06-04 19:29:34 66040 —-a-w- c:\windows\system32\drivers\mozy.sys
2010-06-03 20:29:43 0 d—–w- c:\program files (x86)\Aman Software
2010-06-02 07:48:47 2515 —-a-w- c:\users\contic~1\appdata\roaming\SAS7_000.DAT
2010-06-02 07:16:42 0 d—–w- c:\users\contic~1\appdata\roaming\Nuance
2010-06-02 07:13:56 0 d—–w- c:\program files (x86)\common files\Nuance
2010-06-02 07:13:01 0 d—–w- c:\programdata\Nuance
2010-06-02 07:13:01 0 d—–w- c:\program files (x86)\Nuance
2010-05-31 01:19:04 558704 —-a-w- c:\windows\syswow64\temp.00D
2010-05-31 01:19:03 954640 —-a-w- c:\windows\syswow64\temp.00C
2010-05-31 01:19:02 70656 —-a-w- c:\windows\syswow64\temp.00A
2010-05-31 01:19:02 266293 —-a-w- c:\windows\syswow64\temp.00B
2010-05-31 01:18:54 65024 —-a-w- c:\windows\syswow64\temp.009
2010-05-31 01:18:54 149504 —-a-w- c:\windows\syswow64\Mfcans32.dll
2010-05-31 01:18:54 108032 —-a-w- c:\windows\syswow64\Mfcuia32.dll
2010-05-31 01:18:53 164144 —-a-w- c:\windows\syswow64\Comct232.ocx
2010-05-31 01:18:46 17920 —-a-w- c:\windows\syswow64\temp.007
2010-05-31 01:18:46 1409024 —-a-w- c:\windows\syswow64\temp.008
2010-05-31 01:18:45 147728 —-a-w- c:\windows\syswow64\temp.006
2010-05-31 01:18:44 164112 —-a-w- c:\windows\syswow64\temp.005
2010-05-31 01:18:43 598288 —-a-w- c:\windows\syswow64\temp.004
2010-05-31 01:18:43 0 d—–w- c:\program files (x86)\WebGraphics Optimizer 4.2
2010-05-30 21:27:28 0 d—–w- c:\program files (x86)\NotepadPPPlugin
2010-05-29 07:00:27 0 d—–w- C:\GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}
2010-05-29 06:55:41 0 d—–w- c:\users\contic~1\appdata\roaming\Tweak-7
2010-05-28 00:49:22 36168 —-a-w- c:\windows\system32\uxtuneup.dll
2010-05-28 00:49:22 30024 —-a-w- c:\windows\syswow64\uxtuneup.dll
2010-05-28 00:49:21 25928 —-a-w- c:\windows\system32\authuitu.dll
2010-05-28 00:49:21 21320 —-a-w- c:\windows\syswow64\authuitu.dll
2010-05-28 00:33:21 0 d—–w- c:\users\contic~1\appdata\roaming\NetSpell
2010-05-26 12:11:44 2048 —-a-w- c:\windows\syswow64\tzres.dll
2010-05-26 12:11:44 2048 —-a-w- c:\windows\system32\tzres.dll
2010-05-25 06:13:18 411368 —-a-w- c:\windows\syswow64\deployJava1.dll
2010-05-25 06:13:18 153376 —-a-w- c:\windows\syswow64\javaws.exe
2010-05-25 06:13:18 145184 —-a-w- c:\windows\syswow64\javaw.exe
2010-05-25 06:13:17 145184 —-a-w- c:\windows\syswow64\java.exe
2010-05-25 03:15:24 0 d—–w- c:\users\contic~1\appdata\roaming\MxBoost
2010-05-25 03:13:33 0 d—–w- c:\users\contic~1\appdata\roaming\Maxthon2
2010-05-25 03:11:14 348160 —-a-w- c:\windows\syswow64\msvcr71.dll
2010-05-25 03:11:14 0 d—–w- c:\program files (x86)\Creative Element Power Tools
2010-05-25 02:01:25 0 d—–w- c:\users\contic~1\appdata\roaming\Mapi2Xml
2010-05-25 01:52:31 0 d—–w- c:\users\contic~1\appdata\roaming\Affixa
2010-05-24 01:05:07 0 d—–w- c:\users\contic~1\appdata\roaming\eM Client
2010-05-23 20:46:13 0 d—–w- c:\program files\Affixa
2010-05-23 20:46:12 0 d—–w- c:\program files (x86)\Affixa
2010-05-23 09:44:21 0 d—–w- c:\users\contic~1\appdata\roaming\Stardock
2010-05-23 09:44:08 0 dc-h–w- c:\programdata\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}
2010-05-23 09:43:58 0 d—–w- c:\program files (x86)\Stardock
2010-05-23 06:03:05 0 d—–w- c:\program files (x86)\Evernote
2010-05-23 05:30:16 140096 —-a-w- c:\windows\system32\rdpdispd.dll
2010-05-23 05:30:16 10576 —-a-w- c:\windows\system32\drivers\rdpdispm.sys
2010-05-23 05:30:04 0 d—–w- c:\program files\Live Mesh
2010-05-23 03:18:37 0 d—–w- c:\users\contic~1\appdata\roaming\PNGGauntlet
2010-05-23 01:34:22 0 d—–w- c:\program files (x86)\PNGGauntlet
2010-05-23 01:10:02 0 d—–w- c:\program files (x86)\VIMAS
2010-05-22 08:56:25 252 —-a-w- c:\windows\Gbridge.INI
2010-05-22 08:52:41 0 d—–w- c:\users\contic~1\appdata\roaming\Gbridge
2010-05-22 08:47:57 0 d—–w- c:\program files (x86)\Gbridge LLC
2010-05-22 08:01:14 0 d—–w- c:\programdata\Softland
2010-05-22 08:00:35 0 d—–w- c:\users\contic~1\appdata\roaming\Softland
2010-05-22 08:00:35 0 d—–w- c:\program files (x86)\Softland
2010-05-21 03:50:08 0 d—–w- c:\programdata\MemeoCommon
2010-05-21 03:43:00 0 d—–w- c:\users\contic~1\appdata\roaming\Memeo
2010-05-21 01:26:07 0 d—–w- c:\users\contic~1\appdata\roaming\Prism
2010-05-21 01:23:24 0 d—–w- c:\program files (x86)\Axence
2010-05-21 00:50:59 0 d—–w- c:\programdata\Innovative Solutions
2010-05-21 00:50:46 0 d—–w- c:\program files (x86)\Innovative Solutions
2010-05-21 00:12:07 0 d—–w- c:\users\contic~1\appdata\roaming\Launchy
2010-05-20 23:49:48 0 d—–w- c:\program files\SyncToy 2.1
2010-05-20 23:47:35 0 d—–w- c:\program files\Microsoft Sync Framework
2010-05-20 23:46:37 0 d—–w- c:\users\contic~1\appdata\roaming\DiskSpaceFanPro
2010-05-20 23:46:20 0 d—–w- c:\program files (x86)\DiskSpaceFan
2010-05-20 23:17:53 0 d—–w- c:\users\contic~1\appdata\roaming\IObit
2010-05-20 23:17:52 0 d—–w- c:\program files (x86)\IObit
2010-05-20 09:06:09 0 d—–w- c:\programdata\Uniblue
2010-05-20 09:05:47 0 d—–w- c:\users\contic~1\appdata\roaming\Uniblue
2010-05-20 09:05:01 0 d—–w- c:\program files (x86)\Uniblue
2010-05-20 08:29:25 0 d—–w- c:\programdata\OopsBackup
2010-05-20 06:45:45 0 d—–w- c:\users\contic~1\appdata\roaming\Wireshark
2010-05-19 21:03:59 0 d—–w- c:\program files\Wireshark
2010-05-19 06:32:09 97 —-a-w- c:\users\conticreative\installs.jsd
2010-05-19 06:31:41 80 ——w- c:\users\conticreative\.userCfgIni8JaB
2010-05-19 06:26:14 0 d—–w- c:\program files (x86)\JaBack8
2010-05-19 04:54:55 0 d—–w- c:\program files\LopeSoft
2010-05-19 04:48:53 1610 —-a-w- c:\windows\Sandboxie.ini
2010-05-19 04:48:39 0 d—–w- c:\program files\Sandboxie
2010-05-19 01:55:00 0 d—–w- c:\program files (x86)\DirPrintOK
2010-05-18 19:28:06 0 d—–w- c:\program files\Microsoft IntelliType Pro
2010-05-18 17:22:05 0 d—–w- c:\users\contic~1\appdata\roaming\Thinstall
2010-05-18 17:16:56 0 d—–w- c:\program files (x86)\Xilisoft
2010-05-18 16:50:26 0 d—–w- c:\programdata\eSellerate
2010-05-18 16:49:17 0 d—–w- c:\program files (x86)\SmartSound Software
2010-05-18 16:49:14 0 d—–w- c:\programdata\SmartSound Software Inc
2010-05-18 16:47:24 0 d—–w- c:\windows\RegisteredPackages
2010-05-18 16:47:21 0 d–h–w- c:\windows\msdownld.tmp
2010-05-18 16:46:53 0 d—–w- c:\programdata\InterVideo
2010-05-18 16:38:43 0 d—–w- c:\program files (x86)\Windows Media Components
2010-05-18 16:37:46 0 d—–w- c:\programdata\Ulead Systems
2010-05-18 16:37:44 0 d—–w- c:\program files (x86)\common files\Ulead Systems
2010-05-17 07:27:45 0 d—–w- c:\users\contic~1\appdata\roaming\CS Odessa
2010-05-17 07:27:43 0 d—–w- c:\users\contic~1\appdata\roaming\ConceptDraw MINDMAP
2010-05-17 07:26:17 0 d—–w- c:\users\contic~1\appdata\roaming\ConceptDraw MindMap 6
2010-05-17 07:25:07 0 d—–w- c:\users\contic~1\appdata\roaming\ConceptDraw Project 5
2010-05-17 07:10:32 0 d—–w- c:\users\contic~1\appdata\roaming\CSOdessa
2010-05-17 07:06:15 0 d—–w- c:\program files (x86)\ConceptDraw Office
2010-05-17 06:20:00 0 d—–r- c:\users\conticreative\Virtual Machines
2010-05-17 05:57:41 80944 —-a-w- c:\windows\system32\drivers\vmci.sys
2010-05-17 05:57:35 18480 —-a-w- c:\windows\system32\drivers\VMparport.sys
2010-05-17 05:57:33 68656 —-a-w- c:\windows\system32\drivers\vmx86.sys
2010-05-17 05:57:02 55344 —-a-w- c:\windows\system32\vnetinst.dll
2010-05-17 05:57:02 20016 —-a-w- c:\windows\system32\drivers\vmnetadapter.sys
2010-05-17 05:55:59 37680 —-a-w- c:\windows\system32\drivers\vmusb.sys
2010-05-17 05:55:53 1024 —-a-w- C:\.rnd
2010-05-17 05:55:34 0 d—–w- c:\program files (x86)\common files\VMware
2010-05-17 05:55:14 0 d—–w- c:\programdata\VMware
2010-05-17 05:54:59 0 d—–w- c:\program files (x86)\VMware
2010-05-17 04:40:16 0 d—–w- c:\program files (x86)\Windows Virtual PC
2010-05-17 04:06:28 15872 —-a-w- c:\windows\system32\vpchbuspipe.dll
2010-05-17 04:05:37 95232 —-a-w- c:\windows\system32\drivers\vpcusb.sys
2010-05-17 04:05:37 66304 —-a-w- c:\windows\system32\drivers\vpcnfltr.sys
2010-05-17 04:05:37 187904 —-a-w- c:\windows\system32\drivers\vpchbus.sys
2010-05-17 04:05:35 793600 —-a-w- c:\windows\syswow64\vmsal.exe
2010-05-17 04:05:35 562176 —-a-w- c:\windows\system32\VMCPropertyHandler.dll
2010-05-17 04:05:35 1369600 —-a-w- c:\windows\system32\VPCSettings.exe
2010-05-17 04:05:22 936448 —-a-w- c:\windows\system32\vmsal.exe
2010-05-17 04:04:18 0 d—–w- c:\program files\Windows XP Mode
2010-05-15 04:14:33 0 d—–w- c:\users\conticreative\.argouml
2010-05-14 22:09:59 0 d—–w- c:\windows\system32\inf32
2010-05-14 22:09:59 0 d—–w- c:\users\contic~1\appdata\roaming\GPSoftware
2010-05-14 22:06:10 0 d—–w- c:\programdata\GPSoftware
2010-05-14 22:06:07 0 d—–w- c:\program files\GPSoftware
2010-05-14 19:38:55 0 d—–w- c:\users\contic~1\appdata\roaming\LockHunter
2010-05-14 19:38:19 0 d—–w- c:\program files\LockHunter
2010-05-14 19:28:20 0 d—–w- c:\program files (x86)\Unlocker
2010-05-14 18:43:37 1748 —-a-w- c:\windows\system32\Wacom_Tablet.dat
2010-05-13 18:52:40 8192 —-a-w- c:\windows\syswow64\srvany.exe
2010-05-13 08:31:12 0 d—–w- c:\program files (x86)\Microsoft Synchronization Services
2010-05-13 08:30:31 0 d—–w- c:\windows\PCHEALTH
2010-05-13 08:19:36 0 d—–w- c:\program files (x86)\Microsoft Analysis Services
2010-05-13 07:26:10 1335 —-a-w- c:\windows\system32\reset.cmd
2010-05-13 07:21:13 1331 —-a-w- c:\users\conticreative\reset.cmd
2010-05-13 07:16:03 0 d—–w- c:\program files (x86)\Windows Resource Kits
2010-05-12 00:19:26 976896 —-a-w- c:\windows\system32\inetcomm.dll
2010-05-12 00:19:25 740864 —-a-w- c:\windows\syswow64\inetcomm.dll
2010-05-10 04:43:26 394 –sha-r- c:\users\conticreative\ntuser.pol
2010-05-09 06:19:53 0 d—–w- c:\program files (x86)\VideoLAN
2010-05-09 06:13:58 0 d—–w- c:\program files (x86)\FreeZ Online TV

==================== Find3M ====================

2010-05-18 17:27:53 9392 –sha-w- c:\programdata\KGyGaAvL.sys
2010-05-18 17:07:43 88 –sh–r- c:\programdata\D6F863674B.sys
2010-05-11 16:33:47 72080 —-a-w- c:\users\conticreative\g2mdlhlpx.exe
2010-05-08 02:32:40 237568 —-a-w- c:\windows\syswow64\rmc_rtspdl.dll
2010-05-08 02:32:40 156672 —-a-w- c:\windows\syswow64\rmc_fixasf.exe
2010-05-07 16:06:48 34632 —-a-w- c:\windows\system32\TURegOpt.exe
2010-05-06 17:36:38 270208 ——w- c:\windows\system32\MpSigStub.exe
2010-04-29 22:39:28 24664 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-08 20:33:00 95520 —-a-w- c:\windows\system32\dnssd.dll
2010-04-08 20:33:00 119584 —-a-w- c:\windows\system32\dns-sd.exe
2010-04-08 20:20:02 91424 —-a-w- c:\windows\syswow64\dnssd.dll
2010-04-08 20:20:02 107808 —-a-w- c:\windows\syswow64\dns-sd.exe
2010-04-07 21:37:30 5816 —-a-w- c:\windows\syswow64\casigmgr32s.dll
2010-04-04 01:42:00 61032 —-a-w- c:\windows\system32\nvshext.dll
2010-04-04 01:42:00 159336 —-a-w- c:\windows\system32\nvvsvc.exe
2010-04-04 01:42:00 14828648 —-a-w- c:\windows\system32\nvcpl.dll
2010-04-04 01:42:00 116328 —-a-w- c:\windows\system32\nvmctray.dll
2010-04-04 01:42:00 1067624 —-a-w- c:\windows\system32\nvsvc64.dll
2010-03-28 12:26:49 238232 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-03-20 01:03:20 2770432 —-a-w- c:\windows\system32\python26.dll
2010-03-13 07:55:06 52504 —-a-w- c:\windows\fonts\shagade.ttf
2009-12-24 05:35:54 140844 —-a-w- c:\program files (x86)\uninstal.log
2009-10-28 00:47:26 604 —ha-w- c:\program files (x86)\STLL Notifier
2009-07-14 05:37:38 31548 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 05:37:38 31548 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 05:37:38 291294 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 05:37:38 291294 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:54:24 174 –sha-w- c:\program files\desktop.ini
2009-07-14 04:54:24 174 –sha-w- c:\program files (x86)\desktop.ini
2009-07-14 01:00:34 291294 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 01:00:34 291294 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 01:00:32 31548 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 01:00:32 31548 —-a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 20:44:08 9633792 –sha-r- c:\windows\fonts\StaticCache.dat
2009-10-27 17:17:45 0 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\tfsstore\tfs_dav\svchost0.exe
2009-10-26 20:03:09 0 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\tfsstore\tfs_dav\svchost1.exe
2009-10-27 17:17:45 0 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\tfsstore\tfs_dav\svchost2.exe
2009-10-27 17:38:40 0 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\tfsstore\tfs_dav\svchost4.exe
2009-10-29 18:06:37 0 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\tfsstore\tfs_dav\svchost5.exe
2009-10-29 18:56:22 0 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\tfsstore\tfs_dav\svchost6.exe
2009-10-29 19:27:10 0 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\tfsstore\tfs_dav\svchost7.exe
2009-10-30 05:53:00 0 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\tfsstore\tfs_dav\svchost8.exe
2010-01-22 11:22:14 245760 –sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2010-01-22 11:22:07 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2007-03-09 08:12:32 27648 –sha-w- c:\windows\syswow64\AVSredirect.dll
2009-07-14 01:39:53 398848 –sha-w- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\WinMail.exe
2009-07-14 01:14:45 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 21:04:38.52 ===============
Post #2
Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under the Custom Scan box paste this in


    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\drivers\*.sys /90
    CREATERESTOREPOINT

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI