Spyware / Malware / Virus Removal

Mor.exe has stopped working?

8 min read

Looking for the outcome? Ask AI

gbu Topic Starter

Post #1March 7, 2012, 4:42 PM UTC

Hello there, i was directed to you by the helpful members at Sevenforums.com.

i'l copy/paste what i posted there and also a link to the thread as you may want to read the replies:-
http://www.sevenforums.com/system-security…ed-working.html

The last couple of days ive had a window pop-up that says 'mor.exe has stopped working'
Iv'e noticed this comes up when i visit a site that uses java as the java icon appears in the toolbar at the same time as the window pops up.
The detailed info that is shown is:-

Fault Module Name: mor.exe

Fault Module Version: 0.0.0.0
Fault Module Timestamp: 721c31e7
Exception Code: c0000005
Exception Offset: 0003910b
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 2057
Additional Information 1: 0a9e
Additional Information 2: 0a9e372d3b4ad19135b953a78882e789
Additional Information 3: 0a9e
Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

i click on Close Program and the java icon goes away.

i ran eset online scanner as requested and these are the results:-

C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\4fd90665-49176361 Java/Exploit.Blacole trojan
C:\Users\James\AppData\Roaming\sdra64.exe Win32/Spy.Zbot.WM trojan
C:\Windows\System32\aigovox.dll a variant of Win32/Urlbot.NAO trojan
C:\Windows\System32\movuxavi.exe a variant of Win32/Urlbot.NAT trojan
C:\Windows\System32\MPK\MpkNetInstall.exe probably a variant of Win32/Agent.EUDBPIN trojan
C:\Windows\SysWOW64\aigovox.dll a variant of Win32/Urlbot.NAO trojan
C:\Windows\SysWOW64\movuxavi.exe a variant of Win32/Urlbot.NAT trojan
C:\Windows\SysWOW64\MPK\MpkNetInstall.exe probably a variant of Win32/Agent.EUDBPIN trojan

My own AV Microsoft Security Essentials picked up these before this scan was run.:-

Exploit:Java/CVE-2011-3544.AV
file:C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\5675a445-743090a4->Men.class

Exploit:Java/CVE-2011-3544.AU
file:C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\3ba307a2-5361461b->Loo.class

I also had a recent problem, i had with my router that kept cutting out, i phoned tech support for BeUnlimited and they guided me through a process to allow them to set up remote access to my pc in order to update the firmware and reset some of my settings.
I have since turned off the remote connections tab in system properties.

I have run HiJackThis as per your posting instructions and here is the results:-

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:38:33, on 07/03/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Program Files\My Lockbox\mylbx.exe
C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\James\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arsenal.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=3
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddrnw&s=…hTerms}&f=4
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {66bd2442-241b-44cd-8c7a-b51037053cdb} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Policies\Explorer\Run: [Mpk.exe] C:\Windows\SysWOW64\MPK\Mpk.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AppleChargerSrv - Unknown owner - C:\Windows\system32\AppleChargerSrv.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\system32\nlssrv32.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files (x86)\Blaze Media Pro\NMSAccess32.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 7377 bytes

mowman

Post #2March 8, 2012, 1:55 AM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

Do not use the quote button,copy/paste directly into the reply.

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
  If suspicious objects are found select skip
- Then click Continue > Reboot now
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

gbu

Post #3March 8, 2012, 8:53 AM UTC last edited March 8, 2012, 9:21 AM UTC

Thanks for reply and help with my problem.

The TDSKiller found nothing here is the log:-
08:22:20.0419 6952 TDSS rootkit removing tool [removed] Mar 5 2012 11:23:39
08:22:20.0547 6952 ============================================================
08:22:20.0547 6952 Current date / time: 2012/03/08 08:22:20.0547
08:22:20.0547 6952 SystemInfo:
08:22:20.0547 6952
08:22:20.0547 6952 OS Version: 6.1.7601 ServicePack: 1.0
08:22:20.0547 6952 Product type: Workstation
08:22:20.0547 6952 ComputerName: JAMES-PC
08:22:20.0547 6952 UserName: James
08:22:20.0547 6952 Windows directory: C:\Windows
08:22:20.0547 6952 System windows directory: C:\Windows
08:22:20.0548 6952 Running under WOW64
08:22:20.0548 6952 Processor architecture: Intel x64
08:22:20.0548 6952 Number of processors: 4
08:22:20.0548 6952 Page size: 0x1000
08:22:20.0548 6952 Boot type: Normal boot
08:22:20.0548 6952 ============================================================
08:22:21.0734 6952 Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
08:22:21.0768 6952 Drive \Device\Harddisk1\DR1 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
08:22:21.0787 6952 Drive \Device\Harddisk2\DR2 - Size: 0x45DECD2000 (279.48 Gb), SectorSize: 0x200, Cylinders: 0x8E83, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
08:22:22.0046 6952 \Device\Harddisk0\DR0:
08:22:22.0046 6952 MBR used
08:22:22.0046 6952 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x7F, BlocksNum 0x4A856E42
08:22:22.0046 6952 \Device\Harddisk1\DR1:
08:22:22.0066 6952 MBR used
08:22:22.0066 6952 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x14C6E203
08:22:22.0077 6952 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x14C6E281, BlocksNum 0xB47A8C5
08:22:22.0091 6952 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x200E8B85, BlocksNum 0x35A352E
08:22:22.0133 6952 \Device\Harddisk1\DR1\Partition3: MBR, Type 0x7, StartLBA 0x2368C0F2, BlocksNum 0xC8ABE6B
08:22:22.0150 6952 \Device\Harddisk1\DR1\Partition4: MBR, Type 0x7, StartLBA 0x2FF37F9C, BlocksNum 0x27E52ED
08:22:22.0170 6952 \Device\Harddisk1\DR1\Partition5: MBR, Type 0x7, StartLBA 0x3271D2C8, BlocksNum 0x18139BF9
08:22:22.0170 6952 \Device\Harddisk2\DR2:
08:22:22.0207 6952 MBR used
08:22:22.0207 6952 \Device\Harddisk2\DR2\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xC890724
08:22:22.0229 6952 \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0xC8907A2, BlocksNum 0x16662321
08:22:22.0480 6952 Initialize success
08:22:22.0480 6952 ============================================================
08:22:29.0176 7040 ============================================================
08:22:29.0176 7040 Scan started
08:22:29.0176 7040 Mode: Manual;
08:22:29.0176 7040 ============================================================
08:22:30.0344 7040 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
08:22:30.0352 7040 1394ohci - ok
08:22:30.0393 7040 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
08:22:30.0401 7040 ACPI - ok
08:22:30.0480 7040 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
08:22:30.0481 7040 AcpiPmi - ok
08:22:30.0649 7040 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
08:22:30.0666 7040 adp94xx - ok
08:22:30.0776 7040 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
08:22:30.0794 7040 adpahci - ok
08:22:30.0880 7040 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
08:22:30.0889 7040 adpu320 - ok
08:22:31.0017 7040 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
08:22:31.0034 7040 AFD - ok
08:22:31.0091 7040 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
08:22:31.0093 7040 agp440 - ok
08:22:31.0131 7040 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
08:22:31.0132 7040 aliide - ok
08:22:31.0185 7040 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
08:22:31.0186 7040 amdide - ok
08:22:31.0247 7040 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
08:22:31.0249 7040 AmdK8 - ok
08:22:31.0276 7040 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
08:22:31.0278 7040 AmdPPM - ok
08:22:31.0324 7040 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
08:22:31.0326 7040 amdsata - ok
08:22:31.0403 7040 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
08:22:31.0411 7040 amdsbs - ok
08:22:31.0453 7040 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
08:22:31.0453 7040 amdxata - ok
08:22:31.0509 7040 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
08:22:31.0510 7040 AppID - ok
08:22:31.0596 7040 AppleCharger (6be11ad81d4527d299f0cb5f3731aabc) C:\Windows\system32\DRIVERS\AppleCharger.sys
08:22:31.0606 7040 AppleCharger - ok
08:22:31.0663 7040 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
08:22:31.0665 7040 arc - ok
08:22:31.0705 7040 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
08:22:31.0707 7040 arcsas - ok
08:22:31.0754 7040 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
08:22:31.0755 7040 AsyncMac - ok
08:22:31.0797 7040 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
08:22:31.0798 7040 atapi - ok
08:22:31.0940 7040 atikmdag (3efd964d52221360af0673cd61c2f4f5) C:\Windows\system32\drivers\atikmdag.sys
08:22:32.0051 7040 atikmdag - ok
08:22:32.0121 7040 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
08:22:32.0137 7040 b06bdrv - ok
08:22:32.0221 7040 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
08:22:32.0238 7040 b57nd60a - ok
08:22:32.0346 7040 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
08:22:32.0346 7040 Beep - ok
08:22:32.0452 7040 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
08:22:32.0454 7040 blbdrive - ok
08:22:32.0513 7040 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
08:22:32.0515 7040 bowser - ok
08:22:32.0552 7040 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
08:22:32.0553 7040 BrFiltLo - ok
08:22:32.0579 7040 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
08:22:32.0580 7040 BrFiltUp - ok
08:22:32.0639 7040 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
08:22:32.0648 7040 Brserid - ok
08:22:32.0671 7040 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
08:22:32.0672 7040 BrSerWdm - ok
08:22:32.0704 7040 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
08:22:32.0705 7040 BrUsbMdm - ok
08:22:32.0737 7040 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
08:22:32.0738 7040 BrUsbSer - ok
08:22:32.0801 7040 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\DRIVERS\BthEnum.sys
08:22:32.0803 7040 BthEnum - ok
08:22:32.0845 7040 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
08:22:32.0847 7040 BTHMODEM - ok
08:22:32.0890 7040 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
08:22:32.0893 7040 BthPan - ok
08:22:32.0965 7040 BTHPORT (64c198198501f7560ee41d8d1efa7952) C:\Windows\system32\Drivers\BTHport.sys
08:22:32.0983 7040 BTHPORT - ok
08:22:33.0055 7040 BTHUSB (f188b7394d81010767b6df3178519a37) C:\Windows\system32\Drivers\BTHUSB.sys
08:22:33.0056 7040 BTHUSB - ok
08:22:33.0110 7040 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
08:22:33.0112 7040 cdfs - ok
08:22:33.0257 7040 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
08:22:33.0297 7040 cdrom - ok
08:22:33.0504 7040 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
08:22:33.0505 7040 circlass - ok
08:22:33.0556 7040 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
08:22:33.0573 7040 CLFS - ok
08:22:33.0636 7040 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
08:22:33.0638 7040 CmBatt - ok
08:22:33.0686 7040 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
08:22:33.0687 7040 cmdide - ok
08:22:33.0748 7040 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
08:22:33.0765 7040 CNG - ok
08:22:33.0810 7040 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
08:22:33.0811 7040 Compbatt - ok
08:22:33.0871 7040 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
08:22:33.0872 7040 CompositeBus - ok
08:22:33.0928 7040 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
08:22:33.0929 7040 crcdisk - ok
08:22:34.0008 7040 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
08:22:34.0025 7040 CSC - ok
08:22:34.0095 7040 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
08:22:34.0096 7040 DfsC - ok
08:22:34.0165 7040 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
08:22:34.0166 7040 discache - ok
08:22:34.0213 7040 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
08:22:34.0214 7040 Disk - ok
08:22:34.0268 7040 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
08:22:34.0269 7040 drmkaud - ok
08:22:34.0330 7040 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
08:22:34.0356 7040 DXGKrnl - ok
08:22:34.0451 7040 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
08:22:34.0528 7040 ebdrv - ok
08:22:34.0602 7040 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
08:22:34.0619 7040 elxstor - ok
08:22:34.0684 7040 epmntdrv (9eafb3b3b60b8ad958985152a9309aca) C:\Windows\system32\epmntdrv.sys
08:22:34.0695 7040 epmntdrv - ok
08:22:34.0755 7040 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
08:22:34.0756 7040 ErrDev - ok
08:22:34.0809 7040 EuGdiDrv (fb949ed2c93c878a189039f3d7730942) C:\Windows\system32\EuGdiDrv.sys
08:22:34.0818 7040 EuGdiDrv - ok
08:22:34.0879 7040 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
08:22:34.0882 7040 exfat - ok
08:22:34.0928 7040 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
08:22:34.0939 7040 fastfat - ok
08:22:34.0972 7040 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
08:22:34.0973 7040 fdc - ok
08:22:35.0029 7040 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
08:22:35.0030 7040 FileInfo - ok
08:22:35.0069 7040 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
08:22:35.0070 7040 Filetrace - ok
08:22:35.0111 7040 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
08:22:35.0112 7040 flpydisk - ok
08:22:35.0170 7040 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
08:22:35.0178 7040 FltMgr - ok
08:22:35.0225 7040 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
08:22:35.0226 7040 FsDepends - ok
08:22:35.0300 7040 FSProFilter (8197c85348a33bccfe80dd6e2db53903) C:\Windows\system32\Drivers\FSPFltd.sys
08:22:35.0302 7040 FSProFilter - ok
08:22:35.0350 7040 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
08:22:35.0351 7040 Fs_Rec - ok
08:22:35.0411 7040 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
08:22:35.0418 7040 fvevol - ok
08:22:35.0480 7040 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
08:22:35.0482 7040 gagp30kx - ok
08:22:35.0504 7040 gdrv - ok
08:22:35.0570 7040 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
08:22:35.0571 7040 GEARAspiWDM - ok
08:22:35.0614 7040 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
08:22:35.0615 7040 hcw85cir - ok
08:22:35.0686 7040 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
08:22:35.0695 7040 HdAudAddService - ok
08:22:35.0766 7040 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
08:22:35.0768 7040 HDAudBus - ok
08:22:35.0792 7040 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
08:22:35.0794 7040 HidBatt - ok
08:22:35.0838 7040 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
08:22:35.0840 7040 HidBth - ok
08:22:35.0890 7040 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
08:22:35.0891 7040 HidIr - ok
08:22:35.0950 7040 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys
08:22:35.0951 7040 HidUsb - ok
08:22:36.0014 7040 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
08:22:36.0016 7040 HpSAMD - ok
08:22:36.0085 7040 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
08:22:36.0102 7040 HTTP - ok
08:22:36.0156 7040 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
08:22:36.0157 7040 hwpolicy - ok
08:22:36.0225 7040 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
08:22:36.0227 7040 i8042prt - ok
08:22:36.0295 7040 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
08:22:36.0313 7040 iaStorV - ok
08:22:36.0359 7040 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
08:22:36.0360 7040 iirsp - ok
08:22:36.0487 7040 IntcAzAudAddService (392d5c87f282e8e36df5154418a7bb20) C:\Windows\system32\drivers\RTKVHD64.sys
08:22:36.0555 7040 IntcAzAudAddService - ok
08:22:36.0629 7040 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
08:22:36.0629 7040 intelide - ok
08:22:36.0696 7040 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
08:22:36.0700 7040 intelppm - ok
08:22:36.0805 7040 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
08:22:36.0806 7040 IpFilterDriver - ok
08:22:36.0883 7040 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
08:22:36.0885 7040 IPMIDRV - ok
08:22:36.0945 7040 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
08:22:36.0948 7040 IPNAT - ok
08:22:37.0071 7040 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
08:22:37.0072 7040 IRENUM - ok
08:22:37.0123 7040 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
08:22:37.0124 7040 isapnp - ok
08:22:37.0172 7040 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
08:22:37.0189 7040 iScsiPrt - ok
08:22:37.0242 7040 ISODrive (9c6f3f69163133fb8e56ac4a6e163452) C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys
08:22:37.0243 7040 ISODrive - ok
08:22:37.0302 7040 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
08:22:37.0303 7040 kbdclass - ok
08:22:37.0355 7040 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
08:22:37.0356 7040 kbdhid - ok
08:22:37.0411 7040 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
08:22:37.0412 7040 KSecDD - ok
08:22:37.0445 7040 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
08:22:37.0453 7040 KSecPkg - ok
08:22:37.0499 7040 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
08:22:37.0500 7040 ksthunk - ok
08:22:37.0581 7040 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
08:22:37.0582 7040 lltdio - ok
08:22:37.0637 7040 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
08:22:37.0639 7040 LSI_FC - ok
08:22:37.0684 7040 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
08:22:37.0686 7040 LSI_SAS - ok
08:22:37.0734 7040 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
08:22:37.0735 7040 LSI_SAS2 - ok
08:22:37.0772 7040 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
08:22:37.0774 7040 LSI_SCSI - ok
08:22:37.0823 7040 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
08:22:37.0824 7040 luafv - ok
08:22:37.0863 7040 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
08:22:37.0864 7040 megasas - ok
08:22:37.0909 7040 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
08:22:37.0918 7040 MegaSR - ok
08:22:37.0988 7040 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
08:22:37.0989 7040 Modem - ok
08:22:38.0033 7040 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
08:22:38.0034 7040 monitor - ok
08:22:38.0092 7040 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
08:22:38.0093 7040 mouclass - ok
08:22:38.0151 7040 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
08:22:38.0152 7040 mouhid - ok
08:22:38.0202 7040 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
08:22:38.0204 7040 mountmgr - ok
08:22:38.0356 7040 MpFilter (c177a7ebf5e8a0b596f618870516cab8) C:\Windows\system32\DRIVERS\MpFilter.sys
08:22:38.0365 7040 MpFilter - ok
08:22:38.0409 7040 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
08:22:38.0418 7040 mpio - ok
08:22:38.0499 7040 MpNWMon (8fbf6b31fe8af1833d93c5913d5b4d55) C:\Windows\system32\DRIVERS\MpNWMon.sys
08:22:38.0500 7040 MpNWMon - ok
08:22:38.0557 7040 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
08:22:38.0559 7040 mpsdrv - ok
08:22:38.0616 7040 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
08:22:38.0624 7040 MRxDAV - ok
08:22:38.0687 7040 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
08:22:38.0695 7040 mrxsmb - ok
08:22:38.0767 7040 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
08:22:38.0775 7040 mrxsmb10 - ok
08:22:38.0859 7040 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
08:22:38.0901 7040 mrxsmb20 - ok
08:22:39.0014 7040 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
08:22:39.0015 7040 msahci - ok
08:22:39.0058 7040 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
08:22:39.0067 7040 msdsm - ok
08:22:39.0124 7040 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
08:22:39.0125 7040 Msfs - ok
08:22:39.0166 7040 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
08:22:39.0167 7040 mshidkmdf - ok
08:22:39.0202 7040 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
08:22:39.0203 7040 msisadrv - ok
08:22:39.0253 7040 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
08:22:39.0255 7040 MSKSSRV - ok
08:22:39.0320 7040 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
08:22:39.0321 7040 MSPCLOCK - ok
08:22:39.0362 7040 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
08:22:39.0363 7040 MSPQM - ok
08:22:39.0423 7040 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
08:22:39.0440 7040 MsRPC - ok
08:22:39.0486 7040 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
08:22:39.0488 7040 mssmbios - ok
08:22:39.0539 7040 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
08:22:39.0540 7040 MSTEE - ok
08:22:39.0571 7040 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
08:22:39.0572 7040 MTConfig - ok
08:22:39.0623 7040 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
08:22:39.0624 7040 Mup - ok
08:22:39.0682 7040 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
08:22:39.0691 7040 NativeWifiP - ok
08:22:39.0761 7040 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
08:22:39.0787 7040 NDIS - ok
08:22:39.0836 7040 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
08:22:39.0838 7040 NdisCap - ok
08:22:39.0886 7040 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
08:22:39.0887 7040 NdisTapi - ok
08:22:39.0930 7040 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
08:22:39.0932 7040 Ndisuio - ok
08:22:39.0992 7040 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
08:22:40.0000 7040 NdisWan - ok
08:22:40.0055 7040 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
08:22:40.0056 7040 NDProxy - ok
08:22:40.0107 7040 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
08:22:40.0108 7040 NetBIOS - ok
08:22:40.0151 7040 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
08:22:40.0160 7040 NetBT - ok
08:22:40.0225 7040 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
08:22:40.0226 7040 nfrd960 - ok
08:22:40.0268 7040 NisDrv (5f7d72cbcdd025af1f38fdeee5646968) C:\Windows\system32\DRIVERS\NisDrvWFP.sys
08:22:40.0270 7040 NisDrv - ok
08:22:40.0365 7040 NPF - ok
08:22:40.0413 7040 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
08:22:40.0414 7040 Npfs - ok
08:22:40.0455 7040 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
08:22:40.0457 7040 nsiproxy - ok
08:22:40.0554 7040 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
08:22:40.0589 7040 Ntfs - ok
08:22:40.0642 7040 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
08:22:40.0643 7040 Null - ok
08:22:40.0699 7040 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
08:22:40.0708 7040 nvraid - ok
08:22:40.0756 7040 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
08:22:40.0765 7040 nvstor - ok
08:22:40.0889 7040 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
08:22:40.0891 7040 nv_agp - ok
08:22:40.0991 7040 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
08:22:40.0996 7040 ohci1394 - ok
08:22:41.0133 7040 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
08:22:41.0135 7040 Parport - ok
08:22:41.0244 7040 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
08:22:41.0245 7040 partmgr - ok
08:22:41.0337 7040 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
08:22:41.0346 7040 pci - ok
08:22:41.0395 7040 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
08:22:41.0396 7040 pciide - ok
08:22:41.0497 7040 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
08:22:41.0514 7040 pcmcia - ok
08:22:41.0566 7040 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
08:22:41.0567 7040 pcw - ok
08:22:41.0614 7040 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
08:22:41.0631 7040 PEAUTH - ok
08:22:41.0710 7040 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
08:22:41.0712 7040 PptpMiniport - ok
08:22:41.0765 7040 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
08:22:41.0767 7040 Processor - ok
08:22:41.0833 7040 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
08:22:41.0842 7040 Psched - ok
08:22:41.0916 7040 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
08:22:41.0949 7040 ql2300 - ok
08:22:41.0995 7040 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
08:22:41.0998 7040 ql40xx - ok
08:22:42.0039 7040 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
08:22:42.0041 7040 QWAVEdrv - ok
08:22:42.0085 7040 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
08:22:42.0086 7040 RasAcd - ok
08:22:42.0150 7040 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
08:22:42.0151 7040 RasAgileVpn - ok
08:22:42.0207 7040 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
08:22:42.0210 7040 Rasl2tp - ok
08:22:42.0277 7040 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
08:22:42.0279 7040 RasPppoe - ok
08:22:42.0325 7040 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
08:22:42.0326 7040 RasSstp - ok
08:22:42.0369 7040 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
08:22:42.0377 7040 rdbss - ok
08:22:42.0405 7040 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
08:22:42.0407 7040 rdpbus - ok
08:22:42.0444 7040 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
08:22:42.0445 7040 RDPCDD - ok
08:22:42.0502 7040 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
08:22:42.0510 7040 RDPDR - ok
08:22:42.0543 7040 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
08:22:42.0544 7040 RDPENCDD - ok
08:22:42.0582 7040 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
08:22:42.0583 7040 RDPREFMP - ok
08:22:42.0648 7040 RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys
08:22:42.0650 7040 RdpVideoMiniport - ok
08:22:42.0706 7040 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
08:22:42.0723 7040 RDPWD - ok
08:22:42.0783 7040 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
08:22:42.0792 7040 rdyboost - ok
08:22:42.0893 7040 regavw32 (9dec53035091700005d8e691cc62c912) C:\Windows\system32\DRIVERS\regavw32.sys
08:22:42.0903 7040 regavw32 - ok
08:22:43.0110 7040 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
08:22:43.0119 7040 RFCOMM - ok
08:22:43.0232 7040 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
08:22:43.0234 7040 rspndr - ok
08:22:43.0361 7040 RTL8167 (e50cfb92986dcab49de93788fd695813) C:\Windows\system32\DRIVERS\Rt64win7.sys
08:22:43.0379 7040 RTL8167 - ok
08:22:43.0489 7040 s115bus (e0f0977caafdf719929c8ca02a1c5147) C:\Windows\system32\DRIVERS\s115bus.sys
08:22:43.0492 7040 s115bus - ok
08:22:43.0584 7040 s115mdfl (136328e6c3086a19eb3154058bc7b3a3) C:\Windows\system32\DRIVERS\s115mdfl.sys
08:22:43.0585 7040 s115mdfl - ok
08:22:43.0647 7040 s115mdm (54552277de7eae1a2e108a4cff7abb07) C:\Windows\system32\DRIVERS\s115mdm.sys
08:22:43.0657 7040 s115mdm - ok
08:22:43.0743 7040 s115mgmt (e9b3966836cb9c2107264e44249267df) C:\Windows\system32\DRIVERS\s115mgmt.sys
08:22:43.0746 7040 s115mgmt - ok
08:22:43.0832 7040 s115obex (f6ab3b6e35981c4f3fed4198d3f29674) C:\Windows\system32\DRIVERS\s115obex.sys
08:22:43.0834 7040 s115obex - ok
08:22:43.0883 7040 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
08:22:43.0884 7040 s3cap - ok
08:22:43.0969 7040 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
08:22:43.0972 7040 sbp2port - ok
08:22:44.0062 7040 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
08:22:44.0063 7040 scfilter - ok
08:22:44.0116 7040 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
08:22:44.0117 7040 secdrv - ok
08:22:44.0178 7040 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
08:22:44.0180 7040 Serenum - ok
08:22:44.0241 7040 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
08:22:44.0243 7040 Serial - ok
08:22:44.0293 7040 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
08:22:44.0294 7040 sermouse - ok
08:22:44.0352 7040 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
08:22:44.0353 7040 sffdisk - ok
08:22:44.0395 7040 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
08:22:44.0396 7040 sffp_mmc - ok
08:22:44.0439 7040 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
08:22:44.0440 7040 sffp_sd - ok
08:22:44.0487 7040 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
08:22:44.0488 7040 sfloppy - ok
08:22:44.0538 7040 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
08:22:44.0539 7040 SiSRaid2 - ok
08:22:44.0582 7040 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
08:22:44.0584 7040 SiSRaid4 - ok
08:22:44.0610 7040 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
08:22:44.0612 7040 Smb - ok
08:22:44.0688 7040 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
08:22:44.0689 7040 spldr - ok
08:22:44.0749 7040 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
08:22:44.0766 7040 srv - ok
08:22:44.0837 7040 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
08:22:44.0854 7040 srv2 - ok
08:22:44.0892 7040 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
08:22:44.0901 7040 srvnet - ok
08:22:44.0973 7040 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
08:22:44.0974 7040 stexstor - ok
08:22:45.0049 7040 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
08:22:45.0050 7040 storflt - ok
08:22:45.0113 7040 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
08:22:45.0114 7040 storvsc - ok
08:22:45.0171 7040 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
08:22:45.0173 7040 swenum - ok
08:22:45.0215 7040 Synth3dVsc - ok
08:22:45.0323 7040 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
08:22:45.0367 7040 Tcpip - ok
08:22:45.0523 7040 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
08:22:45.0535 7040 TCPIP6 - ok
08:22:45.0634 7040 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
08:22:45.0636 7040 tcpipreg - ok
08:22:45.0702 7040 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
08:22:45.0704 7040 TDPIPE - ok
08:22:45.0741 7040 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
08:22:45.0742 7040 TDTCP - ok
08:22:45.0793 7040 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
08:22:45.0796 7040 tdx - ok
08:22:45.0847 7040 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
08:22:45.0849 7040 TermDD - ok
08:22:45.0929 7040 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
08:22:45.0931 7040 tssecsrv - ok
08:22:45.0995 7040 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
08:22:45.0997 7040 TsUsbFlt - ok
08:22:46.0036 7040 tsusbhub - ok
08:22:46.0109 7040 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
08:22:46.0112 7040 tunnel - ok
08:22:46.0162 7040 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
08:22:46.0164 7040 uagp35 - ok
08:22:46.0225 7040 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
08:22:46.0234 7040 udfs - ok
08:22:46.0294 7040 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
08:22:46.0296 7040 uliagpkx - ok
08:22:46.0351 7040 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
08:22:46.0352 7040 umbus - ok
08:22:46.0394 7040 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
08:22:46.0395 7040 UmPass - ok
08:22:46.0465 7040 USBAAPL64 (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys
08:22:46.0467 7040 USBAAPL64 - ok
08:22:46.0530 7040 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
08:22:46.0532 7040 usbccgp - ok
08:22:46.0589 7040 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
08:22:46.0591 7040 usbcir - ok
08:22:46.0640 7040 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
08:22:46.0641 7040 usbehci - ok
08:22:46.0694 7040 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
08:22:46.0703 7040 usbhub - ok
08:22:46.0748 7040 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
08:22:46.0749 7040 usbohci - ok
08:22:46.0791 7040 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
08:22:46.0792 7040 usbprint - ok
08:22:46.0843 7040 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
08:22:46.0845 7040 USBSTOR - ok
08:22:46.0901 7040 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
08:22:46.0903 7040 usbuhci - ok
08:22:46.0967 7040 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
08:22:46.0968 7040 vdrvroot - ok
08:22:47.0030 7040 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
08:22:47.0031 7040 vga - ok
08:22:47.0074 7040 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
08:22:47.0076 7040 VgaSave - ok
08:22:47.0105 7040 VGPU - ok
08:22:47.0200 7040 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
08:22:47.0209 7040 vhdmp - ok
08:22:47.0325 7040 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
08:22:47.0327 7040 viaide - ok
08:22:47.0415 7040 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
08:22:47.0423 7040 vmbus - ok
08:22:47.0488 7040 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
08:22:47.0489 7040 VMBusHID - ok
08:22:47.0547 7040 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
08:22:47.0548 7040 volmgr - ok
08:22:47.0605 7040 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
08:22:47.0614 7040 volmgrx - ok
08:22:47.0676 7040 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
08:22:47.0686 7040 volsnap - ok
08:22:47.0769 7040 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
08:22:47.0778 7040 vsmraid - ok
08:22:47.0803 7040 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
08:22:47.0805 7040 vwifibus - ok
08:22:47.0933 7040 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
08:22:47.0935 7040 WacomPen - ok
08:22:48.0027 7040 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
08:22:48.0030 7040 WANARP - ok
08:22:48.0035 7040 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
08:22:48.0036 7040 Wanarpv6 - ok
08:22:48.0104 7040 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
08:22:48.0106 7040 Wd - ok
08:22:48.0159 7040 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
08:22:48.0176 7040 Wdf01000 - ok
08:22:48.0308 7040 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
08:22:48.0310 7040 WfpLwf - ok
08:22:48.0410 7040 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
08:22:48.0411 7040 WIMMount - ok
08:22:48.0532 7040 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
08:22:48.0534 7040 WinUsb - ok
08:22:48.0627 7040 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
08:22:48.0628 7040 WmiAcpi - ok
08:22:48.0672 7040 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
08:22:48.0673 7040 ws2ifsl - ok
08:22:48.0787 7040 WsAudio_DeviceS(1) (ad12f5c7251bb8d575d560894e73cbba) C:\Windows\system32\drivers\WsAudio_DeviceS(1).sys
08:22:48.0799 7040 WsAudio_DeviceS(1) - ok
08:22:48.0872 7040 WsAudio_DeviceS(2) (ad12f5c7251bb8d575d560894e73cbba) C:\Windows\system32\drivers\WsAudio_DeviceS(2).sys
08:22:48.0881 7040 WsAudio_DeviceS(2) - ok
08:22:48.0934 7040 WsAudio_DeviceS(3) (ad12f5c7251bb8d575d560894e73cbba) C:\Windows\system32\drivers\WsAudio_DeviceS(3).sys
08:22:48.0944 7040 WsAudio_DeviceS(3) - ok
08:22:49.0045 7040 WsAudio_DeviceS(4) (ad12f5c7251bb8d575d560894e73cbba) C:\Windows\system32\drivers\WsAudio_DeviceS(4).sys
08:22:49.0055 7040 WsAudio_DeviceS(4) - ok
08:22:49.0105 7040 WsAudio_DeviceS(5) (ad12f5c7251bb8d575d560894e73cbba) C:\Windows\system32\drivers\WsAudio_DeviceS(5).sys
08:22:49.0114 7040 WsAudio_DeviceS(5) - ok
08:22:49.0226 7040 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
08:22:49.0237 7040 WudfPf - ok
08:22:49.0398 7040 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
08:22:49.0414 7040 WUDFRd - ok
08:22:49.0570 7040 ZTEusbmdm6k (8a9e7e6169f92e64d5b5305562e363bb) C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys
08:22:49.0572 7040 ZTEusbmdm6k - ok
08:22:49.0631 7040 ZTEusbnmea (8a9e7e6169f92e64d5b5305562e363bb) C:\Windows\system32\DRIVERS\ZTEusbnmea.sys
08:22:49.0633 7040 ZTEusbnmea - ok
08:22:49.0710 7040 ZTEusbser6k (8a9e7e6169f92e64d5b5305562e363bb) C:\Windows\system32\DRIVERS\ZTEusbser6k.sys
08:22:49.0714 7040 ZTEusbser6k - ok
08:22:49.0908 7040 ZTEusbvoice (8a9e7e6169f92e64d5b5305562e363bb) C:\Windows\system32\DRIVERS\ZTEusbvoice.sys
08:22:49.0910 7040 ZTEusbvoice - ok
08:22:49.0964 7040 ZTEusbwwan (1f2b060e9b22178df821e8c780ef2e3f) C:\Windows\system32\DRIVERS\ZTEusbwwan.sys
08:22:49.0973 7040 ZTEusbwwan - ok
08:22:49.0987 7040 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
08:22:49.0991 7040 \Device\Harddisk0\DR0 - ok
08:22:49.0994 7040 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1
08:22:49.0996 7040 \Device\Harddisk1\DR1 - ok
08:22:50.0014 7040 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk2\DR2
08:22:50.0034 7040 \Device\Harddisk2\DR2 - ok
08:22:50.0038 7040 Boot (0x1200) (a7ff94c332f4f7c70e8311c41e5d194f) \Device\Harddisk0\DR0\Partition0
08:22:50.0039 7040 \Device\Harddisk0\DR0\Partition0 - ok
08:22:50.0044 7040 Boot (0x1200) (b89c9d8283c019ed18c8d1cb909cda27) \Device\Harddisk1\DR1\Partition0
08:22:50.0045 7040 \Device\Harddisk1\DR1\Partition0 - ok
08:22:50.0049 7040 Boot (0x1200) (7ca439258980027d1745aaed9181e72d) \Device\Harddisk1\DR1\Partition1
08:22:50.0050 7040 \Device\Harddisk1\DR1\Partition1 - ok
08:22:50.0055 7040 Boot (0x1200) (ec25b8590ee76b60a5f55519d38a9d22) \Device\Harddisk1\DR1\Partition2
08:22:50.0056 7040 \Device\Harddisk1\DR1\Partition2 - ok
08:22:50.0061 7040 Boot (0x1200) (6f49553d950e9019cffa41ea6ce8281c) \Device\Harddisk1\DR1\Partition3
08:22:50.0062 7040 \Device\Harddisk1\DR1\Partition3 - ok
08:22:50.0066 7040 Boot (0x1200) (0747d554a3b9548253d9d9e1bff1f83c) \Device\Harddisk1\DR1\Partition4
08:22:50.0067 7040 \Device\Harddisk1\DR1\Partition4 - ok
08:22:50.0072 7040 Boot (0x1200) (c06859da2dcf35d6beef1b1f1995fa3c) \Device\Harddisk1\DR1\Partition5
08:22:50.0073 7040 \Device\Harddisk1\DR1\Partition5 - ok
08:22:50.0077 7040 Boot (0x1200) (d601ed8071791cae2654150dcfb93e9e) \Device\Harddisk2\DR2\Partition0
08:22:50.0078 7040 \Device\Harddisk2\DR2\Partition0 - ok
08:22:50.0100 7040 Boot (0x1200) (bee029075dcce01025b43bbffd7d984a) \Device\Harddisk2\DR2\Partition1
08:22:50.0101 7040 \Device\Harddisk2\DR2\Partition1 - ok
08:22:50.0102 7040 ============================================================
08:22:50.0102 7040 Scan finished
08:22:50.0102 7040 ============================================================
08:22:50.0112 7032 Detected object count: 0
08:22:50.0113 7032 Actual detected object count: 0
08:23:10.0431 6948 Deinitialize success

Here is OTL.txt There was no Extra.txt

OTL logfile created on: 08/03/2012 08:41:21 - Run 2
OTL by OldTimer - Version 3.2.35.1 Folder = C:\Users\James\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

8.00 Gb Total Physical Memory | 5.89 Gb Available Physical Memory | 73.62% Memory free
16.00 Gb Paging File | 14.04 Gb Available in Paging File | 87.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 100.28 Gb Total Space | 39.71 Gb Free Space | 39.59% Space Free | Partition Type: NTFS
Drive D: | 179.19 Gb Total Space | 21.66 Gb Free Space | 12.09% Space Free | Partition Type: NTFS
Drive E: | 166.22 Gb Total Space | 105.12 Gb Free Space | 63.25% Space Free | Partition Type: NTFS
Drive F: | 90.24 Gb Total Space | 64.90 Gb Free Space | 71.92% Space Free | Partition Type: NTFS
Drive G: | 26.82 Gb Total Space | 8.91 Gb Free Space | 33.21% Space Free | Partition Type: NTFS
Drive H: | 100.34 Gb Total Space | 29.93 Gb Free Space | 29.83% Space Free | Partition Type: NTFS
Drive I: | 19.95 Gb Total Space | 1.95 Gb Free Space | 9.77% Space Free | Partition Type: NTFS
Drive J: | 192.61 Gb Total Space | 123.52 Gb Free Space | 64.13% Space Free | Partition Type: NTFS
Drive K: | 596.17 Gb Total Space | 18.96 Gb Free Space | 3.18% Space Free | Partition Type: NTFS

Computer Name: JAMES-PC | User Name: James | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\James\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\My Lockbox\mylbx.exe (FSPro Labs)
PRC - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
PRC - C:\Windows\SysWOW64\MPK\MPK.exe ()
PRC - C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe (Google Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\0vnkd2r8.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\gecko10\WINNT_x86-msvc\SSSLauncher.dll ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll ()
MOD - C:\Program Files\My Lockbox\FSPFlt.dll ()
MOD - C:\Windows\SysWOW64\MPK\MPK.exe ()
MOD - C:\Windows\SysWOW64\MPK\Mpk.dll ()
MOD - C:\Windows\SysWOW64\MPK\sqlite3.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (NisSrv) – C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (AppleChargerSrv) – C:\Windows\SysNative\AppleChargerSrv.exe ()
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (TomTomHOMEService) – C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (nlsX86cc) – C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (epmntdrv) – C:\Windows\SysNative\epmntdrv.sys ()
DRV:64bit: - (EuGdiDrv) – C:\Windows\SysNative\EuGdiDrv.sys ()
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (AppleCharger) – C:\Windows\SysNative\drivers\AppleCharger.sys ()
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (WsAudio_DeviceS(5)) WsAudio_DeviceS(5) – C:\Windows\SysNative\drivers\WsAudio_DeviceS(5).sys (Wondershare)
DRV:64bit: - (WsAudio_DeviceS(4)) WsAudio_DeviceS(4) – C:\Windows\SysNative\drivers\WsAudio_DeviceS(4).sys (Wondershare)
DRV:64bit: - (WsAudio_DeviceS(3)) WsAudio_DeviceS(3) – C:\Windows\SysNative\drivers\WsAudio_DeviceS(3).sys (Wondershare)
DRV:64bit: - (WsAudio_DeviceS(2)) WsAudio_DeviceS(2) – C:\Windows\SysNative\drivers\WsAudio_DeviceS(2).sys (Wondershare)
DRV:64bit: - (WsAudio_DeviceS(1)) WsAudio_DeviceS(1) – C:\Windows\SysNative\drivers\WsAudio_DeviceS(1).sys (Wondershare)
DRV:64bit: - (FSProFilter) – C:\Windows\SysNative\drivers\FSPFltd.sys (FSPro Labs)
DRV:64bit: - (ZTEusbwwan) – C:\Windows\SysNative\drivers\ZTEusbwwan.sys (ZTE Incorporated)
DRV:64bit: - (ZTEusbser6k) – C:\Windows\SysNative\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV:64bit: - (ZTEusbnmea) – C:\Windows\SysNative\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV:64bit: - (ZTEusbmdm6k) – C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV:64bit: - (ZTEusbvoice) – C:\Windows\SysNative\drivers\zteusbvoice.sys (ZTE Incorporated)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (regavw32) – C:\Windows\SysNative\drivers\regavw32.sys ()
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (s115mgmt) Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM) – C:\Windows\SysNative\drivers\s115mgmt.sys (MCCI Corporation)
DRV:64bit: - (s115obex) – C:\Windows\SysNative\drivers\s115obex.sys (MCCI Corporation)
DRV:64bit: - (s115mdm) – C:\Windows\SysNative\drivers\s115mdm.sys (MCCI Corporation)
DRV:64bit: - (s115mdfl) – C:\Windows\SysNative\drivers\s115mdfl.sys (MCCI Corporation)
DRV:64bit: - (s115bus) Sony Ericsson Device 115 driver (WDM) – C:\Windows\SysNative\drivers\s115bus.sys (MCCI Corporation)
DRV - (epmntdrv) – C:\Windows\SysWOW64\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\Windows\SysWOW64\EuGdiDrv.sys ()
DRV - (ISODrive) – C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys (EZB Systems, Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (NPF) – C:\Windows\SysWOW64\drivers\npf.sys (CACE Technologies)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=3
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddrnw&s=…hTerms}&f=4
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2548838
IE - HKLM\..\SearchScopes\{E5D13A2B-ABE4-4913-9533-8038B6F3C806}: "URL" = http://startsear.ch/?aff=3&q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.arsenal.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 61 16 7F 53 DD E5 CB 01 [binary data]
IE - HKCU\..\URLSearchHook: {66bd2442-241b-44cd-8c7a-b51037053cdb} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {E5D13A2B-ABE4-4913-9533-8038B6F3C806}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{5F1A0C38-607A-46B7-AA4E-401B712151D7}: "URL" = http://www.google.com/search?q={searchTerm…utputEncoding?}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2548838
IE - HKCU\..\SearchScopes\{E5D13A2B-ABE4-4913-9533-8038B6F3C806}: "URL" = http://startsear.ch/?aff=3&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"
FF - prefs.js..browser.startup.homepage: "http://www.arsenal.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.19.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "http://www.google.com/search?hl=en&q="

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/03/02 17:55:27 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/01/13 14:44:12 | 000,000,000 | —D | M]

[2011/03/28 15:21:37 | 000,000,000 | —D | M] (No name found) – C:\Users\James\AppData\Roaming\Mozilla\Extensions
[2011/03/28 15:21:37 | 000,000,000 | —D | M] (No name found) – C:\Users\James\AppData\Roaming\Mozilla\Extensions\[removed]
[2012/03/06 18:03:17 | 000,000,000 | —D | M] (No name found) – C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\0vnkd2r8.default\extensions
[2012/01/31 23:33:38 | 000,000,000 | —D | M] (FireShot) – C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\0vnkd2r8.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2012/03/06 18:03:17 | 000,000,000 | —D | M] (TVersitybar Community Toolbar) – C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\0vnkd2r8.default\extensions\{66bd2442-241b-44cd-8c7a-b51037053cdb}
[2011/03/04 13:41:08 | 000,000,000 | —D | M] (British English Dictionary) – C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\0vnkd2r8.default\extensions\[removed]
[2012/02/01 20:01:42 | 000,002,291 | —- | M] () – C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\0vnkd2r8.default\searchplugins\s-amazon-uk.xml
[2011/07/11 18:04:02 | 000,000,633 | —- | M] () – C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\0vnkd2r8.default\searchplugins\startsear.xml
[2012/03/06 12:24:40 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/03/06 12:24:40 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
[2012/03/02 17:55:27 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/03/06 12:24:30 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/09/30 22:18:11 | 000,001,538 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/09/30 22:18:11 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/09/30 22:18:11 | 000,000,947 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/09/30 22:18:11 | 000,001,180 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/04/27 16:44:07 | 000,002,048 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
[2011/09/30 22:18:11 | 000,001,135 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/09/12 11:08:09 | 000,002,040 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 0.0.0.0 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 0.0.0.0 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 7 more lines…
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [mylbx] C:\Program Files\My Lockbox\mylbx.exe (FSPro Labs)
O4 - HKLM..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Mpk.exe = C:\Windows\SysWOW64\MPK\Mpk.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C27EB11-EC79-4F20-9904-78D63B7FE4AC}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B8BF8453-0F49-462E-AA2D-C6E1C7FC61B9}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\SysWOW64\MPK\mpk.exe) - C:\Windows\SysWOW64\MPK\MPK.exe ()
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{01e756f7-44ef-11e1-9e12-1c6f6585af1b}\Shell - "" = AutoRun
O33 - MountPoints2\{01e756f7-44ef-11e1-9e12-1c6f6585af1b}\Shell\AutoRun\command - "" = N:\setup_vmb_lite.exe /checkApplicationPresence
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/03/06 12:35:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2012/03/06 12:25:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2012/03/06 12:24:36 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2012/03/06 12:24:36 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2012/03/06 12:24:36 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2012/03/05 18:57:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2012/03/02 19:30:01 | 000,000,000 | —D | C] – C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/03/02 19:30:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/03/02 17:12:14 | 000,509,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntshrui.dll
[2012/03/02 17:12:12 | 000,515,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\timedate.cpl
[2012/03/02 17:12:12 | 000,478,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\timedate.cpl
[2012/03/02 17:11:52 | 000,702,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/03/02 17:11:51 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/03/02 17:11:51 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/03/02 17:11:51 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/03/02 17:11:50 | 000,134,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/03/02 17:11:50 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/03/02 17:11:50 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/03/02 17:11:04 | 000,634,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msvcrt.dll
[2012/03/02 16:10:30 | 000,000,000 | —D | C] – C:\Windows\SysWow64\RTCOM
[2012/03/02 16:10:30 | 000,000,000 | —D | C] – C:\Program Files\Realtek
[2012/03/02 16:10:04 | 002,601,816 | —- | C] (Waves Audio Ltd.) – C:\Windows\SysNative\WavesGUILib.dll
[2012/03/02 16:10:01 | 000,518,896 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSTSX64.dll
[2012/03/02 16:10:01 | 000,155,888 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSWOW64.dll
[2012/03/02 16:10:00 | 000,211,184 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSTSH64.dll
[2012/03/02 16:10:00 | 000,198,896 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSHP64.dll
[2012/03/02 16:09:57 | 000,332,392 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtlCPAPI64.dll
[2012/03/02 16:09:51 | 000,149,608 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtkCfg64.dll
[2012/03/02 16:09:50 | 001,805,928 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtkApi64.dll
[2012/03/02 16:09:47 | 003,114,088 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtkAPO64.dll
[2012/03/02 16:09:45 | 002,399,232 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtPgEx64.dll
[2012/03/02 16:09:44 | 001,245,288 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RTCOM64.dll
[2012/03/02 16:09:42 | 001,559,656 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RTSnMg64.cpl
[2012/03/02 16:09:41 | 000,375,128 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEEP64A.dll
[2012/03/02 16:09:41 | 000,101,208 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEEL64A.dll
[2012/03/02 16:09:40 | 000,204,120 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEED64A.dll
[2012/03/02 16:09:40 | 000,078,680 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEEG64A.dll
[2012/03/02 16:09:38 | 000,310,104 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RP3DHT64.dll
[2012/03/02 16:09:38 | 000,310,104 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RP3DAA64.dll
[2012/03/02 16:09:38 | 000,092,264 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RCoInst64.dll
[2012/03/02 16:09:22 | 002,197,264 | —- | C] (Waves Audio Ltd.) – C:\Windows\SysNative\MaxxAudioEQ.dll
[2012/03/02 16:09:21 | 000,318,808 | —- | C] (Waves Audio Ltd.) – C:\Windows\SysNative\MaxxAudioAPO20.dll
[2012/03/02 16:09:20 | 000,080,984 | —- | C] (Creative Technology Ltd.) – C:\Windows\SysNative\MBWrp64.dll
[2012/03/02 16:09:20 | 000,064,600 | —- | C] (Creative Technology Ltd.) – C:\Windows\SysNative\MBppld64.dll
[2012/03/02 16:09:18 | 000,876,120 | —- | C] (Creative Technology Ltd.) – C:\Windows\SysNative\MBAPO64.dll
[2012/03/02 16:09:18 | 000,060,504 | —- | C] (Creative Technology Ltd.) – C:\Windows\SysNative\MBPPCn64.dll
[2012/03/02 16:09:17 | 000,738,392 | —- | C] (Creative Technology Ltd.) – C:\Windows\SysWow64\MBAPO32.dll
[2012/03/02 16:09:00 | 002,085,440 | —- | C] (Fortemedia Corporation) – C:\Windows\SysNative\FMAPO64.dll
[2012/03/02 16:08:46 | 000,200,800 | —- | C] (Andrea Electronics Corporation) – C:\Windows\SysNative\AERTAC64.dll
[2012/03/02 16:08:46 | 000,108,960 | —- | C] (Andrea Electronics Corporation) – C:\Windows\SysNative\AERTAR64.dll
[2012/03/02 16:08:24 | 000,533,096 | —- | C] (Realtek ) – C:\Windows\SysNative\drivers\Rt64win7.sys
[2012/03/02 16:08:23 | 000,107,552 | —- | C] (Realtek Semiconductor Corporation) – C:\Windows\SysNative\RTNUninst64.dll
[2012/03/02 16:08:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Realtek
[2012/03/02 16:07:23 | 000,053,248 | R— | C] (Windows XP Bundled build C-Centric Single User) – C:\Windows\SysWow64\CSVer.dll
[2012/03/02 16:07:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Intel
[2012/03/02 16:07:13 | 000,000,000 | -H-D | C] – C:\Program Files (x86)\InstallShield Installation Information
[2012/03/02 16:07:13 | 000,000,000 | —D | C] – C:\Program Files\GIGABYTE
[2012/03/02 16:07:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\GIGABYTE
[2012/03/02 16:06:51 | 000,000,000 | -H-D | C] – C:\Program Files (x86)\Temp
[2012/03/02 16:06:48 | 001,284,712 | R— | C] (Realtek Semiconductor Corp.) – C:\Windows\RtlExUpd.dll
[2012/03/02 16:06:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\InstallShield
[2012/03/02 16:06:20 | 000,000,000 | —D | C] – C:\Intel
[2012/02/10 17:21:56 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDFab 8 Qt
[2012/02/10 17:16:37 | 000,000,000 | —D | C] – C:\Users\James\Documents\Freemake
[2012/02/10 17:16:35 | 000,000,000 | —D | C] – C:\ProgramData\Freemake
[2012/02/10 17:15:42 | 000,000,000 | —D | C] – C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
[2012/02/10 17:15:42 | 000,000,000 | —D | C] – C:\Program Files (x86)\Freemake
[2012/02/08 20:58:57 | 000,000,000 | —D | C] – C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GoldWave
[2012/02/08 20:58:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\GoldWave
[2012/02/08 17:57:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free M4a to MP3 Converter
[2012/02/08 17:57:11 | 000,000,000 | —D | C] – C:\Program Files (x86)\Free M4a to MP3 Converter
[2012/02/08 17:16:41 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GoldWave
[2012/02/08 17:15:04 | 000,000,000 | —D | C] – C:\Users\James\AppData\Roaming\Gold Wave Editor
[2011/03/09 21:40:13 | 000,192,512 | R— | C] (Microsoft Windows) – C:\Users\James\AppData\Roaming\sdra64.exe

========== Files - Modified Within 30 Days ==========

[2012/03/07 14:14:23 | 000,014,192 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/03/07 14:14:23 | 000,014,192 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/03/07 12:47:32 | 005,669,278 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/03/07 12:47:32 | 002,607,698 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/03/07 12:47:32 | 000,005,376 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/03/07 12:43:01 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/03/07 12:42:52 | 2146,295,807 | -HS- | M] () – C:\hiberfil.sys
[2012/03/06 12:24:28 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2012/03/06 12:24:28 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2012/03/06 12:24:28 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2012/03/06 12:24:27 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\deployJava1.dll
[2012/03/05 18:57:09 | 000,000,045 | —- | M] () – C:\Windows\SysWow64\initdebug.nfo
[2012/03/05 17:29:51 | 000,001,189 | —- | M] () – C:\Users\James\AppData\Roaming\vso_ts_preview.xml
[2012/03/02 23:33:41 | 000,000,000 | -H– | M] () – C:\Users\James\Documents\Default.rdp
[2012/03/02 22:33:24 | 000,000,822 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2012/03/02 17:57:07 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/03/02 17:52:19 | 005,825,312 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/03/02 16:05:10 | 000,000,010 | —- | M] () – C:\Windows\GSetup.ini
[2012/02/12 19:54:15 | 000,000,865 | —- | M] () – C:\Users\James\Desktop\DVDFab 8 Qt.lnk
[2012/02/12 19:46:34 | 000,000,845 | —- | M] () – C:\Users\James\Application Data\Microsoft\Internet Explorer\Quick Launch\DVDFab 8 Qt.lnk
[2012/02/10 19:54:06 | 006,217,036 | —- | M] () – C:\Users\James\Desktop\transformers_dark_of_the_moon_dvd_cover_2011_original.jpg
[2012/02/10 19:53:52 | 001,508,224 | —- | M] () – C:\Users\James\Desktop\transformers_dark_of_the_moon_dvd_disc2012_original.jpg
[2012/02/10 15:59:09 | 000,000,249 | —- | M] () – C:\Users\James\AppData\Roaming\groovedown.settings
[2012/02/10 12:32:46 | 001,411,741 | —- | M] () – C:\Users\James\Desktop\attack_the_block_cd_cover2011_original.jpg
[2012/02/10 12:32:43 | 005,738,803 | —- | M] () – C:\Users\James\Desktop\attack_the_block_dvd_cover_2011_original.jpg
[2012/02/10 11:25:56 | 007,520,498 | —- | M] () – C:\Users\James\Desktop\Mackenna_s_Gold_scan_fyg2.jpg
[2012/02/10 11:11:00 | 000,000,963 | —- | M] () – C:\Users\James\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/02/08 20:58:57 | 000,000,740 | —- | M] () – C:\Users\James\Desktop\GoldWave.lnk
[2012/02/08 20:57:36 | 003,616,098 | —- | M] () – C:\Users\James\Desktop\night_of_the_running_man.jpg
[2012/02/08 17:57:18 | 000,001,073 | —- | M] () – C:\Users\James\Application Data\Microsoft\Internet Explorer\Quick Launch\Free M4a to MP3 Converter.lnk

========== Files Created - No Company Name ==========

[2012/03/05 18:57:09 | 000,000,045 | —- | C] () – C:\Windows\SysWow64\initdebug.nfo
[2012/03/02 23:33:41 | 000,000,000 | -H– | C] () – C:\Users\James\Documents\Default.rdp
[2012/03/02 16:08:23 | 000,074,272 | —- | C] () – C:\Windows\SysNative\RtNicProp64.dll
[2012/03/02 16:07:13 | 000,031,272 | —- | C] () – C:\Windows\SysNative\AppleChargerSrv.exe
[2012/03/02 16:07:13 | 000,021,104 | —- | C] () – C:\Windows\SysNative\drivers\AppleCharger.sys
[2012/03/02 16:05:10 | 000,000,010 | —- | C] () – C:\Windows\GSetup.ini
[2012/02/10 19:54:05 | 006,217,036 | —- | C] () – C:\Users\James\Desktop\transformers_dark_of_the_moon_dvd_cover_2011_original.jpg
[2012/02/10 19:53:50 | 001,508,224 | —- | C] () – C:\Users\James\Desktop\transformers_dark_of_the_moon_dvd_disc2012_original.jpg
[2012/02/10 17:21:59 | 000,000,865 | —- | C] () – C:\Users\James\Desktop\DVDFab 8 Qt.lnk
[2012/02/10 17:21:59 | 000,000,845 | —- | C] () – C:\Users\James\Application Data\Microsoft\Internet Explorer\Quick Launch\DVDFab 8 Qt.lnk
[2012/02/10 12:32:45 | 001,411,741 | —- | C] () – C:\Users\James\Desktop\attack_the_block_cd_cover2011_original.jpg
[2012/02/10 12:32:32 | 005,738,803 | —- | C] () – C:\Users\James\Desktop\attack_the_block_dvd_cover_2011_original.jpg
[2012/02/10 11:25:55 | 007,520,498 | —- | C] () – C:\Users\James\Desktop\Mackenna_s_Gold_scan_fyg2.jpg
[2012/02/08 20:58:57 | 000,000,740 | —- | C] () – C:\Users\James\Desktop\GoldWave.lnk
[2012/02/08 20:57:34 | 003,616,098 | —- | C] () – C:\Users\James\Desktop\night_of_the_running_man.jpg
[2012/02/08 17:57:18 | 000,001,073 | —- | C] () – C:\Users\James\Application Data\Microsoft\Internet Explorer\Quick Launch\Free M4a to MP3 Converter.lnk
[2012/02/03 11:16:58 | 000,000,037 | -HS- | C] () – C:\Users\James\AppData\Roaming\10952854204d11e2ac1a1d71.14988978
[2012/01/04 23:56:16 | 000,003,584 | —- | C] () – C:\Users\James\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/04 22:35:17 | 000,000,362 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2011/12/13 17:11:26 | 000,003,576 | —- | C] () – C:\Users\James\AppData\Roaming\gd.db
[2011/12/13 17:11:26 | 000,000,249 | —- | C] () – C:\Users\James\AppData\Roaming\groovedown.settings
[2011/11/13 22:56:16 | 000,814,454 | —- | C] () – C:\Users\James\AppData\Local\census.cache
[2011/11/13 22:55:39 | 000,110,163 | —- | C] () – C:\Users\James\AppData\Local\ars.cache
[2011/11/13 22:48:36 | 000,000,036 | —- | C] () – C:\Users\James\AppData\Local\housecall.guid.cache
[2011/09/30 23:02:35 | 000,019,840 | —- | C] () – C:\Windows\SysWow64\EuEpmGdi.dll
[2011/09/30 23:02:34 | 002,469,760 | —- | C] () – C:\Windows\SysWow64\BootMan.exe
[2011/09/30 23:02:34 | 000,086,408 | —- | C] () – C:\Windows\SysWow64\setupempdrv03.exe
[2011/09/30 23:02:34 | 000,014,216 | —- | C] () – C:\Windows\SysWow64\epmntdrv.sys
[2011/09/30 23:02:34 | 000,008,456 | —- | C] () – C:\Windows\SysWow64\EuGdiDrv.sys
[2011/08/25 10:28:15 | 000,007,605 | —- | C] () – C:\Users\James\AppData\Local\resmon.resmoncfg
[2011/08/01 12:18:42 | 000,000,095 | -H– | C] () – C:\ProgramData\emopts.dat
[2011/06/14 21:19:45 | 000,154,112 | —- | C] () – C:\Windows\SysWow64\WSContextMenu.dll
[2011/04/01 13:07:42 | 000,000,032 | —- | C] () – C:\Windows\SysWow64\EUOD.DAT
[2011/03/26 13:16:12 | 000,000,132 | —- | C] () – C:\Users\James\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011/03/04 20:55:05 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/03/04 18:15:41 | 000,001,189 | —- | C] () – C:\Users\James\AppData\Roaming\vso_ts_preview.xml
[2011/03/04 13:12:36 | 000,005,342 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI

========== LOP Check ==========

[2011/08/27 12:56:41 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\Alien Skin
[2011/08/24 13:00:13 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011/03/07 22:06:02 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\Extensis
[2011/12/09 13:34:35 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\FileZilla
[2011/09/25 00:07:10 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\FireShot
[2011/03/17 20:45:34 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\Foxit Software
[2011/08/26 23:03:13 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\FrostWire
[2011/07/03 13:26:36 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\GetRightToGo
[2012/02/08 17:16:31 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\Gold Wave Editor
[2012/02/03 11:16:58 | 000,000,000 | -HSD | M] – C:\Users\James\AppData\Roaming\icsxml
[2011/03/09 17:13:58 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\ImgBurn
[2011/12/13 17:11:26 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\lang
[2012/01/30 12:58:40 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\MusicNet
[2012/02/07 20:29:24 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\PgcEdit
[2012/01/02 15:57:00 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\redsn0w
[2011/03/25 12:40:34 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011/07/06 12:07:08 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\TagScanner
[2011/06/09 11:39:59 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\Teleca
[2011/03/28 15:21:37 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\TomTom
[2012/03/08 08:42:56 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\uTorrent
[2012/01/22 21:15:41 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\Vodafone
[2012/03/05 17:29:52 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\Vso
[2011/04/09 20:51:58 | 000,000,000 | —D | M] – C:\Users\James\AppData\Roaming\WinAVI
[2011/10/02 09:31:58 | 000,032,612 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2010/03/22 01:10:01 | 026,184,192 | —- | M] () – C:\w7lxe.exe

< MD5 for: EXPLORER.EXE >
[2011/02/26 06:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 05:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/14 01:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 05:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 05:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 05:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 06:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/02/25 06:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 06:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 12:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/08/03 06:19:07 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 05:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/02/25 05:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 06:34:59 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 05:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 13:24:45 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 06:38:38 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 05:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/14 01:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 06:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 06:26:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 06:17:37 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

< MD5 for: SVCHOST.EXE >
[2009/07/14 01:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/14 01:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/14 01:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009/07/14 01:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 12:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/20 12:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 01:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/14 01:39:48 | 000,030,208 | —- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 13:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SysNative\userinit.exe
[2010/11/20 13:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 13:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/20 13:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/14 01:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 07:01:57 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 06:24:40 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:0C6951A3
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:F878CACA
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:689E721A

< End of report

OTL Extras:-

mowman

Post #4March 8, 2012, 9:25 AM UTC

Do not use the quote,copy/paste directly into the reply.

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

gbu

Post #5March 8, 2012, 12:54 PM UTC

I ran combofix but now I can't get online it ran through the process and rebooted pc but when I click in Firefox or any toolbar icon I get a popup saying "Illegal operation attempted on a registry key that has been marked for deletion " then another saying it's been moved, renamed or deleted do I want to remove the item, I managed to get into program files and tried to run Firefox from there but it's still the same I'm typing this from my phone at the moment as its my only way of getting online

mowman

Post #6March 8, 2012, 1:28 PM UTC

Reboot the computer,that error will go away.

gbu

Post #7March 8, 2012, 1:31 PM UTC

Took about 3 reboots till i could get online, FF is no longer my default browser but i can change that back. Heres the log it saved. ComboFix 12-03-08.01 - James 08/03/2012 13:09:50.2.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.8190.6834 [GMT 0:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\emopts.dat c:\users\James\AppData\Roaming\sdra64.exe c:\users\James\AppData\Roaming\vso_ts_preview.xml c:\windows\imglib.dll c:\windows\SNMPAPI.DLL c:\windows\SwSys1.bmp c:\windows\SwSys2.bmp c:\windows\sysk32.dll c:\windows\SysWow64\drivers\npf.sys c:\windows\SysWow64\Gdiplus.dll c:\windows\SysWow64\sinvfct.dll . c:\windows\SysWow64\Drivers\atapi.sys . . . is infected!! . . ((((((((((((((((((((((((( Files Created from 2012-02-08 to 2012-03-08 ))))))))))))))))))))))))))))))) . . 2012-03-08 13:22 . 2012-03-08 13:22 ——– d—–w- c:\users\Mcx2-JAMES-PC\AppData\Local\temp 2012-03-08 13:22 . 2012-03-08 13:22 ——– d—–w- c:\users\Mcx1-JAMES-PC\AppData\Local\temp 2012-03-06 12:35 . 2012-03-06 12:35 ——– d—–w- c:\program files (x86)\ESET 2012-03-06 12:25 . 2012-03-06 12:25 ——– d—–w- c:\program files (x86)\Common Files\Java 2012-03-02 17:12 . 2012-01-04 10:44 509952 —-a-w- c:\windows\system32\ntshrui.dll 2012-03-02 17:12 . 2012-01-04 08:58 442880 —-a-w- c:\windows\SysWow64\ntshrui.dll 2012-03-02 17:12 . 2012-01-14 04:06 3145728 —-a-w- c:\windows\system32\win32k.sys 2012-03-02 17:12 . 2011-12-30 06:26 515584 —-a-w- c:\windows\system32\timedate.cpl 2012-03-02 17:12 . 2011-12-30 05:27 478720 —-a-w- c:\windows\SysWow64\timedate.cpl 2012-03-02 17:12 . 2011-12-28 03:59 498688 —-a-w- c:\windows\system32\drivers\afd.sys 2012-03-02 16:10 . 2012-03-02 16:10 ——– d—–w- c:\windows\SysWow64\RTCOM 2012-03-02 16:10 . 2012-03-02 16:10 ——– d—–w- c:\program files\Realtek 2012-03-02 16:10 . 2011-04-18 10:50 2601816 —-a-w- c:\windows\system32\WavesGUILib.dll 2012-03-02 16:10 . 2009-11-24 01:55 518896 —-a-w- c:\windows\system32\SRSTSX64.dll 2012-03-02 16:10 . 2009-11-24 01:55 155888 —-a-w- c:\windows\system32\SRSWOW64.dll 2012-03-02 16:10 . 2009-11-24 01:55 211184 —-a-w- c:\windows\system32\SRSTSH64.dll 2012-03-02 16:10 . 2009-11-24 01:55 198896 —-a-w- c:\windows\system32\SRSHP64.dll 2012-03-02 16:08 . 2010-07-22 08:37 200800 —-a-w- c:\windows\system32\AERTAC64.dll 2012-03-02 16:08 . 2009-11-17 10:12 108960 —-a-w- c:\windows\system32\AERTAR64.dll 2012-03-02 16:08 . 2011-05-16 14:55 533096 —-a-w- c:\windows\system32\drivers\Rt64win7.sys 2012-03-02 16:08 . 2011-05-16 14:55 74272 —-a-w- c:\windows\system32\RtNicProp64.dll 2012-03-02 16:08 . 2011-05-16 14:55 107552 —-a-w- c:\windows\system32\RTNUninst64.dll 2012-03-02 16:08 . 2012-03-02 16:08 ——– d—–w- c:\program files (x86)\Realtek 2012-03-02 16:07 . 2012-03-02 16:07 ——– d—–w- c:\program files (x86)\Intel 2012-03-02 16:07 . 2009-11-18 08:03 53248 —-a-r- c:\windows\SysWow64\CSVer.dll 2012-03-02 16:07 . 2012-03-02 16:08 ——– d–h–w- c:\program files (x86)\InstallShield Installation Information 2012-03-02 16:07 . 2012-03-02 16:07 ——– d—–w- c:\program files\GIGABYTE 2012-03-02 16:07 . 2012-03-02 16:07 ——– d—–w- c:\program files (x86)\GIGABYTE 2012-03-02 16:07 . 2011-01-10 18:16 21104 —-a-w- c:\windows\system32\drivers\AppleCharger.sys 2012-03-02 16:07 . 2010-04-06 16:30 31272 —-a-w- c:\windows\system32\AppleChargerSrv.exe 2012-03-02 16:06 . 2012-03-02 16:10 ——– d–h–w- c:\program files (x86)\Temp 2012-03-02 16:06 . 2011-05-27 09:58 1284712 ——r- c:\windows\RtlExUpd.dll 2012-03-02 16:06 . 2012-03-02 16:06 ——– d—–w- c:\program files (x86)\Common Files\InstallShield 2012-03-02 16:06 . 2012-03-02 16:06 ——– d—–w- C:\Intel 2012-02-12 09:02 . 2012-02-12 09:02 927800 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{45E2ED87-94A6-49C7-B93C-FE5D143DF362}\gapaengine.dll 2012-02-12 08:14 . 2012-02-12 08:14 710992 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2012-02-10 17:16 . 2012-02-10 17:17 ——– d—–w- c:\programdata\Freemake 2012-02-10 17:15 . 2012-02-10 17:18 ——– d—–w- c:\program files (x86)\Freemake 2012-02-08 20:58 . 2012-02-08 20:58 ——– d—–w- c:\program files (x86)\GoldWave 2012-02-08 20:53 . 2012-02-08 20:53 225280 —-atw- c:\users\James\AppData\Roaming\Microsoft\AdjMmsVista.dll 2012-02-08 17:57 . 2012-02-08 17:57 ——– d—–w- c:\program files (x86)\Free M4a to MP3 Converter 2012-02-08 17:15 . 2012-02-08 17:16 ——– d—–w- c:\users\James\AppData\Roaming\Gold Wave Editor . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-03-06 12:24 . 2011-03-25 11:14 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-03-03 00:13 . 2012-02-05 08:41 2301208 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2012-03-03 00:12 . 2012-02-05 08:40 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2012-03-03 00:12 . 2012-01-04 22:33 710992 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2012-03-02 17:57 . 2011-06-19 19:29 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-02-12 08:15 . 2012-01-04 22:33 2301208 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2012-02-12 08:14 . 2012-01-04 22:33 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2012-02-08 07:13 . 2011-03-04 13:16 8643640 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-01-31 12:44 . 2011-03-04 13:15 279656 ——w- c:\windows\system32\MpSigStub.exe . . ((((((((((((((((((((((((((((( SnapShot@2012-03-08_12.35.55 ))))))))))))))))))))))))))))))))))))))))) . + 2011-03-04 13:24 . 2012-03-08 12:58 32338 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-03-08 12:58 32488 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin - 2011-03-04 13:00 . 2012-03-07 12:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-03-04 13:00 . 2012-03-08 12:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-03-04 13:00 . 2012-03-08 12:57 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-03-04 13:00 . 2012-03-07 12:43 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-03-04 13:00 . 2012-03-08 12:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-03-04 13:00 . 2012-03-07 12:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-03-04 13:00 . 2012-03-08 13:06 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-03-04 13:00 . 2012-03-08 12:08 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-03-04 13:00 . 2012-03-08 12:08 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-03-04 13:00 . 2012-03-08 13:06 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-03-04 13:00 . 2012-03-08 12:58 9122 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-942573960-3166080983-68312396-1001_UserData.bin - 2012-03-08 12:35 . 2012-03-08 12:35 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-03-08 12:57 . 2012-03-08 12:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-03-08 12:35 . 2012-03-08 12:35 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-03-08 12:57 . 2012-03-08 12:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 05:01 . 2012-03-08 12:55 469276 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-03-08 12:33 469276 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 02:36 . 2012-03-08 13:01 5702546 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-03-08 13:01 2624190 c:\windows\system32\perfc009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files (x86)\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x] R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 16776] R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 9096] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\DRIVERS\s115bus.sys [x] R3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s115mdfl.sys [x] R3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s115mdm.sys [x] R3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s115mgmt.sys [x] R3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s115obex.sys [x] R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [x] R3 ZTEusbwwan;ZTE MBN Miniport;c:\windows\system32\DRIVERS\ZTEusbwwan.sys [x] S0 FSProFilter;FSPro File Filter;c:\windows\System32\Drivers\FSPFltd.sys [x] S0 regavw32;regavw32;c:\windows\system32\DRIVERS\regavw32.sys [x] S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x] S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2011-04-22 92592] S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [x] S3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [x] S3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [x] S3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [x] S3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [x] . . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736] "mylbx"="c:\program files\My Lockbox\mylbx.exe" [2011-06-05 1898816] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.arsenal.com/ mStart Page = hxxp://startsear.ch/?aff=3 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\James\AppData\Roaming\Mozilla\Firefox\Profiles\0vnkd2r8.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.arsenal.com/ FF - prefs.js: keyword.URL - hxxp://www.google.com/search?hl=en&q= . - - - - ORPHANS REMOVED - - - - . WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" "Key"="ActionsPane3" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-03-08 13:24:35 ComboFix-quarantined-files.txt 2012-03-08 13:24 . Pre-Run: 42,262,700,032 bytes free Post-Run: 41,833,275,392 bytes free . - - End Of File - - B30AD1ADE75187DC40C12618D213E1E3

mowman

Post #8March 8, 2012, 1:42 PM UTC

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
*atapi.sys*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

gbu

Post #9March 8, 2012, 2:44 PM UTC

SystemLook 30.07.11 by jpshortstuff Log created at 14:42 on 08/03/2012 by James Administrator - Elevation successful WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results. ========== filefind ========== Searching for "*atapi.sys*" C:\Windows\ERDNT\cache64\atapi.sys –a—- 24128 bytes [12:38 08/03/2012] [01:52 14/07/2009] 02062C0B390B7729EDC9E69C680A6F3C C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys –a—- 24128 bytes [23:19 13/07/2009] [01:52 14/07/2009] 02062C0B390B7729EDC9E69C680A6F3C C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys –a—- 24128 bytes [23:19 13/07/2009] [01:52 14/07/2009] 02062C0B390B7729EDC9E69C680A6F3C C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys –a—- 24128 bytes [23:19 13/07/2009] [01:52 14/07/2009] 02062C0B390B7729EDC9E69C680A6F3C -= EOF =-

mowman

Post #10March 8, 2012, 3:01 PM UTC

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

FCopy::
C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys | c:\windows\SysWow64\Drivers\atapi.sys

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
If you need help to disable your protection programs see here.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

gbu

Post #11March 8, 2012, 3:23 PM UTC

ComboFix 12-03-08.01 - James 08/03/2012 15:10:12.3.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.8190.5007 [GMT 0:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\James\Desktop\CFScript.txt AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . . ————— FCopy ————— . c:\windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys –> c:\windows\SysWow64\Drivers\atapi.sys . ((((((((((((((((((((((((( Files Created from 2012-02-08 to 2012-03-08 ))))))))))))))))))))))))))))))) . . 2012-03-08 15:15 . 2012-03-08 15:15 ——– d—–w- c:\users\Mcx2-JAMES-PC\AppData\Local\temp 2012-03-08 15:15 . 2012-03-08 15:15 ——– d—–w- c:\users\Mcx1-JAMES-PC\AppData\Local\temp 2012-03-08 15:15 . 2012-03-08 15:15 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-03-08 15:10 . 2009-07-14 01:52 24128 —-a-w- c:\windows\SysWow64\drivers\atapi.sys 2012-03-08 13:40 . 2012-02-08 07:13 8643640 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{51E1DFD8-55BD-42F2-BBF0-C1E859910EC1}\mpengine.dll 2012-03-06 12:35 . 2012-03-06 12:35 ——– d—–w- c:\program files (x86)\ESET 2012-03-06 12:25 . 2012-03-06 12:25 ——– d—–w- c:\program files (x86)\Common Files\Java 2012-03-02 17:12 . 2012-01-04 10:44 509952 —-a-w- c:\windows\system32\ntshrui.dll 2012-03-02 17:12 . 2012-01-04 08:58 442880 —-a-w- c:\windows\SysWow64\ntshrui.dll 2012-03-02 17:12 . 2012-01-14 04:06 3145728 —-a-w- c:\windows\system32\win32k.sys 2012-03-02 17:12 . 2011-12-30 06:26 515584 —-a-w- c:\windows\system32\timedate.cpl 2012-03-02 17:12 . 2011-12-30 05:27 478720 —-a-w- c:\windows\SysWow64\timedate.cpl 2012-03-02 17:12 . 2011-12-28 03:59 498688 —-a-w- c:\windows\system32\drivers\afd.sys 2012-03-02 16:10 . 2012-03-02 16:10 ——– d—–w- c:\windows\SysWow64\RTCOM 2012-03-02 16:10 . 2012-03-02 16:10 ——– d—–w- c:\program files\Realtek 2012-03-02 16:10 . 2011-04-18 10:50 2601816 —-a-w- c:\windows\system32\WavesGUILib.dll 2012-03-02 16:10 . 2009-11-24 01:55 518896 —-a-w- c:\windows\system32\SRSTSX64.dll 2012-03-02 16:10 . 2009-11-24 01:55 155888 —-a-w- c:\windows\system32\SRSWOW64.dll 2012-03-02 16:10 . 2009-11-24 01:55 211184 —-a-w- c:\windows\system32\SRSTSH64.dll 2012-03-02 16:10 . 2009-11-24 01:55 198896 —-a-w- c:\windows\system32\SRSHP64.dll 2012-03-02 16:08 . 2010-07-22 08:37 200800 —-a-w- c:\windows\system32\AERTAC64.dll 2012-03-02 16:08 . 2009-11-17 10:12 108960 —-a-w- c:\windows\system32\AERTAR64.dll 2012-03-02 16:08 . 2011-05-16 14:55 533096 —-a-w- c:\windows\system32\drivers\Rt64win7.sys 2012-03-02 16:08 . 2011-05-16 14:55 74272 —-a-w- c:\windows\system32\RtNicProp64.dll 2012-03-02 16:08 . 2011-05-16 14:55 107552 —-a-w- c:\windows\system32\RTNUninst64.dll 2012-03-02 16:08 . 2012-03-02 16:08 ——– d—–w- c:\program files (x86)\Realtek 2012-03-02 16:07 . 2012-03-02 16:07 ——– d—–w- c:\program files (x86)\Intel 2012-03-02 16:07 . 2009-11-18 08:03 53248 —-a-r- c:\windows\SysWow64\CSVer.dll 2012-03-02 16:07 . 2012-03-02 16:08 ——– d–h–w- c:\program files (x86)\InstallShield Installation Information 2012-03-02 16:07 . 2012-03-02 16:07 ——– d—–w- c:\program files\GIGABYTE 2012-03-02 16:07 . 2012-03-02 16:07 ——– d—–w- c:\program files (x86)\GIGABYTE 2012-03-02 16:07 . 2011-01-10 18:16 21104 —-a-w- c:\windows\system32\drivers\AppleCharger.sys 2012-03-02 16:07 . 2010-04-06 16:30 31272 —-a-w- c:\windows\system32\AppleChargerSrv.exe 2012-03-02 16:06 . 2012-03-02 16:10 ——– d–h–w- c:\program files (x86)\Temp 2012-03-02 16:06 . 2011-05-27 09:58 1284712 ——r- c:\windows\RtlExUpd.dll 2012-03-02 16:06 . 2012-03-02 16:06 ——– d—–w- c:\program files (x86)\Common Files\InstallShield 2012-03-02 16:06 . 2012-03-02 16:06 ——– d—–w- C:\Intel 2012-02-12 09:02 . 2012-02-12 09:02 927800 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{45E2ED87-94A6-49C7-B93C-FE5D143DF362}\gapaengine.dll 2012-02-12 08:14 . 2012-02-12 08:14 710992 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2012-02-10 17:16 . 2012-02-10 17:17 ——– d—–w- c:\programdata\Freemake 2012-02-10 17:15 . 2012-02-10 17:18 ——– d—–w- c:\program files (x86)\Freemake 2012-02-08 20:58 . 2012-02-08 20:58 ——– d—–w- c:\program files (x86)\GoldWave 2012-02-08 20:53 . 2012-02-08 20:53 225280 —-atw- c:\users\James\AppData\Roaming\Microsoft\AdjMmsVista.dll 2012-02-08 17:57 . 2012-02-08 17:57 ——– d—–w- c:\program files (x86)\Free M4a to MP3 Converter 2012-02-08 17:15 . 2012-02-08 17:16 ——– d—–w- c:\users\James\AppData\Roaming\Gold Wave Editor . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-03-06 12:24 . 2011-03-25 11:14 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-03-03 00:13 . 2012-02-05 08:41 2301208 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2012-03-03 00:12 . 2012-02-05 08:40 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2012-03-03 00:12 . 2012-01-04 22:33 710992 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2012-03-02 17:57 . 2011-06-19 19:29 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-02-12 08:15 . 2012-01-04 22:33 2301208 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2012-02-12 08:14 . 2012-01-04 22:33 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2012-02-08 07:13 . 2011-03-04 13:16 8643640 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-01-31 12:44 . 2011-03-04 13:15 279656 ——w- c:\windows\system32\MpSigStub.exe . . ((((((((((((((((((((((((((((( SnapShot@2012-03-08_12.35.55 ))))))))))))))))))))))))))))))))))))))))) . + 2011-03-04 13:24 . 2012-03-08 12:58 32338 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-03-08 12:58 32488 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin - 2011-03-04 13:00 . 2012-03-07 12:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-03-04 13:00 . 2012-03-08 12:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-03-04 13:00 . 2012-03-08 12:57 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-03-04 13:00 . 2012-03-07 12:43 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-03-04 13:00 . 2012-03-08 12:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-03-04 13:00 . 2012-03-07 12:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-03-04 13:00 . 2012-03-08 15:10 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-03-04 13:00 . 2012-03-08 12:08 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-03-04 13:00 . 2012-03-08 12:08 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-03-04 13:00 . 2012-03-08 15:10 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-03-04 13:00 . 2012-03-08 12:58 9122 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-942573960-3166080983-68312396-1001_UserData.bin - 2012-03-08 12:35 . 2012-03-08 12:35 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-03-08 12:57 . 2012-03-08 12:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-03-08 12:35 . 2012-03-08 12:35 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-03-08 12:57 . 2012-03-08 12:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 05:01 . 2012-03-08 12:55 469276 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-03-08 12:33 469276 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 02:36 . 2012-03-08 13:01 5702546 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-03-08 13:01 2624190 c:\windows\system32\perfc009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files (x86)\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x] R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 16776] R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 9096] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\DRIVERS\s115bus.sys [x] R3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s115mdfl.sys [x] R3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s115mdm.sys [x] R3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s115mgmt.sys [x] R3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s115obex.sys [x] R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [x] R3 ZTEusbwwan;ZTE MBN Miniport;c:\windows\system32\DRIVERS\ZTEusbwwan.sys [x] S0 FSProFilter;FSPro File Filter;c:\windows\System32\Drivers\FSPFltd.sys [x] S0 regavw32;regavw32;c:\windows\system32\DRIVERS\regavw32.sys [x] S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2011-04-22 92592] S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [x] S3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [x] S3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [x] S3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [x] S3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [x] . . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736] "mylbx"="c:\program files\My Lockbox\mylbx.exe" [2011-06-05 1898816] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.arsenal.com/ mStart Page = hxxp://startsear.ch/?aff=3 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\James\AppData\Roaming\Mozilla\Firefox\Profiles\0vnkd2r8.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.arsenal.com/ FF - prefs.js: keyword.URL - hxxp://www.google.com/search?hl=en&q= . - - - - ORPHANS REMOVED - - - - . WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" "Key"="ActionsPane3" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-03-08 15:17:30 ComboFix-quarantined-files.txt 2012-03-08 15:17 ComboFix2.txt 2012-03-08 13:24 . Pre-Run: 41,878,315,008 bytes free Post-Run: 41,822,523,392 bytes free . - - End Of File - - 14D3D0A1BC7E5BED0CF0B5E5EF6E20B2

mowman

Post #12March 8, 2012, 3:36 PM UTC

Please download Malwarebytes from Here or Here

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the log please

Also run ESET as you did before and post the results.

gbu

Post #13March 8, 2012, 4:32 PM UTC

Malwarebytes found just one item:- Malwarebytes Anti-Malware (Trial) 1.60.1.1000 www.malwarebytes.org Database version: v2012.03.08.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 James :: JAMES-PC [administrator] Protection: Enabled 08/03/2012 16:26:11 mbam-log-2012-03-08 (16-26-11).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 223160 Time elapsed: 2 minute(s), 48 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 1 HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (Hijack.StartPage) -> Bad: (http://startsear.ch/?aff=3) Good: (http://www.google.com) -> Quarantined and repaired successfully. Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) When i run ESET should i have the box ticked that says remove threats or just do the scan without removal for now?

mowman

Post #14March 8, 2012, 11:08 PM UTC

Leave it unchecked.

gbu

Post #15March 9, 2012, 10:00 AM UTC

C:\Qoobox\Quarantine\C\Users\James\AppData\Roaming\sdra64.exe.vir Win32/Spy.Zbot.WM trojan C:\Qoobox\Quarantine\C\Windows\SysWOW64\movuxavi.exe.vir a variant of Win32/Urlbot.NAT trojan C:\Qoobox\Quarantine\C\Windows\SysWOW64\MPK\MpkNetInstall.exe.vir probably a variant of Win32/Agent.EUDBPIN trojan C:\Windows\System32\aigovox.dll a variant of Win32/Urlbot.NAO trojan C:\Windows\SysWOW64\aigovox.dll a variant of Win32/Urlbot.NAO trojan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Mor.exe has stopped working?

✨ Ask AI

Ask AI