Spyware / Malware / Virus Removal

Windlows Explorer Search Malfunction [Closed]

5 min read

Looking for the outcome? Ask AI

pamelak Topic Starter

Post #1May 16, 2012, 2:48 PM UTC

HI

I have tried rebuilding the index but windows explorer seacrh is still not working. I ran Hijack this. Here is the log. Could the issue be spyware?

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:47:51 AM, on 5/16/2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16968)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
C:\Users\Karp Family\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files (x86)\Creative Home\Hallmark Card Studio 2010\Planner\PLNRnote.exe
C:\Users\Karp Family\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Common Files\AOL\1298466898\ee\aolsoftware.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files (x86)\AVG Secure Search\vprot.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Users\Karp Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q86NK2UP\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://toolbar.inbox.com/search/dispatcher…d&%language
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK/1
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;127.0.0.1:9421;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe
O4 - HKLM\..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\QFSCHD150.EXE"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files (x86)\Common Files\AOL\1298466898\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [Corel File Shell Monitor] c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Karp Family\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [Corel Photo Downloader] "C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files (x86)\AOL Desktop 9.6\AOL.EXE" -b
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe -update activex
O4 - HKCU\..\RunOnce: [Shockwave Updater] "C:\Windows\SysWOW64\Adobe\Shockwave 11\SwHelper_1164634.exe" -Update
O4 - Global Startup: Event Planner Reminder 2010.lnk = ?
O4 - Global Startup: Snapfish PictureMover.lnk = C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe
O8 - Extra context menu item: Open with WordPerfect - c:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\WPLauncher.hta
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - http://h20364.www2.hp.com/CSMWeb/Customer/…DataManager.CAB
O16 - DPF: {75A6AEA3-F26E-4608-AE9B-8DA78C87576E} (Wizard101GameLauncher) - https://kingsisle.hs.llnwd.net/e1/static/th…ameLauncher.CAB
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} (P3DActiveX Control) - http://panda-plugin.disney.go.com/plugin/w…/p3dactivex.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Client Services (HPClientSvc) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Online Backup (NOBU) - Symantec Corporation - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files (x86)\PDF Complete\pdfsvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: RoxioNow Service - Roxio - C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files (x86)\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: vToolbarUpdater11.1.0 - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 13544 bytes

CatByte

Post #2May 19, 2012, 1:15 PM UTC

Hi,

Please run the following:

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Choose your language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Choose your language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

On the System Recovery Options menu you will get the following options:Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.

[*]When the tool opens click Yes to the disclaimer.

[*]Place a check next to List Drivers MD5 as well as the default check marks that are already there

[*]Press Scan button.

[*]type exit and reboot the computer normally

[*]FRST will make a log (FRST.txt) on the flash drive, please copy and paste the log in your reply.

pamelak

Post #3May 19, 2012, 2:27 PM UTC

Tanks for your reply! Here is the log you requested: Scan result of Farbar Recovery Scan Tool Version: 19-05-2012 Ran by [removed] at 19-05-2012 10:17:51 Running from L:\ Windows 7 Home Premium (X64) OS Language: English(US) The current controlset is ControlSet001 ========================== Registry (Whitelisted) ============= HKLM\…\Run: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard) HKLM\…\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [161304 2010-05-06] (Intel Corporation) HKLM\…\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [386584 2010-05-06] (Intel Corporation) HKLM\…\Run: [Persistence] C:\Windows\system32\igfxpers.exe [413208 2010-05-06] (Intel Corporation) HKLM\…\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe /background [611896 2010-09-15] () HKLM\…\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1271168 2012-03-26] (Microsoft Corporation) HKLM-x32\…\Run: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard) HKLM-x32\…\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe [664600 2010-09-28] (PDF Complete Inc) HKLM-x32\…\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation) HKLM-x32\…\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [439568 2010-05-10] (Microsoft Corporation) HKLM-x32\…\Run: [QuickFinder Scheduler] "c:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\QFSCHD150.EXE" [136600 2010-10-25] (Corel Corporation) HKLM-x32\…\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\…\Run: [HostManager] C:\Program Files (x86)\Common Files\AOL\1298466898\ee\AOLSoftware.exe [41800 2010-03-07] (AOL Inc.) HKLM-x32\…\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [35736 2011-01-30] (Adobe Systems Incorporated) HKLM-x32\…\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [932288 2010-11-10] (Adobe Systems Incorporated) HKLM-x32\…\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.) HKLM-x32\…\Run: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe [948880 2011-03-03] (Carbonite, Inc.) HKLM-x32\…\Run: [Corel File Shell Monitor] c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe [x] HKLM-x32\…\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-11-01] (Apple Inc.) HKLM-x32\…\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-12-07] (Apple Inc.) HKLM-x32\…\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" [1104440 2012-05-16] () HKLM-x32\…\Run: [Advanced System Protector] [x] HKU\Karp Family\…\Run: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [x] HKU\Karp Family\…\Run: [Akamai NetSession Interface] "C:\Users\Karp Family\AppData\Local\Akamai\netsession_win.exe" [3331872 2012-03-13] (Akamai Technologies, Inc) HKU\Karp Family\…\Run: [Corel Photo Downloader] "C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup [526992 2010-07-27] (Corel, Inc.) HKU\Karp Family\…\Run: [AOL Fast Start] "C:\Program Files (x86)\AOL Desktop 9.6\AOL.EXE" -b [42320 2011-01-13] (AOL Inc.) Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 ==================== Services (Whitelisted) ====== 3 AOL ACS; "C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe" [46640 2006-10-23] (AOL LLC) 2 CarboniteService; "C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe" [6315664 2011-03-03] (Carbonite, Inc. (www.carbonite.com)) 2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE [102400 2006-04-17] (SEIKO EPSON CORPORATION) 2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [86072 2011-09-09] (Hewlett-Packard Company) 3 Microsoft Office Groove Audit Service; "C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe" [64856 2009-02-26] (Microsoft Corporation) 2 NOBU; "C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" SERVICE [2804568 2010-06-01] (Symantec Corporation) 3 Symantec RemoteAssist; "C:\Program Files (x86)\Common Files\Symantec Shared\Support Controls\ssrc.exe" [394704 2008-01-29] (Symantec, Inc.) 2 vToolbarUpdater11.1.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe [935480 2012-05-16] () 2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll [x] 2 LightScribeService; "c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe" [x] 2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x] 3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x] 2 PSI_SVC_2; "c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe" [x] ========================== Drivers (Whitelisted) ============= 3 igfx; C:\Windows\System32\DRIVERS\igdkmd64.sys [10326784 2010-04-20] (Intel Corporation) 3 rcmirror; C:\Windows\System32\Drivers\rcmirror.sys [4608 2010-01-18] (Windows ® Win 7 DDK provider) 3 wanatw; C:\Windows\System32\DRIVERS\wanatw64.sys [24064 2006-11-29] (America Online, Inc.) ========================== NetSvcs (Whitelisted) =========== ============ One Month Created Files and Folders ============== 2012-05-19 10:17 - 2012-05-19 10:18 - 0000000 ____D C:\FRST 2012-05-19 06:05 - 2012-05-19 06:05 - 0419488 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2012-05-16 16:47 - 2012-05-16 16:47 - 0028160 ____A C:\Users\Karp Family\Desktop\subplansmay17.doc 2012-05-16 13:15 - 2012-05-16 13:15 - 0000000 ____D C:\Users\Karp Family\AppData\Local\{48C63070-5216-48FB-A63F-E8A74C8775E5} 2012-05-16 06:48 - 2012-05-16 06:48 - 0013546 ____A C:\Users\Karp Family\Desktop\hijackthis.log 2012-05-16 06:47 - 2012-05-16 06:47 - 0464613 ____A C:\Users\Karp Family\Desktop\Untitled.png 2012-05-16 06:41 - 2012-05-19 06:04 - 0000296 ____A C:\Windows\Tasks\RegClean Pro_UPDATES.job 2012-05-16 06:41 - 2012-05-18 11:02 - 0000288 ____A C:\Windows\Tasks\RegClean Pro_DEFAULT.job 2012-05-16 06:41 - 2012-05-16 06:41 - 0001207 ____A C:\Users\Public\Desktop\Advanced System Protector.lnk 2012-05-16 06:41 - 2012-05-16 06:41 - 0001056 ____A C:\Users\Public\Desktop\RegClean Pro.lnk 2012-05-16 06:41 - 2012-05-16 06:41 - 0000000 ____D C:\Users\Karp Family\AppData\Roaming\Systweak 2012-05-16 06:41 - 2012-05-16 06:41 - 0000000 ____D C:\Users\All Users\Systweak 2012-05-16 06:41 - 2012-05-16 06:41 - 0000000 ____D C:\ProgramData\Systweak 2012-05-16 06:41 - 2012-05-16 06:41 - 0000000 ____D C:\Program Files (x86)\RegClean Pro 2012-05-16 06:41 - 2012-05-16 06:41 - 0000000 ____D C:\Program Files (x86)\Advanced System Protector 2012-05-16 06:41 - 2012-03-30 08:14 - 0018816 ____A (Systweak Inc., (www.systweak.com)) C:\Windows\System32\roboot64.exe 2012-05-16 06:41 - 2008-11-20 20:08 - 0016896 ____A C:\Windows\System32\sasnative64.exe 2012-05-16 06:34 - 2012-05-16 06:34 - 0000060 ____A C:\Windows\control.ini 2012-05-16 06:34 - 2012-05-16 06:33 - 0724992 ____A (Indigo Rose Corporation) C:\Windows\iun6002.exe 2012-05-16 06:33 - 2012-05-16 08:57 - 0000000 ____D C:\Users\All Users\AVG Secure Search 2012-05-16 06:33 - 2012-05-16 08:57 - 0000000 ____D C:\ProgramData\AVG Secure Search 2012-05-16 06:33 - 2012-05-16 06:33 - 0000000 ____D C:\Users\Karp Family\AppData\Local\AVG Secure Search 2012-05-16 06:33 - 2012-05-16 06:33 - 0000000 ____D C:\Program Files (x86)\AVG Secure Search 2012-05-16 06:29 - 2012-05-16 06:29 - 0007168 __ASH C:\Users\Karp Family\Documents\Thumbs.db 2012-05-15 16:03 - 2012-05-15 16:06 - 0000000 ____D C:\Users\Karp Family\Documents\Dinawalkathonposter 2012-05-15 16:03 - 2012-05-15 16:03 - 0020681 ____A C:\Users\Karp Family\Documents\Dinawalkathonposter.zip 2012-05-13 09:10 - 2012-05-13 09:11 - 0000000 ____D C:\Users\Karp Family\Documents\My Kindle Content 2012-05-13 09:10 - 2012-05-13 09:10 - 0000000 ____D C:\Users\Karp Family\AppData\Local\Amazon 2012-05-12 05:25 - 2012-05-12 05:26 - 6353180 ____A C:\Users\Karp Family\Desktop\Shapiro and Russo096.pdf 2012-05-12 05:01 - 2012-05-12 05:02 - 0000000 ____D C:\Archived 2012-05-12 05:01 - 2012-05-12 05:01 - 0000000 ____D C:\Users\Karp Family\Desktop\HOCKEY 2012-05-10 17:44 - 2012-05-10 17:44 - 0026112 ____A C:\Users\Karp Family\Documents\Tavares-CHAMPIONSHIP.doc 2012-05-10 12:12 - 2012-05-10 12:12 - 0001334 ____A C:\Users\Public\Desktop\Pirates of the Caribbean Online.lnk 2012-05-10 12:12 - 2012-05-10 12:12 - 0000000 ____D C:\Program Files (x86)\Disney 2012-05-10 11:34 - 2012-04-01 21:34 - 5504880 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-05-10 11:34 - 2012-03-02 22:29 - 1837568 ____A (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll 2012-05-10 11:34 - 2012-03-02 22:29 - 1541120 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2012-05-10 11:34 - 2012-03-02 22:29 - 0902656 ____A (Microsoft Corporation) C:\Windows\System32\d2d1.dll 2012-05-10 11:34 - 2012-03-02 22:29 - 0320512 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll 2012-05-10 11:34 - 2012-03-02 22:29 - 0197120 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll 2012-05-10 11:34 - 2012-03-02 21:40 - 1170944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2012-05-10 11:34 - 2012-03-02 21:40 - 1074176 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2012-05-10 11:34 - 2012-03-02 21:40 - 0739840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2012-05-10 11:34 - 2012-03-02 21:40 - 0218624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll 2012-05-10 11:34 - 2012-03-02 21:40 - 0161792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll 2012-05-10 11:33 - 2012-04-01 20:46 - 3958128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2012-05-10 11:33 - 2012-04-01 20:46 - 3902320 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2012-05-10 11:33 - 2012-04-01 19:01 - 3143680 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-05-10 11:33 - 2012-03-30 03:09 - 1895280 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-05-10 11:33 - 2012-03-16 23:55 - 0075632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys 2012-05-09 17:39 - 2012-05-09 17:39 - 0000000 ____D C:\Users\Karp Family\AppData\Local\ElevatedDiagnostics 2012-05-06 15:08 - 2012-05-06 15:08 - 0015469 ____A C:\Users\Karp Family\Documents\title.docx 2012-05-06 13:33 - 2012-05-06 14:30 - 0010876 ____A C:\Users\Karp Family\Documents\Observations.docx 2012-05-06 13:03 - 2012-05-06 12:58 - 0021660 ____A C:\Users\Karp Family\Desktop\liv'sgraph.png 2012-05-03 17:17 - 2012-05-03 17:18 - 0107530 ____A C:\Users\Karp Family\Desktop\regents612.pdf 2012-05-02 16:47 - 2012-05-06 13:05 - 0012269 ____A C:\Users\Karp Family\Documents\Chart.docx 2012-04-30 23:00 - 2012-04-30 23:01 - 0000000 ____D C:\Program Files (x86)\Microsoft Security Client 2012-04-25 17:19 - 2012-04-25 17:25 - 0000000 ____D C:\Users\Karp Family\Documents\8thgrverifications 2012-04-25 17:19 - 2012-04-25 17:19 - 0321817 ____A C:\Users\Karp Family\Documents\8thgrverifications.zip 2012-04-23 12:17 - 2012-04-23 12:28 - 0011753 ____A C:\Users\Karp Family\Documents\Scientific Method.docx 2012-04-22 09:05 - 2012-04-22 09:05 - 1310164 ____A C:\Users\Karp Family\Documents\All About Hannah & Sam.pptx ============ 3 Months Modified Files and Folders ============= 2012-05-19 10:18 - 2012-05-19 10:17 - 0000000 ____D C:\FRST 2012-05-19 06:05 - 2012-05-19 06:05 - 0419488 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2012-05-19 06:05 - 2011-07-16 19:26 - 0000904 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2012-05-19 06:05 - 2011-05-26 05:24 - 0070304 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2012-05-19 06:04 - 2012-05-16 06:41 - 0000296 ____A C:\Windows\Tasks\RegClean Pro_UPDATES.job 2012-05-19 06:04 - 2009-07-13 21:08 - 0000006 ___AH C:\Windows\Tasks\SA.DAT 2012-05-19 06:04 - 2009-07-13 20:51 - 0046603 ____A C:\Windows\setupact.log 2012-05-19 06:03 - 2011-02-15 22:26 - 3193888768 __ASH C:\hiberfil.sys 2012-05-19 06:03 - 2011-02-15 22:26 - 0911382 ____A C:\Windows\PFRO.log 2012-05-19 06:03 - 2010-12-14 10:53 - 1745808 ____A C:\Windows\WindowsUpdate.log 2012-05-19 05:57 - 2011-07-16 19:26 - 0000908 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2012-05-18 11:02 - 2012-05-16 06:41 - 0000288 ____A C:\Windows\Tasks\RegClean Pro_DEFAULT.job 2012-05-16 16:47 - 2012-05-16 16:47 - 0028160 ____A C:\Users\Karp Family\Desktop\subplansmay17.doc 2012-05-16 16:29 - 2011-02-17 04:21 - 0006580 __ASH C:\Users\All Users\KGyGaAvL.sys 2012-05-16 16:29 - 2011-02-17 04:21 - 0006580 __ASH C:\ProgramData\KGyGaAvL.sys 2012-05-16 16:29 - 2009-07-13 21:32 - 0000000 ____D C:\Windows\System32\FxsTmp 2012-05-16 13:15 - 2012-05-16 13:15 - 0000000 ____D C:\Users\Karp Family\AppData\Local\{48C63070-5216-48FB-A63F-E8A74C8775E5} 2012-05-16 13:14 - 2011-02-23 05:39 - 0000000 ____D C:\Users\Karp Family\OLIVIA'S DOCUMENTS 2012-05-16 08:57 - 2012-05-16 06:33 - 0000000 ____D C:\Users\All Users\AVG Secure Search 2012-05-16 08:57 - 2012-05-16 06:33 - 0000000 ____D C:\ProgramData\AVG Secure Search 2012-05-16 06:48 - 2012-05-16 06:48 - 0013546 ____A C:\Users\Karp Family\Desktop\hijackthis.log 2012-05-16 06:47 - 2012-05-16 06:47 - 0464613 ____A C:\Users\Karp Family\Desktop\Untitled.png 2012-05-16 06:41 - 2012-05-16 06:41 - 0001207 ____A C:\Users\Public\Desktop\Advanced System Protector.lnk 2012-05-16 06:41 - 2012-05-16 06:41 - 0001056 ____A C:\Users\Public\Desktop\RegClean Pro.lnk 2012-05-16 06:41 - 2012-05-16 06:41 - 0000000 ____D C:\Users\Karp Family\AppData\Roaming\Systweak 2012-05-16 06:41 - 2012-05-16 06:41 - 0000000 ____D C:\Users\All Users\Systweak 2012-05-16 06:41 - 2012-05-16 06:41 - 0000000 ____D C:\ProgramData\Systweak 2012-05-16 06:41 - 2012-05-16 06:41 - 0000000 ____D C:\Program Files (x86)\RegClean Pro 2012-05-16 06:41 - 2012-05-16 06:41 - 0000000 ____D C:\Program Files (x86)\Advanced System Protector 2012-05-16 06:40 - 2009-07-13 20:45 - 0015792 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-05-16 06:40 - 2009-07-13 20:45 - 0015792 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-05-16 06:34 - 2012-05-16 06:34 - 0000060 ____A C:\Windows\control.ini 2012-05-16 06:33 - 2012-05-16 06:34 - 0724992 ____A (Indigo Rose Corporation) C:\Windows\iun6002.exe 2012-05-16 06:33 - 2012-05-16 06:33 - 0000000 ____D C:\Users\Karp Family\AppData\Local\AVG Secure Search 2012-05-16 06:33 - 2012-05-16 06:33 - 0000000 ____D C:\Program Files (x86)\AVG Secure Search 2012-05-16 06:33 - 2011-02-15 19:33 - 0000000 ____D C:\Users\Karp Family\AppData\LocalLow 2012-05-16 06:29 - 2012-05-16 06:29 - 0007168 __ASH C:\Users\Karp Family\Documents\Thumbs.db 2012-05-16 02:54 - 2009-07-13 21:13 - 0729880 ____A C:\Windows\System32\PerfStringBackup.INI 2012-05-15 16:06 - 2012-05-15 16:03 - 0000000 ____D C:\Users\Karp Family\Documents\Dinawalkathonposter 2012-05-15 16:03 - 2012-05-15 16:03 - 0020681 ____A C:\Users\Karp Family\Documents\Dinawalkathonposter.zip 2012-05-15 05:46 - 2010-12-14 11:11 - 0000000 ____D C:\Users\All Users\PDFC 2012-05-15 05:46 - 2010-12-14 11:11 - 0000000 ____D C:\ProgramData\PDFC 2012-05-14 17:47 - 2011-02-18 11:16 - 0000000 ____D C:\Users\Karp Family\AppData\Local\CrashDumps 2012-05-14 04:58 - 2012-02-13 05:04 - 0000000 ____A C:\Windows\System32\HP_ActiveX_Patch_NOT_DETECTED.txt 2012-05-14 04:58 - 2011-02-21 12:11 - 0000052 ____A C:\Windows\SysWOW64\DOErrors.log 2012-05-14 04:57 - 2011-02-21 12:10 - 0000000 ____D C:\Users\Karp Family\AppData\Roaming\HP Support Assistant 2012-05-14 04:57 - 2011-02-17 00:00 - 0000000 ____D C:\Users\Karp Family\AppData\Roaming\HpUpdate 2012-05-13 09:11 - 2012-05-13 09:10 - 0000000 ____D C:\Users\Karp Family\Documents\My Kindle Content 2012-05-13 09:10 - 2012-05-13 09:10 - 0000000 ____D C:\Users\Karp Family\AppData\Local\Amazon 2012-05-13 02:38 - 2011-03-05 06:59 - 0000054 ____A C:\Users\Karp Family\Documents\Hallmark Card Studio 2010.txt 2012-05-12 05:26 - 2012-05-12 05:25 - 6353180 ____A C:\Users\Karp Family\Desktop\Shapiro and Russo096.pdf 2012-05-12 05:02 - 2012-05-12 05:01 - 0000000 ____D C:\Archived 2012-05-12 05:01 - 2012-05-12 05:01 - 0000000 ____D C:\Users\Karp Family\Desktop\HOCKEY 2012-05-11 23:00 - 2011-02-21 17:58 - 0000000 ____D C:\Users\All Users\Microsoft Help 2012-05-11 23:00 - 2011-02-21 17:58 - 0000000 ____D C:\ProgramData\Microsoft Help 2012-05-10 23:38 - 2009-07-13 20:45 - 0522848 ____A C:\Windows\System32\FNTCACHE.DAT 2012-05-10 23:36 - 2010-12-14 11:19 - 0000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2012-05-10 23:18 - 2011-02-16 04:01 - 57848688 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-05-10 23:01 - 2009-07-13 23:45 - 0000000 ____D C:\Program Files\Windows Journal 2012-05-10 17:44 - 2012-05-10 17:44 - 0026112 ____A C:\Users\Karp Family\Documents\Tavares-CHAMPIONSHIP.doc 2012-05-10 12:12 - 2012-05-10 12:12 - 0001334 ____A C:\Users\Public\Desktop\Pirates of the Caribbean Online.lnk 2012-05-10 12:12 - 2012-05-10 12:12 - 0000000 ____D C:\Program Files (x86)\Disney 2012-05-09 17:39 - 2012-05-09 17:39 - 0000000 ____D C:\Users\Karp Family\AppData\Local\ElevatedDiagnostics 2012-05-09 04:12 - 2012-02-07 07:37 - 0000356 ____A C:\Windows\Tasks\HPCeeScheduleForKarp Family.job 2012-05-09 04:11 - 2011-02-16 04:49 - 0000000 ____D C:\Users\Karp Family\Scott 2012-05-08 04:18 - 2011-02-16 05:44 - 0000000 ____D C:\Users\Karp Family\Documents\Pam 2012-05-08 04:17 - 2011-02-15 19:33 - 0000000 ____D C:\users\Karp Family 2012-05-06 15:08 - 2012-05-06 15:08 - 0015469 ____A C:\Users\Karp Family\Documents\title.docx 2012-05-06 14:30 - 2012-05-06 13:33 - 0010876 ____A C:\Users\Karp Family\Documents\Observations.docx 2012-05-06 13:05 - 2012-05-02 16:47 - 0012269 ____A C:\Users\Karp Family\Documents\Chart.docx 2012-05-06 12:58 - 2012-05-06 13:03 - 0021660 ____A C:\Users\Karp Family\Desktop\liv'sgraph.png 2012-05-03 17:18 - 2012-05-03 17:17 - 0107530 ____A C:\Users\Karp Family\Desktop\regents612.pdf 2012-04-30 23:01 - 2012-04-30 23:00 - 0000000 ____D C:\Program Files (x86)\Microsoft Security Client 2012-04-30 23:01 - 2011-07-15 11:23 - 0001945 ____A C:\Windows\epplauncher.mif 2012-04-30 23:01 - 2011-07-15 11:21 - 0743538 ____A C:\Windows\SysWOW64\PerfStringBackup.INI 2012-04-30 23:01 - 2011-07-15 11:21 - 0000000 ____D C:\Program Files\Microsoft Security Client 2012-04-25 17:25 - 2012-04-25 17:19 - 0000000 ____D C:\Users\Karp Family\Documents\8thgrverifications 2012-04-25 17:19 - 2012-04-25 17:19 - 0321817 ____A C:\Users\Karp Family\Documents\8thgrverifications.zip 2012-04-23 12:28 - 2012-04-23 12:17 - 0011753 ____A C:\Users\Karp Family\Documents\Scientific Method.docx 2012-04-22 09:05 - 2012-04-22 09:05 - 1310164 ____A C:\Users\Karp Family\Documents\All About Hannah & Sam.pptx 2012-04-20 04:01 - 2011-05-26 04:01 - 0000352 ____A C:\Windows\Tasks\HPCeeScheduleForKARPFAMILY-HP$.job 2012-04-19 16:45 - 2012-04-17 16:05 - 0012597 ____A C:\Users\Karp Family\Documents\Reality Check Reading Log.docx 2012-04-12 04:09 - 2011-06-14 02:05 - 0058880 __ASH C:\Users\Karp Family\Thumbs.db 2012-04-11 15:29 - 2012-04-11 15:29 - 6959342 ____A C:\Users\Karp Family\Documents\Manischewitzville.wmv 2012-04-04 17:48 - 2011-02-16 17:35 - 0000000 ____D C:\Users\Karp Family\AppData\Local\Google 2012-04-04 16:23 - 2011-02-16 17:35 - 0000000 ____D C:\Program Files\Google 2012-04-04 16:23 - 2011-02-16 17:35 - 0000000 ____D C:\Program Files (x86)\Google 2012-04-04 16:23 - 2011-02-16 04:32 - 0000000 ____D C:\Users\All Users\Google 2012-04-04 16:23 - 2011-02-16 04:32 - 0000000 ____D C:\ProgramData\Google 2012-04-04 12:52 - 2012-04-04 12:52 - 0035840 ____A C:\Users\Karp Family\Documents\MarkDatewalkathonposter.doc 2012-04-01 21:34 - 2012-05-10 11:34 - 5504880 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-04-01 20:46 - 2012-05-10 11:33 - 3958128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2012-04-01 20:46 - 2012-05-10 11:33 - 3902320 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2012-04-01 19:01 - 2012-05-10 11:33 - 3143680 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-04-01 11:39 - 2012-04-01 11:39 - 5253319 ____A C:\Users\Karp Family\Desktop\IMG_0887.mov 2012-04-01 08:43 - 2011-10-23 12:12 - 0115667 ____A C:\Users\Karp Family\Documents\Memo.m4a 2012-03-30 08:14 - 2012-05-16 06:41 - 0018816 ____A (Systweak Inc., (www.systweak.com)) C:\Windows\System32\roboot64.exe 2012-03-30 03:09 - 2012-05-10 11:33 - 1895280 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-03-27 17:13 - 2012-03-27 17:13 - 0262158 ____A C:\Users\Karp Family\Documents\DanielKarp.jpg 2012-03-26 18:05 - 2012-03-26 18:05 - 0045056 ____A C:\Users\Karp Family\Documents\Copyof03_Boys_Schedule_Spring_2012.xls 2012-03-26 18:04 - 2012-03-26 18:04 - 0029696 ____A C:\Users\Karp Family\Documents\Spring2012TeamRosters.xls 2012-03-26 17:59 - 2012-03-09 19:22 - 0017920 ____A C:\Users\Karp Family\Documents\Tavares.xls 2012-03-26 17:49 - 2012-03-26 17:49 - 0326485 ____A C:\Users\Karp Family\Documents\2012OTNightatCitiField.pdf 2012-03-21 10:00 - 2011-11-09 11:57 - 0000000 ____D C:\Users\Karp Family\AppData\Local\Akamai 2012-03-20 16:44 - 2011-04-27 11:25 - 0098688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\NisDrvWFP.sys 2012-03-20 16:44 - 2011-04-18 09:18 - 0203888 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\MpFilter.sys 2012-03-18 18:16 - 2011-02-16 04:49 - 0000000 ____D C:\Users\Karp Family\Sam 2012-03-18 18:15 - 2012-03-18 18:15 - 0000000 ____D C:\Users\Karp Family\Documents\SAM 2012-03-16 23:55 - 2012-05-10 11:33 - 0075632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys 2012-03-13 09:27 - 2012-03-13 09:23 - 0000000 ____D C:\Users\Karp Family\AppData\Roaming\CasinoOnNet 2012-03-13 09:24 - 2012-03-13 09:24 - 0002002 ____A C:\Users\Karp Family\Desktop\888casino.lnk 2012-03-13 09:24 - 2012-03-13 09:23 - 0000000 ____D C:\Program Files (x86)\CasinoOnNet 2012-03-13 09:11 - 2009-07-13 21:32 - 0000000 ____D C:\Windows\Downloaded Program Files 2012-03-12 13:06 - 2011-08-20 18:49 - 0000000 ____D C:\Users\Karp Family\AppData\Local\Corel 2012-03-09 17:55 - 2012-03-09 17:40 - 0273610 ____A C:\Users\Karp Family\Desktop\scoring_2011-2012.pdf 2012-03-07 04:43 - 2010-12-14 10:52 - 0000000 ____D C:\Windows\SysWOW64\Macromed 2012-03-06 04:19 - 2011-02-16 04:55 - 0010154 ____A C:\Users\Karp Family\Sti_Trace.log 2012-03-05 10:49 - 2011-05-24 05:47 - 0439296 __ASH C:\Users\Karp Family\Desktop\Thumbs.db 2012-03-04 17:32 - 2012-03-04 17:32 - 10323026 ____A C:\Users\Karp Family\Desktop\rx087.jpg 2012-03-03 14:41 - 2011-06-06 13:58 - 0000000 ____D C:\Users\Karp Family\Desktop\Sam's Art 2012-03-03 14:40 - 2012-01-22 17:10 - 0010949 ____A C:\Users\Karp Family\Desktop\Dear LMFAO.docx 2012-03-02 22:29 - 2012-05-10 11:34 - 1837568 ____A (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll 2012-03-02 22:29 - 2012-05-10 11:34 - 1541120 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2012-03-02 22:29 - 2012-05-10 11:34 - 0902656 ____A (Microsoft Corporation) C:\Windows\System32\d2d1.dll 2012-03-02 22:29 - 2012-05-10 11:34 - 0320512 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll 2012-03-02 22:29 - 2012-05-10 11:34 - 0197120 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll 2012-03-02 21:40 - 2012-05-10 11:34 - 1170944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2012-03-02 21:40 - 2012-05-10 11:34 - 1074176 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2012-03-02 21:40 - 2012-05-10 11:34 - 0739840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2012-03-02 21:40 - 2012-05-10 11:34 - 0218624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll 2012-03-02 21:40 - 2012-05-10 11:34 - 0161792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll 2012-03-01 19:17 - 2012-03-01 19:17 - 0011172 ____A C:\Users\Karp Family\Desktop\Frankenstein 3.docx 2012-02-29 22:54 - 2012-04-10 23:00 - 0022896 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fs_rec.sys 2012-02-29 22:45 - 2012-04-10 23:00 - 0220672 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll 2012-02-29 22:40 - 2012-04-10 23:00 - 0080896 ____A (Microsoft Corporation) C:\Windows\System32\imagehlp.dll 2012-02-29 22:35 - 2012-04-10 23:00 - 0005120 ____A (Microsoft Corporation) C:\Windows\System32\wmi.dll 2012-02-29 21:49 - 2012-04-10 23:00 - 0172544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2012-02-29 21:45 - 2012-04-10 23:00 - 0158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2012-02-29 21:40 - 2012-04-10 23:00 - 0005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll 2012-02-29 02:35 - 2012-02-29 02:35 - 0000969 ____A C:\Users\Karp Family\Desktop\AOL Desktop 9.6.lnk 2012-02-28 18:55 - 2012-02-28 18:55 - 9829938 ____A C:\Users\Karp Family\Desktop\intro-religions-of-the-world.pdf 2012-02-28 13:34 - 2012-02-28 13:34 - 0310691 ____A C:\Users\Karp Family\Desktop\February Parent Calendar.pdf 2012-02-27 22:35 - 2012-04-10 18:35 - 1501184 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-02-27 22:35 - 2012-04-10 18:35 - 1197568 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-02-27 22:35 - 2012-04-10 18:35 - 0134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-02-27 22:33 - 2012-04-10 18:35 - 9335296 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-02-27 22:33 - 2012-04-10 18:35 - 1026560 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll 2012-02-27 22:33 - 2012-04-10 18:35 - 0703488 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2012-02-27 22:33 - 2012-04-10 18:35 - 0097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-02-27 22:33 - 2012-04-10 18:35 - 0082944 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll 2012-02-27 22:33 - 2012-04-10 18:35 - 0057856 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll 2012-02-27 22:32 - 2012-04-10 18:35 - 2458624 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-02-27 22:32 - 2012-04-10 18:35 - 12372480 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-02-27 22:32 - 2012-04-10 18:35 - 0445952 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll 2012-02-27 22:32 - 2012-04-10 18:35 - 0256000 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll 2012-02-27 22:32 - 2012-04-10 18:35 - 0247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-02-27 22:32 - 2012-04-10 18:35 - 0064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-02-27 22:29 - 2012-04-10 18:35 - 0012288 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe 2012-02-27 21:40 - 2012-04-10 18:35 - 1230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-02-27 21:40 - 2012-04-10 18:35 - 0981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-02-27 21:40 - 2012-04-10 18:35 - 0132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-02-27 21:38 - 2012-04-10 18:35 - 5998592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-02-27 21:38 - 2012-04-10 18:35 - 0606208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll 2012-02-27 21:38 - 2012-04-10 18:35 - 0599552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2012-02-27 21:38 - 2012-04-10 18:35 - 0067072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-02-27 21:38 - 2012-04-10 18:35 - 0064512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2012-02-27 21:38 - 2012-04-10 18:35 - 0048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-02-27 21:38 - 2012-04-10 18:35 - 0044544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2012-02-27 21:37 - 2012-04-10 18:35 - 2072576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-02-27 21:37 - 2012-04-10 18:35 - 10991104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-02-27 21:37 - 2012-04-10 18:35 - 0381440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2012-02-27 21:37 - 2012-04-10 18:35 - 0185856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2012-02-27 21:37 - 2012-04-10 18:35 - 0176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-02-27 21:35 - 2012-04-10 18:35 - 0012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2012-02-27 21:17 - 2012-04-10 18:35 - 0482816 ____A (Microsoft Corporation) C:\Windows\System32\html.iec 2012-02-27 20:35 - 2012-04-10 18:35 - 1638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-02-27 20:31 - 2012-04-10 18:35 - 0386048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2012-02-27 19:57 - 2012-04-10 18:35 - 1638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-02-26 15:29 - 2012-01-20 18:56 - 0010953 ____A C:\Users\Karp Family\Documents\Olivia Trivia.docx 2012-02-26 07:13 - 2012-02-24 17:48 - 0010454 ____A C:\Users\Karp Family\Documents\party list.docx 2012-02-25 17:50 - 2012-02-25 17:50 - 0011835 ____A C:\Users\Karp Family\Documents\Dear benji.docx 2012-02-22 00:01 - 2009-07-13 18:34 - 0000478 ____A C:\Windows\win.ini 2012-02-20 04:19 - 2012-02-20 04:19 - 0093094 ____A C:\Users\Karp Family\Documents\photo.jpg ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\…\.exe: exefile => OK HKLM\…\exefile\DefaultIcon: %1 => OK HKLM\…\exefile\open\command: "%1" %* => OK ========================= Memory info ====================== Percentage of memory in use: 20% Total physical RAM: 4061.24 MB Available physical RAM: 3243.74 MB Total Pagefile: 4059.39 MB Available Pagefile: 3211.74 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ======================= Partitions ========================= 1 Drive c: (OS) (Fixed) (Total:918.31 GB) (Free:674.73 GB) NTFS ==>[System with boot components (obtained from reading drive)] 2 Drive e: (HP_RECOVERY) (Fixed) (Total:13.1 GB) (Free:1.57 GB) NTFS ==>[System with boot components (obtained from reading drive)] 3 Drive f: (SHREK_2_US_16X9) (CDROM) (Total:7.6 GB) (Free:0 GB) UDF 4 Drive g: (WD Passport) (Fixed) (Total:149.01 GB) (Free:83.49 GB) FAT32 9 Drive l: (Transcend) (Removable) (Total:1.87 GB) (Free:1.86 GB) FAT32 11 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS 12 Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Disk ### Status Size Free Dyn Gpt ——– ————- ——- ——- — — Disk 0 Online 931 GB 0 B Disk 1 Online 149 GB 0 B Disk 2 No Media 0 B 0 B Disk 3 No Media 0 B 0 B Disk 4 No Media 0 B 0 B Disk 5 No Media 0 B 0 B Disk 6 Online 1925 MB 0 B Disk 7 No Media 0 B 0 B Partitions of Disk 0: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Primary 100 MB 1024 KB Partition 2 Primary 918 GB 101 MB Partition 3 Primary 13 GB 918 GB ================================================================================ ====================== Disk: 0 Partition 1 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 1 Y SYSTEM NTFS Partition 100 MB Healthy ================================================================================ ====================== Disk: 0 Partition 2 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 2 C OS NTFS Partition 918 GB Healthy ================================================================================ ====================== Disk: 0 Partition 3 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 3 E HP_RECOVERY NTFS Partition 13 GB Healthy ================================================================================ ====================== Partitions of Disk 1: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Primary 149 GB 31 KB ================================================================================ ====================== Disk: 1 Partition 1 Type : 0C Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 4 G WD Passport FAT32 Partition 149 GB Healthy ================================================================================ ====================== Partitions of Disk 6: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Primary 1921 MB 4096 KB ================================================================================ ====================== Disk: 6 Partition 1 Type : 0B Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 9 L Transcend FAT32 Removable 1921 MB Healthy ================================================================================ ====================== ========================================================== Last Boot: 2012-05-18 20:14 ======================= End Of Log ==========================

CatByte

Post #4May 19, 2012, 2:39 PM UTC

Hi

Please do the following:

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
when the window opens, click on Change Parameters
under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
click OK
Press Start Scan
- If Malicious objects are found then ensure Cure is selected
- If TDLFS File System is found then ensure Delete is selected
- Then click Continue > Reboot now
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

NEXT

Refer to the ComboFix User's Guide

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
You can get help on disabling your protection programs here
Double click on ComboFix.exe & follow the prompts.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

———————————————————————————————
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

———————————————————————————————

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

pamelak

Post #5May 19, 2012, 5:14 PM UTC

Ok I have followed this next set of instrucitons but that computer is now hung up. There is a small blue screen for combo fix. It says that it is creating the combo fix log but it hasn't done anything..for the last 10 minutes or so. Please advise. Thanks!

pamelak

Post #6May 19, 2012, 5:21 PM UTC

Ok update -= it finally finished. here are the 2 logs requested: TDSSKiller Log: 12:15:37.0086 5132 TDSS rootkit removing tool [removed] May 16 2012 07:37:57 12:15:37.0320 5132 ============================================================ 12:15:37.0320 5132 Current date / time: 2012/05/19 12:15:37.0320 12:15:37.0320 5132 SystemInfo: 12:15:37.0320 5132 12:15:37.0320 5132 OS Version: 6.1.7600 ServicePack: 0.0 12:15:37.0320 5132 Product type: Workstation 12:15:37.0320 5132 ComputerName: KARPFAMILY-HP 12:15:37.0320 5132 UserName: Karp Family 12:15:37.0320 5132 Windows directory: C:\Windows 12:15:37.0320 5132 System windows directory: C:\Windows 12:15:37.0320 5132 Running under WOW64 12:15:37.0320 5132 Processor architecture: Intel x64 12:15:37.0320 5132 Number of processors: 2 12:15:37.0320 5132 Page size: 0x1000 12:15:37.0320 5132 Boot type: Normal boot 12:15:37.0320 5132 ============================================================ 12:15:38.0396 5132 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 12:15:42.0094 5132 Drive \Device\Harddisk1\DR1 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 12:15:42.0125 5132 ============================================================ 12:15:42.0125 5132 \Device\Harddisk0\DR0: 12:15:42.0125 5132 MBR partitions: 12:15:42.0125 5132 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 12:15:42.0125 5132 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x72C9F800 12:15:42.0125 5132 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x72CD2000, BlocksNum 0x1A34000 12:15:42.0125 5132 \Device\Harddisk1\DR1: 12:15:42.0125 5132 MBR partitions: 12:15:42.0125 5132 \Device\Harddisk1\DR1\Partition0: MBR, Type 0xC, StartLBA 0x3F, BlocksNum 0x12A18A82 12:15:42.0125 5132 ============================================================ 12:15:42.0125 5132 C: <-> \Device\Harddisk0\DR0\Partition1 12:15:42.0156 5132 D: <-> \Device\Harddisk0\DR0\Partition2 12:15:42.0156 5132 K: <-> \Device\Harddisk1\DR1\Partition0 12:15:42.0156 5132 ============================================================ 12:15:42.0156 5132 Initialize success 12:15:42.0156 5132 ============================================================ 12:16:01.0796 0216 ============================================================ 12:16:01.0796 0216 Scan started 12:16:01.0796 0216 Mode: Manual; TDLFS; 12:16:01.0796 0216 ============================================================ 12:16:02.0311 0216 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys 12:16:02.0327 0216 1394ohci - ok 12:16:02.0358 0216 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys 12:16:02.0374 0216 ACPI - ok 12:16:02.0374 0216 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys 12:16:02.0374 0216 AcpiPmi - ok 12:16:02.0405 0216 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 12:16:02.0405 0216 adp94xx - ok 12:16:02.0436 0216 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 12:16:02.0436 0216 adpahci - ok 12:16:02.0452 0216 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 12:16:02.0452 0216 adpu320 - ok 12:16:02.0483 0216 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 12:16:02.0483 0216 AeLookupSvc - ok 12:16:02.0530 0216 AFD (db9d6c6b2cd95a9ca414d045b627422e) C:\Windows\system32\drivers\afd.sys 12:16:02.0545 0216 AFD - ok 12:16:02.0561 0216 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys 12:16:02.0561 0216 agp440 - ok 12:16:02.0732 0216 Akamai (1125c7d9fb8898015829c387c1bc87c7) c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll 12:16:02.0732 0216 Suspicious file (Hidden): c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll. md5: 1125c7d9fb8898015829c387c1bc87c7 12:16:02.0748 0216 Akamai ( HiddenFile.Multi.Generic ) - warning 12:16:02.0748 0216 Akamai - detected HiddenFile.Multi.Generic (1) 12:16:02.0795 0216 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 12:16:02.0795 0216 ALG - ok 12:16:02.0810 0216 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys 12:16:02.0826 0216 aliide - ok 12:16:02.0826 0216 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys 12:16:02.0842 0216 amdide - ok 12:16:02.0842 0216 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 12:16:02.0842 0216 AmdK8 - ok 12:16:02.0857 0216 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 12:16:02.0857 0216 AmdPPM - ok 12:16:02.0904 0216 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys 12:16:02.0904 0216 amdsata - ok 12:16:02.0920 0216 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 12:16:02.0920 0216 amdsbs - ok 12:16:02.0951 0216 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys 12:16:02.0951 0216 amdxata - ok 12:16:03.0029 0216 AOL ACS (85180cf88c5ebad73b452a43a004ca51) C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe 12:16:03.0044 0216 AOL ACS - ok 12:16:03.0060 0216 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys 12:16:03.0060 0216 AppID - ok 12:16:03.0091 0216 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 12:16:03.0091 0216 AppIDSvc - ok 12:16:03.0107 0216 Appinfo (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll 12:16:03.0107 0216 Appinfo - ok 12:16:03.0185 0216 Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 12:16:03.0185 0216 Apple Mobile Device - ok 12:16:03.0200 0216 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 12:16:03.0216 0216 arc - ok 12:16:03.0232 0216 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 12:16:03.0232 0216 arcsas - ok 12:16:03.0247 0216 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 12:16:03.0247 0216 AsyncMac - ok 12:16:03.0263 0216 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys 12:16:03.0263 0216 atapi - ok 12:16:03.0310 0216 AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll 12:16:03.0310 0216 AudioEndpointBuilder - ok 12:16:03.0325 0216 AudioSrv (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll 12:16:03.0325 0216 AudioSrv - ok 12:16:03.0372 0216 AxInstSV (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll 12:16:03.0372 0216 AxInstSV - ok 12:16:03.0403 0216 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 12:16:03.0403 0216 b06bdrv - ok 12:16:03.0434 0216 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 12:16:03.0434 0216 b57nd60a - ok 12:16:03.0450 0216 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 12:16:03.0466 0216 BDESVC - ok 12:16:03.0466 0216 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 12:16:03.0466 0216 Beep - ok 12:16:03.0497 0216 BFE (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll 12:16:03.0512 0216 BFE - ok 12:16:03.0544 0216 BITS (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\System32\qmgr.dll 12:16:03.0575 0216 BITS - ok 12:16:03.0590 0216 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 12:16:03.0590 0216 blbdrive - ok 12:16:03.0684 0216 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe 12:16:03.0684 0216 Bonjour Service - ok 12:16:03.0715 0216 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys 12:16:03.0715 0216 bowser - ok 12:16:03.0731 0216 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 12:16:03.0731 0216 BrFiltLo - ok 12:16:03.0778 0216 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 12:16:03.0778 0216 BrFiltUp - ok 12:16:03.0793 0216 Browser (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll 12:16:03.0793 0216 Browser - ok 12:16:03.0809 0216 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 12:16:03.0809 0216 Brserid - ok 12:16:03.0856 0216 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 12:16:03.0856 0216 BrSerWdm - ok 12:16:03.0856 0216 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 12:16:03.0856 0216 BrUsbMdm - ok 12:16:03.0871 0216 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 12:16:03.0871 0216 BrUsbSer - ok 12:16:03.0887 0216 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 12:16:03.0887 0216 BTHMODEM - ok 12:16:03.0902 0216 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 12:16:03.0902 0216 bthserv - ok 12:16:04.0183 0216 CarboniteService (33e43a31ac6ac6ba95d4772d8cca076f) C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe 12:16:04.0277 0216 CarboniteService - ok 12:16:04.0339 0216 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 12:16:04.0339 0216 cdfs - ok 12:16:04.0370 0216 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys 12:16:04.0370 0216 cdrom - ok 12:16:04.0402 0216 CertPropSvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll 12:16:04.0402 0216 CertPropSvc - ok 12:16:04.0417 0216 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 12:16:04.0417 0216 circlass - ok 12:16:04.0433 0216 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 12:16:04.0433 0216 CLFS - ok 12:16:04.0495 0216 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 12:16:04.0495 0216 clr_optimization_v2.0.50727_32 - ok 12:16:04.0511 0216 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 12:16:04.0526 0216 clr_optimization_v2.0.50727_64 - ok 12:16:04.0573 0216 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 12:16:04.0573 0216 clr_optimization_v4.0.30319_32 - ok 12:16:04.0604 0216 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 12:16:04.0604 0216 clr_optimization_v4.0.30319_64 - ok 12:16:04.0620 0216 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 12:16:04.0620 0216 CmBatt - ok 12:16:04.0620 0216 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys 12:16:04.0636 0216 cmdide - ok 12:16:04.0667 0216 CNG (937beb186a735aca91d717044a49d17e) C:\Windows\system32\Drivers\cng.sys 12:16:04.0667 0216 CNG - ok 12:16:04.0682 0216 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 12:16:04.0682 0216 Compbatt - ok 12:16:04.0698 0216 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys 12:16:04.0698 0216 CompositeBus - ok 12:16:04.0714 0216 COMSysApp - ok 12:16:04.0729 0216 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 12:16:04.0729 0216 crcdisk - ok 12:16:04.0760 0216 CryptSvc (8c57411b66282c01533cb776f98ad384) C:\Windows\system32\cryptsvc.dll 12:16:04.0760 0216 CryptSvc - ok 12:16:04.0792 0216 dc3d (76e02db615a03801d698199a2bc4a06a) C:\Windows\system32\DRIVERS\dc3d.sys 12:16:04.0792 0216 dc3d - ok 12:16:04.0838 0216 DcomLaunch (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll 12:16:04.0838 0216 DcomLaunch - ok 12:16:04.0885 0216 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 12:16:04.0885 0216 defragsvc - ok 12:16:04.0916 0216 DfsC (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys 12:16:04.0916 0216 DfsC - ok 12:16:04.0948 0216 Dhcp (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll 12:16:04.0948 0216 Dhcp - ok 12:16:04.0963 0216 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 12:16:04.0963 0216 discache - ok 12:16:04.0994 0216 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 12:16:04.0994 0216 Disk - ok 12:16:05.0026 0216 Dnscache (85cf424c74a1d5ec33533e1dbff9920a) C:\Windows\System32\dnsrslvr.dll 12:16:05.0041 0216 Dnscache - ok 12:16:05.0057 0216 dot3svc (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll 12:16:05.0072 0216 dot3svc - ok 12:16:05.0088 0216 DPS (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll 12:16:05.0088 0216 DPS - ok 12:16:05.0119 0216 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 12:16:05.0119 0216 drmkaud - ok 12:16:05.0197 0216 DXGKrnl (ebce0b0924835f635f620d19f0529dce) C:\Windows\System32\drivers\dxgkrnl.sys 12:16:05.0213 0216 DXGKrnl - ok 12:16:05.0228 0216 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 12:16:05.0228 0216 EapHost - ok 12:16:05.0338 0216 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 12:16:05.0384 0216 ebdrv - ok 12:16:05.0462 0216 EFS (156f6159457d0aa7e59b62681b56eb90) C:\Windows\System32\lsass.exe 12:16:05.0462 0216 EFS - ok 12:16:05.0525 0216 ehRecvr (47c071994c3f649f23d9cd075ac9304a) C:\Windows\ehome\ehRecvr.exe 12:16:05.0525 0216 ehRecvr - ok 12:16:05.0540 0216 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 12:16:05.0540 0216 ehSched - ok 12:16:05.0587 0216 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 12:16:05.0587 0216 elxstor - ok 12:16:05.0634 0216 EPSON_PM_RPCV4_01 (cdca791afa0483f44bba576dbfafd04d) C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE 12:16:05.0634 0216 EPSON_PM_RPCV4_01 - ok 12:16:05.0650 0216 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys 12:16:05.0650 0216 ErrDev - ok 12:16:05.0681 0216 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 12:16:05.0681 0216 EventSystem - ok 12:16:05.0712 0216 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 12:16:05.0712 0216 exfat - ok 12:16:05.0728 0216 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 12:16:05.0728 0216 fastfat - ok 12:16:05.0759 0216 Fax (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe 12:16:05.0774 0216 Fax - ok 12:16:05.0806 0216 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 12:16:05.0806 0216 fdc - ok 12:16:05.0837 0216 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 12:16:05.0837 0216 fdPHost - ok 12:16:05.0837 0216 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 12:16:05.0837 0216 FDResPub - ok 12:16:05.0852 0216 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 12:16:05.0852 0216 FileInfo - ok 12:16:05.0852 0216 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 12:16:05.0868 0216 Filetrace - ok 12:16:05.0868 0216 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 12:16:05.0868 0216 flpydisk - ok 12:16:05.0884 0216 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys 12:16:05.0884 0216 FltMgr - ok 12:16:05.0977 0216 FontCache (cb5e4b9c319e3c6bb363eb7e58a4a051) C:\Windows\system32\FntCache.dll 12:16:05.0993 0216 FontCache - ok 12:16:06.0055 0216 FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 12:16:06.0055 0216 FontCache3.0.0.0 - ok 12:16:06.0086 0216 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 12:16:06.0086 0216 FsDepends - ok 12:16:06.0118 0216 Fs_Rec (d3e3f93d67821a2db2b3d9fac2dc2064) C:\Windows\system32\drivers\Fs_Rec.sys 12:16:06.0118 0216 Fs_Rec - ok 12:16:06.0149 0216 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys 12:16:06.0164 0216 fvevol - ok 12:16:06.0196 0216 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 12:16:06.0196 0216 gagp30kx - ok 12:16:06.0258 0216 GameConsoleService (d154305de6090e6e84e525f84bb08a06) C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe 12:16:06.0258 0216 GameConsoleService - ok 12:16:06.0305 0216 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 12:16:06.0305 0216 GEARAspiWDM - ok 12:16:06.0352 0216 gpsvc (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll 12:16:06.0352 0216 gpsvc - ok 12:16:06.0445 0216 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 12:16:06.0445 0216 gupdate - ok 12:16:06.0461 0216 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 12:16:06.0461 0216 gupdatem - ok 12:16:06.0508 0216 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe 12:16:06.0508 0216 gusvc - ok 12:16:06.0523 0216 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 12:16:06.0523 0216 hcw85cir - ok 12:16:06.0554 0216 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys 12:16:06.0554 0216 HdAudAddService - ok 12:16:06.0570 0216 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys 12:16:06.0586 0216 HDAudBus - ok 12:16:06.0601 0216 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 12:16:06.0601 0216 HidBatt - ok 12:16:06.0617 0216 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 12:16:06.0617 0216 HidBth - ok 12:16:06.0632 0216 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 12:16:06.0632 0216 HidIr - ok 12:16:06.0648 0216 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll 12:16:06.0648 0216 hidserv - ok 12:16:06.0664 0216 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys 12:16:06.0664 0216 HidUsb - ok 12:16:06.0664 0216 hkmsvc (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll 12:16:06.0679 0216 hkmsvc - ok 12:16:06.0695 0216 HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll 12:16:06.0695 0216 HomeGroupListener - ok 12:16:06.0726 0216 HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll 12:16:06.0726 0216 HomeGroupProvider - ok 12:16:06.0820 0216 HP Support Assistant Service (13bb1114451c63bfb41ba7daa4d70a29) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe 12:16:06.0820 0216 HP Support Assistant Service - ok 12:16:06.0866 0216 HPClientSvc (3dc11a802353401332d49c3cbfbbe5fc) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe 12:16:06.0866 0216 HPClientSvc - ok 12:16:06.0898 0216 HPDrvMntSvc.exe (bcc4a8b2e2e902f52e7f2e7d8e125765) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe 12:16:06.0898 0216 HPDrvMntSvc.exe - ok 12:16:06.0944 0216 hpqwmiex (ec9739a46f1f83c6e52a7a4697f44a65) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe 12:16:06.0960 0216 hpqwmiex - ok 12:16:07.0054 0216 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys 12:16:07.0054 0216 HpSAMD - ok 12:16:07.0116 0216 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys 12:16:07.0116 0216 HTTP - ok 12:16:07.0132 0216 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys 12:16:07.0132 0216 hwpolicy - ok 12:16:07.0147 0216 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys 12:16:07.0147 0216 i8042prt - ok 12:16:07.0194 0216 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys 12:16:07.0194 0216 iaStorV - ok 12:16:07.0272 0216 idsvc (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 12:16:07.0272 0216 idsvc - ok 12:16:07.0600 0216 igfx (2a22ab054f4630d2ef4bab2853f6d5f6) C:\Windows\system32\DRIVERS\igdkmd64.sys 12:16:07.0787 0216 igfx - ok 12:16:07.0834 0216 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 12:16:07.0834 0216 iirsp - ok 12:16:07.0865 0216 IKEEXT (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll 12:16:07.0880 0216 IKEEXT - ok 12:16:07.0896 0216 Impcd (dd587a55390ed2295bce6d36ad567da9) C:\Windows\system32\DRIVERS\Impcd.sys 12:16:07.0896 0216 Impcd - ok 12:16:07.0990 0216 IntcAzAudAddService (3c4b4ee54febb09f7e9f58776de96dca) C:\Windows\system32\drivers\RTKVHD64.sys 12:16:08.0036 0216 IntcAzAudAddService - ok 12:16:08.0083 0216 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys 12:16:08.0083 0216 intelide - ok 12:16:08.0099 0216 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 12:16:08.0099 0216 intelppm - ok 12:16:08.0146 0216 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 12:16:08.0161 0216 IPBusEnum - ok 12:16:08.0192 0216 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys 12:16:08.0192 0216 IpFilterDriver - ok 12:16:08.0224 0216 iphlpsvc (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll 12:16:08.0224 0216 iphlpsvc - ok 12:16:08.0255 0216 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys 12:16:08.0255 0216 IPMIDRV - ok 12:16:08.0286 0216 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 12:16:08.0286 0216 IPNAT - ok 12:16:08.0380 0216 iPod Service (46d249f9db7844cc01050a9345f0f61b) C:\Program Files\iPod\bin\iPodService.exe 12:16:08.0395 0216 iPod Service - ok 12:16:08.0411 0216 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 12:16:08.0411 0216 IRENUM - ok 12:16:08.0426 0216 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys 12:16:08.0426 0216 isapnp - ok 12:16:08.0442 0216 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys 12:16:08.0442 0216 iScsiPrt - ok 12:16:08.0489 0216 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys 12:16:08.0489 0216 kbdclass - ok 12:16:08.0489 0216 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys 12:16:08.0489 0216 kbdhid - ok 12:16:08.0536 0216 KeyIso (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 12:16:08.0536 0216 KeyIso - ok 12:16:08.0551 0216 KSecDD (16c1b906fc5ead84769f90b736b6bf0e) C:\Windows\system32\Drivers\ksecdd.sys 12:16:08.0551 0216 KSecDD - ok 12:16:08.0582 0216 KSecPkg (0b711550c56444879d71c7daabda6c83) C:\Windows\system32\Drivers\ksecpkg.sys 12:16:08.0582 0216 KSecPkg - ok 12:16:08.0582 0216 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 12:16:08.0582 0216 ksthunk - ok 12:16:08.0629 0216 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 12:16:08.0629 0216 KtmRm - ok 12:16:08.0692 0216 LanmanServer (81f1d04d4d0e433099365127375fd501) C:\Windows\system32\srvsvc.dll 12:16:08.0692 0216 LanmanServer - ok 12:16:08.0707 0216 LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll 12:16:08.0723 0216 LanmanWorkstation - ok 12:16:08.0770 0216 LightScribeService (7550d101bf49fdb1f92666a233ee36c4) c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe 12:16:08.0770 0216 LightScribeService - ok 12:16:08.0785 0216 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 12:16:08.0785 0216 lltdio - ok 12:16:08.0801 0216 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 12:16:08.0816 0216 lltdsvc - ok 12:16:08.0832 0216 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 12:16:08.0832 0216 lmhosts - ok 12:16:08.0848 0216 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 12:16:08.0848 0216 LSI_FC - ok 12:16:08.0863 0216 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 12:16:08.0863 0216 LSI_SAS - ok 12:16:08.0879 0216 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 12:16:08.0879 0216 LSI_SAS2 - ok 12:16:08.0910 0216 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 12:16:08.0910 0216 LSI_SCSI - ok 12:16:08.0910 0216 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 12:16:08.0910 0216 luafv - ok 12:16:08.0926 0216 Mcx2Svc (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll 12:16:08.0926 0216 Mcx2Svc - ok 12:16:08.0941 0216 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 12:16:08.0941 0216 megasas - ok 12:16:08.0972 0216 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 12:16:08.0972 0216 MegaSR - ok 12:16:09.0066 0216 Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe 12:16:09.0066 0216 Microsoft Office Groove Audit Service - ok 12:16:09.0082 0216 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 12:16:09.0097 0216 MMCSS - ok 12:16:09.0097 0216 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 12:16:09.0097 0216 Modem - ok 12:16:09.0113 0216 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 12:16:09.0113 0216 monitor - ok 12:16:09.0128 0216 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys 12:16:09.0128 0216 mouclass - ok 12:16:09.0128 0216 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 12:16:09.0128 0216 mouhid - ok 12:16:09.0144 0216 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys 12:16:09.0144 0216 mountmgr - ok 12:16:09.0191 0216 MpFilter (94c66ededcdb6a126880472f9a704d8e) C:\Windows\system32\DRIVERS\MpFilter.sys 12:16:09.0191 0216 MpFilter - ok 12:16:09.0206 0216 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys 12:16:09.0206 0216 mpio - ok 12:16:09.0222 0216 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 12:16:09.0222 0216 mpsdrv - ok 12:16:09.0253 0216 MpsSvc (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll 12:16:09.0269 0216 MpsSvc - ok 12:16:09.0284 0216 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys 12:16:09.0284 0216 MRxDAV - ok 12:16:09.0331 0216 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys 12:16:09.0331 0216 mrxsmb - ok 12:16:09.0362 0216 mrxsmb10 (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys 12:16:09.0362 0216 mrxsmb10 - ok 12:16:09.0378 0216 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys 12:16:09.0378 0216 mrxsmb20 - ok 12:16:09.0394 0216 msahci (2ba4ff3d5eb68587dd662a896f649c7d) C:\Windows\system32\DRIVERS\msahci.sys 12:16:09.0394 0216 msahci - ok 12:16:09.0425 0216 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys 12:16:09.0425 0216 msdsm - ok 12:16:09.0440 0216 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 12:16:09.0440 0216 MSDTC - ok 12:16:09.0456 0216 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 12:16:09.0456 0216 Msfs - ok 12:16:09.0472 0216 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 12:16:09.0472 0216 mshidkmdf - ok 12:16:09.0472 0216 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys 12:16:09.0472 0216 msisadrv - ok 12:16:09.0503 0216 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 12:16:09.0503 0216 MSiSCSI - ok 12:16:09.0503 0216 msiserver - ok 12:16:09.0518 0216 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 12:16:09.0518 0216 MSKSSRV - ok 12:16:09.0565 0216 MsMpSvc (59faaf2c83c8169ea20f9e335e418907) c:\Program Files\Microsoft Security Client\MsMpEng.exe 12:16:09.0581 0216 MsMpSvc - ok 12:16:09.0596 0216 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 12:16:09.0596 0216 MSPCLOCK - ok 12:16:09.0596 0216 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 12:16:09.0596 0216 MSPQM - ok 12:16:09.0628 0216 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys 12:16:09.0628 0216 MsRPC - ok 12:16:09.0628 0216 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys 12:16:09.0628 0216 mssmbios - ok 12:16:09.0643 0216 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 12:16:09.0643 0216 MSTEE - ok 12:16:09.0659 0216 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 12:16:09.0659 0216 MTConfig - ok 12:16:09.0690 0216 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 12:16:09.0690 0216 Mup - ok 12:16:09.0721 0216 napagent (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll 12:16:09.0721 0216 napagent - ok 12:16:09.0752 0216 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 12:16:09.0752 0216 NativeWifiP - ok 12:16:09.0799 0216 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys 12:16:09.0815 0216 NDIS - ok 12:16:09.0830 0216 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 12:16:09.0830 0216 NdisCap - ok 12:16:09.0862 0216 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 12:16:09.0862 0216 NdisTapi - ok 12:16:09.0862 0216 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys 12:16:09.0877 0216 Ndisuio - ok 12:16:09.0877 0216 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys 12:16:09.0877 0216 NdisWan - ok 12:16:09.0893 0216 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys 12:16:09.0893 0216 NDProxy - ok 12:16:09.0908 0216 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 12:16:09.0908 0216 NetBIOS - ok 12:16:09.0924 0216 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys 12:16:09.0924 0216 NetBT - ok 12:16:09.0940 0216 Netlogon (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 12:16:09.0955 0216 Netlogon - ok 12:16:09.0971 0216 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 12:16:09.0986 0216 Netman - ok 12:16:10.0002 0216 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 12:16:10.0002 0216 netprofm - ok 12:16:10.0049 0216 netr28x (1982b291df9833fb3adc397ebd310a18) C:\Windows\system32\DRIVERS\netr28x.sys 12:16:10.0064 0216 netr28x - ok 12:16:10.0111 0216 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 12:16:10.0111 0216 NetTcpPortSharing - ok 12:16:10.0158 0216 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 12:16:10.0158 0216 nfrd960 - ok 12:16:10.0220 0216 NisDrv (91b4e0273d2f6c24ef845f2b41311289) C:\Windows\system32\DRIVERS\NisDrvWFP.sys 12:16:10.0220 0216 NisDrv - ok 12:16:10.0283 0216 NisSrv (10a43829a9e606af3eef25a1c1665923) c:\Program Files\Microsoft Security Client\NisSrv.exe 12:16:10.0283 0216 NisSrv - ok 12:16:10.0314 0216 NlaSvc (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll 12:16:10.0330 0216 NlaSvc - ok 12:16:10.0423 0216 NOBU (5839a8027d6d324a7cd494051a96628c) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe 12:16:10.0470 0216 NOBU - ok 12:16:10.0532 0216 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 12:16:10.0532 0216 Npfs - ok 12:16:10.0532 0216 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 12:16:10.0548 0216 nsi - ok 12:16:10.0548 0216 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 12:16:10.0548 0216 nsiproxy - ok 12:16:10.0610 0216 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys 12:16:10.0642 0216 Ntfs - ok 12:16:10.0673 0216 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 12:16:10.0688 0216 Null - ok 12:16:10.0735 0216 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys 12:16:10.0751 0216 nvraid - ok 12:16:10.0782 0216 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys 12:16:10.0782 0216 nvstor - ok 12:16:10.0829 0216 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys 12:16:10.0829 0216 nv_agp - ok 12:16:10.0922 0216 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 12:16:10.0938 0216 odserv - ok 12:16:10.0954 0216 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys 12:16:10.0954 0216 ohci1394 - ok 12:16:11.0000 0216 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 12:16:11.0000 0216 ose - ok 12:16:11.0032 0216 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 12:16:11.0032 0216 p2pimsvc - ok 12:16:11.0047 0216 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 12:16:11.0063 0216 p2psvc - ok 12:16:11.0078 0216 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 12:16:11.0078 0216 Parport - ok 12:16:11.0110 0216 partmgr (90061b1acfe8ccaa5345750ffe08d8b8) C:\Windows\system32\drivers\partmgr.sys 12:16:11.0110 0216 partmgr - ok 12:16:11.0125 0216 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 12:16:11.0125 0216 PcaSvc - ok 12:16:11.0141 0216 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys 12:16:11.0141 0216 pci - ok 12:16:11.0156 0216 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys 12:16:11.0156 0216 pciide - ok 12:16:11.0172 0216 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 12:16:11.0172 0216 pcmcia - ok 12:16:11.0172 0216 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 12:16:11.0172 0216 pcw - ok 12:16:11.0188 0216 pdfcDispatcher - ok 12:16:11.0219 0216 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 12:16:11.0234 0216 PEAUTH - ok 12:16:11.0281 0216 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 12:16:11.0281 0216 PerfHost - ok 12:16:11.0328 0216 pla (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll 12:16:11.0359 0216 pla - ok 12:16:11.0390 0216 PlugPlay (98b1721b8718164293b9701b98c52d77) C:\Windows\system32\umpnpmgr.dll 12:16:11.0406 0216 PlugPlay - ok 12:16:11.0406 0216 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 12:16:11.0422 0216 PNRPAutoReg - ok 12:16:11.0437 0216 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 12:16:11.0437 0216 PNRPsvc - ok 12:16:11.0484 0216 PolicyAgent (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll 12:16:11.0484 0216 PolicyAgent - ok 12:16:11.0515 0216 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 12:16:11.0515 0216 Power - ok 12:16:11.0546 0216 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys 12:16:11.0546 0216 PptpMiniport - ok 12:16:11.0562 0216 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 12:16:11.0562 0216 Processor - ok 12:16:11.0578 0216 ProfSvc (f381975e1f4346de875cb07339ce8d3a) C:\Windows\system32\profsvc.dll 12:16:11.0578 0216 ProfSvc - ok 12:16:11.0593 0216 ProtectedStorage (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 12:16:11.0593 0216 ProtectedStorage - ok 12:16:11.0624 0216 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys 12:16:11.0624 0216 Psched - ok 12:16:11.0687 0216 PSI_SVC_2 (f036cfb275d0c55f4e45fbbf5f98b3c8) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe 12:16:11.0702 0216 PSI_SVC_2 - ok 12:16:11.0749 0216 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 12:16:11.0765 0216 ql2300 - ok 12:16:11.0827 0216 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 12:16:11.0827 0216 ql40xx - ok 12:16:11.0843 0216 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 12:16:11.0858 0216 QWAVE - ok 12:16:11.0858 0216 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 12:16:11.0858 0216 QWAVEdrv - ok 12:16:11.0874 0216 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 12:16:11.0874 0216 RasAcd - ok 12:16:11.0890 0216 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 12:16:11.0890 0216 RasAgileVpn - ok 12:16:11.0905 0216 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 12:16:11.0905 0216 RasAuto - ok 12:16:11.0921 0216 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys 12:16:11.0936 0216 Rasl2tp - ok 12:16:11.0952 0216 RasMan (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll 12:16:11.0952 0216 RasMan - ok 12:16:11.0968 0216 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 12:16:11.0968 0216 RasPppoe - ok 12:16:11.0968 0216 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 12:16:11.0968 0216 RasSstp - ok 12:16:12.0014 0216 rcmirror (96597c96d5acf4a3ef0b24d396853879) C:\Windows\system32\DRIVERS\rcmirror.sys 12:16:12.0014 0216 rcmirror - ok 12:16:12.0030 0216 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys 12:16:12.0046 0216 rdbss - ok 12:16:12.0061 0216 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 12:16:12.0061 0216 rdpbus - ok 12:16:12.0061 0216 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 12:16:12.0061 0216 RDPCDD - ok 12:16:12.0077 0216 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 12:16:12.0077 0216 RDPENCDD - ok 12:16:12.0092 0216 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 12:16:12.0092 0216 RDPREFMP - ok 12:16:12.0139 0216 RDPWD (074ac702d8b8b660b0e1371555995386) C:\Windows\system32\drivers\RDPWD.sys 12:16:12.0139 0216 RDPWD - ok 12:16:12.0155 0216 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys 12:16:12.0155 0216 rdyboost - ok 12:16:12.0186 0216 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 12:16:12.0186 0216 RemoteAccess - ok 12:16:12.0202 0216 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 12:16:12.0202 0216 RemoteRegistry - ok 12:16:12.0248 0216 RoxioNow Service (c1568e17039b2ec2b73a4f880ddd51e5) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe 12:16:12.0248 0216 RoxioNow Service - ok 12:16:12.0280 0216 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 12:16:12.0280 0216 RpcEptMapper - ok 12:16:12.0280 0216 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 12:16:12.0280 0216 RpcLocator - ok 12:16:12.0311 0216 RpcSs (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll 12:16:12.0311 0216 RpcSs - ok 12:16:12.0326 0216 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 12:16:12.0326 0216 rspndr - ok 12:16:12.0358 0216 RTL8167 (b15c021c2c9bb217a799d9532e8f04d4) C:\Windows\system32\DRIVERS\Rt64win7.sys 12:16:12.0358 0216 RTL8167 - ok 12:16:12.0389 0216 SamSs (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 12:16:12.0389 0216 SamSs - ok 12:16:12.0404 0216 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys 12:16:12.0404 0216 sbp2port - ok 12:16:12.0420 0216 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 12:16:12.0436 0216 SCardSvr - ok 12:16:12.0436 0216 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys 12:16:12.0436 0216 scfilter - ok 12:16:12.0482 0216 Schedule (624d0f5ff99428bb90a5b8a4123e918e) C:\Windows\system32\schedsvc.dll 12:16:12.0514 0216 Schedule - ok 12:16:12.0529 0216 SCPolicySvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll 12:16:12.0529 0216 SCPolicySvc - ok 12:16:12.0545 0216 SDRSVC (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll 12:16:12.0545 0216 SDRSVC - ok 12:16:12.0576 0216 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 12:16:12.0576 0216 secdrv - ok 12:16:12.0576 0216 seclogon (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll 12:16:12.0576 0216 seclogon - ok 12:16:12.0592 0216 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll 12:16:12.0592 0216 SENS - ok 12:16:12.0623 0216 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 12:16:12.0623 0216 SensrSvc - ok 12:16:12.0638 0216 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 12:16:12.0638 0216 Serenum - ok 12:16:12.0654 0216 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 12:16:12.0654 0216 Serial - ok 12:16:12.0670 0216 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 12:16:12.0670 0216 sermouse - ok 12:16:12.0701 0216 SessionEnv (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll 12:16:12.0701 0216 SessionEnv - ok 12:16:12.0701 0216 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys 12:16:12.0701 0216 sffdisk - ok 12:16:12.0716 0216 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys 12:16:12.0716 0216 sffp_mmc - ok 12:16:12.0748 0216 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys 12:16:12.0748 0216 sffp_sd - ok 12:16:12.0748 0216 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 12:16:12.0748 0216 sfloppy - ok 12:16:12.0779 0216 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll 12:16:12.0779 0216 SharedAccess - ok 12:16:12.0810 0216 ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll 12:16:12.0810 0216 ShellHWDetection - ok 12:16:12.0826 0216 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 12:16:12.0826 0216 SiSRaid2 - ok 12:16:12.0841 0216 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 12:16:12.0841 0216 SiSRaid4 - ok 12:16:12.0857 0216 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 12:16:12.0857 0216 Smb - ok 12:16:12.0872 0216 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 12:16:12.0872 0216 SNMPTRAP - ok 12:16:12.0888 0216 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 12:16:12.0888 0216 spldr - ok 12:16:12.0904 0216 Spooler (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\Windows\System32\spoolsv.exe 12:16:12.0904 0216 Spooler - ok 12:16:13.0044 0216 sppsvc (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe 12:16:13.0106 0216 sppsvc - ok 12:16:13.0184 0216 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 12:16:13.0184 0216 sppuinotify - ok 12:16:13.0247 0216 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys 12:16:13.0247 0216 srv - ok 12:16:13.0294 0216 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys 12:16:13.0294 0216 srv2 - ok 12:16:13.0325 0216 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys 12:16:13.0325 0216 srvnet - ok 12:16:13.0340 0216 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 12:16:13.0356 0216 SSDPSRV - ok 12:16:13.0372 0216 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 12:16:13.0372 0216 SstpSvc - ok 12:16:13.0372 0216 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 12:16:13.0372 0216 stexstor - ok 12:16:13.0418 0216 stisvc (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll 12:16:13.0418 0216 stisvc - ok 12:16:13.0434 0216 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys 12:16:13.0434 0216 swenum - ok 12:16:13.0450 0216 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 12:16:13.0450 0216 swprv - ok 12:16:13.0512 0216 Symantec RemoteAssist (267c914667c94e5f47d342311c1c577f) C:\Program Files (x86)\Common Files\Symantec Shared\Support Controls\ssrc.exe 12:16:13.0512 0216 Symantec RemoteAssist - ok 12:16:13.0606 0216 SysMain (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll 12:16:13.0652 0216 SysMain - ok 12:16:13.0933 0216 TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll 12:16:13.0933 0216 TabletInputService - ok 12:16:13.0964 0216 TapiSrv (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll 12:16:13.0980 0216 TapiSrv - ok 12:16:13.0996 0216 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 12:16:13.0996 0216 TBS - ok 12:16:14.0120 0216 Tcpip (624c5b3aa4c99b3184bb922d9ece3ff0) C:\Windows\system32\drivers\tcpip.sys 12:16:14.0152 0216 Tcpip - ok 12:16:14.0261 0216 TCPIP6 (624c5b3aa4c99b3184bb922d9ece3ff0) C:\Windows\system32\DRIVERS\tcpip.sys 12:16:14.0261 0216 TCPIP6 - ok 12:16:14.0339 0216 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys 12:16:14.0339 0216 tcpipreg - ok 12:16:14.0354 0216 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 12:16:14.0354 0216 TDPIPE - ok 12:16:14.0386 0216 TDTCP (7518f7bcfd4b308abc9192bacaf6c970) C:\Windows\system32\drivers\tdtcp.sys 12:16:14.0386 0216 TDTCP - ok 12:16:14.0401 0216 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys 12:16:14.0401 0216 tdx - ok 12:16:14.0401 0216 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys 12:16:14.0401 0216 TermDD - ok 12:16:14.0432 0216 TermService (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll 12:16:14.0448 0216 TermService - ok 12:16:14.0464 0216 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 12:16:14.0464 0216 Themes - ok 12:16:14.0479 0216 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 12:16:14.0479 0216 THREADORDER - ok 12:16:14.0510 0216 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 12:16:14.0510 0216 TrkWks - ok 12:16:14.0557 0216 TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe 12:16:14.0557 0216 TrustedInstaller - ok 12:16:14.0573 0216 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys 12:16:14.0573 0216 tssecsrv - ok 12:16:14.0588 0216 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys 12:16:14.0588 0216 tunnel - ok 12:16:14.0604 0216 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 12:16:14.0620 0216 uagp35 - ok 12:16:14.0635 0216 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys 12:16:14.0651 0216 udfs - ok 12:16:14.0666 0216 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 12:16:14.0666 0216 UI0Detect - ok 12:16:14.0682 0216 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys 12:16:14.0682 0216 uliagpkx - ok 12:16:14.0682 0216 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys 12:16:14.0682 0216 umbus - ok 12:16:14.0698 0216 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 12:16:14.0698 0216 UmPass - ok 12:16:14.0729 0216 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 12:16:14.0729 0216 upnphost - ok 12:16:14.0776 0216 USBAAPL64 (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys 12:16:14.0776 0216 USBAAPL64 - ok 12:16:14.0822 0216 usbccgp (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys 12:16:14.0822 0216 usbccgp - ok 12:16:14.0854 0216 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys 12:16:14.0854 0216 usbcir - ok 12:16:14.0885 0216 usbehci (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\DRIVERS\usbehci.sys 12:16:14.0885 0216 usbehci - ok 12:16:14.0900 0216 usbhub (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys 12:16:14.0916 0216 usbhub - ok 12:16:14.0932 0216 usbohci (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\drivers\usbohci.sys 12:16:14.0932 0216 usbohci - ok 12:16:14.0963 0216 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 12:16:14.0963 0216 usbprint - ok 12:16:14.0994 0216 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys 12:16:14.0994 0216 usbscan - ok 12:16:15.0025 0216 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS 12:16:15.0025 0216 USBSTOR - ok 12:16:15.0041 0216 usbuhci (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\DRIVERS\usbuhci.sys 12:16:15.0041 0216 usbuhci - ok 12:16:15.0056 0216 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 12:16:15.0056 0216 UxSms - ok 12:16:15.0088 0216 VaultSvc (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 12:16:15.0088 0216 VaultSvc - ok 12:16:15.0088 0216 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys 12:16:15.0088 0216 vdrvroot - ok 12:16:15.0119 0216 vds (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe 12:16:15.0119 0216 vds - ok 12:16:15.0134 0216 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 12:16:15.0134 0216 vga - ok 12:16:15.0134 0216 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 12:16:15.0134 0216 VgaSave - ok 12:16:15.0150 0216 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys 12:16:15.0166 0216 vhdmp - ok 12:16:15.0166 0216 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys 12:16:15.0166 0216 viaide - ok 12:16:15.0181 0216 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys 12:16:15.0181 0216 volmgr - ok 12:16:15.0197 0216 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys 12:16:15.0212 0216 volmgrx - ok 12:16:15.0212 0216 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys 12:16:15.0212 0216 volsnap - ok 12:16:15.0244 0216 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 12:16:15.0244 0216 vsmraid - ok 12:16:15.0322 0216 VSS (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe 12:16:15.0384 0216 VSS - ok 12:16:15.0478 0216 vToolbarUpdater11.1.0 (5fa45791413acce628d5361458f32dde) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe 12:16:15.0493 0216 vToolbarUpdater11.1.0 - ok 12:16:15.0540 0216 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys 12:16:15.0540 0216 vwifibus - ok 12:16:15.0556 0216 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys 12:16:15.0556 0216 vwififlt - ok 12:16:15.0587 0216 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 12:16:15.0587 0216 W32Time - ok 12:16:15.0602 0216 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 12:16:15.0602 0216 WacomPen - ok 12:16:15.0618 0216 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 12:16:15.0618 0216 WANARP - ok 12:16:15.0618 0216 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 12:16:15.0618 0216 Wanarpv6 - ok 12:16:15.0696 0216 wanatw (eceb715bece47e101ddec06b11126066) C:\Windows\system32\DRIVERS\wanatw64.sys 12:16:15.0696 0216 wanatw - ok 12:16:15.0790 0216 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe 12:16:15.0805 0216 WatAdminSvc - ok 12:16:15.0868 0216 wbengine (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe 12:16:15.0899 0216 wbengine - ok 12:16:15.0961 0216 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 12:16:15.0961 0216 WbioSrvc - ok 12:16:16.0008 0216 wcncsvc (dd1bae8ebfc653824d29ccf8c9054d68) C:\Windows\System32\wcncsvc.dll 12:16:16.0008 0216 wcncsvc - ok 12:16:16.0024 0216 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 12:16:16.0024 0216 WcsPlugInService - ok 12:16:16.0039 0216 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 12:16:16.0039 0216 Wd - ok 12:16:16.0070 0216 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 12:16:16.0070 0216 Wdf01000 - ok 12:16:16.0086 0216 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 12:16:16.0086 0216 WdiServiceHost - ok 12:16:16.0102 0216 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 12:16:16.0102 0216 WdiSystemHost - ok 12:16:16.0133 0216 WebClient (733006127f235be7c35354ebee7b9a7b) C:\Windows\System32\webclnt.dll 12:16:16.0133 0216 WebClient - ok 12:16:16.0148 0216 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 12:16:16.0148 0216 Wecsvc - ok 12:16:16.0164 0216 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 12:16:16.0164 0216 wercplsupport - ok 12:16:16.0211 0216 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 12:16:16.0226 0216 WerSvc - ok 12:16:16.0273 0216 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 12:16:16.0273 0216 WfpLwf - ok 12:16:16.0289 0216 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 12:16:16.0289 0216 WIMMount - ok 12:16:16.0320 0216 WinDefend - ok 12:16:16.0336 0216 WinHttpAutoProxySvc - ok 12:16:16.0367 0216 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 12:16:16.0367 0216 Winmgmt - ok 12:16:16.0445 0216 WinRM (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll 12:16:16.0476 0216 WinRM - ok 12:16:16.0554 0216 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys 12:16:16.0554 0216 WinUsb - ok 12:16:16.0585 0216 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 12:16:16.0601 0216 Wlansvc - ok 12:16:16.0694 0216 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 12:16:16.0741 0216 wlidsvc - ok 12:16:16.0788 0216 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys 12:16:16.0788 0216 WmiAcpi - ok 12:16:16.0804 0216 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 12:16:16.0819 0216 wmiApSrv - ok 12:16:16.0819 0216 WMPNetworkSvc - ok 12:16:16.0835 0216 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 12:16:16.0835 0216 WPCSvc - ok 12:16:16.0835 0216 WPDBusEnum (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll 12:16:16.0835 0216 WPDBusEnum - ok 12:16:16.0850 0216 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 12:16:16.0850 0216 ws2ifsl - ok 12:16:16.0882 0216 wscsvc (8f9f3969933c02da96eb0f84576db43e) C:\Windows\System32\wscsvc.dll 12:16:16.0882 0216 wscsvc - ok 12:16:16.0897 0216 WSearch - ok 12:16:16.0975 0216 wuauserv (38340204a2d0228f1e87740fc5e554a7) C:\Windows\system32\wuaueng.dll 12:16:17.0022 0216 wuauserv - ok 12:16:17.0069 0216 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys 12:16:17.0084 0216 WudfPf - ok 12:16:17.0084 0216 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys 12:16:17.0084 0216 WUDFRd - ok 12:16:17.0100 0216 wudfsvc (b551d6637aa0e132c18ac6e504f7b79b) C:\Windows\System32\WUDFSvc.dll 12:16:17.0116 0216 wudfsvc - ok 12:16:17.0116 0216 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 12:16:17.0131 0216 WwanSvc - ok 12:16:17.0147 0216 MBR (0x1B8) (1a27293bce0d09a656bb590caf33579b) \Device\Harddisk0\DR0 12:16:17.0334 0216 \Device\Harddisk0\DR0 - ok 12:16:17.0334 0216 MBR (0x1B8) (8464d19686910a2e5d0e5c28c70a95ab) \Device\Harddisk1\DR1 12:16:17.0786 0216 \Device\Harddisk1\DR1 - ok 12:16:17.0802 0216 Boot (0x1200) (3082dc9b20e5535e4941a588efe4ed24) \Device\Harddisk0\DR0\Partition0 12:16:17.0802 0216 \Device\Harddisk0\DR0\Partition0 - ok 12:16:17.0802 0216 Boot (0x1200) (6625d81485f4771b8874d44f14f92913) \Device\Harddisk0\DR0\Partition1 12:16:17.0818 0216 \Device\Harddisk0\DR0\Partition1 - ok 12:16:17.0833 0216 Boot (0x1200) (4e567a98c0e4635cfe044f4941e9cdbb) \Device\Harddisk0\DR0\Partition2 12:16:17.0833 0216 \Device\Harddisk0\DR0\Partition2 - ok 12:16:17.0849 0216 Boot (0x1200) (4b64a948f71cc0a3657a80a83f5efb33) \Device\Harddisk1\DR1\Partition0 12:16:17.0849 0216 \Device\Harddisk1\DR1\Partition0 - ok 12:16:17.0849 0216 ============================================================ 12:16:17.0849 0216 Scan finished 12:16:17.0849 0216 ============================================================ 12:16:17.0864 4984 Detected object count: 1 12:16:17.0864 4984 Actual detected object count: 1 12:16:48.0394 4984 c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll - copied to quarantine 12:16:48.0877 4984 HKLM\SYSTEM\ControlSet001\services\Akamai - will be deleted on reboot 12:16:48.0893 4984 HKLM\SYSTEM\ControlSet002\services\Akamai - will be deleted on reboot 12:16:49.0049 4984 c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll - will be deleted on reboot 12:16:49.0049 4984 Akamai ( HiddenFile.Multi.Generic ) - User select action: Delete 12:16:59.0002 5128 Deinitialize success Combo Fix Log: ComboFix 12-05-19.01 - Karp Family 05/19/2012 12:47:33.2.2 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.4061.2456 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6} SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . —- Previous Run ——- . c:\programdata\7ADE953A07.sys c:\programdata\Microsoft Private Data\Microsoft\t.id C:\Thumbs.db c:\users\Download\04071902\04071900.JPG c:\users\Download\04071902\04071901.JPG c:\users\Download\04071902\04071902.JPG c:\users\Download\04081702\04081700.JPG c:\users\Download\04081702\04081701.JPG c:\users\Download\04081702\04081702.JPG c:\windows\iun6002.exe . . ((((((((((((((((((((((((( Files Created from 2012-04-19 to 2012-05-19 ))))))))))))))))))))))))))))))) . . 2012-05-19 18:17 . 2012-05-19 18:18 ——– d—–w- C:\FRST 2012-05-19 16:56 . 2012-05-19 16:56 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-05-19 16:16 . 2012-05-19 16:16 ——– d—–w- C:\TDSSKiller_Quarantine 2012-05-19 14:05 . 2012-05-19 14:05 419488 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-05-19 08:19 . 2012-05-08 17:02 8955792 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8CAB824C-6986-4EA9-8B60-2F50A6F0034B}\mpengine.dll 2012-05-18 08:18 . 2012-05-08 17:02 8955792 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-05-16 14:41 . 2012-05-16 14:41 ——– d—–w- c:\program files (x86)\Advanced System Protector 2012-05-16 14:41 . 2012-05-16 14:41 ——– d—–w- c:\programdata\Systweak 2012-05-16 14:41 . 2008-11-21 04:08 16896 —-a-w- c:\windows\system32\sasnative64.exe 2012-05-16 14:41 . 2012-05-19 16:45 ——– d—–w- c:\users\Karp Family\AppData\Roaming\Systweak 2012-05-16 14:41 . 2012-03-30 16:14 18816 —-a-w- c:\windows\system32\roboot64.exe 2012-05-16 14:33 . 2012-05-16 14:33 ——– d—–w- c:\users\Karp Family\AppData\Local\AVG Secure Search 2012-05-16 14:33 . 2012-05-16 16:57 ——– d—–w- c:\programdata\AVG Secure Search 2012-05-16 14:33 . 2012-05-16 14:33 ——– d—–w- c:\program files (x86)\Common Files\AVG Secure Search 2012-05-16 14:33 . 2012-05-16 14:33 ——– d—–w- c:\program files (x86)\AVG Secure Search 2012-05-13 17:10 . 2012-05-13 17:10 ——– d—–w- c:\users\Karp Family\AppData\Local\Amazon 2012-05-12 13:01 . 2012-05-12 13:02 ——– d—–w- C:\Archived 2012-05-10 20:12 . 2012-05-10 20:12 ——– d—–w- c:\program files (x86)\Disney 2012-05-10 19:34 . 2012-03-03 06:29 1541120 —-a-w- c:\windows\system32\DWrite.dll 2012-05-10 19:34 . 2012-03-03 06:29 1837568 —-a-w- c:\windows\system32\d3d10warp.dll 2012-05-10 19:34 . 2012-03-03 05:40 1170944 —-a-w- c:\windows\SysWow64\d3d10warp.dll 2012-05-10 19:34 . 2012-03-03 06:29 320512 —-a-w- c:\windows\system32\d3d10_1core.dll 2012-05-10 19:34 . 2012-03-03 06:29 197120 —-a-w- c:\windows\system32\d3d10_1.dll 2012-05-10 19:34 . 2012-03-03 06:29 902656 —-a-w- c:\windows\system32\d2d1.dll 2012-05-10 19:34 . 2012-03-03 05:40 1074176 —-a-w- c:\windows\SysWow64\DWrite.dll 2012-05-10 19:34 . 2012-03-03 05:40 739840 —-a-w- c:\windows\SysWow64\d2d1.dll 2012-05-10 19:34 . 2012-03-03 05:40 218624 —-a-w- c:\windows\SysWow64\d3d10_1core.dll 2012-05-10 19:34 . 2012-03-03 05:40 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll 2012-05-10 19:34 . 2012-04-02 05:34 5504880 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-10 19:33 . 2012-04-02 03:01 3143680 —-a-w- c:\windows\system32\win32k.sys 2012-05-10 19:33 . 2012-04-02 04:46 3958128 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-10 19:33 . 2012-04-02 04:46 3902320 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-05-10 19:33 . 2012-03-17 07:55 75632 —-a-w- c:\windows\system32\drivers\partmgr.sys 2012-05-10 19:33 . 2012-03-30 11:09 1895280 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-05-10 19:33 . 2012-04-02 05:26 1732096 —-a-w- c:\program files\Windows Journal\NBDoc.DLL 2012-05-10 19:33 . 2012-04-02 05:24 1367552 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2012-05-10 19:33 . 2012-04-02 04:40 936960 —-a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2012-05-10 19:33 . 2012-04-02 05:24 1402880 —-a-w- c:\program files\Windows Journal\JNWDRV.dll 2012-05-10 19:33 . 2012-04-02 05:24 1393664 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll 2012-05-10 01:39 . 2012-05-10 01:39 ——– d—–w- c:\users\Karp Family\AppData\Local\ElevatedDiagnostics 2012-05-10 01:39 . 2012-05-10 01:39 ——– d—–w- c:\users\Karp Family\AppData\Local\Diagnostics 2012-05-01 07:00 . 2012-05-01 07:01 ——– d—–w- c:\program files (x86)\Microsoft Security Client . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-05-19 14:05 . 2011-05-26 13:24 70304 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-05-17 00:29 . 2011-02-17 12:21 6580 –sha-w- c:\programdata\KGyGaAvL.sys 2012-03-21 00:44 . 2011-04-27 19:25 98688 —-a-w- c:\windows\system32\drivers\NisDrvWFP.sys 2012-03-21 00:44 . 2011-04-18 17:18 203888 —-a-w- c:\windows\system32\drivers\MpFilter.sys 2012-03-05 14:59 . 2012-03-05 14:59 162664 —-a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10140.bin 2012-03-01 06:54 . 2012-04-11 07:00 22896 —-a-w- c:\windows\system32\drivers\fs_rec.sys 2012-03-01 06:45 . 2012-04-11 07:00 220672 —-a-w- c:\windows\system32\wintrust.dll 2012-03-01 06:40 . 2012-04-11 07:00 80896 —-a-w- c:\windows\system32\imagehlp.dll 2012-03-01 06:35 . 2012-04-11 07:00 5120 —-a-w- c:\windows\system32\wmi.dll 2012-03-01 05:49 . 2012-04-11 07:00 172544 —-a-w- c:\windows\SysWow64\wintrust.dll 2012-03-01 05:45 . 2012-04-11 07:00 158720 —-a-w- c:\windows\SysWow64\imagehlp.dll 2012-03-01 05:40 . 2012-04-11 07:00 5120 —-a-w- c:\windows\SysWow64\wmi.dll 2012-02-28 06:35 . 2012-04-11 02:35 1197568 —-a-w- c:\windows\system32\wininet.dll 2012-02-28 06:33 . 2012-04-11 02:35 57856 —-a-w- c:\windows\system32\licmgr10.dll 2012-02-28 05:40 . 2012-04-11 02:35 981504 —-a-w- c:\windows\SysWow64\wininet.dll 2012-02-28 05:38 . 2012-04-11 02:35 44544 —-a-w- c:\windows\SysWow64\licmgr10.dll 2012-02-28 05:17 . 2012-04-11 02:35 482816 —-a-w- c:\windows\system32\html.iec 2012-02-28 04:35 . 2012-04-11 02:35 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2012-02-28 04:31 . 2012-04-11 02:35 386048 —-a-w- c:\windows\SysWow64\html.iec 2012-02-28 03:57 . 2012-04-11 02:35 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-05-16 14:33 2068536 —-a-w- c:\program files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll" [2012-05-16 2068536] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green] @="{95A27763-F62A-4114-9072-E81D87DE3B68}" [HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}] 2011-03-04 00:52 762000 —-a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial] @="{E300CD91-100F-4E67-9AF3-1384A6124015}" [HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}] 2011-03-04 00:52 762000 —-a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow] @="{5E529433-B50E-4bef-A63B-16A6B71B071A}" [HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}] 2011-03-04 00:52 762000 —-a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Akamai NetSession Interface"="c:\users\Karp Family\AppData\Local\Akamai\netsession_win.exe" [2012-03-13 3331872] "Corel Photo Downloader"="c:\program files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2010-07-28 526992] "AOL Fast Start"="c:\program files (x86)\AOL Desktop 9.6\AOL.EXE" [2011-01-13 42320] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576] "PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2010-09-28 664600] "Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928] "Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568] "QuickFinder Scheduler"="c:\program files (x86)\Corel\WordPerfect Office X5\Programs\QFSCHD150.EXE" [2010-10-26 136600] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "HostManager"="c:\program files (x86)\Common Files\AOL\1298466898\ee\AOLSoftware.exe" [2010-03-08 41800] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888] "Carbonite Backup"="c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe" [2011-03-04 948880] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736] "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-05-16 1104440] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Event Planner Reminder 2010.lnk - c:\windows\Installer\{601BE80D-247B-4084-94C7-7A54369DB7A2}\Shortcut_EventPlan_E2FBA8F7F7FD4C5EAA7D652BB0CAAA9D.exe [2011-3-5 341328] Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-9-28 1040952] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-17 136176] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-17 136176] R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696] R3 rcmirror;rcmirror;c:\windows\system32\DRIVERS\rcmirror.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072] S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264] S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x] S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2010-09-28 1119768] S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-09-11 399344] S2 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe [2012-05-16 935480] S3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x] S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] Akamai REG_MULTI_SZ Akamai . Contents of the 'Scheduled Tasks' folder . 2012-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-17 03:26] . 2012-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-17 03:26] . 2012-05-09 c:\windows\Tasks\HPCeeScheduleForKarp Family.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15] . 2012-04-20 c:\windows\Tasks\HPCeeScheduleForKARPFAMILY-HP$.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green] @="{95A27763-F62A-4114-9072-E81D87DE3B68}" [HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}] 2011-03-04 00:36 1174672 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial] @="{E300CD91-100F-4E67-9AF3-1384A6124015}" [HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}] 2011-03-04 00:36 1174672 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow] @="{5E529433-B50E-4bef-A63B-16A6B71B071A}" [HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}] 2011-03-04 00:36 1174672 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-07 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-07 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-07 413208] "SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-09-15 611896] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local;127.0.0.1:9421; IE: Open with WordPerfect - c:\program files (x86)\Corel\WordPerfect Office X5\Programs\WPLauncher.hta TCP: DhcpNameServer = 192.168.1.1 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll DPF: {75A6AEA3-F26E-4608-AE9B-8DA78C87576E} - hxxps://kingsisle.hs.llnwd.net/e1/static/themes/wizard101A/activex/Wizard101GameLauncher.CAB . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKCU-Run-TomTomHOME.exe - c:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe Wow6432Node-HKLM-Run-Corel File Shell Monitor - c:\program files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe Wow6432Node-HKLM-Run-Advanced System Protector - (no file) SafeBoot-13228242.sys WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher] "ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\programdata\EPSON\EPW!3 SSRP\E_S30RP1.EXE c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe c:\program files (x86)\Advanced System Protector\advancedsystemprotector.exe c:\program files (x86)\AOL Desktop 9.6\waol.exe c:\program files (x86)\Common Files\AOL\ACS\AOLAcsd.exe c:\program files (x86)\AOL Desktop 9.6\shellmon.exe . ************************************************************************** . Completion time: 2012-05-19 13:16:30 - machine was rebooted ComboFix-quarantined-files.txt 2012-05-19 17:16 . Pre-Run: 724,704,780,288 bytes free Post-Run: 724,242,722,816 bytes free . - - End Of File - - 8F04902D32467CF134A202FD90595BBA Thanks!

CatByte

Post #7May 19, 2012, 5:56 PM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

DDS::
uInternet Settings,ProxyOverride = *.local;127.0.0.1:9421;

ClearJavaCache::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix may request an update; please allow it.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan completes, press the LIST OF THREATS FOUND button
Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
Include the contents of this report in your next reply.
Press the BACK button.
Press Finish

NEXT

Please advise how the computer is running now and if there are any outstanding issues

pamelak

Post #8May 20, 2012, 3:27 AM UTC

Combo fix Log:
ComboFix 12-05-19.02 - Karp Family 05/19/2012 16:34:27.3.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.4061.2762 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Karp Family\Desktop\CFscript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-04-19 to 2012-05-19 )))))))))))))))))))))))))))))))
.
.
2012-05-19 20:41 . 2012-05-19 20:41 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-05-19 18:17 . 2012-05-19 18:18 ——– d—–w- C:\FRST
2012-05-19 17:17 . 2012-05-08 17:02 8955792 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{91FBD0D6-8D1A-42EB-8393-FC20858F9489}\mpengine.dll
2012-05-19 16:16 . 2012-05-19 16:16 ——– d—–w- C:\TDSSKiller_Quarantine
2012-05-19 14:05 . 2012-05-19 14:05 419488 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-18 08:18 . 2012-05-08 17:02 8955792 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-05-16 14:41 . 2012-05-16 14:41 ——– d—–w- c:\program files (x86)\Advanced System Protector
2012-05-16 14:41 . 2012-05-16 14:41 ——– d—–w- c:\programdata\Systweak
2012-05-16 14:41 . 2008-11-21 04:08 16896 —-a-w- c:\windows\system32\sasnative64.exe
2012-05-16 14:41 . 2012-05-19 16:45 ——– d—–w- c:\users\Karp Family\AppData\Roaming\Systweak
2012-05-16 14:41 . 2012-03-30 16:14 18816 —-a-w- c:\windows\system32\roboot64.exe
2012-05-16 14:33 . 2012-05-16 14:33 ——– d—–w- c:\users\Karp Family\AppData\Local\AVG Secure Search
2012-05-16 14:33 . 2012-05-16 16:57 ——– d—–w- c:\programdata\AVG Secure Search
2012-05-16 14:33 . 2012-05-16 14:33 ——– d—–w- c:\program files (x86)\Common Files\AVG Secure Search
2012-05-16 14:33 . 2012-05-16 14:33 ——– d—–w- c:\program files (x86)\AVG Secure Search
2012-05-13 17:10 . 2012-05-13 17:10 ——– d—–w- c:\users\Karp Family\AppData\Local\Amazon
2012-05-12 13:01 . 2012-05-12 13:02 ——– d—–w- C:\Archived
2012-05-10 20:12 . 2012-05-10 20:12 ——– d—–w- c:\program files (x86)\Disney
2012-05-10 19:34 . 2012-03-03 06:29 1541120 —-a-w- c:\windows\system32\DWrite.dll
2012-05-10 19:34 . 2012-03-03 06:29 1837568 —-a-w- c:\windows\system32\d3d10warp.dll
2012-05-10 19:34 . 2012-03-03 05:40 1170944 —-a-w- c:\windows\SysWow64\d3d10warp.dll
2012-05-10 19:34 . 2012-03-03 06:29 320512 —-a-w- c:\windows\system32\d3d10_1core.dll
2012-05-10 19:34 . 2012-03-03 06:29 197120 —-a-w- c:\windows\system32\d3d10_1.dll
2012-05-10 19:34 . 2012-03-03 06:29 902656 —-a-w- c:\windows\system32\d2d1.dll
2012-05-10 19:34 . 2012-03-03 05:40 1074176 —-a-w- c:\windows\SysWow64\DWrite.dll
2012-05-10 19:34 . 2012-03-03 05:40 739840 —-a-w- c:\windows\SysWow64\d2d1.dll
2012-05-10 19:34 . 2012-03-03 05:40 218624 —-a-w- c:\windows\SysWow64\d3d10_1core.dll
2012-05-10 19:34 . 2012-03-03 05:40 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll
2012-05-10 19:34 . 2012-04-02 05:34 5504880 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-05-10 19:33 . 2012-04-02 03:01 3143680 —-a-w- c:\windows\system32\win32k.sys
2012-05-10 19:33 . 2012-04-02 04:46 3958128 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-05-10 19:33 . 2012-04-02 04:46 3902320 —-a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-05-10 19:33 . 2012-03-17 07:55 75632 —-a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-10 19:33 . 2012-03-30 11:09 1895280 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-10 19:33 . 2012-04-02 05:26 1732096 —-a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-05-10 19:33 . 2012-04-02 05:24 1367552 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-10 19:33 . 2012-04-02 04:40 936960 —-a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-10 19:33 . 2012-04-02 05:24 1402880 —-a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-05-10 19:33 . 2012-04-02 05:24 1393664 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-05-10 01:39 . 2012-05-10 01:39 ——– d—–w- c:\users\Karp Family\AppData\Local\ElevatedDiagnostics
2012-05-10 01:39 . 2012-05-10 01:39 ——– d—–w- c:\users\Karp Family\AppData\Local\Diagnostics
2012-05-01 07:00 . 2012-05-01 07:01 ——– d—–w- c:\program files (x86)\Microsoft Security Client
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-19 14:05 . 2011-05-26 13:24 70304 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-17 00:29 . 2011-02-17 12:21 6580 –sha-w- c:\programdata\KGyGaAvL.sys
2012-03-21 00:44 . 2011-04-27 19:25 98688 —-a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-03-21 00:44 . 2011-04-18 17:18 203888 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2012-03-05 14:59 . 2012-03-05 14:59 162664 —-a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10140.bin
2012-03-01 06:54 . 2012-04-11 07:00 22896 —-a-w- c:\windows\system32\drivers\fs_rec.sys
2012-03-01 06:45 . 2012-04-11 07:00 220672 —-a-w- c:\windows\system32\wintrust.dll
2012-03-01 06:40 . 2012-04-11 07:00 80896 —-a-w- c:\windows\system32\imagehlp.dll
2012-03-01 06:35 . 2012-04-11 07:00 5120 —-a-w- c:\windows\system32\wmi.dll
2012-03-01 05:49 . 2012-04-11 07:00 172544 —-a-w- c:\windows\SysWow64\wintrust.dll
2012-03-01 05:45 . 2012-04-11 07:00 158720 —-a-w- c:\windows\SysWow64\imagehlp.dll
2012-03-01 05:40 . 2012-04-11 07:00 5120 —-a-w- c:\windows\SysWow64\wmi.dll
2012-02-28 06:35 . 2012-04-11 02:35 1197568 —-a-w- c:\windows\system32\wininet.dll
2012-02-28 06:33 . 2012-04-11 02:35 57856 —-a-w- c:\windows\system32\licmgr10.dll
2012-02-28 05:40 . 2012-04-11 02:35 981504 —-a-w- c:\windows\SysWow64\wininet.dll
2012-02-28 05:38 . 2012-04-11 02:35 44544 —-a-w- c:\windows\SysWow64\licmgr10.dll
2012-02-28 05:17 . 2012-04-11 02:35 482816 —-a-w- c:\windows\system32\html.iec
2012-02-28 04:35 . 2012-04-11 02:35 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2012-02-28 04:31 . 2012-04-11 02:35 386048 —-a-w- c:\windows\SysWow64\html.iec
2012-02-28 03:57 . 2012-04-11 02:35 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb
.
.
((((((((((((((((((((((((((((( SnapShot@2012-05-19_17.00.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2012-05-19 17:00 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-05-19 16:19 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-05-19 17:00 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-05-19 16:19 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-05-19 16:19 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-05-19 17:00 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-16 03:35 . 2012-05-19 17:01 33938 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-05-19 17:01 41164 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2011-02-16 06:30 . 2012-05-19 16:39 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-16 06:30 . 2012-05-19 16:57 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-16 06:30 . 2012-05-19 16:39 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-02-16 06:30 . 2012-05-19 16:57 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-05-19 16:39 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-05-19 16:57 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-02-16 03:33 . 2012-05-19 16:59 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-16 03:33 . 2012-05-19 20:44 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-02-16 03:33 . 2012-05-19 20:44 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-02-16 03:33 . 2012-05-19 16:59 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-02-16 03:33 . 2012-05-19 16:59 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-16 03:33 . 2012-05-19 20:44 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-16 03:33 . 2012-05-19 20:45 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-16 03:33 . 2012-05-19 16:59 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-02-16 03:33 . 2012-05-19 16:59 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-02-16 03:33 . 2012-05-19 20:45 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2012-05-19 16:57 . 2012-05-19 16:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-05-19 20:43 . 2012-05-19 20:43 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-05-19 16:57 . 2012-05-19 16:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-05-19 20:43 . 2012-05-19 20:43 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-02-16 11:05 . 2012-05-19 20:28 328528 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
- 2009-07-14 02:36 . 2012-05-19 16:46 626290 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-05-19 17:04 626290 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-05-19 16:46 107566 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2012-05-19 17:04 107566 c:\windows\system32\perfc009.dat
- 2009-07-14 05:01 . 2012-05-19 16:56 462164 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-05-19 20:42 462164 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-02-16 12:03 . 2012-05-19 20:42 1815668 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2731395502-1286736164-1658964139-1001-8192.dat
- 2011-02-16 12:03 . 2012-05-19 16:56 1815668 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2731395502-1286736164-1658964139-1001-8192.dat
- 2009-07-14 02:34 . 2012-05-19 16:54 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2012-05-19 17:11 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-05-16 14:33 2068536 —-a-w- c:\program files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll" [2012-05-16 2068536]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2011-03-04 00:52 762000 —-a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2011-03-04 00:52 762000 —-a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2011-03-04 00:52 762000 —-a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"="c:\users\Karp Family\AppData\Local\Akamai\netsession_win.exe" [2012-03-13 3331872]
"Corel Photo Downloader"="c:\program files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2010-07-28 526992]
"AOL Fast Start"="c:\program files (x86)\AOL Desktop 9.6\AOL.EXE" [2011-01-13 42320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2010-09-28 664600]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"QuickFinder Scheduler"="c:\program files (x86)\Corel\WordPerfect Office X5\Programs\QFSCHD150.EXE" [2010-10-26 136600]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"HostManager"="c:\program files (x86)\Common Files\AOL\1298466898\ee\AOLSoftware.exe" [2010-03-08 41800]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"Carbonite Backup"="c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe" [2011-03-04 948880]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-05-16 1104440]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Event Planner Reminder 2010.lnk - c:\windows\Installer\{601BE80D-247B-4084-94C7-7A54369DB7A2}\Shortcut_EventPlan_E2FBA8F7F7FD4C5EAA7D652BB0CAAA9D.exe [2011-3-5 341328]
Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-9-28 1040952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-17 136176]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-17 136176]
R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 rcmirror;rcmirror;c:\windows\system32\DRIVERS\rcmirror.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2010-09-28 1119768]
S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-09-11 399344]
S2 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe [2012-05-16 935480]
S3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-17 03:26]
.
2012-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-17 03:26]
.
2012-05-09 c:\windows\Tasks\HPCeeScheduleForKarp Family.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]
.
2012-04-20 c:\windows\Tasks\HPCeeScheduleForKARPFAMILY-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2011-03-04 00:36 1174672 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2011-03-04 00:36 1174672 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2011-03-04 00:36 1174672 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-05-07 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-05-07 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-05-07 413208]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-09-15 611896]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride =
IE: Open with WordPerfect - c:\program files (x86)\Corel\WordPerfect Office X5\Programs\WPLauncher.hta
TCP: DhcpNameServer = 192.168.1.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll
DPF: {75A6AEA3-F26E-4608-AE9B-8DA78C87576E} - hxxps://kingsisle.hs.llnwd.net/e1/static/themes/wizard101A/activex/Wizard101GameLauncher.CAB
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\programdata\EPSON\EPW!3 SSRP\E_S30RP1.EXE
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Advanced System Protector\advancedsystemprotector.exe
.
**************************************************************************
.
Completion time: 2012-05-19 16:57:00 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-19 20:56
ComboFix2.txt 2012-05-19 17:16
.
Pre-Run: 724,840,472,576 bytes free
Post-Run: 724,431,273,984 bytes free
.
- - End Of File - - 4E995A559A3AFF293D179669A3D159CD

Malware Log:
Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.05.19.06

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Karp Family :: KARPFAMILY-HP [administrator]

Protection: Enabled

5/19/2012 5:04:21 PM
mbam-log-2012-05-19 (17-04-21).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 232132
Time elapsed: 3 minute(s), 8 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Esetscan Log:
C:\Documents and Settings\Karp Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KEM6VP52\oi_ExplorerPlusEvalexe[1].exe a variant of Win32/OpenInstall application
C:\Program Files (x86)\RealArcade\Installer\GameHouse-Installer_am-robinsquestalegendborn_gamehouse_.exe Win32/OpenCandy application

OK unfortunately the windows search is still not working

Thanks!
Pam

CatByte

Post #9May 20, 2012, 3:39 AM UTC

unfortunately the windows search is still not working

It doesn't appear to be malware related

did you try the "Hotfix"?

try rebuilding the index again as well as the hot fix

It seems to be a common issue

http://www.intowindows.com/how-to-fix-wind…earch-problems/

let me know if that helps

CatByte

Post #10June 8, 2012, 2:15 AM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Windlows Explorer Search Malfunction [Closed]

✨ Ask AI

Ask AI