What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

lxi master 7.8v5 Runtime Error abnormal program termination

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
i have Design Software lxi master 7.8v5
software runs fine. when i try and cut my vinyl the cut manager gives me the following error

Runtime Error
program:c:\program files\ve lxi master 7.8v5\program\app2.exe

abnormal program termination

HELP i cant work!

here is the hijackthis log

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:28:46 PM, on 12/16/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\WINDOWS\system32\ASTSRV.EXE
C:\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
c:\Program Files\Common Files\Protexis\License

Service\PsiService_2.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common

Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\mshta.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\Connection

Wizard\ICWCONN1.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\1aaa\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page

= http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyServer = :0
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O3 - Toolbar: (no name) - {71576546-354D-41c9-AAE8-31F2EC22BF0D}

- (no file)
O3 - Toolbar: Yahoo! Toolbar -

{EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar -

{3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program

Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: ZoneAlarm Security Toolbar -

{91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program

Files\ZoneAlarm_Security\tbZone.dll
O3 - Toolbar: ZoneAlarm Security Engine -

{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program

Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlu

gin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program

Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program

Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE

C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common

Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop

Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program

Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program

Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program

Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP

Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE

"C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [ISUSPM Startup]

C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common

Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone

Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program

Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel

FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download

Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe"

-silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program

Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater]

C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150596.exe

-Update -1150596 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT

5.1; Trident/4.0; Comcast Install 1.0; .NET CLR 1.0.3705; .NET

CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET

CLR 3.5.30729; Media Center PC 4.0; WWTClient2)"

-"http://www.chamberofchat.com/chat/chat.asp"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program

Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program

Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: Research -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2}

- C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 -

{E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program

Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP:

c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://www.shoutcast.com
O15 - Trusted Zone: http://*.witchezbrew.com
O15 - Trusted Zone: *.wix.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime

Object) -

http://appldnld.apple.com.edgesuite.net/co…nfo.apple.com/Q

uickTime/qtactivex/qtplugin.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System

Requirements Lab) -

http://www.nvidia.com/content/DriverDownlo…3.0.0.4/srl_bin

/sysreqlab_nvd.cab
O16 - DPF: {2DA3C4AB-E6B6-47A6-B0F3-1BD81524B51B}

(ActiveWorldsDownload Control) -

http://www.activeworlds.com/products/Activ…ldsDownload.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl

Object) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} -

http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6CE31B8D-8340-4DBD-B78E-BF59620924DC} (Quest3DCtlr2

Class) -

http://www.quest3d.com/webplugin/download/…t3dactivex2.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart

Scan) -

http://www.nvidia.com/content/DriverDownlo…ce/NvidiaSmartS

can.cab
O16 - DPF: {75A6AEA3-F26E-4608-AE9B-8DA78C87576E} -

https://kingsisle.hs.llnwd.net/e1/static/th…izard101A/activ

ex/Wizard101GameLauncher.CAB
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook

Photo Uploader 5 Control) -

http://upload.facebook.com/controls/2009.0….5.8.1/Facebook

PhotoUploader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -

http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat

Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} -

(no file)
O20 - AppInit_DLLs: C:\WINDOWS\System32\ctscal32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program

Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: a8f8e94f867 -

C:\WINDOWS\System32\ctscal32.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader -

{438755C2-A8BA-11D1-B96B-00A0C90312E1} -

C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon -

{8C7461EF-2B13-11d2-BE35-3078302C2030} -

C:\WINDOWS\system32\browseui.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) -

Emsi Software GmbH - C:\Program Files\a-squared

Anti-Malware\a2service.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis

- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program

Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program

Files\Application Updater\ApplicationUpdater.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. -

C:\WINDOWS\system32\ASTSRV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) -

Macrovision Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point

Software Technologies - C:\Program

Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program

Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: MySql - Unknown owner -

C:\mysql\bin\mysqld-nt.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown

owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA

Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OQG - Unknown owner -

C:\DOCUME~1\Pat\LOCALS~1\Temp\OQG.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP -

C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner -

C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner -

C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc.

- c:\Program Files\Common Files\Protexis\License

Service\PsiService_2.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2)

(sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program

Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point

Software Technologies LTD -

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 11670 bytes
Post #2
:welcome:

Hijackthis is not used much anymore, we use other tools that show us much more. Run this program and post the log, if no malware than I can link you to another forum to help you as we just do malware removal on this one.


OTL by OldTimer
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
Post #3
OTL logfile created on: 12/18/2010 10:40:51 AM - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Pat\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.00% Memory free
8.00 Gb Paging File | 7.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 5277 6277 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 45.52 Gb Free Space | 19.55% Space Free | Partition Type: NTFS
Drive D: | 409.41 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: WW-DA5C87462BD | User Name: Pat | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Pat\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files\a-squared Anti-Malware\a2service.exe (Emsi Software GmbH)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
PRC - C:\Program Files\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
PRC - C:\WINDOWS\system32\ASTSRV.EXE (Nalpeiron Ltd.)
PRC - C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
PRC - C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
PRC - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
PRC - C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
PRC - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe ()
PRC - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\WINDOWS\system32\CtHelper.exe (Creative Technology Ltd)
PRC - c:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (InstallShield Software Corporation)
PRC - C:\mysql\bin\mysqld-nt.exe ()


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Pat\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Unlocker\UnlockerHook.dll ()
MOD - C:\WINDOWS\system32\msvcp60.dll (Microsoft Corporation)
MOD - C:\Program Files\Comcast\Desktop Doctor\bin\sprthook.dll (SupportSoft, Inc.)


========== Win32 Services (SafeList) ==========

SRV - (OQG) – C:\DOCUME~1\Pat\LOCALS~1\Temp\OQG.exe File not found
SRV - (a2AntiMalware) – C:\Program Files\a-squared Anti-Malware\a2service.exe (Emsi Software GmbH)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (vsmon) – C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe (Check Point Software Technologies)
SRV - (npggsvc) – C:\WINDOWS\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (Application Updater) – C:\Program Files\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
SRV - (astcc) – C:\WINDOWS\system32\ASTSRV.EXE (Nalpeiron Ltd.)
SRV - (AcrSch2Svc) – C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (Ventrilo) – C:\Program Files\VentSrv\ventrilo_svc.exe ()
SRV - (sprtsvc_ddoctorv2) SupportSoft Sprocket Service (ddoctorv2) – C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (PSI_SVC_2) – c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)
SRV - (MySql) – C:\mysql\bin\mysqld-nt.exe ()


========== Driver Services (SafeList) ==========

DRV - (xhunter1) – C:\WINDOWS\xhunter1.sys File not found
DRV - (XDva349) – C:\WINDOWS\System32\XDva349.sys File not found
DRV - (vtany) – C:\WINDOWS\vtany.sys File not found
DRV - (LMIInfo) – C:\Program Files\LogMeIn\x86\RaInfo.sys File not found
DRV - (lgrxvxwj) – C:\WINDOWS\System32\drivers\mylo.sys File not found
DRV - (EagleNT) – C:\WINDOWS\System32\drivers\EagleNT.sys File not found
DRV - (ALSysIO) – C:\DOCUME~1\Pat\LOCALS~1\Temp\ALSysIO.sys File not found
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (Lavasoft Kernexplorer) – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (a2acc) – C:\Program Files\a-squared Anti-Malware\a2accx86.sys (Emsi Software GmbH)
DRV - (vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (timounter) – C:\WINDOWS\system32\DRIVERS\timntr.sys (Acronis)
DRV - (tifsfilter) – C:\WINDOWS\system32\drivers\tifsfilt.sys (Acronis)
DRV - (snapman) – C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis)
DRV - (tdrpman) – C:\WINDOWS\system32\DRIVERS\tdrpman.sys (Acronis)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (LMIRfsClientNP) – C:\WINDOWS\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (Haspnt) – C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (akshasp) – C:\WINDOWS\system32\drivers\akshasp.sys (Aladdin Knowledge Systems Ltd.)
DRV - (Hardlock) – C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV - (aksusb) – C:\WINDOWS\system32\drivers\aksusb.sys (Aladdin Knowledge Systems Ltd.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (nvgts) – C:\WINDOWS\system32\DRIVERS\nvgts.sys (NVIDIA Corporation)
DRV - (LMIRfsDriver) – C:\WINDOWS\system32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (PciPPorts) – C:\WINDOWS\system32\drivers\PciPPorts.sys ()
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (COMMONFX.DLL) – C:\WINDOWS\system32\COMMONFX.DLL (Creative Technology Ltd)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (CT20XUT.DLL) – C:\WINDOWS\system32\CT20XUT.DLL (Creative Technology Ltd.)
DRV - (CTHWIUT.DLL) – C:\WINDOWS\system32\CTHWIUT.DLL (Creative Technology Ltd.)
DRV - (CTEXFIFX.DLL) – C:\WINDOWS\system32\CTEXFIFX.DLL (Creative Technology Ltd.)
DRV - (CTEDSPSY.DLL) – C:\WINDOWS\system32\CTEDSPSY.DLL (Creative Technology Ltd)
DRV - (CTEDSPIO.DLL) – C:\WINDOWS\system32\CTEDSPIO.DLL (Creative Technology Ltd)
DRV - (CTEDSPFX.DLL) – C:\WINDOWS\system32\CTEDSPFX.DLL (Creative Technology Ltd)
DRV - (CTERFXFX.DLL) – C:\WINDOWS\system32\CTERFXFX.DLL (Creative Technology Ltd)
DRV - (CTEAPSFX.DLL) – C:\WINDOWS\system32\CTEAPSFX.DLL (Creative Technology Ltd)
DRV - (CTSBLFX.DLL) – C:\WINDOWS\system32\CTSBLFX.DLL (Creative Technology Ltd)
DRV - (CTAUDFX.DLL) – C:\WINDOWS\system32\CTAUDFX.DLL (Creative Technology Ltd)
DRV - (hap17v2k) – C:\WINDOWS\system32\drivers\haP17v2k.sys (Creative Technology Ltd)
DRV - (hap16v2k) – C:\WINDOWS\system32\drivers\haP16v2k.sys (Creative Technology Ltd)
DRV - (ha10kx2k) – C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ctdvda2k) – C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (emAudio) – C:\WINDOWS\system32\drivers\emAudio.sys (Pinnacle Systems GmbH)
DRV - (Par1284) – C:\Program Files\FlexiSIGN-PRO 8.1v1\Program\Par1284.sys (Warp Nine Engineering)
DRV - (speedfan) – C:\WINDOWS\system32\speedfan.sys (Windows ® 2000 DDK provider)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (DCamUSBEMPIA) – C:\WINDOWS\system32\drivers\emDevice.sys (eMPIA Technology, Inc.)
DRV - (FiltUSBEMPIA) – C:\WINDOWS\system32\drivers\emFilter.sys (eMPIA Technology, Inc.)
DRV - (ScanUSBEMPIA) – C:\WINDOWS\system32\drivers\emScan.sys (eMPIA Technology, Inc.)
DRV - (HSXHWBS2) – C:\WINDOWS\system32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsx) – C:\WINDOWS\system32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSX_DP) – C:\WINDOWS\system32\drivers\HSX_DP.sys (Conexant Systems, Inc.)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (MPE) – C:\WINDOWS\system32\drivers\mpe.sys (Microsoft Corporation)
DRV - (P17) – C:\WINDOWS\system32\drivers\P17.sys (Creative Technology Ltd.)
DRV - (Sentinel) – C:\WINDOWS\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.)
DRV - (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) – C:\WINDOWS\system32\drivers\es1371mp.sys (Creative Technology Ltd.)
DRV - (ADM8511) – C:\WINDOWS\system32\drivers\ADM8511.SYS (ADMtek Incorporated)
DRV - (giveio) – C:\WINDOWS\system32\giveio.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch⁡=15627"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/home?AF=15627"
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.%(version)s
FF - prefs.js..extensions.enabledItems: {91da5e8a-3318-4f8c-b67e-5964de3ab546}:[removed]
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.260.0
FF - prefs.js..keyword.URL: "http://search.babylon.com/?babsrc=adbartrp⁡=15627&q;="

FF - HKLM\software\mozilla\Firefox\extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2010/12/14 15:29:28 | 000,000,000 | —D | M]

[2010/02/28 11:29:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Mozilla\Extensions
[2009/06/15 17:35:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Mozilla\Extensions\[removed]
[2009/10/07 15:52:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Mozilla\Firefox\extensions
[2009/10/07 15:52:24 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Pat\Application Data\Mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010/12/14 14:21:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Mozilla\Firefox\Profiles\fqzz0xmf.default\extensions
[2010/10/29 09:08:37 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Pat\Application Data\Mozilla\Firefox\Profiles\fqzz0xmf.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/12/14 14:21:52 | 000,000,000 | —D | M] (ZoneAlarm Security Toolbar) – C:\Documents and Settings\Pat\Application Data\Mozilla\Firefox\Profiles\fqzz0xmf.default\extensions\{91da5e8a-3318-4f8c-b67e-5964de3ab546}
[2010/11/12 21:05:11 | 000,002,226 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml

O1 HOSTS File: ([2010/01/23 20:11:00 | 000,000,736 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (no name) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Toolbar) - {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\tbZone.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Toolbar) - {91DA5E8A-3318-4F8C-B67E-5964DE3AB546} - C:\Program Files\ZoneAlarm_Security\tbZone.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTxfiHlp] C:\WINDOWS\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [ddoctorv2] C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.dll ()
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [USB2Check] C:\WINDOWS\System32\PCLECoInst.DLL (Pinnacle Systems)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe File not found
O4 - HKCU..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe (IGN Entertainment)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\Shockwave 11\SwHelper_1150596.exe -Update -1150596 -Mozilla\4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident\4.0; File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Pat\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: shoutcast.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: witchezbrew.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: wix.com ([]* in Trusted sites)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2DA3C4AB-E6B6-47A6-B0F3-1BD81524B51B} http://www.activeworlds.com/products/Activ…ldsDownload.cab (ActiveWorldsDownload Control)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab (CDownloadCtrl Object)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {6CE31B8D-8340-4DBD-B78E-BF59620924DC} http://www.quest3d.com/webplugin/download/…t3dactivex2.cab (Quest3DCtlr2 Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {75A6AEA3-F26E-4608-AE9B-8DA78C87576E} https://kingsisle.hs.llnwd.net/e1/static/th…ameLauncher.CAB (Reg Error: Key error.)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} http://fdl.msn.com/public/chat/msnchat45.cab (MSN Chat Control 4.5)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - Reg Error: Key error. File not found
O20 - AppInit_DLLs: (C:\WINDOWS\System32\ctscal32.dll) - C:\WINDOWS\System32\ctscal32.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\a8f8e94f867: DllName - C:\WINDOWS\System32\ctscal32.dll - C:\WINDOWS\System32\ctscal32.dll File not found
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Pat\My Documents\My Pictures\alchemist2.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Pat\My Documents\My Pictures\alchemist2.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/05/12 14:17:28 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{1bc54136-3f40-11de-8578-00047600eb29}\Shell - "" = AutoRun
O33 - MountPoints2\{1bc54136-3f40-11de-8578-00047600eb29}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{2cba69ca-3f2c-11de-8574-b4b306d621e5}\Shell - "" = AutoRun
O33 - MountPoints2\{2cba69ca-3f2c-11de-8574-b4b306d621e5}\Shell\AutoRun - "" = Auto&Play;
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O34 - HKLM BootExecute: (pfdnnt C:\WINDOWS\system32\pfdnnt_actions.sys) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/12/16 22:13:26 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Pat\Desktop\OTL.exe
[2010/12/16 12:14:46 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/12/16 11:20:16 | 000,008,576 | —- | C] (Panda Software International) – C:\WINDOWS\System32\drivers\bcnsrurlpilm.sys
[2010/12/16 11:15:20 | 000,007,680 | —- | C] (Lavasoft AB) – C:\WINDOWS\System32\drivers\RKL2B.tmp.sys
[2010/12/16 10:58:56 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Pat\Recent
[2010/12/16 10:22:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Pat\Application Data\SUPERAntiSpyware.com
[2010/12/16 10:22:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/12/16 10:22:33 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/12/14 16:10:31 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Identities
[2010/12/14 14:22:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Pat\My Documents\ForceField Shared Files
[2010/12/14 14:22:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Pat\Application Data\CheckPoint
[2010/12/14 14:16:53 | 000,000,000 | —D | C] – C:\Documents and Settings\Pat\Local Settings\Application Data\Conduit
[2010/12/14 14:16:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Pat\Local Settings\Application Data\ZoneAlarm_Security
[2010/12/14 14:16:52 | 000,000,000 | —D | C] – C:\Program Files\Conduit
[2010/12/14 14:16:51 | 000,000,000 | —D | C] – C:\Program Files\ZoneAlarm_Security
[2010/12/14 14:16:39 | 000,000,000 | —D | C] – C:\Program Files\CheckPoint
[2010/12/14 14:16:32 | 000,058,368 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsregexp.dll
[2010/12/14 14:16:31 | 000,104,448 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\zlcommdb.dll
[2010/12/14 14:16:31 | 000,069,120 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\zlcomm.dll
[2010/12/14 14:16:23 | 000,043,008 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vswmi.dll
[2010/12/14 14:16:22 | 001,238,528 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\zpeng25.dll
[2010/12/14 14:16:22 | 000,110,080 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsxml.dll
[2010/12/14 14:16:21 | 000,302,592 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vspubapi.dll
[2010/12/14 14:16:21 | 000,108,032 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsmonapi.dll
[2010/12/14 14:16:21 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ZoneLabs
[2010/12/14 14:16:20 | 000,532,224 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsdatant.sys
[2010/12/14 14:16:19 | 000,000,000 | —D | C] – C:\Program Files\Zone Labs
[2010/12/14 14:15:53 | 000,000,000 | —D | C] – C:\WINDOWS\Internet Logs
[2010/12/14 14:15:51 | 000,715,264 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsutil.dll
[2010/12/14 14:15:51 | 000,228,864 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsinit.dll
[2010/12/14 14:15:51 | 000,112,128 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsdata.dll
[2010/12/13 00:34:14 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/12/13 00:01:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2010/12/12 23:59:02 | 000,000,000 | -HSD | C] – C:\Documents and Settings\All Users\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2010/12/12 19:14:13 | 000,000,000 | —D | C] – C:\1contact
[2010/12/12 16:20:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Pat\Local Settings\Application Data\Sunbelt Software
[2010/12/12 16:13:48 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
[2010/12/12 00:34:45 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Sun
[2010/12/11 13:26:14 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/12/11 12:18:22 | 000,012,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mouhid.sys
[2010/12/11 12:18:19 | 000,014,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhid.sys
[2010/12/11 12:11:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS
[2010/12/11 11:28:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Pat\My Documents\Downloads
[2010/12/10 23:32:50 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple Computer
[2010/12/10 22:12:24 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/12/10 21:11:20 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/12/10 21:10:48 | 000,000,000 | —D | C] – C:\Program Files\Emsisoft HiJackFree
[2010/12/10 17:22:28 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/12/10 17:22:16 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/12/10 17:07:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Pat\Local Settings\Application Data\{BF91E067-3E83-4B89-8E04-B68FF632D5E9}
[2010/12/07 21:35:22 | 000,000,000 | —D | C] – C:\Program Files\Skype(2)
[2010/12/04 14:59:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Firefly Studios
[2010/12/04 14:59:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Pat\My Documents\Stronghold 2
[2010/12/04 14:35:04 | 000,000,000 | —D | C] – C:\New Folder
[2010/11/21 15:21:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Pat\Local Settings\Application Data\Microsoft_Research
[2002/04/10 20:41:06 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\A3d.dll
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/18 06:22:25 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/18 03:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At5.job
[2010/12/18 02:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At1.job
[2010/12/18 01:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At2.job
[2010/12/18 00:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At3.job
[2010/12/17 23:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At24.job
[2010/12/17 22:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At23.job
[2010/12/17 21:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At21.job
[2010/12/17 20:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At22.job
[2010/12/17 19:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At20.job
[2010/12/17 18:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At19.job
[2010/12/17 17:15:00 | 000,000,386 | —- | M] () – C:\WINDOWS\tasks\1-Click Maintenance.job
[2010/12/17 17:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At16.job
[2010/12/17 16:11:35 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At18.job
[2010/12/17 16:11:35 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At17.job
[2010/12/17 16:11:35 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At15.job
[2010/12/17 16:11:35 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At14.job
[2010/12/17 16:11:35 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At13.job
[2010/12/17 14:13:23 | 000,000,418 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{4215FCA3-CB14-4E44-A244-BD9F18444D3D}.job
[2010/12/17 11:21:21 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/12/17 11:16:41 | 000,254,055 | —- | M] () – C:\WINDOWS\System32\NvApps.xml
[2010/12/17 11:16:17 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/12/16 22:13:27 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Pat\Desktop\OTL.exe
[2010/12/16 13:59:24 | 000,628,338 | —- | M] () – C:\Documents and Settings\Pat\Desktop\dss.ZIP
[2010/12/16 13:39:16 | 000,012,540 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/12/16 13:05:44 | 000,624,128 | —- | M] () – C:\Documents and Settings\Pat\Desktop\dds.scr
[2010/12/16 12:25:26 | 000,000,815 | —- | M] () – C:\Documents and Settings\Pat\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/12/16 11:40:05 | 000,012,540 | —- | M] () – C:\WINDOWS\System32\wpa.bak
[2010/12/16 11:38:23 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At12.job
[2010/12/16 11:19:59 | 000,008,576 | —- | M] (Panda Software International) – C:\WINDOWS\System32\drivers\bcnsrurlpilm.sys
[2010/12/16 11:15:20 | 000,007,680 | —- | M] (Lavasoft AB) – C:\WINDOWS\System32\drivers\RKL2B.tmp.sys
[2010/12/16 11:15:04 | 000,377,856 | —- | M] () – C:\Documents and Settings\Pat\Desktop\AriesRemoverInst.exe
[2010/12/16 10:54:32 | 000,000,481 | —- | M] () – C:\Documents and Settings\Pat\Desktop\Shortcut to ATF-Cleaner.lnk
[2010/12/16 10:49:59 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At9.job
[2010/12/16 10:49:59 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At8.job
[2010/12/16 10:49:59 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At7.job
[2010/12/16 10:49:59 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At6.job
[2010/12/16 10:49:59 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At4.job
[2010/12/16 10:49:58 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At11.job
[2010/12/16 10:49:58 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\At10.job
[2010/12/16 10:22:35 | 000,001,678 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/12/14 14:22:35 | 000,421,442 | —- | M] () – C:\WINDOWS\System32\vsconfig.xml
[2010/12/14 14:16:34 | 000,004,212 | -H– | M] () – C:\WINDOWS\System32\zllictbl.dat
[2010/12/14 14:16:34 | 000,000,731 | —- | M] () – C:\Documents and Settings\Pat\Desktop\ZoneAlarm Security.lnk
[2010/12/14 09:05:04 | 000,015,560 | —- | M] () – C:\WINDOWS\System32\333.js
[2010/12/13 06:46:53 | 000,452,668 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/12/13 06:46:53 | 000,076,512 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/12/12 16:23:43 | 000,098,392 | —- | M] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/12/12 16:13:45 | 000,000,885 | —- | M] () – C:\Documents and Settings\Pat\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/12/12 16:13:45 | 000,000,867 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/12/11 10:40:46 | 000,000,120 | —- | M] () – C:\WINDOWS\Vzawe.dat
[2010/12/11 10:40:46 | 000,000,000 | —- | M] () – C:\WINDOWS\Qwepodemadavaku.bin
[2010/12/06 13:36:06 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/12/05 21:03:54 | 000,025,088 | —- | M] () – C:\Documents and Settings\Pat\Desktop\bye bye Ultimaonline.doc
[2010/12/03 22:07:49 | 000,000,181 | —- | M] () – C:\Documents and Settings\Pat\Desktop\WitchezBrewRadio chat group -.url
[2010/12/03 04:05:34 | 000,064,288 | —- | M] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2010/12/03 04:05:33 | 000,015,880 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2010/11/30 12:50:22 | 000,000,214 | —- | M] () – C:\Documents and Settings\Pat\Desktop\ROBetaWinDedicatedServer.url
[2010/11/30 11:39:52 | 000,189,480 | —- | M] () – C:\WINDOWS\System32\PnkBstrB.xtr
[2010/11/24 09:01:57 | 000,000,176 | —- | M] () – C:\Documents and Settings\Pat\Desktop\wzbr.url
[2010/11/21 14:24:10 | 000,002,537 | —- | M] () – C:\Documents and Settings\All Users\Desktop\WorldWide Telescope.lnk
[2010/11/21 13:58:44 | 000,001,978 | —- | M] () – C:\Documents and Settings\All Users\Desktop\WWT ¦ Mars.lnk
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/16 13:59:24 | 000,628,338 | —- | C] () – C:\Documents and Settings\Pat\Desktop\dss.ZIP
[2010/12/16 13:05:43 | 000,624,128 | —- | C] () – C:\Documents and Settings\Pat\Desktop\dds.scr
[2010/12/16 11:15:03 | 000,377,856 | —- | C] () – C:\Documents and Settings\Pat\Desktop\AriesRemoverInst.exe
[2010/12/16 10:54:31 | 000,000,481 | —- | C] () – C:\Documents and Settings\Pat\Desktop\Shortcut to ATF-Cleaner.lnk
[2010/12/16 10:22:35 | 000,001,678 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/12/14 14:16:34 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2010/12/14 14:16:34 | 000,000,731 | —- | C] () – C:\Documents and Settings\Pat\Desktop\ZoneAlarm Security.lnk
[2010/12/14 14:16:20 | 000,421,442 | —- | C] () – C:\WINDOWS\System32\vsconfig.xml
[2010/12/14 08:05:01 | 000,015,560 | —- | C] () – C:\WINDOWS\System32\333.js
[2010/12/12 16:13:45 | 000,000,885 | —- | C] () – C:\Documents and Settings\Pat\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/12/12 16:13:45 | 000,000,867 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/12/10 21:11:20 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/10 17:07:33 | 000,000,120 | —- | C] () – C:\WINDOWS\Vzawe.dat
[2010/12/10 17:07:33 | 000,000,000 | —- | C] () – C:\WINDOWS\Qwepodemadavaku.bin
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At24.job
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At23.job
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At22.job
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At21.job
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At20.job
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At19.job
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At18.job
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At17.job
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At16.job
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At15.job
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At14.job
[2010/12/10 17:05:37 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At13.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At9.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At8.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At7.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At6.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At5.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At4.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At3.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At2.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At12.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At11.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At10.job
[2010/12/10 17:05:36 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\At1.job
[2010/11/30 12:50:22 | 000,000,214 | —- | C] () – C:\Documents and Settings\Pat\Desktop\ROBetaWinDedicatedServer.url
[2010/11/21 13:58:44 | 000,001,978 | —- | C] () – C:\Documents and Settings\All Users\Desktop\WWT ¦ Mars.lnk
[2010/10/24 12:06:31 | 000,137,544 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010/10/24 12:06:30 | 000,139,152 | —- | C] () – C:\Documents and Settings\Pat\Application Data\PnkBstrK.sys
[2010/09/30 19:21:12 | 000,002,516 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2010/09/30 19:21:12 | 000,000,088 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\278FB3479F.sys
[2010/07/06 18:15:54 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2010/06/22 12:21:11 | 000,119,808 | —- | C] () – C:\WINDOWS\System32\drivers\PciSPorts.sys
[2010/06/22 12:21:11 | 000,082,432 | —- | C] () – C:\WINDOWS\System32\drivers\PciPPorts.sys
[2010/05/01 23:04:10 | 000,484,352 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2010/04/26 12:29:23 | 000,001,718 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2010/02/21 17:30:43 | 000,002,151 | —- | C] () – C:\Documents and Settings\All Users\Application Data\afl.log
[2010/01/23 20:52:15 | 000,000,256 | —- | C] () – C:\WINDOWS\onlineeye.INI
[2010/01/23 17:15:06 | 000,000,016 | —- | C] () – C:\WINDOWS\System32\msvcsv60.dll
[2010/01/07 15:22:21 | 000,000,029 | —- | C] () – C:\WINDOWS\PControl.ini
[2009/09/13 12:38:42 | 000,001,025 | —- | C] () – C:\Documents and Settings\Pat\Application Data\alarms.ini
[2009/09/13 12:38:25 | 000,000,749 | —- | C] () – C:\Documents and Settings\Pat\Application Data\AtomicAlarmClock.ini
[2009/07/12 20:26:21 | 000,000,216 | -HS- | C] () – C:\WINDOWS\WSYS049.SYS
[2009/07/08 20:03:02 | 000,058,880 | —- | C] () – C:\WINDOWS\System32\bdmpegv.dll
[2009/06/17 10:13:30 | 000,508,224 | —- | C] () – C:\WINDOWS\System32\ICCProfiles.dll
[2009/06/08 21:57:22 | 000,026,624 | —- | C] () – C:\Documents and Settings\Pat\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/03 13:08:34 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/05/25 10:15:21 | 000,000,383 | —- | C] () – C:\WINDOWS\System32\haspdos.sys
[2009/05/13 22:13:31 | 000,064,512 | —- | C] () – C:\WINDOWS\System32\P17.dll
[2009/05/13 20:22:18 | 000,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/05/12 14:36:56 | 000,000,126 | —- | C] () – C:\Documents and Settings\Pat\Local Settings\Application Data\fusioncache.dat
[2009/05/12 14:34:21 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2009/05/12 08:39:18 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/10/07 08:13:30 | 000,197,912 | —- | C] () – C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 08:13:22 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 08:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll
[2007/04/12 07:10:28 | 000,105,728 | —- | C] () – C:\WINDOWS\System32\APOMgrH.dll
[2007/04/09 11:55:14 | 000,097,785 | —- | C] () – C:\WINDOWS\System32\instwdm.ini
[2007/04/09 11:33:50 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CTBurst.dll
[2006/10/02 08:25:18 | 000,000,307 | —- | C] () – C:\WINDOWS\System32\kill.ini
[2006/05/09 14:50:00 | 000,573,440 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/05/09 14:50:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2006/05/09 14:50:00 | 000,225,280 | —- | C] () – C:\WINDOWS\System32\nvrszhc.dll
[2006/05/09 14:50:00 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\nvrszht.dll
[2005/08/05 13:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\PsisDecd.dll
[2005/06/16 09:17:16 | 000,071,680 | —- | C] () – C:\WINDOWS\System32\ctmmactl.dll
[2004/03/28 21:11:10 | 000,067,428 | —- | C] () – C:\WINDOWS\System32\Ludap17.ini
[2003/10/02 05:48:18 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\P17CPI.dll
[2003/03/04 03:29:00 | 000,000,029 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[1996/04/03 14:33:26 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2010/04/22 13:19:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Acronis
[2009/05/23 16:30:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Age of Empires 3
[2009/05/14 08:14:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2009/07/21 14:17:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2010/12/04 14:59:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Firefly Studios
[2009/06/13 12:41:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
[2009/05/13 20:26:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ICQ
[2009/12/19 22:37:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nexon
[2010/09/17 21:33:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2009/12/31 15:28:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nitro PDF
[2009/10/19 12:14:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Palo Alto Software
[2010/08/10 15:08:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Panda Security
[2009/10/19 12:12:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PAS
[2009/07/08 18:11:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2010/01/23 17:03:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sonoma Wire Works
[2009/06/10 08:57:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sony
[2010/01/27 16:29:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SupportSoft
[2010/12/13 06:43:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2010/12/12 16:14:19 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
[2010/12/12 23:59:02 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2009/10/16 16:28:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Auslogics
[2010/03/13 15:54:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Aventurine
[2010/12/11 12:13:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Azureus
[2010/11/12 21:06:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\BabylonToolbar
[2009/07/07 10:30:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\blaxxun interactive
[2009/06/03 15:12:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Canneverbe_Limited
[2010/12/14 14:22:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\CheckPoint
[2010/06/28 21:20:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/02/05 17:39:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\CreeperWorld
[2010/02/05 13:01:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\CreeperWorldDEMO.BA6B793AB2C9FDD744493F22666C1F8DFA806A5E.1
[2009/08/19 23:30:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Darkfall
[2009/08/19 21:18:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Darkfall US
[2010/05/02 00:49:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Dealio
[2009/12/31 15:27:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Downloaded Installations
[2009/06/13 10:21:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\FileZilla
[2009/12/22 15:25:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Five9
[2010/05/01 23:04:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\FreeAudioPack
[2010/10/27 14:57:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\FreeStone Group
[2010/10/12 18:31:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\GameRanger
[2010/06/20 10:43:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\GetRightToGo
[2009/11/10 03:45:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Gizmoz
[2009/06/13 12:37:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\GlobalSCAPE
[2009/05/13 20:26:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\ICQ
[2010/07/07 08:03:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\ImgBurn
[2009/12/19 16:40:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\MP3SkypeRecorder
[2009/06/10 09:01:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\NetMedia Providers
[2010/07/07 08:27:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Nitro PDF
[2009/05/12 20:33:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\OpenOffice.org
[2009/06/10 16:47:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Opera
[2009/10/19 12:15:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Palo Alto Software
[2010/08/10 15:11:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Panda Security
[2009/06/10 09:32:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Pandora's Box 3
[2010/09/15 19:42:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\PirateGalaxy
[2009/12/24 22:13:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Publish Providers
[2009/07/12 18:15:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Red Alert 3
[2010/05/02 00:49:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Search Settings
[2009/11/14 12:19:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\SecondLife
[2009/06/10 08:57:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Sony
[2010/08/08 21:38:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\TeamViewer
[2010/12/13 00:01:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\TuneUp Software
[2009/09/02 20:13:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Uniblue
[2010/07/04 08:26:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Unity
[2009/08/31 21:47:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Windows Search
[2010/06/20 10:46:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Pat\Application Data\Xilisoft
[2010/12/17 17:15:00 | 000,000,386 | —- | M] () – C:\WINDOWS\Tasks\1-Click Maintenance.job
[2010/12/17 11:21:21 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/12/18 02:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At1.job
[2010/12/16 10:49:58 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At10.job
[2010/12/16 10:49:58 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At11.job
[2010/12/16 11:38:23 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At12.job
[2010/12/17 16:11:35 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At13.job
[2010/12/17 16:11:35 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At14.job
[2010/12/17 16:11:35 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At15.job
[2010/12/17 17:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At16.job
[2010/12/17 16:11:35 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At17.job
[2010/12/17 16:11:35 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At18.job
[2010/12/17 18:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At19.job
[2010/12/18 01:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At2.job
[2010/12/17 19:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At20.job
[2010/12/17 21:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At21.job
[2010/12/17 20:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At22.job
[2010/12/17 22:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At23.job
[2010/12/17 23:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At24.job
[2010/12/18 00:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At3.job
[2010/12/16 10:49:59 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At4.job
[2010/12/18 03:05:00 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At5.job
[2010/12/16 10:49:59 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At6.job
[2010/12/16 10:49:59 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At7.job
[2010/12/16 10:49:59 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At8.job
[2010/12/16 10:49:59 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\At9.job
[2010/12/17 14:13:23 | 000,000,418 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{4215FCA3-CB14-4E44-A244-BD9F18444D3D}.job

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2010/09/17 21:33:48 | 000,000,000 | —D | M](C:\Documents and Settings\Pat\My Documents\?? ???) – C:\Documents and Settings\Pat\My Documents\넥슨 플러그
[2010/09/17 21:33:48 | 000,000,000 | —D | C](C:\Documents and Settings\Pat\My Documents\?? ???) – C:\Documents and Settings\Pat\My Documents\넥슨 플러그

< End of report >
Post #5
Thanks for the logs., run these in order please.

Please download ATF Cleaner by Atribune to your desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.





Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #6
ok i am running combofix and it just hangs on completed stage _50 i assume since it finshed 49 hanging fir a few hours is this correct?
Post #7
It usually does not take that long. Give it another half hour or so and then just reboot your computer ,

C:\Combofix.txt <–The log can be found here
Post #11
OK, run this program and post the log please.


  • Download TDSSKiller and save it to your Desktop.
  • Extract the file and run it.
  • Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)
  • Please post the content of the TDSSKiller log
Post #12
2010/12/19 20:30:02.0750 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46 2010/12/19 20:30:02.0750 ================================================================================ 2010/12/19 20:30:02.0750 SystemInfo: 2010/12/19 20:30:02.0750 2010/12/19 20:30:02.0750 OS Version: 5.1.2600 ServicePack: 3.0 2010/12/19 20:30:02.0750 Product type: Workstation 2010/12/19 20:30:02.0750 ComputerName: WW-DA5C87462BD 2010/12/19 20:30:02.0750 UserName: Pat 2010/12/19 20:30:02.0750 Windows directory: C:\WINDOWS 2010/12/19 20:30:02.0750 System windows directory: C:\WINDOWS 2010/12/19 20:30:02.0750 Processor architecture: Intel x86 2010/12/19 20:30:02.0750 Number of processors: 2 2010/12/19 20:30:02.0750 Page size: 0x1000 2010/12/19 20:30:02.0750 Boot type: Normal boot 2010/12/19 20:30:02.0750 ================================================================================ 2010/12/19 20:30:03.0156 Initialize success 2010/12/19 20:30:07.0296 ================================================================================ 2010/12/19 20:30:07.0296 Scan started 2010/12/19 20:30:07.0296 Mode: Manual; 2010/12/19 20:30:07.0296 ================================================================================ 2010/12/19 20:30:08.0187 a2acc (2d1e1a70041319338035c3df51bfd200) C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2accx86.sys 2010/12/19 20:30:08.0437 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 2010/12/19 20:30:08.0531 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 2010/12/19 20:30:08.0687 ADM8511 (b05f2367f62552a2de7e3c352b7b9885) C:\WINDOWS\system32\DRIVERS\ADM8511.SYS 2010/12/19 20:30:08.0875 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 2010/12/19 20:30:09.0031 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys 2010/12/19 20:30:09.0250 akshasp (64fc197d24a2b240598f29ce0a6660c0) C:\WINDOWS\system32\DRIVERS\akshasp.sys 2010/12/19 20:30:09.0359 aksusb (2490cf6ad9f422506a088169758b6940) C:\WINDOWS\system32\DRIVERS\aksusb.sys 2010/12/19 20:30:09.0734 AmdPPM (033448d435e65c4bd72e70521fd05c76) C:\WINDOWS\system32\DRIVERS\AmdPPM.sys 2010/12/19 20:30:10.0046 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys 2010/12/19 20:30:10.0296 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 2010/12/19 20:30:10.0390 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 2010/12/19 20:30:10.0500 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 2010/12/19 20:30:10.0640 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 2010/12/19 20:30:10.0781 bcnsrurlpilm (d7dbfbc453b645111e6d21142305e80b) C:\WINDOWS\system32\drivers\bcnsrurlpilm.sys 2010/12/19 20:30:10.0937 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 2010/12/19 20:30:11.0234 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 2010/12/19 20:30:11.0343 CCDECODE (fdc06e2ada8c468ebb161624e03976cf) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 2010/12/19 20:30:11.0531 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 2010/12/19 20:30:11.0687 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 2010/12/19 20:30:11.0859 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 2010/12/19 20:30:12.0109 COMMONFX.DLL (1ef05b641e9a67ded74ac8ad40055dbf) C:\WINDOWS\system32\COMMONFX.DLL 2010/12/19 20:30:12.0312 CT20XUT.DLL (6191a973461852a09d643609e1d5f7c6) C:\WINDOWS\system32\CT20XUT.DLL 2010/12/19 20:30:12.0437 ctac32k (8ac5f77e30e37d2d11bd99eff0c53d8c) C:\WINDOWS\system32\drivers\ctac32k.sys 2010/12/19 20:30:12.0640 ctaud2k (673241d314e932f4890509ae8ebf26db) C:\WINDOWS\system32\drivers\ctaud2k.sys 2010/12/19 20:30:12.0781 CTAUDFX.DLL (472b82d7e549e7fab428852e4d16f21d) C:\WINDOWS\system32\CTAUDFX.DLL 2010/12/19 20:30:13.0078 ctdvda2k (ed316d4c3d39c5b6c23de067e275c183) C:\WINDOWS\system32\drivers\ctdvda2k.sys 2010/12/19 20:30:13.0218 CTEAPSFX.DLL (6a57f82009563aee8826f117e1d3c72c) C:\WINDOWS\system32\CTEAPSFX.DLL 2010/12/19 20:30:13.0328 CTEDSPFX.DLL (c8ac1ffaeadd655193d7b1811a572d8d) C:\WINDOWS\system32\CTEDSPFX.DLL 2010/12/19 20:30:13.0437 CTEDSPIO.DLL (44495d9daf675257d00b25b041ee6667) C:\WINDOWS\system32\CTEDSPIO.DLL 2010/12/19 20:30:13.0546 CTEDSPSY.DLL (8e90b1762cb42e2fc76dac9210c83c66) C:\WINDOWS\system32\CTEDSPSY.DLL 2010/12/19 20:30:13.0703 CTERFXFX.DLL (d3fbd9983325435b06795f29cb57ed3d) C:\WINDOWS\system32\CTERFXFX.DLL 2010/12/19 20:30:13.0921 CTEXFIFX.DLL (2c48e9d8ca703964463f27ae341115b7) C:\WINDOWS\system32\CTEXFIFX.DLL 2010/12/19 20:30:14.0171 CTHWIUT.DLL (f7657c598e7c29c6683c1e4a8dd68884) C:\WINDOWS\system32\CTHWIUT.DLL 2010/12/19 20:30:14.0312 ctprxy2k (34e7f8a499fd8361df14fedb724c0ad3) C:\WINDOWS\system32\drivers\ctprxy2k.sys 2010/12/19 20:30:14.0390 CTSBLFX.DLL (679ae21eb7f48a08184813aebabdec7c) C:\WINDOWS\system32\CTSBLFX.DLL 2010/12/19 20:30:14.0546 ctsfm2k (8db84de3aab34a8b4c2f644eff41cd76) C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys 2010/12/19 20:30:14.0796 DCamUSBEMPIA (5118ea8a2f55fa4d4295516500b78229) C:\WINDOWS\system32\DRIVERS\emDevice.sys 2010/12/19 20:30:14.0937 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 2010/12/19 20:30:15.0093 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 2010/12/19 20:30:15.0265 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 2010/12/19 20:30:15.0359 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 2010/12/19 20:30:15.0500 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 2010/12/19 20:30:15.0687 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 2010/12/19 20:30:15.0953 emAudio (200da4f1964c11b3c19a07f937394624) C:\WINDOWS\system32\drivers\emAudio.sys 2010/12/19 20:30:16.0125 emupia (2885f72d2daffd0329272f12e16d6579) C:\WINDOWS\system32\drivers\emupia2k.sys 2010/12/19 20:30:16.0234 es1371 (24e564f710d887ecc75cfe59882ecc5d) C:\WINDOWS\system32\drivers\es1371mp.sys 2010/12/19 20:30:16.0343 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 2010/12/19 20:30:16.0437 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys 2010/12/19 20:30:16.0531 FiltUSBEMPIA (6f87e4706f59463b74bc4fad0f67338f) C:\WINDOWS\system32\DRIVERS\emFilter.sys 2010/12/19 20:30:16.0671 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 2010/12/19 20:30:16.0781 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 2010/12/19 20:30:16.0875 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys 2010/12/19 20:30:17.0156 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 2010/12/19 20:30:17.0312 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 2010/12/19 20:30:17.0484 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys 2010/12/19 20:30:17.0671 giveio (77ebf3e9386daa51551af429052d88d0) C:\WINDOWS\system32\giveio.sys 2010/12/19 20:30:17.0828 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 2010/12/19 20:30:17.0953 ha10kx2k (da2c735b66d2e7b739f9a46146581a9d) C:\WINDOWS\system32\drivers\ha10kx2k.sys 2010/12/19 20:30:18.0109 hap16v2k (5c7d6d68796e4621b4168c879908dae0) C:\WINDOWS\system32\drivers\hap16v2k.sys 2010/12/19 20:30:18.0421 hap17v2k (a595b88ad16d8b5693ddf08113caf30e) C:\WINDOWS\system32\drivers\hap17v2k.sys 2010/12/19 20:30:18.0578 Hardlock (2a2448dd47208722c0cf3665687ae9f6) C:\WINDOWS\system32\drivers\hardlock.sys 2010/12/19 20:30:18.0750 Haspnt (2dd25f060dc9f79b5cdf33d90ed93669) C:\WINDOWS\system32\drivers\Haspnt.sys 2010/12/19 20:30:18.0843 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 2010/12/19 20:30:18.0953 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 2010/12/19 20:30:19.0218 HPZid412 (9f1d80908658eb7f1bf70809e0b51470) C:\WINDOWS\system32\DRIVERS\HPZid412.sys 2010/12/19 20:30:19.0328 HPZipr12 (f7e3e9d50f9cd3de28085a8fdaa0a1c3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 2010/12/19 20:30:19.0406 HPZius12 (cf1b7951b4ec8d13f3c93b74bb2b461b) C:\WINDOWS\system32\DRIVERS\HPZius12.sys 2010/12/19 20:30:19.0500 HSXHWBS2 (1f5c64b0c6b2e2f48735a77ae714ccb8) C:\WINDOWS\system32\DRIVERS\HSXHWBS2.sys 2010/12/19 20:30:19.0656 HSX_DP (a7f8c9228898a1e871d2ae7082f50ac3) C:\WINDOWS\system32\DRIVERS\HSX_DP.sys 2010/12/19 20:30:19.0828 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 2010/12/19 20:30:20.0140 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 2010/12/19 20:30:20.0250 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 2010/12/19 20:30:20.0515 IntcAzAudAddService (14b48553be78472d2bd3a518658a1710) C:\WINDOWS\system32\drivers\RtkHDAud.sys 2010/12/19 20:30:20.0859 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys 2010/12/19 20:30:21.0046 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 2010/12/19 20:30:21.0156 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 2010/12/19 20:30:21.0312 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 2010/12/19 20:30:21.0437 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 2010/12/19 20:30:21.0500 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 2010/12/19 20:30:21.0640 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 2010/12/19 20:30:21.0828 ISWKL (5c7c9ea45700f5187f71eb7b0dab18c5) C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys 2010/12/19 20:30:21.0937 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 2010/12/19 20:30:21.0968 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 2010/12/19 20:30:22.0109 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 2010/12/19 20:30:22.0234 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 2010/12/19 20:30:22.0734 lmimirr (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys 2010/12/19 20:30:22.0875 LMIRfsDriver (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys 2010/12/19 20:30:23.0031 mdmxsdk (e246a32c445056996074a397da56e815) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 2010/12/19 20:30:23.0109 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys 2010/12/19 20:30:23.0218 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 2010/12/19 20:30:23.0421 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 2010/12/19 20:30:23.0812 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 2010/12/19 20:30:24.0390 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 2010/12/19 20:30:24.0859 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 2010/12/19 20:30:25.0296 MPE (83eff7b976ae24f1a496ca94a8a19919) C:\WINDOWS\system32\DRIVERS\MPE.sys 2010/12/19 20:30:25.0468 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 2010/12/19 20:30:25.0609 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 2010/12/19 20:30:25.0734 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 2010/12/19 20:30:25.0828 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2010/12/19 20:30:25.0921 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 2010/12/19 20:30:26.0031 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 2010/12/19 20:30:26.0125 MSTEE (d5059366b361f0e1124753447af08aa2) C:\WINDOWS\system32\drivers\MSTEE.sys 2010/12/19 20:30:26.0218 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys 2010/12/19 20:30:26.0328 NABTSFEC (ac31b352ce5e92704056d409834beb74) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 2010/12/19 20:30:26.0484 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 2010/12/19 20:30:26.0625 NdisIP (abd7629cf2796250f315c1dd0b6cf7a0) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 2010/12/19 20:30:26.0734 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 2010/12/19 20:30:26.0781 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 2010/12/19 20:30:26.0859 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 2010/12/19 20:30:26.0890 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys 2010/12/19 20:30:26.0984 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 2010/12/19 20:30:27.0125 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys 2010/12/19 20:30:27.0265 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 2010/12/19 20:30:27.0406 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 2010/12/19 20:30:27.0546 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 2010/12/19 20:30:27.0906 nv (4c3696c1ed1a36629ebb348bf745a328) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 2010/12/19 20:30:28.0296 NVENETFD (22eedb34c4d7613a25b10c347c6c4c21) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys 2010/12/19 20:30:28.0406 nvgts (75e2e77c5497f34e60491d27bf03f1cb) C:\WINDOWS\system32\DRIVERS\nvgts.sys 2010/12/19 20:30:28.0515 nvnetbus (5e3f6ad5cad0f12d3cccd06fd964087a) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys 2010/12/19 20:30:28.0625 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 2010/12/19 20:30:28.0734 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 2010/12/19 20:30:28.0843 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys 2010/12/19 20:30:29.0000 ossrv (103a9b117a7d9903111955cdafe65ac6) C:\WINDOWS\system32\DRIVERS\ctoss2k.sys 2010/12/19 20:30:29.0093 P17 (abfb35446f754702f7edba131a2b43fe) C:\WINDOWS\system32\drivers\P17.sys 2010/12/19 20:30:29.0281 Par1284 (8e55251d83763ccca60fe26a811cfb0c) C:\Program Files\FlexiSIGN-PRO 8.1v1\Program\Par1284.sys 2010/12/19 20:30:29.0515 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys 2010/12/19 20:30:29.0687 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 2010/12/19 20:30:29.0750 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 2010/12/19 20:30:29.0890 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 2010/12/19 20:30:30.0046 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 2010/12/19 20:30:30.0140 PciPPorts (6de789c487908d8c3781e96d05b7ae0f) C:\WINDOWS\system32\DRIVERS\PciPPorts.sys 2010/12/19 20:30:30.0234 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 2010/12/19 20:30:30.0484 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 2010/12/19 20:30:30.0609 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys 2010/12/19 20:30:30.0734 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 2010/12/19 20:30:30.0953 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys 2010/12/19 20:30:31.0484 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2010/12/19 20:30:31.0578 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 2010/12/19 20:30:31.0671 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 2010/12/19 20:30:31.0765 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 2010/12/19 20:30:31.0859 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 2010/12/19 20:30:31.0968 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 2010/12/19 20:30:32.0125 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys 2010/12/19 20:30:32.0234 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 2010/12/19 20:30:32.0421 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 2010/12/19 20:30:32.0437 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 2010/12/19 20:30:32.0593 ScanUSBEMPIA (f5a633609777c212ec5ff19927fc5955) C:\WINDOWS\system32\DRIVERS\emScan.sys 2010/12/19 20:30:32.0687 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 2010/12/19 20:30:32.0828 Sentinel (aebba7428a6c40cce3c5abde45190b24) C:\WINDOWS\System32\Drivers\SENTINEL.SYS 2010/12/19 20:30:32.0953 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys 2010/12/19 20:30:33.0078 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 2010/12/19 20:30:33.0234 SLIP (1ffc44d6787ec1ea9a2b1440a90fa5c1) C:\WINDOWS\system32\DRIVERS\SLIP.sys 2010/12/19 20:30:33.0359 snapman (68fc62a72bd6d8e9dfe3718440be94a0) C:\WINDOWS\system32\DRIVERS\snapman.sys 2010/12/19 20:30:33.0531 speedfan (5d6401db90ec81b71f8e2c5c8f0fef23) C:\WINDOWS\system32\speedfan.sys 2010/12/19 20:30:33.0812 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 2010/12/19 20:30:33.0953 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 2010/12/19 20:30:34.0093 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys 2010/12/19 20:30:34.0265 streamip (a9f9fd0212e572b84edb9eb661f6bc04) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 2010/12/19 20:30:34.0343 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 2010/12/19 20:30:34.0437 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 2010/12/19 20:30:34.0703 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 2010/12/19 20:30:34.0843 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 2010/12/19 20:30:34.0953 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 2010/12/19 20:30:35.0093 tdrpman (3b7b6779eb231f731bba8f9fe67aadfc) C:\WINDOWS\system32\DRIVERS\tdrpman.sys 2010/12/19 20:30:35.0218 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 2010/12/19 20:30:35.0328 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 2010/12/19 20:30:35.0375 tifsfilter (b0b3122bff3910e0ba97014045467778) C:\WINDOWS\system32\DRIVERS\tifsfilt.sys 2010/12/19 20:30:35.0453 timounter (13bfe330880ac0ce8672d00aa5aff738) C:\WINDOWS\system32\DRIVERS\timntr.sys 2010/12/19 20:30:35.0671 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 2010/12/19 20:30:35.0859 UnlockerDriver5 (4847639d852763ee39415c929470f672) C:\Program Files\Unlocker\UnlockerDriver5.sys 2010/12/19 20:30:36.0140 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 2010/12/19 20:30:36.0265 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys 2010/12/19 20:30:36.0328 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 2010/12/19 20:30:36.0421 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 2010/12/19 20:30:36.0515 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 2010/12/19 20:30:36.0625 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys 2010/12/19 20:30:36.0718 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 2010/12/19 20:30:36.0796 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 2010/12/19 20:30:36.0890 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 2010/12/19 20:30:37.0000 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 2010/12/19 20:30:37.0156 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 2010/12/19 20:30:37.0328 vsdatant (050c38ebb22512122e54b47dc278bccd) C:\WINDOWS\system32\vsdatant.sys 2010/12/19 20:30:37.0796 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 2010/12/19 20:30:38.0125 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 2010/12/19 20:30:38.0265 winachsx (11ec1afceb5c917ce73d3c301ff4291e) C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys 2010/12/19 20:30:38.0421 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys 2010/12/19 20:30:38.0546 WSTCODEC (233cdd1c06942115802eb7ce6669e099) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 2010/12/19 20:30:38.0640 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 2010/12/19 20:30:38.0734 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 2010/12/19 20:30:38.0859 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0) 2010/12/19 20:30:38.0859 ================================================================================ 2010/12/19 20:30:38.0859 Scan finished 2010/12/19 20:30:38.0859 ================================================================================ 2010/12/19 20:30:38.0875 Detected object count: 1 2010/12/19 20:30:53.0265 \HardDisk0 - will be cured after reboot 2010/12/19 20:30:53.0265 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure 2010/12/19 20:30:57.0640 Deinitialize success
Post #14
Good Morning,

Lets hold off on the updates right now, you where infected with TDL4 variant of the TDSS Rootkit that in turn infected your Master Boot Record , it won't be cured until you reboot so if you have not done so do it now.

Then drag Combofix to the trash and use the links I provided earlier and download a fresh copy and run it, it should run now . Post the log when done
Post #15
hi i did as instructed remove combofix re download and reinstall.. i turned off all anti-virus and ran combofix and still is hangs up on 50. i dont think it creates a log file.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI