Infected with malware despite corporate managed officeScan

I'm getting adtext in all webpages and my search results are often being redirected to pages that i didn't search for. for example, walmart.com & at&t take me to ad click landing pages when i go to them from google search results.

This computer has corporate managed Office Scan installed. Boo !

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:32:35 PM, on 5/16/2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16968)
Boot mode: Normal

Running processes:
C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files (x86)\Digital Line Detect\DLG.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\SysWOW64\rundll32.exe
C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Altiris\Altiris Agent\AeXAgentUIHost.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\Notepad++\notepad++.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\Trillian\trillian.exe
C:\Program Files (x86)\Password Safe\pwsafe.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\ooVoo\ooVoo.exe
C:\Windows\Downloaded Program Files\TunnelServer.exe
C:\windows\SysWOW64\rundll32.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\windows\SysWOW64\rundll32.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\JSmith\Desktop\apps\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Cengage Learning
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HttpWatch Basic - {F1F69322-008F-4895-B2BF-AD194219825A} - C:\Program Files (x86)\HttpWatch\httpwatchsc.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files (x86)\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Communicator] "C:\Program Files (x86)\Microsoft Office Communicator\communicator.exe" /fromrunkey
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HttpWatch_RegIEPlugin] C:\Program Files (x86)\HttpWatch\regieplugin.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [AeXAgentLogon] C:\Program Files (x86)\Altiris\Altiris Agent\AeXAgentActivate.exe /logon
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\JSmith\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ooVoo.exe] C:\Program Files (x86)\ooVoo\ooVoo.exe /minimized
O4 - HKCU\..\Run: [ElevatedDiagnostics] rundll32.exe "C:\Users\JSmith\AppData\Local\Google\ElevatedDiagnostics\kkjdsstku.dll",DllRegisterServer
O4 - HKCU\..\RunOnce: [] cmd.exe /c rd /s /q "C:\Users\JSmith\AppData\Local\Temp\joi12C2.tmp"
O4 - HKCU\..\RunOnce: [join.me_joi5F09.tmp_cleanup] cmd.exe /c del /f /q "C:\Users\JSmith\AppData\Local\Temp\joi5F09.tmp_cleanup.bat"
O4 - HKCU\..\RunOnce: [join.me_joi3E92.tmp_cleanup] cmd.exe /c del /f /q "C:\Users\JSmith\AppData\Local\Temp\joi3E92.tmp_cleanup.bat"
O4 - HKCU\..\RunOnce: [join.me_joiFF1E.tmp_cleanup] cmd.exe /c del /f /q "C:\Users\JSmith\AppData\Local\Temp\joiFF1E.tmp_cleanup.bat"
O4 - HKCU\..\RunOnce: [join.me_joi12C2.tmp_cleanup] cmd.exe /c del /f /q "C:\Users\JSmith\AppData\Local\Temp\joi12C2.tmp_cleanup.bat"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [ElevatedDiagnostics] rundll32.exe "C:\Users\JSmith\AppData\Local\Google\ElevatedDiagnostics\kkjdsstku.dll",DllRegisterServer (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Samsung.PCSync] "C:\Program Files (x86)\Samsung\Samsung PC Studio 7\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Samsung.PCSync] "C:\Program Files (x86)\Samsung\Samsung PC Studio 7\PcSync2.exe" /NoDialog (User 'Default user')
O4 - .DEFAULT User Startup: SetTaskbar.vbs (User 'Default user')
O4 - Startup: Dropbox.lnk = C:\Users\JSmith\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: Password Safe.lnk = C:\Program Files (x86)\Password Safe\pwsafe.exe
O4 - Startup: Trillian.lnk = C:\Program Files (x86)\Trillian\trillian.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files (x86)\Digital Line Detect\DLG.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: HttpWatch Basic - res://C:\Program Files (x86)\HttpWatch\httpwatch.dll/1351
O9 - Extra button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra 'Tools' menuitem: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra button: HttpWatch Basic - {D103E85B-5D67-42c1-8C83-F01079DBAB26} - C:\Program Files (x86)\HttpWatch\httpwatch.dll
O9 - Extra 'Tools' menuitem: HttpWatch Basic - {D103E85B-5D67-42c1-8C83-F01079DBAB26} - C:\Program Files (x86)\HttpWatch\httpwatch.dll
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - (no file)
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - (no file)
O15 - Trusted Zone: http://access.cengage.com
O15 - Trusted Zone: http://magellan.cengage.com
O15 - Trusted Zone: http://magellantest.cengage.com
O15 - Trusted Zone: http://OHCINTESTW7348.OHCINTESTW7348
O15 - Trusted Zone: http://*.OHCINTESTW7348
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - https://ohcincorpav01.corp.local:4343/offic…ll/WinNTChk.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupINICtrl Class) - https://cabelav01:4343/officescan/console/h…ll/setupini.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - https://cabelav01:4343/officescan/console/h…stall/setup.cab
O16 - DPF: {195538FD-1C39-44B1-A7C3-5D7137A8A8F1} (OPSWAT AntiViruses Class) - https://access.cengage.com/vdesk/terminal/f…0,2012,419,1901
O16 - DPF: {2BCDB465-81F9-41CB-832C-8037A4064446} (F5 Networks VPN Manager) - https://access.cengage.com/vdesk/terminal/u…1,2011,623,1635
O16 - DPF: {30CF9713-6614-4556-B5F5-66F8C7F9DEF1} (OPSWAT FireWalls Class) - https://access.cengage.com/vdesk/terminal/f…0,2012,419,1901
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - https://ohcincorpav01.corp.local:4343/offic…root/AtxEnc.cab
O16 - DPF: {41EF3CD2-D8CC-4438-84B1-280BB4E77C8E} (F5 Networks Dynamic Application Tunnel Control) - https://access.cengage.com/vdesk/terminal/f…1,2011,623,1629
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} (F5 Networks Auto Update) - https://access.cengage.com/vdesk/terminal/I…,2011,0623,1633
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.5.7.cab
O16 - DPF: {49EC7987-E331-44E3-B170-748B58A268B9} (OPSWAT ProcessesScanner Class) - https://access.cengage.com/vdesk/terminal/f…0,2012,419,1901
O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} (F5 Networks Policy Agent Host Class) - https://access.cengage.com/vdesk/terminal/f…,2011,0623,1617
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - https://ohcincorpav01.corp.local:4343/offic…/RemoveCtrl.cab
O16 - DPF: {831FB9D5-7704-46BE-B4AE-BD946EE97F4C} (Siebel Email Support for Microsoft Outlook and Lotus Notes) - http://magellan.cengage.com/sales_enu/2043…tBound_mail.cab
O16 - DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} (Siebel Desktop Integration) - http://magellan.cengage.com/sales_enu/2043…Integration.cab
O16 - DPF: {A62585A1-D5ED-4505-9A71-0268DD51982C} (Siebel High Interactivity Framework) - http://magellan.cengage.com/sales_enu/2043…x_HI_Client.cab
O16 - DPF: {CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7} (F5 Networks SuperHost Class) - https://access.cengage.com/vdesk/terminal/u…1,2011,623,1625
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://aplia.webex.com/client/T27L/webex/ieatgpc1.cab
O16 - DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} (F5 Networks Host Control) - https://access.cengage.com/vdesk/terminal/u…1,2011,623,1620
O16 - DPF: {E16AD7BB-6189-4C16-985A-7314EF875AC8} (Siebel Calendar) - http://magellan.cengage.com/sales_enu/2043…Ax_Calendar.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} (F5 Networks OS Policy Agent) - https://access.cengage.com/policy/download_…,2011,0623,1628
O16 - DPF: {E734BF43-7194-4E3A-832F-307606DDF665} (Unyte Conferencing Plugin) - https://ash-cs6.conferenceservers.com/compo…ts/WDPLUGIN.CAB
O16 - DPF: {EBDC91CB-F23F-477D-B152-3F7243760D04} (F5 Networks OPSWAT Helper Control) - https://access.cengage.com/vdesk/terminal/f…0,2012,419,1901
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corp.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = corp.local
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Symantec Management Agent (AeXNSClient) - Symantec Corporation - C:\Program Files (x86)\Altiris\Altiris Agent\AeXNSAgent.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: AltirisAgentProvider - Altiris, Inc. - C:\Program Files (x86)\Altiris\Altiris Agent\Agents\WMIProviderAgent\AltirisAgentProvider.exe
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel® Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Auto Scroll (Lenovo.VIRTSCRLSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NMSAccess - Unknown owner - C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
O23 - Service: OfficeScan NT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: Power Manager DBC Service - Lenovo - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files (x86)\Common Files\New Boundary\PrismXL\PrismXL.sys
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Cisco EnergyWise Enabler (PwmEWSvc) - Lenovo Group Limited - C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: System Update (SUService) - Lenovo Group Limited - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: OfficeScan NT Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPfw.exe
O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmProxy.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 23016 bytes

Hello and

My name is patndoris. I will be glad to take a look at your log and help you with solving any malware problems. It will be very helpful if you follow these guidelines:

• Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
• Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
• Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• Please follow my instructions carefully and in the order they are posted. You may also find it helpful to print out the instructions you receive.
• Please do not run any scans or install/uninstall any applications or delete anything without being directed to do so.
• Remember, absence of symptoms does not mean the infection is all gone. Please stick with me till you're given the "all clear".
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
• Please reply within 3 days. If I do not hear back from you in that time frame, I will post a reminder for you. Topics with no reply in 4 days are closed!

HijackThis has largely been replaced by other tools. Since being acquired by TrendMicro, HijackThis has not been regularly updated. Many infections are now able to hide partly, or completely from a HijackThis scan. DDS includes all the scan locations of HijackThis and more.



Download and Run DDS by sUBs

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Save both reports to your desktop.

—————————————————

Please Please copy / paste the scan reults.

DDS.txt and Attach.txt






Please read carefully and follow these steps. There is a difference between what you see in one of the images below and what I need you to do.
We are only creating a log - I do NOT want you to "cure" or try to fix anything in this step. It is very important that you don't choose Cure when presented with that option.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure but I want you to choose SKIP instead , click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

. DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.4.1 Run by [removed] at 11:38:48 on 2012-05-23 Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8088.2909 [GMT -7:00] . AV: Trend Micro OfficeScan Antivirus *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902} SP: Trend Micro OfficeScan Anti-spyware *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Trend Micro Personal Firewall *Enabled* {50C2E989-60CF-0845-AFD3-290B7D301E79} . ============== Running Processes =============== . C:\windows\system32\wininit.exe C:\windows\system32\lsm.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\ibmpmsvc.exe C:\windows\system32\svchost.exe -k RPCSS C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\windows\system32\svchost.exe -k LocalService C:\windows\system32\svchost.exe -k NetworkService C:\windows\system32\WLANExt.exe C:\windows\system32\conhost.exe C:\windows\System32\spoolsv.exe C:\windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe C:\windows\system32\svchost.exe -k apphost C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe C:\Program Files\Intel\WiFi\bin\EvtEng.exe C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\windows\SysWOW64\svchost.exe -k hpdevmgmt C:\windows\system32\svchost.exe -k HsfXAudioService C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\Microsoft LifeCam\MSCamS64.exe C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\sqlservr.exe C:\windows\System32\svchost.exe -k HPZ12 C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrtscan.exe C:\windows\System32\svchost.exe -k HPZ12 C:\Program Files (x86)\Common Files\New Boundary\PrismXL\PrismXL.sys C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\windows\system32\svchost.exe -k imgsvc C:\Program Files\IIS\Microsoft Web Farm Framework\WebFarmService.exe C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe C:\windows\system32\taskhost.exe C:\windows\system32\Dwm.exe C:\windows\Explorer.EXE C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\windows\system32\wbem\unsecapp.exe C:\windows\system32\wbem\wmiprvse.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE C:\windows\system32\conhost.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files (x86)\Digital Line Detect\DLG.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Trend Micro\OfficeScan Client\PccNTMon.exe C:\windows\system32\rundll32.exe C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe C:\windows\system32\igfxext.exe C:\windows\system32\igfxsrvc.exe C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe C:\Users\JSmith\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\Program Files (x86)\Password Safe\pwsafe.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files\iPod\bin\iPodService.exe C:\windows\system32\SearchIndexer.exe C:\windows\system32\svchost.exe -k HPService C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPfw.exe C:\windows\system32\svchost.exe -k bthsvcs C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE C:\Program Files (x86)\Trend Micro\OfficeScan Client\CNTAoSMgr.exe C:\windows\system32\conhost.exe C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmProxy.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\windows\system32\sppsvc.exe C:\Program Files (x86)\Lenovo\System Update\SUService.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\windows\SysWOW64\rundll32.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Notepad++\notepad++.exe C:\windows\splwow64.exe C:\Windows\system32\PrintIsolationHost.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\windows\system32\conhost.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\Downloaded Program Files\TunnelServer.exe C:\windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\JSmith\AppData\Local\Google\Chrome\Application\chrome.exe C:\windows\system32\taskeng.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\windows\SysWOW64\cmd.exe C:\windows\system32\conhost.exe C:\windows\SysWOW64\cscript.exe C:\windows\system32\DllHost.exe C:\windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uSearch Bar = Preserve uWindow Title = Internet Explorer provided by Cengage Learning uStart Page = www.google.com uDefault_Page_URL = www.google.com mWinlogon: Userinit=userinit.exe BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: {53707962-6F74-2D53-2644-206D7942484F} - No File BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll BHO: HttpWatch Basic: {f1f69322-008f-4895-b2bf-ad194219825a} - C:\Program Files (x86)\HttpWatch\httpwatchsc.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll EB: HttpWatch Basic: {2b4c4770-27fd-4a09-b17d-33ca580965fb} - C:\Program Files (x86)\HttpWatch\httpwatch.dll uRun: [Google Update] "C:\Users\JSmith\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRun: [ooVoo.exe] C:\Program Files (x86)\ooVoo\ooVoo.exe /minimized mRun: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor mRun: [OfficeScanNT Monitor] "C:\Program Files (x86)\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow mRun: [Communicator] "C:\Program Files (x86)\Microsoft Office Communicator\communicator.exe" /fromrunkey mRun: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe mRun: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe mRun: [HttpWatch_RegIEPlugin] C:\Program Files (x86)\HttpWatch\regieplugin.exe mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray mRun: [AeXAgentLogon] C:\Program Files (x86)\Altiris\Altiris Agent\AeXAgentActivate.exe /logon mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" dRun: [Samsung.PCSync] "C:\Program Files (x86)\Samsung\Samsung PC Studio 7\PcSync2.exe" /NoDialog dRun: [ElevatedDiagnostics] rundll32.exe "C:\Users\JSmith\AppData\Local\Google\ElevatedDiagnostics\kkjdsstku.dll",DllRegisterServer StartupFolder: C:\Users\JSmith\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\JSmith\AppData\Roaming\Dropbox\bin\Dropbox.exe StartupFolder: C:\Users\JSmith\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\PASSWO~1.LNK - C:\Program Files (x86)\Password Safe\pwsafe.exe StartupFolder: C:\Users\JSmith\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Trillian.lnk - C:\Program Files (x86)\Trillian\trillian.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DIGITA~1.LNK - C:\Program Files (x86)\Digital Line Detect\DLG.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL IE: {D103E85B-5D67-42c1-8C83-F01079DBAB26} - {2B4C4770-27FD-4A09-B17D-33CA580965FB} - C:\Program Files (x86)\HttpWatch\httpwatch.dll IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} Trusted Zone: cengage.com\access Trusted Zone: cengage.com\magellan Trusted Zone: cengage.com\magellantest Trusted Zone: concursolutions.com\www Trusted Zone: OHCINTESTW7348 Trusted Zone: OHCINTESTW7348\OHCINTESTW7348 DPF: {00134F72-5284-44F7-95A8-52A619F70751} - hxxps://ohcincorpav01.corp.local:4343/officescan/console/html/ClientInstall/WinNTChk.cab DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} - hxxps://cabelav01:4343/officescan/console/html/ClientInstall/setupini.cab DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} - hxxps://cabelav01:4343/officescan/console/html/ClientInstall/setup.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {195538FD-1C39-44B1-A7C3-5D7137A8A8F1} - hxxps://access.cengage.com/vdesk/terminal/f5opswati.cab#Version=7060,2012,419,1901 DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {2BCDB465-81F9-41CB-832C-8037A4064446} - hxxps://access.cengage.com/vdesk/terminal/urxvpn.cab#version=6031,2011,623,1635 DPF: {30CF9713-6614-4556-B5F5-66F8C7F9DEF1} - hxxps://access.cengage.com/vdesk/terminal/f5opswati.cab#Version=7060,2012,419,1901 DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} - hxxps://ohcincorpav01.corp.local:4343/officescan/console/html/root/AtxEnc.cab DPF: {41EF3CD2-D8CC-4438-84B1-280BB4E77C8E} - hxxps://access.cengage.com/vdesk/terminal/f5tunsrv.cab#version=6031,2011,623,1629 DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} - C:\Users\JSmith\AppData\Local\Temp\IXP000.TMP\InstallerControl.cab DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab DPF: {49EC7987-E331-44E3-B170-748B58A268B9} - hxxps://access.cengage.com/vdesk/terminal/f5opswati.cab#Version=7060,2012,419,1901 DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} - hxxps://access.cengage.com/vdesk/terminal/f5InspectionHost.cab#version=6031,2011,0623,1617 DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} - hxxps://ohcincorpav01.corp.local:4343/officescan/console/html/ClientInstall/RemoveCtrl.cab DPF: {831FB9D5-7704-46BE-B4AE-BD946EE97F4C} - hxxp://magellan.cengage.com/sales_enu/20433/applets/SiebelAx_OutBound_mail.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - hxxp://magellan.cengage.com/sales_enu/20433/applets/SiebelAx_Desktop_Integration.cab DPF: {A62585A1-D5ED-4505-9A71-0268DD51982C} - hxxp://magellan.cengage.com/sales_enu/20433/applets/SiebelAx_HI_Client.cab DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7} - hxxps://access.cengage.com/vdesk/terminal/urxshost.cab#version=6031,2011,623,1625 DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://aplia.webex.com/client/T27L/webex/ieatgpc1.cab DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} - hxxps://access.cengage.com/vdesk/terminal/urxhost.cab#version=6031,2011,623,1620 DPF: {E16AD7BB-6189-4C16-985A-7314EF875AC8} - hxxp://magellan.cengage.com/sales_enu/20433/applets/SiebelAx_Calendar.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} - hxxps://access.cengage.com/policy/download_binary.php/win32/f5syschk.cab#Version=6031,2011,0623,1628 DPF: {E734BF43-7194-4E3A-832F-307606DDF665} - hxxps://ash-cs6.conferenceservers.com/components/WDPLUGIN.CAB DPF: {EBDC91CB-F23F-477D-B152-3F7243760D04} - hxxps://access.cengage.com/vdesk/terminal/f5opswati.cab#Version=7060,2012,419,1901 TCP: DhcpNameServer = 192.168.0.1 TCP: Interfaces\{1865EE0F-6EA1-4CB7-9629-BEA19B1DFF31} : DhcpNameServer = 10.160.3.179 192.168.0.1 TCP: Interfaces\{2159D11E-EC43-404E-B87B-7F98366ECA25} : DhcpNameServer = 10.166.64.18 10.166.64.19 TCP: Interfaces\{31989556-5E0B-4F96-933C-10D40BABB4DC} : NameServer = 10.160.3.179 10.160.3.180 TCP: Interfaces\{A810647F-E53C-4750-B206-49357A355B4B} : DhcpNameServer = 192.168.0.1 TCP: Interfaces\{A810647F-E53C-4750-B206-49357A355B4B}\3414353424C414E47445F4E4D2D413 : DhcpNameServer = 10.0.2.1 TCP: Interfaces\{A810647F-E53C-4750-B206-49357A355B4B}\34C475942533C43342421212 : DhcpNameServer = 10.166.64.18 10.166.64.19 10.160.3.179 TCP: Interfaces\{D90229F2-1565-4EBA-B61F-894664660AF3} : DhcpNameServer = 192.168.0.1 TCP: Interfaces\{F3C1C0EB-3DA9-4232-A10C-45EA5BCEC2C1} : DhcpNameServer = 192.168.0.1 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO-X64: 0x1 - No File BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO-X64: HP Print Enhancer - No File BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: {53707962-6F74-2D53-2644-206D7942484F} - No File BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO-X64: SkypeIEPluginBHO - No File BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll BHO-X64: HttpWatch Basic: {F1F69322-008F-4895-B2BF-AD194219825A} - C:\Program Files (x86)\HttpWatch\httpwatchsc.dll BHO-X64: HttpWatch Basic - No File BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll BHO-X64: HP Smart BHO Class - No File EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File EB-X64: {2B4C4770-27FD-4A09-B17D-33CA580965FB} - No File mRun-x64: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor mRun-x64: [OfficeScanNT Monitor] "C:\Program Files (x86)\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow mRun-x64: [Communicator] "C:\Program Files (x86)\Microsoft Office Communicator\communicator.exe" /fromrunkey mRun-x64: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" mRun-x64: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin mRun-x64: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe mRun-x64: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe mRun-x64: [HttpWatch_RegIEPlugin] C:\Program Files (x86)\HttpWatch\regieplugin.exe mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray mRun-x64: [AeXAgentLogon] C:\Program Files (x86)\Altiris\Altiris Agent\AeXAgentActivate.exe /logon mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" IE-X64: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files (x86)\Fiddler2\Fiddler.exe" Hosts: 127.0.0.1 www.spywareinfo.com Hosts: 69.32.128.200 access.cengage.com #ADDED BY F5 NETWORKS SSL TUNNEL - ORIGINAL RECORD# Hosts: 69.32.128.200 access #ADDED BY F5 NETWORKS SSL TUNNEL - ORIGINAL RECORD# ================= FIREFOX =================== . FF - ProfilePath - C:\Users\JSmith\AppData\Roaming\Mozilla\Firefox\Profiles\c7qjzvzk.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Common Files\Wolfram Research\Browser\8.0.1.2063897\npmathplugin.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npatgpc.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll FF - plugin: C:\Program Files (x86)\Photosynth\npPhotosynthMozilla.dll FF - plugin: c:\Program Files\Microsoft Silverlight\2.0.40115.0\npctrl.dll FF - plugin: c:\Program Files\Microsoft Silverlight\3.0.40624.0\npctrl.dll FF - plugin: c:\Program Files\Microsoft Silverlight\3.0.40818.0\npctrl.dll FF - plugin: c:\Program Files\Microsoft Silverlight\3.0.50106.0\npctrl.dll FF - plugin: c:\Program Files\Microsoft Silverlight\3.0.50611.0\npctrl.dll FF - plugin: c:\Program Files\Microsoft Silverlight\4.0.50524.0\npctrl.dll FF - plugin: C:\Program Files\Microsoft\Web Platform Installer\NPWPIDetector.dll FF - plugin: C:\Users\JSmith\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Users\JSmith\AppData\Roaming\Mozilla\Firefox\Profiles\c7qjzvzk.default\extensions\{DBBB3167-6E81-400f-BBFD-BD8921726F52}\plugins\NPuroamHost.dll FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll FF - plugin: C:\windows\SysWOW64\npDeployJava1.dll FF - plugin: C:\windows\SysWOW64\npmproxy.dll . ============= SERVICES / DRIVERS =============== . R0 DzHDD64;DzHDD64;C:\windows\system32\DRIVERS\DzHDD64.sys –> C:\windows\system32\DRIVERS\DzHDD64.sys [?] R1 lenovo.smi;Lenovo System Interface Driver;C:\windows\system32\DRIVERS\smiifx64.sys –> C:\windows\system32\DRIVERS\smiifx64.sys [?] R1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;C:\windows\system32\DRIVERS\tmlwf.sys –> C:\windows\system32\DRIVERS\tmlwf.sys [?] R2 TmFilter;Trend Micro Filter;C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmxpflt.sys [2010-10-20 342288] R2 TmPreFilter;Trend Micro PreFilter;C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmpreflt.sys [2010-10-20 42768] R2 tmwfp;Trend Micro WFP Callout Driver;C:\windows\system32\DRIVERS\tmwfp.sys –> C:\windows\system32\DRIVERS\tmwfp.sys [?] R3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;C:\windows\system32\DRIVERS\AMPPAL.sys –> C:\windows\system32\DRIVERS\AMPPAL.sys [?] R3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;C:\windows\system32\Drivers\ATSwpWDF.sys –> C:\windows\system32\Drivers\ATSwpWDF.sys [?] R3 btusbflt;Bluetooth USB Filter;C:\windows\system32\drivers\btusbflt.sys –> C:\windows\system32\drivers\btusbflt.sys [?] R3 CAXHWAZL;CAXHWAZL;C:\windows\system32\DRIVERS\CAXHWAZL.sys –> C:\windows\system32\DRIVERS\CAXHWAZL.sys [?] R3 e1yexpress;Intel® Gigabit Network Connections Driver;C:\windows\system32\DRIVERS\e1y62x64.sys –> C:\windows\system32\DRIVERS\e1y62x64.sys [?] R3 HECIx64;Intel® Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys –> C:\windows\system32\DRIVERS\HECIx64.sys [?] R3 MBAMProtector;MBAMProtector;\??\C:\windows\system32\drivers\mbam.sys –> C:\windows\system32\drivers\mbam.sys [?] R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;C:\windows\system32\Drivers\nx6000.sys –> C:\windows\system32\Drivers\nx6000.sys [?] R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\windows\system32\DRIVERS\NETwNs64.sys –> C:\windows\system32\DRIVERS\NETwNs64.sys [?] S3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;C:\windows\system32\DRIVERS\amppal.sys –> C:\windows\system32\DRIVERS\amppal.sys [?] S3 cpudrv64;cpudrv64;C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [2009-12-18 17864] S3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;C:\windows\system32\DRIVERS\e1k62x64.sys –> C:\windows\system32\DRIVERS\e1k62x64.sys [?] S3 ioatdma1;ioatdma1;C:\windows\system32\Drivers\qd162x64.sys –> C:\windows\system32\Drivers\qd162x64.sys [?] S3 ioatdma2;Intel® QuickData Technology device ver.2;C:\windows\system32\Drivers\qd262x64.sys –> C:\windows\system32\Drivers\qd262x64.sys [?] S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\windows\system32\DRIVERS\NETw5s64.sys –> C:\windows\system32\DRIVERS\NETw5s64.sys [?] S3 SrvHsfHDA;SrvHsfHDA;C:\windows\system32\DRIVERS\VSTAZL6.SYS –> C:\windows\system32\DRIVERS\VSTAZL6.SYS [?] S3 SrvHsfV92;SrvHsfV92;C:\windows\system32\DRIVERS\VSTDPV6.SYS –> C:\windows\system32\DRIVERS\VSTDPV6.SYS [?] S3 SrvHsfWinac;SrvHsfWinac;C:\windows\system32\DRIVERS\VSTCNXT6.SYS –> C:\windows\system32\DRIVERS\VSTCNXT6.SYS [?] S4 RsFx0105;RsFx0105 Driver;C:\windows\system32\DRIVERS\RsFx0105.sys –> C:\windows\system32\DRIVERS\RsFx0105.sys [?] S4 RsFx0151;RsFx0151 Driver;C:\windows\system32\DRIVERS\RsFx0151.sys –> C:\windows\system32\DRIVERS\RsFx0151.sys [?] . =============== Created Last 30 ================ . 2012-05-21 16:37:15 18512 —-a-w- C:\windows\System32\drivers\urfltv64.sys 2012-05-18 22:04:10 ——– d—–w- C:\ProgramData\VS 2012-05-18 21:11:16 77312 —-a-w- C:\windows\System32\rdpwsx.dll 2012-05-18 21:11:16 149504 —-a-w- C:\windows\System32\rdpcorekmts.dll 2012-05-18 19:46:35 ——– d–h–w- C:\ProgramData\CanonIJFAX 2012-05-18 19:46:30 88576 —-a-w- C:\windows\System32\Spool\prtprocs\x64\CNMPPAN.DLL 2012-05-18 19:46:30 29696 —-a-w- C:\windows\System32\Spool\prtprocs\x64\CNMPDAN.DLL 2012-05-18 19:46:27 302080 —-a-w- C:\windows\System32\CNCALAN.DLL 2012-05-18 19:46:23 374784 —-a-w- C:\windows\System32\CNMLMAN.DLL 2012-05-18 00:12:04 ——– d—–w- C:\windows\System32\SPReview 2012-05-18 00:11:41 ——– d—–w- C:\windows\System32\EventProviders 2012-05-18 00:02:59 658432 —-a-w- C:\windows\System32\PerfCenterCPL.dll 2012-05-18 00:01:48 189952 —-a-w- C:\windows\SysWow64\wdscore.dll 2012-05-18 00:01:48 189952 —-a-w- C:\windows\SysWow64\sqmapi.dll 2012-05-18 00:01:47 209920 —-a-w- C:\windows\SysWow64\PkgMgr.exe 2012-05-18 00:01:44 323072 —-a-w- C:\windows\SysWow64\drvstore.dll 2012-05-18 00:01:44 257024 —-a-w- C:\windows\SysWow64\dpx.dll 2012-05-18 00:01:43 606208 —-a-w- C:\windows\SysWow64\wbem\fastprox.dll 2012-05-18 00:01:43 363008 —-a-w- C:\windows\SysWow64\wbemcomn.dll 2012-05-18 00:01:43 189952 —-a-w- C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll 2012-05-18 00:00:54 529408 —-a-w- C:\windows\System32\wbemcomn.dll 2012-05-18 00:00:54 524288 —-a-w- C:\windows\System32\wmicmiplugin.dll 2012-05-18 00:00:54 244736 —-a-w- C:\Program Files\Windows Portable Devices\sqmapi.dll 2012-05-18 00:00:54 1225216 —-a-w- C:\windows\System32\wbem\wbemcore.dll 2012-05-18 00:00:53 933376 —-a-w- C:\windows\System32\SmiEngine.dll 2012-05-18 00:00:53 244736 —-a-w- C:\windows\System32\sqmapi.dll 2012-05-18 00:00:52 199168 —-a-w- C:\windows\System32\PkgMgr.exe 2012-05-18 00:00:47 422912 —-a-w- C:\windows\System32\drvstore.dll 2012-05-18 00:00:47 399872 —-a-w- C:\windows\System32\dpx.dll 2012-05-17 23:42:10 1918320 —-a-w- C:\windows\System32\drivers\tcpip.sys 2012-05-17 23:40:11 2164224 —-a-w- C:\Program Files\Windows Journal\Journal.exe 2012-05-17 23:40:11 1732096 —-a-w- C:\Program Files\Windows Journal\NBDoc.DLL 2012-05-17 23:40:11 1367552 —-a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll 2012-05-17 23:40:10 936960 —-a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2012-05-17 23:40:10 1402880 —-a-w- C:\Program Files\Windows Journal\JNWDRV.dll 2012-05-17 23:40:10 1393664 —-a-w- C:\Program Files\Windows Journal\JNTFiltr.dll 2012-05-17 23:17:23 ——– d—–w- C:\Program Files (x86)\Oracle 2012-05-17 23:17:19 772504 —-a-w- C:\windows\SysWow64\npDeployJava1.dll 2012-05-17 23:08:54 97208 —-a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll 2012-05-13 00:17:06 ——– d—–w- C:\Users\JSmith\AppData\Local\TechSmith 2012-05-13 00:14:02 ——– d—–w- C:\windows\SysWow64\QuickTime 2012-05-13 00:13:41 ——– d—–w- C:\Program Files (x86)\Common Files\TechSmith Shared 2012-05-13 00:04:50 ——– d—–w- C:\Program Files (x86)\WinPcap 2012-05-13 00:01:49 ——– d—–w- C:\Program Files (x86)\WMR14 2012-05-12 23:39:09 49664 —-a-w- C:\windows\System32\CamCodec.dll 2012-05-12 23:39:09 ——– d—–w- C:\Program Files (x86)\CamStudio 2.6b 2012-05-10 00:12:02 ——– d—–w- C:\Program Files (x86)\Fiddler2 2012-05-04 17:46:32 8744608 —-a-w- C:\windows\SysWow64\FlashPlayerInstaller.exe 2012-05-04 17:12:43 419488 —-a-w- C:\windows\SysWow64\FlashPlayerApp.exe 2012-05-04 16:01:44 81408 —-a-w- C:\windows\System32\imagehlp.dll 2012-05-04 16:01:44 5120 —-a-w- C:\windows\SysWow64\wmi.dll 2012-05-04 16:01:44 5120 —-a-w- C:\windows\System32\wmi.dll 2012-05-04 16:01:44 23408 —-a-w- C:\windows\System32\drivers\fs_rec.sys 2012-05-04 16:01:44 220672 —-a-w- C:\windows\System32\wintrust.dll 2012-05-04 16:01:44 172544 —-a-w- C:\windows\SysWow64\wintrust.dll 2012-05-04 16:01:44 159232 —-a-w- C:\windows\SysWow64\imagehlp.dll 2012-05-04 03:22:44 ——– d—–w- C:\Program Files (x86)\Mozilla Maintenance Service 2012-05-04 03:22:40 157352 —-a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe 2012-05-04 03:22:40 129976 —-a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe 2012-04-29 21:50:03 ——– d—–w- C:\Program Files (x86)\Photosynth 2012-04-29 19:03:38 ——– d—–w- C:\Program Files\iPod 2012-04-29 19:03:37 ——– d—–w- C:\Program Files\iTunes 2012-04-29 19:03:37 ——– d—–w- C:\Program Files (x86)\iTunes 2012-04-29 19:01:30 ——– d—–w- C:\Program Files\Bonjour 2012-04-29 19:01:30 ——– d—–w- C:\Program Files (x86)\Bonjour 2012-04-29 18:57:30 10630568 —-a-r- C:\Users\JSmith\AppData\Roaming\Microsoft\Installer\{62939D22-F2E8-44BD-A655-0D1F41D5EBA2}\PhotoSceneEditor.exe 2012-04-29 18:57:30 ——– d—–w- C:\Users\JSmith\AppData\Roaming\Autodesk 2012-04-29 18:57:27 ——– d—–w- C:\Program Files (x86)\Autodesk . ==================== Find3M ==================== . 2012-05-18 20:20:07 152576 —-a-w- C:\windows\SysWow64\msclmd.dll 2012-05-18 20:20:06 175616 —-a-w- C:\windows\System32\msclmd.dll 2012-05-04 18:46:35 70304 —-a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-04-05 01:47:02 687504 —-a-w- C:\windows\SysWow64\deployJava1.dll 2012-03-31 06:05:57 5559664 —-a-w- C:\windows\System32\ntoskrnl.exe 2012-03-31 04:39:37 3968368 —-a-w- C:\windows\SysWow64\ntkrnlpa.exe 2012-03-31 04:39:37 3913072 —-a-w- C:\windows\SysWow64\ntoskrnl.exe 2012-03-31 03:10:03 3146240 —-a-w- C:\windows\System32\win32k.sys 2012-03-17 07:58:57 75120 —-a-w- C:\windows\System32\drivers\partmgr.sys 2012-03-03 06:35:38 1544704 —-a-w- C:\windows\System32\DWrite.dll 2012-03-03 05:31:19 1077248 —-a-w- C:\windows\SysWow64\DWrite.dll 2012-02-28 06:39:37 1188864 —-a-w- C:\windows\System32\wininet.dll 2012-02-28 05:38:52 981504 —-a-w- C:\windows\SysWow64\wininet.dll 2012-02-28 04:31:38 1638912 —-a-w- C:\windows\System32\mshtml.tlb 2012-02-28 03:52:27 1638912 —-a-w- C:\windows\SysWow64\mshtml.tlb . ============= FINISH: 11:40:44.15 ===============

TDSSKiller didn't find anything on its scan, here is the report: 11:44:26.0228 6520 TDSS rootkit removing tool [removed] May 23 2012 08:15:30 11:44:26.0682 6520 ============================================================ 11:44:26.0682 6520 Current date / time: 2012/05/23 11:44:26.0682 11:44:26.0682 6520 SystemInfo: 11:44:26.0682 6520 11:44:26.0682 6520 OS Version: 6.1.7601 ServicePack: 1.0 11:44:26.0682 6520 Product type: Workstation 11:44:26.0682 6520 ComputerName: CABELJSMITH-L1 11:44:26.0682 6520 UserName: JSmith 11:44:26.0682 6520 Windows directory: C:\windows 11:44:26.0682 6520 System windows directory: C:\windows 11:44:26.0682 6520 Running under WOW64 11:44:26.0682 6520 Processor architecture: Intel x64 11:44:26.0682 6520 Number of processors: 2 11:44:26.0682 6520 Page size: 0x1000 11:44:26.0682 6520 Boot type: Normal boot 11:44:26.0682 6520 ============================================================ 11:44:27.0258 6520 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x7E2D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040 11:44:27.0268 6520 ============================================================ 11:44:27.0268 6520 \Device\Harddisk0\DR0: 11:44:27.0268 6520 MBR partitions: 11:44:27.0268 6520 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 11:44:27.0268 6520 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1D192970 11:44:27.0268 6520 ============================================================ 11:44:27.0294 6520 C: <-> \Device\Harddisk0\DR0\Partition1 11:44:27.0294 6520 ============================================================ 11:44:27.0294 6520 Initialize success 11:44:27.0294 6520 ============================================================ 11:44:40.0931 8100 ============================================================ 11:44:40.0931 8100 Scan started 11:44:40.0931 8100 Mode: Manual; 11:44:40.0931 8100 ============================================================ 11:44:44.0735 8100 1394ohci (a87d604aea360176311474c87a63bb88) C:\windows\system32\drivers\1394ohci.sys 11:44:44.0737 8100 1394ohci - ok 11:44:44.0839 8100 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\windows\system32\drivers\ACPI.sys 11:44:44.0844 8100 ACPI - ok 11:44:44.0895 8100 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\windows\system32\drivers\acpipmi.sys 11:44:44.0896 8100 AcpiPmi - ok 11:44:45.0023 8100 AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 11:44:45.0025 8100 AdobeFlashPlayerUpdateSvc - ok 11:44:45.0081 8100 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\windows\system32\DRIVERS\adp94xx.sys 11:44:45.0085 8100 adp94xx - ok 11:44:45.0131 8100 adpahci (597f78224ee9224ea1a13d6350ced962) C:\windows\system32\DRIVERS\adpahci.sys 11:44:45.0133 8100 adpahci - ok 11:44:45.0169 8100 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\windows\system32\DRIVERS\adpu320.sys 11:44:45.0170 8100 adpu320 - ok 11:44:45.0202 8100 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\windows\System32\aelupsvc.dll 11:44:45.0203 8100 AeLookupSvc - ok 11:44:45.0387 8100 AeXNSClient (20a7fe29ebe0d0c9db0fb9bd629d6f10) C:\Program Files (x86)\Altiris\Altiris Agent\AeXNSAgent.exe 11:44:45.0396 8100 AeXNSClient - ok 11:44:45.0538 8100 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\windows\system32\drivers\afd.sys 11:44:45.0543 8100 AFD - ok 11:44:45.0608 8100 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\windows\system32\drivers\agp440.sys 11:44:45.0608 8100 agp440 - ok 11:44:45.0644 8100 ALG (3290d6946b5e30e70414990574883ddb) C:\windows\System32\alg.exe 11:44:45.0646 8100 ALG - ok 11:44:45.0676 8100 aliide (5812713a477a3ad7363c7438ca2ee038) C:\windows\system32\drivers\aliide.sys 11:44:45.0677 8100 aliide - ok 11:44:45.0839 8100 AltirisAgentProvider (378875bc5858dd08329796a608ea9620) C:\Program Files (x86)\Altiris\Altiris Agent\Agents\WMIProviderAgent\AltirisAgentProvider.exe 11:44:45.0844 8100 AltirisAgentProvider - ok 11:44:45.0901 8100 amdide (1ff8b4431c353ce385c875f194924c0c) C:\windows\system32\drivers\amdide.sys 11:44:45.0901 8100 amdide - ok 11:44:45.0937 8100 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\windows\system32\DRIVERS\amdk8.sys 11:44:45.0937 8100 AmdK8 - ok 11:44:45.0976 8100 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\windows\system32\DRIVERS\amdppm.sys 11:44:45.0977 8100 AmdPPM - ok 11:44:46.0052 8100 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\windows\system32\drivers\amdsata.sys 11:44:46.0052 8100 amdsata - ok 11:44:46.0104 8100 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\windows\system32\DRIVERS\amdsbs.sys 11:44:46.0105 8100 amdsbs - ok 11:44:46.0143 8100 amdxata (540daf1cea6094886d72126fd7c33048) C:\windows\system32\drivers\amdxata.sys 11:44:46.0144 8100 amdxata - ok 11:44:46.0183 8100 AMPPAL (7d9e301ab3247765702d0b65e2e47e50) C:\windows\system32\DRIVERS\AMPPAL.sys 11:44:46.0185 8100 AMPPAL - ok 11:44:46.0192 8100 AMPPALP (7d9e301ab3247765702d0b65e2e47e50) C:\windows\system32\DRIVERS\amppal.sys 11:44:46.0194 8100 AMPPALP - ok 11:44:46.0328 8100 AMPPALR3 (864c632b999be1237a3dc46736e71f27) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe 11:44:46.0367 8100 AMPPALR3 - ok 11:44:46.0508 8100 AppHostSvc (59d01fa91962c9c1e9b4022b2d3b46db) C:\windows\system32\inetsrv\apphostsvc.dll 11:44:46.0515 8100 AppHostSvc - ok 11:44:46.0604 8100 AppID (89a69c3f2f319b43379399547526d952) C:\windows\system32\drivers\appid.sys 11:44:46.0604 8100 AppID - ok 11:44:46.0627 8100 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\windows\System32\appidsvc.dll 11:44:46.0633 8100 AppIDSvc - ok 11:44:46.0678 8100 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\windows\System32\appinfo.dll 11:44:46.0686 8100 Appinfo - ok 11:44:46.0785 8100 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 11:44:46.0795 8100 Apple Mobile Device - ok 11:44:46.0819 8100 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\windows\System32\appmgmts.dll 11:44:46.0821 8100 AppMgmt - ok 11:44:46.0865 8100 arc (c484f8ceb1717c540242531db7845c4e) C:\windows\system32\DRIVERS\arc.sys 11:44:46.0867 8100 arc - ok 11:44:46.0949 8100 arcsas (019af6924aefe7839f61c830227fe79c) C:\windows\system32\DRIVERS\arcsas.sys 11:44:46.0951 8100 arcsas - ok 11:44:47.0047 8100 aspnet_state (9217d874131ae6ff8f642f124f00a555) C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 11:44:47.0048 8100 aspnet_state - ok 11:44:47.0085 8100 AsyncMac (769765ce2cc62867468cea93969b2242) C:\windows\system32\DRIVERS\asyncmac.sys 11:44:47.0086 8100 AsyncMac - ok 11:44:47.0141 8100 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\windows\system32\drivers\atapi.sys 11:44:47.0142 8100 atapi - ok 11:44:47.0229 8100 ATSwpWDF (ea512f43f4a28d18b52cafe8c93984fb) C:\windows\system32\Drivers\ATSwpWDF.sys 11:44:47.0233 8100 ATSwpWDF - ok 11:44:47.0318 8100 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\windows\System32\Audiosrv.dll 11:44:47.0336 8100 AudioEndpointBuilder - ok 11:44:47.0343 8100 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\windows\System32\Audiosrv.dll 11:44:47.0347 8100 AudioSrv - ok 11:44:47.0398 8100 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\windows\System32\AxInstSV.dll 11:44:47.0409 8100 AxInstSV - ok 11:44:47.0487 8100 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\windows\system32\DRIVERS\bxvbda.sys 11:44:47.0490 8100 b06bdrv - ok 11:44:47.0540 8100 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\windows\system32\DRIVERS\b57nd60a.sys 11:44:47.0541 8100 b57nd60a - ok 11:44:47.0583 8100 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\windows\System32\bdesvc.dll 11:44:47.0607 8100 BDESVC - ok 11:44:47.0626 8100 Beep (16a47ce2decc9b099349a5f840654746) C:\windows\system32\drivers\Beep.sys 11:44:47.0627 8100 Beep - ok 11:44:47.0733 8100 BFE (82974d6a2fd19445cc5171fc378668a4) C:\windows\System32\bfe.dll 11:44:47.0776 8100 BFE - ok 11:44:47.0889 8100 BITS (1ea7969e3271cbc59e1730697dc74682) C:\windows\System32\qmgr.dll 11:44:47.0899 8100 BITS - ok 11:44:47.0943 8100 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\windows\system32\DRIVERS\blbdrive.sys 11:44:47.0943 8100 blbdrive - ok 11:44:48.0034 8100 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe 11:44:48.0050 8100 Bonjour Service - ok 11:44:48.0078 8100 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\windows\system32\DRIVERS\bowser.sys 11:44:48.0080 8100 bowser - ok 11:44:48.0116 8100 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\windows\system32\DRIVERS\BrFiltLo.sys 11:44:48.0117 8100 BrFiltLo - ok 11:44:48.0132 8100 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\windows\system32\DRIVERS\BrFiltUp.sys 11:44:48.0133 8100 BrFiltUp - ok 11:44:48.0178 8100 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\windows\System32\browser.dll 11:44:48.0189 8100 Browser - ok 11:44:48.0217 8100 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\windows\System32\Drivers\Brserid.sys 11:44:48.0219 8100 Brserid - ok 11:44:48.0246 8100 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\windows\System32\Drivers\BrSerWdm.sys 11:44:48.0247 8100 BrSerWdm - ok 11:44:48.0282 8100 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\windows\System32\Drivers\BrUsbMdm.sys 11:44:48.0282 8100 BrUsbMdm - ok 11:44:48.0303 8100 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\windows\System32\Drivers\BrUsbSer.sys 11:44:48.0304 8100 BrUsbSer - ok 11:44:48.0368 8100 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\windows\system32\drivers\BthEnum.sys 11:44:48.0368 8100 BthEnum - ok 11:44:48.0404 8100 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\windows\system32\DRIVERS\bthmodem.sys 11:44:48.0405 8100 BTHMODEM - ok 11:44:48.0434 8100 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\windows\system32\DRIVERS\bthpan.sys 11:44:48.0435 8100 BthPan - ok 11:44:48.0469 8100 BTHPORT (64c198198501f7560ee41d8d1efa7952) C:\windows\System32\Drivers\BTHport.sys 11:44:48.0473 8100 BTHPORT - ok 11:44:48.0512 8100 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\windows\system32\bthserv.dll 11:44:48.0520 8100 bthserv - ok 11:44:48.0600 8100 BTHSSecurityMgr (9e2af97302b9f4bf97e952a865eb31ae) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe 11:44:48.0613 8100 BTHSSecurityMgr - ok 11:44:48.0647 8100 BTHUSB (f188b7394d81010767b6df3178519a37) C:\windows\System32\Drivers\BTHUSB.sys 11:44:48.0648 8100 BTHUSB - ok 11:44:48.0676 8100 btusbflt (2641a3fe3d7b0646308f33b67f3b5300) C:\windows\system32\drivers\btusbflt.sys 11:44:48.0677 8100 btusbflt - ok 11:44:48.0765 8100 CAXHWAZL (48360b88c4bf45850653bb7c86888ed4) C:\windows\system32\DRIVERS\CAXHWAZL.sys 11:44:48.0767 8100 CAXHWAZL - ok 11:44:48.0827 8100 cdfs (b8bd2bb284668c84865658c77574381a) C:\windows\system32\DRIVERS\cdfs.sys 11:44:48.0828 8100 cdfs - ok 11:44:48.0894 8100 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\windows\system32\drivers\cdrom.sys 11:44:48.0895 8100 cdrom - ok 11:44:48.0988 8100 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\windows\System32\certprop.dll 11:44:48.0996 8100 CertPropSvc - ok 11:44:49.0030 8100 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\windows\system32\DRIVERS\circlass.sys 11:44:49.0031 8100 circlass - ok 11:44:49.0077 8100 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\windows\system32\CLFS.sys 11:44:49.0081 8100 CLFS - ok 11:44:49.0140 8100 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 11:44:49.0141 8100 clr_optimization_v2.0.50727_32 - ok 11:44:49.0179 8100 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 11:44:49.0181 8100 clr_optimization_v2.0.50727_64 - ok 11:44:49.0250 8100 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 11:44:49.0253 8100 clr_optimization_v4.0.30319_32 - ok 11:44:49.0318 8100 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 11:44:49.0320 8100 clr_optimization_v4.0.30319_64 - ok 11:44:49.0367 8100 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\windows\system32\DRIVERS\CmBatt.sys 11:44:49.0368 8100 CmBatt - ok 11:44:49.0409 8100 cmdide (e19d3f095812725d88f9001985b94edd) C:\windows\system32\drivers\cmdide.sys 11:44:49.0410 8100 cmdide - ok 11:44:49.0460 8100 CNG (c4943b6c962e4b82197542447ad599f4) C:\windows\system32\Drivers\cng.sys 11:44:49.0465 8100 CNG - ok 11:44:49.0526 8100 CnxtHdAudService (d3c4f72e8f8dc523b02a0c313ceeea99) C:\windows\system32\drivers\CHDRT64.sys 11:44:49.0531 8100 CnxtHdAudService - ok 11:44:49.0548 8100 Compbatt (102de219c3f61415f964c88e9085ad14) C:\windows\system32\DRIVERS\compbatt.sys 11:44:49.0548 8100 Compbatt - ok 11:44:49.0602 8100 CompositeBus (03edb043586cceba243d689bdda370a8) C:\windows\system32\drivers\CompositeBus.sys 11:44:49.0603 8100 CompositeBus - ok 11:44:49.0606 8100 COMSysApp - ok 11:44:49.0741 8100 cpudrv64 (3ca734ce373e5675fbc15ca2c45228e5) C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys 11:44:49.0741 8100 cpudrv64 - ok 11:44:49.0772 8100 crcdisk (1c827878a998c18847245fe1f34ee597) C:\windows\system32\DRIVERS\crcdisk.sys 11:44:49.0773 8100 crcdisk - ok 11:44:49.0833 8100 CryptSvc (15597883fbe9b056f276ada3ad87d9af) C:\windows\system32\cryptsvc.dll 11:44:49.0847 8100 CryptSvc - ok 11:44:49.0928 8100 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\windows\system32\drivers\csc.sys 11:44:49.0932 8100 CSC - ok 11:44:50.0002 8100 CscService (3ab183ab4d2c79dcf459cd2c1266b043) C:\windows\System32\cscsvc.dll 11:44:50.0010 8100 CscService - ok 11:44:50.0065 8100 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\windows\system32\rpcss.dll 11:44:50.0071 8100 DcomLaunch - ok 11:44:50.0131 8100 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\windows\System32\defragsvc.dll 11:44:50.0145 8100 defragsvc - ok 11:44:50.0222 8100 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\windows\system32\Drivers\dfsc.sys 11:44:50.0223 8100 DfsC - ok 11:44:50.0280 8100 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\windows\system32\dhcpcore.dll 11:44:50.0293 8100 Dhcp - ok 11:44:50.0328 8100 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\windows\system32\drivers\discache.sys 11:44:50.0329 8100 discache - ok 11:44:50.0359 8100 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\windows\system32\DRIVERS\disk.sys 11:44:50.0360 8100 Disk - ok 11:44:50.0387 8100 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\windows\System32\dnsrslvr.dll 11:44:50.0399 8100 Dnscache - ok 11:44:50.0449 8100 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\windows\System32\dot3svc.dll 11:44:50.0462 8100 dot3svc - ok 11:44:50.0534 8100 DozeSvc (277247b79da2230d0c3aeb83e6cd8ca7) C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE 11:44:50.0540 8100 DozeSvc - ok 11:44:50.0592 8100 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\windows\system32\dps.dll 11:44:50.0602 8100 DPS - ok 11:44:50.0637 8100 drmkaud (9b19f34400d24df84c858a421c205754) C:\windows\system32\drivers\drmkaud.sys 11:44:50.0637 8100 drmkaud - ok 11:44:50.0743 8100 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\windows\System32\drivers\dxgkrnl.sys 11:44:50.0766 8100 DXGKrnl - ok 11:44:50.0804 8100 DzHDD64 (ce4cffd9f64b86bceb1c343fc9924d72) C:\windows\system32\DRIVERS\DzHDD64.sys 11:44:50.0805 8100 DzHDD64 - ok 11:44:50.0855 8100 e1kexpress (f369e83f6cdab987ca2dd764278659a6) C:\windows\system32\DRIVERS\e1k62x64.sys 11:44:50.0857 8100 e1kexpress - ok 11:44:50.0910 8100 e1yexpress (11d0eca73ab25135f65656b93adbcb3d) C:\windows\system32\DRIVERS\e1y62x64.sys 11:44:50.0913 8100 e1yexpress - ok 11:44:50.0954 8100 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\windows\System32\eapsvc.dll 11:44:50.0981 8100 EapHost - ok 11:44:51.0148 8100 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\windows\system32\DRIVERS\evbda.sys 11:44:51.0176 8100 ebdrv - ok 11:44:51.0285 8100 EFS (c118a82cd78818c29ab228366ebf81c3) C:\windows\System32\lsass.exe 11:44:51.0287 8100 EFS - ok 11:44:51.0386 8100 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\windows\ehome\ehRecvr.exe 11:44:51.0393 8100 ehRecvr - ok 11:44:51.0415 8100 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\windows\ehome\ehsched.exe 11:44:51.0416 8100 ehSched - ok 11:44:51.0489 8100 elxstor (0e5da5369a0fcaea12456dd852545184) C:\windows\system32\DRIVERS\elxstor.sys 11:44:51.0493 8100 elxstor - ok 11:44:51.0528 8100 ErrDev (34a3c54752046e79a126e15c51db409b) C:\windows\system32\drivers\errdev.sys 11:44:51.0528 8100 ErrDev - ok 11:44:51.0592 8100 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\windows\system32\es.dll 11:44:51.0596 8100 EventSystem - ok 11:44:51.0811 8100 EvtEng (e3a96d5ae6e5c7b5472011ba77353368) C:\Program Files\Intel\WiFi\bin\EvtEng.exe 11:44:51.0826 8100 EvtEng - ok 11:44:51.0987 8100 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\windows\system32\drivers\exfat.sys 11:44:51.0989 8100 exfat - ok 11:44:52.0064 8100 f5ipfw (cabdb2a7eadbbe7f881d1ad931b53ed2) C:\windows\system32\drivers\urfltv64.sys 11:44:52.0065 8100 f5ipfw - ok 11:44:52.0099 8100 fastfat (0adc83218b66a6db380c330836f3e36d) C:\windows\system32\drivers\fastfat.sys 11:44:52.0100 8100 fastfat - ok 11:44:52.0207 8100 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\windows\system32\fxssvc.exe 11:44:52.0215 8100 Fax - ok 11:44:52.0251 8100 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\windows\system32\DRIVERS\fdc.sys 11:44:52.0251 8100 fdc - ok 11:44:52.0287 8100 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\windows\system32\fdPHost.dll 11:44:52.0293 8100 fdPHost - ok 11:44:52.0307 8100 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\windows\system32\fdrespub.dll 11:44:52.0328 8100 FDResPub - ok 11:44:52.0355 8100 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\windows\system32\drivers\fileinfo.sys 11:44:52.0356 8100 FileInfo - ok 11:44:52.0369 8100 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\windows\system32\drivers\filetrace.sys 11:44:52.0369 8100 Filetrace - ok 11:44:52.0388 8100 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\windows\system32\DRIVERS\flpydisk.sys 11:44:52.0389 8100 flpydisk - ok 11:44:52.0422 8100 FltMgr (da6b67270fd9db3697b20fce94950741) C:\windows\system32\drivers\fltmgr.sys 11:44:52.0425 8100 FltMgr - ok 11:44:52.0513 8100 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\windows\system32\FntCache.dll 11:44:52.0540 8100 FontCache - ok 11:44:52.0610 8100 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 11:44:52.0612 8100 FontCache3.0.0.0 - ok 11:44:52.0640 8100 FsDepends (d43703496149971890703b4b1b723eac) C:\windows\system32\drivers\FsDepends.sys 11:44:52.0641 8100 FsDepends - ok 11:44:52.0675 8100 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\windows\system32\drivers\Fs_Rec.sys 11:44:52.0675 8100 Fs_Rec - ok 11:44:52.0742 8100 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\windows\system32\DRIVERS\fvevol.sys 11:44:52.0744 8100 fvevol - ok 11:44:52.0786 8100 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\windows\system32\DRIVERS\gagp30kx.sys 11:44:52.0787 8100 gagp30kx - ok 11:44:52.0813 8100 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\windows\system32\DRIVERS\GEARAspiWDM.sys 11:44:52.0814 8100 GEARAspiWDM - ok 11:44:52.0894 8100 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\windows\System32\gpsvc.dll 11:44:52.0931 8100 gpsvc - ok 11:44:53.0048 8100 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 11:44:53.0049 8100 gupdate - ok 11:44:53.0053 8100 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 11:44:53.0056 8100 gupdatem - ok 11:44:53.0077 8100 HBtnKey (943350b87bb0339bf61343e8ac3ef25e) C:\windows\system32\DRIVERS\wstbtndb.sys 11:44:53.0078 8100 HBtnKey - ok 11:44:53.0096 8100 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\windows\system32\drivers\hcw85cir.sys 11:44:53.0097 8100 hcw85cir - ok 11:44:53.0164 8100 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\windows\system32\drivers\HdAudio.sys 11:44:53.0166 8100 HdAudAddService - ok 11:44:53.0194 8100 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\windows\system32\drivers\HDAudBus.sys 11:44:53.0195 8100 HDAudBus - ok 11:44:53.0223 8100 HECIx64 (15c9789470b8855ac2f54fdf96802d13) C:\windows\system32\DRIVERS\HECIx64.sys 11:44:53.0224 8100 HECIx64 - ok 11:44:53.0242 8100 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\windows\system32\DRIVERS\HidBatt.sys 11:44:53.0243 8100 HidBatt - ok 11:44:53.0267 8100 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\windows\system32\DRIVERS\hidbth.sys 11:44:53.0269 8100 HidBth - ok 11:44:53.0310 8100 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\windows\system32\DRIVERS\hidir.sys 11:44:53.0311 8100 HidIr - ok 11:44:53.0339 8100 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\windows\system32\hidserv.dll 11:44:53.0345 8100 hidserv - ok 11:44:53.0396 8100 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\windows\system32\DRIVERS\hidusb.sys 11:44:53.0396 8100 HidUsb - ok 11:44:53.0453 8100 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\windows\system32\kmsvc.dll 11:44:53.0463 8100 hkmsvc - ok 11:44:53.0519 8100 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\windows\system32\ListSvc.dll 11:44:53.0533 8100 HomeGroupListener - ok 11:44:53.0580 8100 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\windows\system32\provsvc.dll 11:44:53.0592 8100 HomeGroupProvider - ok 11:44:53.0698 8100 hpqcxs08 (1dae5c46d42b02a6d5862e1482efb390) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll 11:44:53.0701 8100 hpqcxs08 - ok 11:44:53.0741 8100 hpqddsvc (99e8eef42fe2f4af29b08c3355dd7685) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll 11:44:53.0759 8100 hpqddsvc - ok 11:44:53.0829 8100 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\windows\system32\drivers\HpSAMD.sys 11:44:53.0830 8100 HpSAMD - ok 11:44:53.0902 8100 HPSLPSVC (f37882f128efacefe353e0bae2766909) C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL 11:44:53.0913 8100 HPSLPSVC - ok 11:44:54.0055 8100 HsfXAudioService (447256d1c026654c5cd3cc17e7b20631) C:\windows\SysWOW64\XAudio64.dll 11:44:54.0070 8100 HsfXAudioService - ok 11:44:54.0247 8100 HSF_DPV (f6ac1087a131fbb385400667bea64fbe) C:\windows\system32\DRIVERS\CAX_DPV.sys 11:44:54.0261 8100 HSF_DPV - ok 11:44:54.0418 8100 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\windows\system32\drivers\HTTP.sys 11:44:54.0423 8100 HTTP - ok 11:44:54.0473 8100 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\windows\system32\drivers\hwpolicy.sys 11:44:54.0473 8100 hwpolicy - ok 11:44:54.0507 8100 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\windows\system32\drivers\i8042prt.sys 11:44:54.0508 8100 i8042prt - ok 11:44:54.0576 8100 iastor (85977cd13fc16069ce0af7943a811775) C:\windows\system32\Drivers\iaStor.sys 11:44:54.0580 8100 iastor - ok 11:44:54.0648 8100 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\windows\system32\drivers\iaStorV.sys 11:44:54.0650 8100 iaStorV - ok 11:44:54.0690 8100 IBMPMDRV (2151176db657aeff9b873d23380c3f5b) C:\windows\system32\DRIVERS\ibmpmdrv.sys 11:44:54.0690 8100 IBMPMDRV - ok 11:44:54.0716 8100 IBMPMSVC (c76a67aed080538d420550c903696788) C:\windows\system32\ibmpmsvc.exe 11:44:54.0718 8100 IBMPMSVC - ok 11:44:54.0859 8100 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 11:44:54.0882 8100 idsvc - ok 11:44:55.0469 8100 igfx (c6238c6abd6ac99f5d152da4e9439a3d) C:\windows\system32\DRIVERS\igdkmd64.sys 11:44:55.0634 8100 igfx - ok 11:44:55.0784 8100 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\windows\system32\DRIVERS\iirsp.sys 11:44:55.0784 8100 iirsp - ok 11:44:55.0893 8100 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\windows\System32\ikeext.dll 11:44:55.0915 8100 IKEEXT - ok 11:44:55.0972 8100 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\windows\system32\drivers\intelide.sys 11:44:55.0973 8100 intelide - ok 11:44:56.0010 8100 intelppm (ada036632c664caa754079041cf1f8c1) C:\windows\system32\DRIVERS\intelppm.sys 11:44:56.0010 8100 intelppm - ok 11:44:56.0032 8100 ioatdma1 (e45575812630b049ce0f679d87561a4d) C:\windows\System32\Drivers\qd162x64.sys 11:44:56.0033 8100 ioatdma1 - ok 11:44:56.0069 8100 ioatdma2 (2c23820dd9e81199e60f553eb50bc449) C:\windows\System32\Drivers\qd262x64.sys 11:44:56.0070 8100 ioatdma2 - ok 11:44:56.0116 8100 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\windows\system32\ipbusenum.dll 11:44:56.0126 8100 IPBusEnum - ok 11:44:56.0169 8100 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\windows\system32\DRIVERS\ipfltdrv.sys 11:44:56.0170 8100 IpFilterDriver - ok 11:44:56.0245 8100 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\windows\System32\iphlpsvc.dll 11:44:56.0251 8100 iphlpsvc - ok 11:44:56.0280 8100 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\windows\system32\drivers\IPMIDrv.sys 11:44:56.0281 8100 IPMIDRV - ok 11:44:56.0329 8100 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\windows\system32\drivers\ipnat.sys 11:44:56.0330 8100 IPNAT - ok 11:44:56.0445 8100 iPod Service (50d6ccc6ff5561f9f56946b3e6164fb8) C:\Program Files\iPod\bin\iPodService.exe 11:44:56.0472 8100 iPod Service - ok 11:44:56.0504 8100 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\windows\system32\drivers\irenum.sys 11:44:56.0505 8100 IRENUM - ok 11:44:56.0545 8100 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\windows\system32\drivers\isapnp.sys 11:44:56.0545 8100 isapnp - ok 11:44:56.0573 8100 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\windows\system32\drivers\msiscsi.sys 11:44:56.0575 8100 iScsiPrt - ok 11:44:56.0605 8100 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\windows\system32\DRIVERS\kbdclass.sys 11:44:56.0606 8100 kbdclass - ok 11:44:56.0672 8100 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\windows\system32\DRIVERS\kbdhid.sys 11:44:56.0672 8100 kbdhid - ok 11:44:56.0702 8100 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\windows\system32\lsass.exe 11:44:56.0703 8100 KeyIso - ok 11:44:56.0750 8100 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\windows\system32\Drivers\ksecdd.sys 11:44:56.0751 8100 KSecDD - ok 11:44:56.0766 8100 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\windows\system32\Drivers\ksecpkg.sys 11:44:56.0767 8100 KSecPkg - ok 11:44:56.0793 8100 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\windows\system32\drivers\ksthunk.sys 11:44:56.0794 8100 ksthunk - ok 11:44:56.0834 8100 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\windows\system32\msdtckrm.dll 11:44:56.0850 8100 KtmRm - ok 11:44:56.0895 8100 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\windows\system32\srvsvc.dll 11:44:56.0908 8100 LanmanServer - ok 11:44:56.0959 8100 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\windows\System32\wkssvc.dll 11:44:56.0969 8100 LanmanWorkstation - ok 11:44:57.0093 8100 LENOVO.MICMUTE (340288b3b2edc8afd5ff127df85142a7) C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe 11:44:57.0094 8100 LENOVO.MICMUTE - ok 11:44:57.0109 8100 lenovo.smi (2b9d8555dc004e240082d18e7725ce20) C:\windows\system32\DRIVERS\smiifx64.sys 11:44:57.0109 8100 lenovo.smi - ok 11:44:57.0129 8100 Lenovo.VIRTSCRLSVC (f7de50781dc4d162c1005eb30d98f931) C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe 11:44:57.0131 8100 Lenovo.VIRTSCRLSVC - ok 11:44:57.0173 8100 lltdio (1538831cf8ad2979a04c423779465827) C:\windows\system32\DRIVERS\lltdio.sys 11:44:57.0174 8100 lltdio - ok 11:44:57.0212 8100 lltdsvc (c1185803384ab3feed115f79f109427f) C:\windows\System32\lltdsvc.dll 11:44:57.0226 8100 lltdsvc - ok 11:44:57.0245 8100 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\windows\System32\lmhsvc.dll 11:44:57.0251 8100 lmhosts - ok 11:44:57.0290 8100 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\windows\system32\DRIVERS\lsi_fc.sys 11:44:57.0291 8100 LSI_FC - ok 11:44:57.0327 8100 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\windows\system32\DRIVERS\lsi_sas.sys 11:44:57.0328 8100 LSI_SAS - ok 11:44:57.0359 8100 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\windows\system32\DRIVERS\lsi_sas2.sys 11:44:57.0360 8100 LSI_SAS2 - ok 11:44:57.0398 8100 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\windows\system32\DRIVERS\lsi_scsi.sys 11:44:57.0399 8100 LSI_SCSI - ok 11:44:57.0429 8100 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\windows\system32\drivers\luafv.sys 11:44:57.0431 8100 luafv - ok 11:44:57.0501 8100 MBAMProtector (79da94b35371b9e7104460c7693dcb2c) C:\windows\system32\drivers\mbam.sys 11:44:57.0502 8100 MBAMProtector - ok 11:44:57.0601 8100 MBAMService (de199f3aa9c541a349af95a5c72a71af) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe 11:44:57.0648 8100 MBAMService - ok 11:44:57.0706 8100 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\windows\system32\Mcx2Svc.dll 11:44:57.0716 8100 Mcx2Svc - ok 11:44:57.0809 8100 MDM (7cf1b716372b89568ae4c0fe769f5869) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe 11:44:57.0846 8100 MDM - ok 11:44:57.0882 8100 mdmxsdk (e4f44ec214b3e381e1fc844a02926666) C:\windows\system32\DRIVERS\mdmxsdk.sys 11:44:57.0883 8100 mdmxsdk - ok 11:44:57.0898 8100 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\windows\system32\DRIVERS\megasas.sys 11:44:57.0899 8100 megasas - ok 11:44:57.0940 8100 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\windows\system32\DRIVERS\MegaSR.sys 11:44:57.0942 8100 MegaSR - ok 11:44:57.0981 8100 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\windows\system32\mmcss.dll 11:44:57.0989 8100 MMCSS - ok 11:44:58.0035 8100 Modem (800ba92f7010378b09f9ed9270f07137) C:\windows\system32\drivers\modem.sys 11:44:58.0036 8100 Modem - ok 11:44:58.0068 8100 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\windows\system32\DRIVERS\monitor.sys 11:44:58.0069 8100 monitor - ok 11:44:58.0117 8100 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\windows\system32\DRIVERS\mouclass.sys 11:44:58.0118 8100 mouclass - ok 11:44:58.0153 8100 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\windows\system32\DRIVERS\mouhid.sys 11:44:58.0153 8100 mouhid - ok 11:44:58.0195 8100 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\windows\system32\drivers\mountmgr.sys 11:44:58.0196 8100 mountmgr - ok 11:44:58.0291 8100 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 11:44:58.0292 8100 MozillaMaintenance - ok 11:44:58.0348 8100 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\windows\system32\drivers\mpio.sys 11:44:58.0349 8100 mpio - ok 11:44:58.0431 8100 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\windows\system32\drivers\mpsdrv.sys 11:44:58.0432 8100 mpsdrv - ok 11:44:58.0539 8100 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\windows\system32\mpssvc.dll 11:44:58.0546 8100 MpsSvc - ok 11:44:58.0588 8100 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\windows\system32\drivers\mrxdav.sys 11:44:58.0589 8100 MRxDAV - ok 11:44:58.0619 8100 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\windows\system32\DRIVERS\mrxsmb.sys 11:44:58.0621 8100 mrxsmb - ok 11:44:58.0643 8100 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\windows\system32\DRIVERS\mrxsmb10.sys 11:44:58.0646 8100 mrxsmb10 - ok 11:44:58.0700 8100 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\windows\system32\DRIVERS\mrxsmb20.sys 11:44:58.0701 8100 mrxsmb20 - ok 11:44:58.0746 8100 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\windows\system32\drivers\msahci.sys 11:44:58.0747 8100 msahci - ok 11:44:58.0817 8100 MSCamSvc (41fb1d61df09c36ccab0b04eec66f6d5) C:\Program Files\Microsoft LifeCam\MSCamS64.exe 11:44:58.0833 8100 MSCamSvc - ok 11:44:58.0919 8100 MsDepSvc (a1d066fbee853912f8e1c3f0a62dd6b5) C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe 11:44:58.0929 8100 MsDepSvc - ok 11:44:58.0967 8100 msdsm (db801a638d011b9633829eb6f663c900) C:\windows\system32\drivers\msdsm.sys 11:44:58.0968 8100 msdsm - ok 11:44:59.0004 8100 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\windows\System32\msdtc.exe 11:44:59.0007 8100 MSDTC - ok 11:44:59.0049 8100 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\windows\system32\drivers\Msfs.sys 11:44:59.0050 8100 Msfs - ok 11:44:59.0080 8100 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\windows\System32\drivers\mshidkmdf.sys 11:44:59.0081 8100 mshidkmdf - ok 11:44:59.0132 8100 MSHUSBVideo (bb590070d606ae6f008341fc9a7b2ad7) C:\windows\system32\Drivers\nx6000.sys 11:44:59.0133 8100 MSHUSBVideo - ok 11:44:59.0171 8100 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\windows\system32\drivers\msisadrv.sys 11:44:59.0171 8100 msisadrv - ok 11:44:59.0211 8100 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\windows\system32\iscsiexe.dll 11:44:59.0223 8100 MSiSCSI - ok 11:44:59.0227 8100 msiserver - ok 11:44:59.0258 8100 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\windows\system32\drivers\MSKSSRV.sys 11:44:59.0259 8100 MSKSSRV - ok 11:44:59.0268 8100 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\windows\system32\drivers\MSPCLOCK.sys 11:44:59.0268 8100 MSPCLOCK - ok 11:44:59.0286 8100 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\windows\system32\drivers\MSPQM.sys 11:44:59.0287 8100 MSPQM - ok 11:44:59.0348 8100 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\windows\system32\drivers\MsRPC.sys 11:44:59.0352 8100 MsRPC - ok 11:44:59.0380 8100 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\windows\system32\drivers\mssmbios.sys 11:44:59.0381 8100 mssmbios - ok 11:44:59.0472 8100 MSSQL$SQLEXPRESS - ok 11:44:59.0511 8100 MSSQLSERVER - ok 11:44:59.0559 8100 MSSQLServerADHelper100 (04ef36eaf5c4dbce424d81b76f1e9231) c:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE 11:44:59.0567 8100 MSSQLServerADHelper100 - ok 11:44:59.0611 8100 MSSQLServerOLAPService - ok 11:44:59.0647 8100 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\windows\system32\drivers\MSTEE.sys 11:44:59.0647 8100 MSTEE - ok 11:44:59.0680 8100 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\windows\system32\DRIVERS\MTConfig.sys 11:44:59.0681 8100 MTConfig - ok 11:44:59.0698 8100 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\windows\system32\Drivers\mup.sys 11:44:59.0699 8100 Mup - ok 11:44:59.0792 8100 napagent (582ac6d9873e31dfa28a4547270862dd) C:\windows\system32\qagentRT.dll 11:44:59.0809 8100 napagent - ok 11:44:59.0849 8100 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\windows\system32\DRIVERS\nwifi.sys 11:44:59.0851 8100 NativeWifiP - ok 11:44:59.0973 8100 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\windows\system32\drivers\ndis.sys 11:44:59.0984 8100 NDIS - ok 11:45:00.0045 8100 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\windows\system32\DRIVERS\ndiscap.sys 11:45:00.0046 8100 NdisCap - ok 11:45:00.0084 8100 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\windows\system32\DRIVERS\ndistapi.sys 11:45:00.0084 8100 NdisTapi - ok 11:45:00.0130 8100 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\windows\system32\DRIVERS\ndisuio.sys 11:45:00.0131 8100 Ndisuio - ok 11:45:00.0183 8100 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\windows\system32\DRIVERS\ndiswan.sys 11:45:00.0184 8100 NdisWan - ok 11:45:00.0238 8100 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\windows\system32\drivers\NDProxy.sys 11:45:00.0238 8100 NDProxy - ok 11:45:00.0274 8100 Net Driver HPZ12 (2334dc48997ba203b794df3ee70521db) C:\Windows\system32\HPZinw12.dll 11:45:00.0283 8100 Net Driver HPZ12 - ok 11:45:00.0318 8100 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\windows\system32\DRIVERS\netbios.sys 11:45:00.0319 8100 NetBIOS - ok 11:45:00.0377 8100 NetBT (09594d1089c523423b32a4229263f068) C:\windows\system32\DRIVERS\netbt.sys 11:45:00.0379 8100 NetBT - ok 11:45:00.0454 8100 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\windows\system32\lsass.exe 11:45:00.0456 8100 Netlogon - ok 11:45:00.0507 8100 Netman (847d3ae376c0817161a14a82c8922a9e) C:\windows\System32\netman.dll 11:45:00.0523 8100 Netman - ok 11:45:00.0599 8100 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) c:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 11:45:00.0601 8100 NetMsmqActivator - ok 11:45:00.0605 8100 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) c:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 11:45:00.0606 8100 NetPipeActivator - ok 11:45:00.0642 8100 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\windows\System32\netprofm.dll 11:45:00.0648 8100 netprofm - ok 11:45:00.0654 8100 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) c:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 11:45:00.0655 8100 NetTcpActivator - ok 11:45:00.0659 8100 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) c:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 11:45:00.0660 8100 NetTcpPortSharing - ok 11:45:01.0145 8100 NETw5s64 (18555f48844c2861d9dce8f2b7223ae5) C:\windows\system32\DRIVERS\NETw5s64.sys 11:45:01.0201 8100 NETw5s64 - ok 11:45:01.0756 8100 NETwNs64 (50ad7f7040c22bb7caa59a0880875a21) C:\windows\system32\DRIVERS\NETwNs64.sys 11:45:01.0819 8100 NETwNs64 - ok 11:45:01.0966 8100 nfrd960 (77889813be4d166cdab78ddba990da92) C:\windows\system32\DRIVERS\nfrd960.sys 11:45:01.0967 8100 nfrd960 - ok 11:45:02.0042 8100 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\windows\System32\nlasvc.dll 11:45:02.0046 8100 NlaSvc - ok 11:45:02.0142 8100 NMSAccess (7aea4df1ca68fd45dd4bbe1f0243ce7f) C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe 11:45:02.0143 8100 NMSAccess - ok 11:45:02.0167 8100 NPF (351533acc2a069b94e80bbfc177e8fdf) C:\windows\system32\drivers\npf.sys 11:45:02.0168 8100 NPF - ok 11:45:02.0195 8100 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\windows\system32\drivers\Npfs.sys 11:45:02.0196 8100 Npfs - ok 11:45:02.0215 8100 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\windows\system32\nsisvc.dll 11:45:02.0222 8100 nsi - ok 11:45:02.0229 8100 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\windows\system32\drivers\nsiproxy.sys 11:45:02.0230 8100 nsiproxy - ok 11:45:02.0361 8100 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\windows\system32\drivers\Ntfs.sys 11:45:02.0377 8100 Ntfs - ok 11:45:02.0542 8100 ntrtscan (1b3be4dfcc24640547dfbec8bdd3c7c4) C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrtscan.exe 11:45:02.0579 8100 ntrtscan - ok 11:45:02.0676 8100 Null (9899284589f75fa8724ff3d16aed75c1) C:\windows\system32\drivers\Null.sys 11:45:02.0677 8100 Null - ok 11:45:02.0739 8100 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\windows\system32\drivers\nvraid.sys 11:45:02.0741 8100 nvraid - ok 11:45:02.0766 8100 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\windows\system32\drivers\nvstor.sys 11:45:02.0767 8100 nvstor - ok 11:45:02.0825 8100 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\windows\system32\drivers\nv_agp.sys 11:45:02.0826 8100 nv_agp - ok 11:45:02.0925 8100 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 11:45:02.0951 8100 odserv - ok 11:45:02.0994 8100 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\windows\system32\drivers\ohci1394.sys 11:45:02.0995 8100 ohci1394 - ok 11:45:03.0051 8100 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 11:45:03.0070 8100 ose - ok 11:45:03.0125 8100 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\windows\system32\pnrpsvc.dll 11:45:03.0130 8100 p2pimsvc - ok 11:45:03.0153 8100 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\windows\system32\p2psvc.dll 11:45:03.0171 8100 p2psvc - ok 11:45:03.0198 8100 Parport (0086431c29c35be1dbc43f52cc273887) C:\windows\system32\DRIVERS\parport.sys 11:45:03.0199 8100 Parport - ok 11:45:03.0221 8100 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\windows\system32\drivers\partmgr.sys 11:45:03.0222 8100 partmgr - ok 11:45:03.0241 8100 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\windows\System32\pcasvc.dll 11:45:03.0253 8100 PcaSvc - ok 11:45:03.0283 8100 pccsmcfd (bc0018c2d29f655188a0ed3fa94fdb24) C:\windows\system32\DRIVERS\pccsmcfdx64.sys 11:45:03.0284 8100 pccsmcfd - ok 11:45:03.0332 8100 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\windows\system32\drivers\pci.sys 11:45:03.0334 8100 pci - ok 11:45:03.0355 8100 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\windows\system32\drivers\pciide.sys 11:45:03.0355 8100 pciide - ok 11:45:03.0379 8100 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\windows\system32\DRIVERS\pcmcia.sys 11:45:03.0381 8100 pcmcia - ok 11:45:03.0459 8100 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\windows\system32\drivers\pcw.sys 11:45:03.0460 8100 pcw - ok 11:45:03.0488 8100 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\windows\system32\drivers\peauth.sys 11:45:03.0494 8100 PEAUTH - ok 11:45:03.0574 8100 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\windows\system32\peerdistsvc.dll 11:45:03.0589 8100 PeerDistSvc - ok 11:45:03.0676 8100 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\windows\SysWow64\perfhost.exe 11:45:03.0678 8100 PerfHost - ok 11:45:03.0868 8100 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\windows\system32\pla.dll 11:45:03.0893 8100 pla - ok 11:45:03.0938 8100 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\windows\system32\umpnpmgr.dll 11:45:03.0942 8100 PlugPlay - ok 11:45:04.0015 8100 Pml Driver HPZ12 (ac78df349f0e4cfb8b667c0cfff83cce) C:\Windows\system32\HPZipm12.dll 11:45:04.0024 8100 Pml Driver HPZ12 - ok 11:45:04.0067 8100 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\windows\system32\pnrpauto.dll 11:45:04.0074 8100 PNRPAutoReg - ok 11:45:04.0191 8100 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\windows\system32\pnrpsvc.dll 11:45:04.0194 8100 PNRPsvc - ok 11:45:04.0264 8100 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\windows\System32\ipsecsvc.dll 11:45:04.0280 8100 PolicyAgent - ok 11:45:04.0324 8100 Power (a2cca4fb273e6050f17a0a416cff2fcd) C:\windows\system32\umpo.dll 11:45:04.0328 8100 Power - ok 11:45:04.0409 8100 Power Manager DBC Service (836fe79de8767d77136b6491a3d61089) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE 11:45:04.0426 8100 Power Manager DBC Service - ok 11:45:04.0511 8100 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\windows\system32\DRIVERS\raspptp.sys 11:45:04.0512 8100 PptpMiniport - ok 11:45:04.0591 8100 PrismXL (4654096808f5e81b7c95d3518b9954a9) C:\Program Files (x86)\Common Files\New Boundary\PrismXL\PrismXL.sys 11:45:04.0597 8100 PrismXL - ok 11:45:04.0609 8100 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\windows\system32\DRIVERS\processr.sys 11:45:04.0610 8100 Processor - ok 11:45:04.0664 8100 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\windows\system32\profsvc.dll 11:45:04.0677 8100 ProfSvc - ok 11:45:04.0703 8100 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\windows\system32\lsass.exe 11:45:04.0704 8100 ProtectedStorage - ok 11:45:04.0731 8100 psadd (4a768fb063a38b0a78ad97617d3a04f5) C:\windows\system32\DRIVERS\psadd.sys 11:45:04.0732 8100 psadd - ok 11:45:04.0777 8100 Psched (0557cf5a2556bd58e26384169d72438d) C:\windows\system32\DRIVERS\pacer.sys 11:45:04.0779 8100 Psched - ok 11:45:04.0854 8100 PwmEWSvc (576444157f1cb25ae2057eed586d4889) C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE 11:45:04.0856 8100 PwmEWSvc - ok 11:45:04.0961 8100 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\windows\system32\DRIVERS\ql2300.sys 11:45:04.0971 8100 ql2300 - ok 11:45:05.0078 8100 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\windows\system32\DRIVERS\ql40xx.sys 11:45:05.0079 8100 ql40xx - ok 11:45:05.0133 8100 QWAVE (906191634e99aea92c4816150bda3732) C:\windows\system32\qwave.dll 11:45:05.0146 8100 QWAVE - ok 11:45:05.0178 8100 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\windows\system32\drivers\qwavedrv.sys 11:45:05.0179 8100 QWAVEdrv - ok 11:45:05.0204 8100 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\windows\system32\DRIVERS\rasacd.sys 11:45:05.0205 8100 RasAcd - ok 11:45:05.0239 8100 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\windows\system32\DRIVERS\AgileVpn.sys 11:45:05.0239 8100 RasAgileVpn - ok 11:45:05.0259 8100 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\windows\System32\rasauto.dll 11:45:05.0270 8100 RasAuto - ok 11:45:05.0313 8100 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\windows\system32\DRIVERS\rasl2tp.sys 11:45:05.0314 8100 Rasl2tp - ok 11:45:05.0393 8100 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\windows\System32\rasmans.dll 11:45:05.0408 8100 RasMan - ok 11:45:05.0415 8100 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\windows\system32\DRIVERS\raspppoe.sys 11:45:05.0417 8100 RasPppoe - ok 11:45:05.0424 8100 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\windows\system32\DRIVERS\rassstp.sys 11:45:05.0425 8100 RasSstp - ok 11:45:05.0483 8100 rdbss (77f665941019a1594d887a74f301fa2f) C:\windows\system32\DRIVERS\rdbss.sys 11:45:05.0486 8100 rdbss - ok 11:45:05.0558 8100 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\windows\system32\DRIVERS\rdpbus.sys 11:45:05.0559 8100 rdpbus - ok 11:45:05.0564 8100 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\windows\system32\DRIVERS\RDPCDD.sys 11:45:05.0564 8100 RDPCDD - ok 11:45:05.0615 8100 RDPDR (1b6163c503398b23ff8b939c67747683) C:\windows\system32\drivers\rdpdr.sys 11:45:05.0617 8100 RDPDR - ok 11:45:05.0670 8100 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\windows\system32\drivers\rdpencdd.sys 11:45:05.0671 8100 RDPENCDD - ok 11:45:05.0715 8100 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\windows\system32\drivers\rdprefmp.sys 11:45:05.0715 8100 RDPREFMP - ok 11:45:05.0746 8100 RDPWD (6d76e6433574b058adcb0c50df834492) C:\windows\system32\drivers\RDPWD.sys 11:45:05.0749 8100 RDPWD - ok 11:45:05.0838 8100 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\windows\system32\drivers\rdyboost.sys 11:45:05.0841 8100 rdyboost - ok 11:45:05.0991 8100 RegSrvc (fd11c1287d38a46fb72353e14d50089c) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe 11:45:06.0001 8100 RegSrvc - ok 11:45:06.0038 8100 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\windows\System32\mprdim.dll 11:45:06.0049 8100 RemoteAccess - ok 11:45:06.0085 8100 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\windows\system32\regsvc.dll 11:45:06.0097 8100 RemoteRegistry - ok 11:45:06.0374 8100 ReportServer (7af4ac869410aafe24eb9637932b6a17) C:\Program Files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe 11:45:06.0393 8100 ReportServer - ok 11:45:06.0509 8100 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\windows\system32\DRIVERS\rfcomm.sys 11:45:06.0511 8100 RFCOMM - ok 11:45:06.0567 8100 rimmptsk (f45d6e12eb99a668f52201637c67c8f5) C:\windows\system32\DRIVERS\rimmpx64.sys 11:45:06.0568 8100 rimmptsk - ok 11:45:06.0602 8100 rimsptsk (eac02ed935a9c1f2ddd8d985c465b854) C:\windows\system32\DRIVERS\rimspx64.sys 11:45:06.0603 8100 rimsptsk - ok 11:45:06.0631 8100 rismxdp (931a8f843b4120df527c3684daf77fd9) C:\windows\system32\DRIVERS\rixdpx64.sys 11:45:06.0632 8100 rismxdp - ok 11:45:06.0682 8100 rpcapd (b60f58f175de20a6739194e85b035178) C:\Program Files (x86)\WinPcap\rpcapd.exe 11:45:06.0699 8100 rpcapd - ok 11:45:06.0722 8100 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\windows\System32\RpcEpMap.dll 11:45:06.0730 8100 RpcEptMapper - ok 11:45:06.0754 8100 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\windows\system32\locator.exe 11:45:06.0755 8100 RpcLocator - ok 11:45:06.0817 8100 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\windows\system32\rpcss.dll 11:45:06.0821 8100 RpcSs - ok 11:45:06.0858 8100 RsFx0105 (c9fe05a63c500abe3afa5786504c4d36) C:\windows\system32\DRIVERS\RsFx0105.sys 11:45:06.0861 8100 RsFx0105 - ok 11:45:06.0951 8100 RsFx0151 (c606c5f712a3761896ceffa4af6b1268) C:\windows\system32\DRIVERS\RsFx0151.sys 11:45:06.0953 8100 RsFx0151 - ok 11:45:06.0998 8100 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\windows\system32\DRIVERS\rspndr.sys 11:45:06.0999 8100 rspndr - ok 11:45:07.0034 8100 s3cap (e60c0a09f997826c7627b244195ab581) C:\windows\system32\drivers\vms3cap.sys 11:45:07.0035 8100 s3cap - ok 11:45:07.0069 8100 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\windows\system32\lsass.exe 11:45:07.0071 8100 SamSs - ok 11:45:07.0117 8100 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\windows\system32\drivers\sbp2port.sys 11:45:07.0118 8100 sbp2port - ok 11:45:07.0150 8100 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\windows\System32\SCardSvr.dll 11:45:07.0170 8100 SCardSvr - ok 11:45:07.0207 8100 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\windows\system32\DRIVERS\scfilter.sys 11:45:07.0208 8100 scfilter - ok 11:45:07.0314 8100 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\windows\system32\schedsvc.dll 11:45:07.0326 8100 Schedule - ok 11:45:07.0372 8100 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\windows\System32\certprop.dll 11:45:07.0373 8100 SCPolicySvc - ok 11:45:07.0412 8100 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\windows\system32\drivers\sdbus.sys 11:45:07.0413 8100 sdbus - ok 11:45:07.0460 8100 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\windows\System32\SDRSVC.dll 11:45:07.0475 8100 SDRSVC - ok 11:45:07.0506 8100 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\windows\system32\drivers\secdrv.sys 11:45:07.0507 8100 secdrv - ok 11:45:07.0547 8100 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\windows\system32\seclogon.dll 11:45:07.0553 8100 seclogon - ok 11:45:07.0570 8100 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\windows\System32\sens.dll 11:45:07.0572 8100 SENS - ok 11:45:07.0656 8100 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\windows\system32\sensrsvc.dll 11:45:07.0673 8100 SensrSvc - ok 11:45:07.0721 8100 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\windows\system32\DRIVERS\serenum.sys 11:45:07.0722 8100 Serenum - ok 11:45:07.0756 8100 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\windows\system32\DRIVERS\serial.sys 11:45:07.0757 8100 Serial - ok 11:45:07.0831 8100 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\windows\system32\DRIVERS\sermouse.sys 11:45:07.0832 8100 sermouse - ok 11:45:07.0945 8100 ServiceLayer (3ec8de67b1c78c31e54c0f030e6bd7d5) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe 11:45:08.0039 8100 ServiceLayer - ok 11:45:08.0097 8100 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\windows\system32\sessenv.dll 11:45:08.0106 8100 SessionEnv - ok 11:45:08.0144 8100 sffdisk (a554811bcd09279536440c964ae35bbf) C:\windows\system32\drivers\sffdisk.sys 11:45:08.0145 8100 sffdisk - ok 11:45:08.0164 8100 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\windows\system32\drivers\sffp_mmc.sys 11:45:08.0165 8100 sffp_mmc - ok 11:45:08.0184 8100 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\windows\system32\drivers\sffp_sd.sys 11:45:08.0184 8100 sffp_sd - ok 11:45:08.0232 8100 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\windows\system32\DRIVERS\sfloppy.sys 11:45:08.0233 8100 sfloppy - ok 11:45:08.0311 8100 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\windows\System32\ipnathlp.dll 11:45:08.0326 8100 SharedAccess - ok 11:45:08.0359 8100 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\windows\System32\shsvcs.dll 11:45:08.0375 8100 ShellHWDetection - ok 11:45:08.0403 8100 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\windows\system32\DRIVERS\SiSRaid2.sys 11:45:08.0403 8100 SiSRaid2 - ok 11:45:08.0434 8100 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\windows\system32\DRIVERS\sisraid4.sys 11:45:08.0434 8100 SiSRaid4 - ok 11:45:08.0499 8100 SkypeUpdate (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files (x86)\Skype\Updater\Updater.exe 11:45:08.0819 8100 SkypeUpdate - ok 11:45:08.0863 8100 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\windows\system32\DRIVERS\smb.sys 11:45:08.0864 8100 Smb - ok 11:45:08.0912 8100 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\windows\System32\snmptrap.exe 11:45:08.0914 8100 SNMPTRAP - ok 11:45:08.0948 8100 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\windows\system32\drivers\spldr.sys 11:45:08.0949 8100 spldr - ok 11:45:09.0022 8100 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\windows\System32\spoolsv.exe 11:45:09.0030 8100 Spooler - ok 11:45:09.0212 8100 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\windows\system32\sppsvc.exe 11:45:09.0250 8100 sppsvc - ok 11:45:09.0373 8100 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\windows\system32\sppuinotify.dll 11:45:09.0381 8100 sppuinotify - ok 11:45:09.0509 8100 SQLAgent$SQLEXPRESS (3420e0482ad95120b471b7328a8d7d08) c:\Program Files\Microsoft SQL Server\MSSQL10_50.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE 11:45:09.0529 8100 SQLAgent$SQLEXPRESS - ok 11:45:09.0591 8100 SQLBrowser (7d67c07c63796775cc5492bcfeaff125) c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe 11:45:09.0610 8100 SQLBrowser - ok 11:45:09.0717 8100 SQLSERVERAGENT (45e65fb17a4cd5facbd3ca16c8334c82) C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE 11:45:09.0736 8100 SQLSERVERAGENT - ok 11:45:09.0777 8100 SQLWriter (f98ddfbfe0ee66d4c4b00693512b9527) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 11:45:09.0791 8100 SQLWriter - ok 11:45:09.0949 8100 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\windows\system32\DRIVERS\srv.sys 11:45:09.0955 8100 srv - ok 11:45:10.0007 8100 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\windows\system32\DRIVERS\srv2.sys 11:45:10.0012 8100 srv2 - ok 11:45:10.0078 8100 SrvHsfHDA (0c4540311e11664b245a263e1154cef8) C:\windows\system32\DRIVERS\VSTAZL6.SYS 11:45:10.0079 8100 SrvHsfHDA - ok 11:45:10.0200 8100 SrvHsfV92 (02071d207a9858fbe3a48cbfd59c4a04) C:\windows\system32\DRIVERS\VSTDPV6.SYS 11:45:10.0213 8100 SrvHsfV92 - ok 11:45:10.0286 8100 SrvHsfWinac (18e40c245dbfaf36fd0134a7ef2df396) C:\windows\system32\DRIVERS\VSTCNXT6.SYS 11:45:10.0291 8100 SrvHsfWinac - ok 11:45:10.0330 8100 srvnet (27e461f0be5bff5fc737328f749538c3) C:\windows\system32\DRIVERS\srvnet.sys 11:45:10.0332 8100 srvnet - ok 11:45:10.0397 8100 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\windows\System32\ssdpsrv.dll 11:45:10.0410 8100 SSDPSRV - ok 11:45:10.0438 8100 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\windows\system32\sstpsvc.dll 11:45:10.0447 8100 SstpSvc - ok 11:45:10.0461 8100 StarOpen - ok 11:45:10.0492 8100 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\windows\system32\DRIVERS\stexstor.sys 11:45:10.0493 8100 stexstor - ok 11:45:10.0542 8100 StillCam (decacb6921ded1a38642642685d77dac) C:\windows\system32\DRIVERS\serscan.sys 11:45:10.0543 8100 StillCam - ok 11:45:10.0608 8100 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\windows\System32\wiaservc.dll 11:45:10.0627 8100 stisvc - ok 11:45:10.0667 8100 storflt (7785dc213270d2fc066538daf94087e7) C:\windows\system32\drivers\vmstorfl.sys 11:45:10.0668 8100 storflt - ok 11:45:10.0698 8100 StorSvc (c40841817ef57d491f22eb103da587cc) C:\windows\system32\storsvc.dll 11:45:10.0705 8100 StorSvc - ok 11:45:10.0725 8100 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\windows\system32\drivers\storvsc.sys 11:45:10.0726 8100 storvsc - ok 11:45:10.0819 8100 SUService (6ea2f517373771cac5188e82617c9c0b) C:\Program Files (x86)\Lenovo\System Update\SUService.exe 11:45:10.0832 8100 SUService - ok 11:45:10.0876 8100 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\windows\system32\drivers\swenum.sys 11:45:10.0876 8100 swenum - ok 11:45:10.0955 8100 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 11:45:11.0001 8100 SwitchBoard - ok 11:45:11.0085 8100 swprv (e08e46fdd841b7184194011ca1955a0b) C:\windows\System32\swprv.dll 11:45:11.0089 8100 swprv - ok 11:45:11.0132 8100 SynTP (772493a8945495f1a287bf6c4ca25b48) C:\windows\system32\DRIVERS\SynTP.sys 11:45:11.0135 8100 SynTP - ok 11:45:11.0243 8100 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\windows\system32\sysmain.dll 11:45:11.0263 8100 SysMain - ok 11:45:11.0375 8100 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\windows\System32\TabSvc.dll 11:45:11.0385 8100 TabletInputService - ok 11:45:11.0418 8100 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\windows\System32\tapisrv.dll 11:45:11.0433 8100 TapiSrv - ok 11:45:11.0454 8100 TBS (1be03ac720f4d302ea01d40f588162f6) C:\windows\System32\tbssvc.dll 11:45:11.0457 8100 TBS - ok 11:45:11.0568 8100 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\windows\system32\drivers\tcpip.sys 11:45:11.0587 8100 Tcpip - ok 11:45:11.0775 8100 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\windows\system32\DRIVERS\tcpip.sys 11:45:11.0785 8100 TCPIP6 - ok 11:45:11.0851 8100 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\windows\system32\drivers\tcpipreg.sys 11:45:11.0852 8100 tcpipreg - ok 11:45:11.0878 8100 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\windows\system32\drivers\tdpipe.sys 11:45:11.0879 8100 TDPIPE - ok 11:45:11.0911 8100 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\windows\system32\drivers\tdtcp.sys 11:45:11.0911 8100 TDTCP - ok 11:45:11.0972 8100 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\windows\system32\DRIVERS\tdx.sys 11:45:11.0973 8100 tdx - ok 11:45:12.0039 8100 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\windows\system32\drivers\termdd.sys 11:45:12.0040 8100 TermDD - ok 11:45:12.0100 8100 TermService (2e648163254233755035b46dd7b89123) C:\windows\System32\termsrv.dll 11:45:12.0120 8100 TermService - ok 11:45:12.0139 8100 Themes (f0344071948d1a1fa732231785a0664c) C:\windows\system32\themeservice.dll 11:45:12.0147 8100 Themes - ok 11:45:12.0172 8100 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\windows\system32\mmcss.dll 11:45:12.0174 8100 THREADORDER - ok 11:45:12.0257 8100 TmFilter (8b97ba7e28bd39a2bc4a2bb66a83fec0) C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmXPFlt.sys 11:45:12.0260 8100 TmFilter - ok 11:45:12.0369 8100 tmlisten (72fd200f1b49e83969d252e5eff6b6d1) C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe 11:45:12.0412 8100 tmlisten - ok 11:45:12.0586 8100 tmlwf (a678423d1d5afe965576f6aeb5e02edd) C:\windows\system32\DRIVERS\tmlwf.sys 11:45:12.0587 8100 tmlwf - ok 11:45:12.0668 8100 TmPfw (0f8f4107ccde33d2c9462e1c65b2c971) C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPfw.exe 11:45:12.0692 8100 TmPfw - ok 11:45:12.0724 8100 TmPreFilter (1889f49a828b1cf0e2866cdd325875b0) C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPreFlt.sys 11:45:12.0724 8100 TmPreFilter - ok 11:45:12.0807 8100 TmProxy (b55961fc9c78290f89538b4f932525b4) C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmProxy.exe 11:45:12.0816 8100 TmProxy - ok 11:45:12.0967 8100 tmtdi (a42e6780c52b248af54c6010a9a93384) C:\windows\system32\DRIVERS\tmtdi.sys 11:45:12.0973 8100 tmtdi - ok 11:45:13.0058 8100 tmwfp (939a47fc38f41198bd98b82a547e0f0f) C:\windows\system32\DRIVERS\tmwfp.sys 11:45:13.0062 8100 tmwfp - ok 11:45:13.0160 8100 TPHKLOAD (83415782d47f8064fcafea308abb2246) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe 11:45:13.0167 8100 TPHKLOAD - ok 11:45:13.0192 8100 TPHKSVC (c04bb65441913ab621c58a8bd3169b23) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe 11:45:13.0194 8100 TPHKSVC - ok 11:45:13.0225 8100 TPM (dbcc20c02e8a3e43b03c304a4e40a84f) C:\windows\system32\drivers\tpm.sys 11:45:13.0227 8100 TPM - ok 11:45:13.0239 8100 TPPWRIF (7165b5a9b4867f64a6d6935f57d4196b) C:\windows\system32\drivers\Tppwr64v.sys 11:45:13.0239 8100 TPPWRIF - ok 11:45:13.0278 8100 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\windows\System32\trkwks.dll 11:45:13.0289 8100 TrkWks - ok 11:45:13.0358 8100 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\windows\servicing\TrustedInstaller.exe 11:45:13.0361 8100 TrustedInstaller - ok 11:45:13.0417 8100 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\windows\system32\DRIVERS\tssecsrv.sys 11:45:13.0418 8100 tssecsrv - ok 11:45:13.0484 8100 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\windows\system32\drivers\tsusbflt.sys 11:45:13.0485 8100 TsUsbFlt - ok 11:45:13.0552 8100 tunnel (3566a8daafa27af944f5d705eaa64894) C:\windows\system32\DRIVERS\tunnel.sys 11:45:13.0554 8100 tunnel - ok 11:45:13.0594 8100 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\windows\system32\DRIVERS\uagp35.sys 11:45:13.0595 8100 uagp35 - ok 11:45:13.0649 8100 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\windows\system32\DRIVERS\udfs.sys 11:45:13.0652 8100 udfs - ok 11:45:13.0682 8100 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\windows\system32\UI0Detect.exe 11:45:13.0684 8100 UI0Detect - ok 11:45:13.0739 8100 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\windows\system32\drivers\uliagpkx.sys 11:45:13.0740 8100 uliagpkx - ok 11:45:13.0812 8100 umbus (dc54a574663a895c8763af0fa1ff7561) C:\windows\system32\drivers\umbus.sys 11:45:13.0812 8100 umbus - ok 11:45:13.0852 8100 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\windows\system32\DRIVERS\umpass.sys 11:45:13.0852 8100 UmPass - ok 11:45:13.0905 8100 UmRdpService (a293dcd756d04d8492a750d03b9a297c) C:\windows\System32\umrdp.dll 11:45:13.0919 8100 UmRdpService - ok 11:45:13.0967 8100 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\windows\System32\upnphost.dll 11:45:13.0984 8100 upnphost - ok 11:45:14.0009 8100 urvpndrv (e082a25008d29f1215d6398f59d74f4e) C:\windows\system32\DRIVERS\covpnv64.sys 11:45:14.0009 8100 urvpndrv - ok 11:45:14.0044 8100 USBAAPL64 (fb251567f41bc61988b26731dec19e4b) C:\windows\system32\Drivers\usbaapl64.sys 11:45:14.0045 8100 USBAAPL64 - ok 11:45:14.0080 8100 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\windows\system32\drivers\usbaudio.sys 11:45:14.0081 8100 usbaudio - ok 11:45:14.0118 8100 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\windows\system32\DRIVERS\usbccgp.sys 11:45:14.0119 8100 usbccgp - ok 11:45:14.0168 8100 usbcir (af0892a803fdda7492f595368e3b68e7) C:\windows\system32\drivers\usbcir.sys 11:45:14.0169 8100 usbcir - ok 11:45:14.0221 8100 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\windows\system32\drivers\usbehci.sys 11:45:14.0222 8100 usbehci - ok 11:45:14.0260 8100 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\windows\system32\DRIVERS\usbhub.sys 11:45:14.0262 8100 usbhub - ok 11:45:14.0301 8100 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\windows\system32\drivers\usbohci.sys 11:45:14.0302 8100 usbohci - ok 11:45:14.0332 8100 usbprint (73188f58fb384e75c4063d29413cee3d) C:\windows\system32\DRIVERS\usbprint.sys 11:45:14.0333 8100 usbprint - ok 11:45:14.0353 8100 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\windows\system32\drivers\USBSTOR.SYS 11:45:14.0354 8100 USBSTOR - ok 11:45:14.0376 8100 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\windows\system32\drivers\usbuhci.sys 11:45:14.0377 8100 usbuhci - ok 11:45:14.0420 8100 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\windows\System32\Drivers\usbvideo.sys 11:45:14.0421 8100 usbvideo - ok 11:45:14.0443 8100 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\windows\System32\uxsms.dll 11:45:14.0451 8100 UxSms - ok 11:45:14.0515 8100 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\windows\system32\lsass.exe 11:45:14.0517 8100 VaultSvc - ok 11:45:14.0583 8100 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\windows\system32\drivers\vdrvroot.sys 11:45:14.0584 8100 vdrvroot - ok 11:45:14.0651 8100 vds (8d6b481601d01a456e75c3210f1830be) C:\windows\System32\vds.exe 11:45:14.0658 8100 vds - ok 11:45:14.0697 8100 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\windows\system32\DRIVERS\vgapnp.sys 11:45:14.0698 8100 vga - ok 11:45:14.0720 8100 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\windows\System32\drivers\vga.sys 11:45:14.0720 8100 VgaSave - ok 11:45:14.0767 8100 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\windows\system32\drivers\vhdmp.sys 11:45:14.0769 8100 vhdmp - ok 11:45:14.0796 8100 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\windows\system32\drivers\viaide.sys 11:45:14.0796 8100 viaide - ok 11:45:14.0823 8100 vmbus (86ea3e79ae350fea5331a1303054005f) C:\windows\system32\drivers\vmbus.sys 11:45:14.0825 8100 vmbus - ok 11:45:14.0840 8100 VMBusHID (7de90b48f210d29649380545db45a187) C:\windows\system32\drivers\VMBusHID.sys 11:45:14.0840 8100 VMBusHID - ok 11:45:14.0869 8100 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\windows\system32\drivers\volmgr.sys 11:45:14.0870 8100 volmgr - ok 11:45:14.0921 8100 volmgrx (a255814907c89be58b79ef2f189b843b) C:\windows\system32\drivers\volmgrx.sys 11:45:14.0925 8100 volmgrx - ok 11:45:14.0949 8100 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\windows\system32\drivers\volsnap.sys 11:45:14.0952 8100 volsnap - ok 11:45:14.0976 8100 vpcbus (b4a73ca4ef9a02b9738cea9ad5fe5917) C:\windows\system32\DRIVERS\vpchbus.sys 11:45:14.0977 8100 vpcbus - ok 11:45:15.0034 8100 vpcnfltr (e675fb2b48c54f09895482e2253b289c) C:\windows\system32\DRIVERS\vpcnfltr.sys 11:45:15.0034 8100 vpcnfltr - ok 11:45:15.0075 8100 vpcusb (5fb42082b0d19a0268705f1dd343df20) C:\windows\system32\DRIVERS\vpcusb.sys 11:45:15.0076 8100 vpcusb - ok 11:45:15.0130 8100 vpcvmm (207b6539799cc1c112661a9b620dd233) C:\windows\system32\drivers\vpcvmm.sys 11:45:15.0133 8100 vpcvmm - ok 11:45:15.0303 8100 VSApiNt (3a5862d9a4fe4bbb2ffa1700e2b21b9b) C:\Program Files (x86)\Trend Micro\OfficeScan Client\VSApiNt.sys 11:45:15.0314 8100 VSApiNt - ok 11:45:15.0450 8100 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\windows\system32\DRIVERS\vsmraid.sys 11:45:15.0452 8100 vsmraid - ok 11:45:15.0598 8100 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\windows\system32\vssvc.exe 11:45:15.0615 8100 VSS - ok 11:45:15.0669 8100 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\windows\system32\DRIVERS\vwifibus.sys 11:45:15.0671 8100 vwifibus - ok 11:45:15.0689 8100 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\windows\system32\DRIVERS\vwififlt.sys 11:45:15.0690 8100 vwififlt - ok 11:45:15.0725 8100 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\windows\system32\DRIVERS\vwifimp.sys 11:45:15.0725 8100 vwifimp - ok 11:45:15.0773 8100 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\windows\system32\w32time.dll 11:45:15.0779 8100 W32Time - ok 11:45:15.0898 8100 W3SVC (b32009db1972e7f2c227499289c4384a) C:\windows\system32\inetsrv\iisw3adm.dll 11:45:15.0914 8100 W3SVC - ok 11:45:15.0952 8100 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\windows\system32\DRIVERS\wacompen.sys 11:45:15.0953 8100 WacomPen - ok 11:45:16.0012 8100 WANARP (356afd78a6ed4457169241ac3965230c) C:\windows\system32\DRIVERS\wanarp.sys 11:45:16.0013 8100 WANARP - ok 11:45:16.0016 8100 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\windows\system32\DRIVERS\wanarp.sys 11:45:16.0017 8100 Wanarpv6 - ok 11:45:16.0032 8100 WAS (b32009db1972e7f2c227499289c4384a) C:\windows\system32\inetsrv\iisw3adm.dll 11:45:16.0034 8100 WAS - ok 11:45:16.0180 8100 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\windows\system32\Wat\WatAdminSvc.exe 11:45:16.0214 8100 WatAdminSvc - ok 11:45:16.0323 8100 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\windows\system32\wbengine.exe 11:45:16.0357 8100 wbengine - ok 11:45:16.0443 8100 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\windows\System32\wbiosrvc.dll 11:45:16.0457 8100 WbioSrvc - ok 11:45:16.0552 8100 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\windows\System32\wcncsvc.dll 11:45:16.0568 8100 wcncsvc - ok 11:45:16.0585 8100 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\windows\System32\WcsPlugInService.dll 11:45:16.0593 8100 WcsPlugInService - ok 11:45:16.0628 8100 Wd (72889e16ff12ba0f235467d6091b17dc) C:\windows\system32\DRIVERS\wd.sys 11:45:16.0628 8100 Wd - ok 11:45:16.0663 8100 WDC_SAM (a3d04ebf5227886029b4532f20d026f7) C:\windows\system32\DRIVERS\wdcsam64.sys 11:45:16.0664 8100 WDC_SAM - ok 11:45:16.0714 8100 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\windows\system32\drivers\Wdf01000.sys 11:45:16.0721 8100 Wdf01000 - ok 11:45:16.0758 8100 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\windows\system32\wdi.dll 11:45:16.0761 8100 WdiServiceHost - ok 11:45:16.0764 8100 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\windows\system32\wdi.dll 11:45:16.0767 8100 WdiSystemHost - ok 11:45:16.0822 8100 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\windows\System32\webclnt.dll 11:45:16.0837 8100 WebClient - ok 11:45:16.0928 8100 WebFarmService (d4de1482f9770a6e3e4f03c4bc5eb193) C:\Program Files\IIS\Microsoft Web Farm Framework\WebFarmService.exe 11:45:16.0929 8100 WebFarmService - ok 11:45:16.0956 8100 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\windows\system32\wecsvc.dll 11:45:16.0970 8100 Wecsvc - ok 11:45:16.0981 8100 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\windows\System32\wercplsupport.dll 11:45:16.0990 8100 wercplsupport - ok 11:45:17.0008 8100 WerSvc (6d137963730144698cbd10f202e9f251) C:\windows\System32\WerSvc.dll 11:45:17.0010 8100 WerSvc - ok 11:45:17.0059 8100 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\windows\system32\DRIVERS\wfplwf.sys 11:45:17.0060 8100 WfpLwf - ok 11:45:17.0083 8100 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\windows\system32\drivers\wimmount.sys 11:45:17.0084 8100 WIMMount - ok 11:45:17.0143 8100 winachsf (1edbbf412a382550af6eb35f5e46928e) C:\windows\system32\DRIVERS\CAX_CNXT.sys 11:45:17.0148 8100 winachsf - ok 11:45:17.0181 8100 WinDefend - ok 11:45:17.0190 8100 WinHttpAutoProxySvc - ok 11:45:17.0276 8100 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\windows\system32\wbem\WMIsvc.dll 11:45:17.0297 8100 Winmgmt - ok 11:45:17.0417 8100 WinRM (bcb1310604aa415c4508708975b3931e) C:\windows\system32\WsmSvc.dll 11:45:17.0452 8100 WinRM - ok 11:45:17.0589 8100 WinUsb (fe88b288356e7b47b74b13372add906d) C:\windows\system32\DRIVERS\WinUSB.sys 11:45:17.0590 8100 WinUsb - ok 11:45:17.0672 8100 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\windows\System32\wlansvc.dll 11:45:17.0683 8100 Wlansvc - ok 11:45:17.0724 8100 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\windows\system32\drivers\wmiacpi.sys 11:45:17.0725 8100 WmiAcpi - ok 11:45:17.0771 8100 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\windows\system32\wbem\WmiApSrv.exe 11:45:17.0773 8100 wmiApSrv - ok 11:45:17.0841 8100 WMPNetworkSvc - ok 11:45:17.0902 8100 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\windows\System32\wpcsvc.dll 11:45:17.0910 8100 WPCSvc - ok 11:45:17.0955 8100 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\windows\system32\wpdbusenum.dll 11:45:17.0964 8100 WPDBusEnum - ok 11:45:17.0989 8100 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\windows\system32\drivers\ws2ifsl.sys 11:45:17.0990 8100 ws2ifsl - ok 11:45:18.0015 8100 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\windows\System32\wscsvc.dll 11:45:18.0025 8100 wscsvc - ok 11:45:18.0070 8100 WSDPrintDevice (8d918b1db190a4d9b1753a66fa8c96e8) C:\windows\system32\DRIVERS\WSDPrint.sys 11:45:18.0070 8100 WSDPrintDevice - ok 11:45:18.0076 8100 WSDScan (4a2a5c50dd1a63577d3aca94269fbc7f) C:\windows\system32\DRIVERS\WSDScan.sys 11:45:18.0077 8100 WSDScan - ok 11:45:18.0081 8100 WSearch - ok 11:45:18.0269 8100 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\windows\system32\wuaueng.dll 11:45:18.0293 8100 wuauserv - ok 11:45:18.0413 8100 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\windows\system32\drivers\WudfPf.sys 11:45:18.0414 8100 WudfPf - ok 11:45:18.0449 8100 WUDFRd (cf8d590be3373029d57af80914190682) C:\windows\system32\DRIVERS\WUDFRd.sys 11:45:18.0450 8100 WUDFRd - ok 11:45:18.0489 8100 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\windows\System32\WUDFSvc.dll 11:45:18.0499 8100 wudfsvc - ok 11:45:18.0533 8100 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\windows\System32\wwansvc.dll 11:45:18.0547 8100 WwanSvc - ok 11:45:18.0608 8100 XAudio (e8f3fa126a06f8e7088f63757112a186) C:\windows\system32\DRIVERS\XAudio64.sys 11:45:18.0609 8100 XAudio - ok 11:45:18.0672 8100 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 11:45:18.0829 8100 \Device\Harddisk0\DR0 - ok 11:45:18.0836 8100 Boot (0x1200) (518ac2f78a950c09eee48690fd9064a3) \Device\Harddisk0\DR0\Partition0 11:45:18.0837 8100 \Device\Harddisk0\DR0\Partition0 - ok 11:45:18.0865 8100 Boot (0x1200) (825e999e654adf9cd10fa70a595d3e41) \Device\Harddisk0\DR0\Partition1 11:45:18.0871 8100 \Device\Harddisk0\DR0\Partition1 - ok 11:45:18.0871 8100 ============================================================ 11:45:18.0871 8100 Scan finished 11:45:18.0871 8100 ============================================================ 11:45:18.0889 4768 Detected object count: 0 11:45:18.0889 4768 Actual detected object count: 0

Had to contact corporate IT to get the password to stop TrendMicro OfficeScan. They insisted I run malwarebytes first. This found & quarantined some malware, but did not fix the problem, so I was then able to get IT to type the password (to shut off OfficeScan) & I ran ComboFix. Logs from both are provided. However, the problem is not solved (search results in google and links opened in a new tab opened from any page still get redirected about 1 in 4 times) Note that ComboFix did not prompt for a restart. after restart, problem still persists. Note: I did restart after Malwarbytes did its id/quarantine (it prompted me to). …………….. Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.05.29.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 JSmith :: CABELJSMITH-L1 [administrator] 5/29/2012 12:55:16 PM mbam-log-2012-05-29 (12-55-16).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 281500 Time elapsed: 11 minute(s), 52 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 1 HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ElevatedDiagnostics (Trojan.Happili.XGen) -> Data: rundll32.exe "C:\Users\JSmith\AppData\Local\Google\ElevatedDiagnostics\kkjdsstku.dll",DllRegisterServer -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 3 C:\Users\JSmith\AppData\Local\Google\ElevatedDiagnostics\kkjdsstku.dll (Trojan.Happili.XGen) -> Quarantined and deleted successfully. C:\Users\JSmith\AppData\Local\Temp\0.5020643572072956 (Trojan.Happili) -> Quarantined and deleted successfully. C:\Users\JSmith\AppData\Local\Temp\nsqA6D0.tmp\kkjdsstku.dll (Trojan.Happili.XGen) -> Quarantined and deleted successfully. (end) …………….. ComboFix 12-05-29.01 - JSmith 05/29/2012 13:29:04.1.2 - x64 Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8088.6106 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe FW: Trend Micro Personal Firewall *Disabled* {50C2E989-60CF-0845-AFD3-290B7D301E79} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\data c:\data\ibdata1 c:\programdata\Roaming . . ((((((((((((((((((((((((( Files Created from 2012-04-28 to 2012-05-29 ))))))))))))))))))))))))))))))) . . 2012-05-29 20:37 . 2012-05-29 20:37 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-05-29 20:37 . 2012-05-29 20:37 ——– d—–w- c:\users\da0006024\AppData\Local\temp 2012-05-29 20:37 . 2012-05-29 20:37 ——– d—–w- c:\users\Classic .NET AppPool\AppData\Local\temp 2012-05-29 20:37 . 2012-05-29 20:37 ——– d—–w- c:\users\Administrator\AppData\Local\temp 2012-05-21 16:37 . 2011-06-23 16:36 18512 —-a-w- c:\windows\system32\drivers\urfltv64.sys 2012-05-18 22:11 . 2012-05-18 22:11 ——– d—–w- c:\windows\symbols 2012-05-18 22:04 . 2012-05-18 22:04 ——– d—–w- c:\programdata\VS 2012-05-18 21:54 . 2012-05-18 21:54 ——– d—–w- c:\program files\Microsoft Silverlight 2012-05-18 21:54 . 2012-05-18 21:54 ——– d—–w- c:\program files (x86)\Microsoft Silverlight 2012-05-18 21:11 . 2012-01-25 06:38 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-05-18 21:11 . 2012-01-25 06:38 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-05-18 19:46 . 2012-05-18 19:46 ——– d–h–w- c:\windows\system32\CanonIJ Uninstaller Information 2012-05-18 19:46 . 2012-05-18 19:46 ——– d–h–w- c:\programdata\CanonIJFAX 2012-05-18 19:46 . 2012-05-18 19:46 ——– d–h–w- c:\programdata\CanonBJ 2012-05-18 19:46 . 2010-10-18 12:00 88576 —-a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPPAN.DLL 2012-05-18 19:46 . 2010-10-18 12:00 29696 —-a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPDAN.DLL 2012-05-18 19:46 . 2010-11-12 12:00 302080 —-a-w- c:\windows\system32\CNCALAN.DLL 2012-05-18 19:46 . 2010-10-18 12:00 374784 —-a-w- c:\windows\system32\CNMLMAN.DLL 2012-05-18 00:12 . 2012-05-18 00:12 ——– d—–w- c:\windows\system32\SPReview 2012-05-18 00:11 . 2012-05-18 00:11 ——– d—–w- c:\windows\system32\EventProviders 2012-05-18 00:01 . 2010-11-20 12:21 189952 —-a-w- c:\windows\SysWow64\wdscore.dll 2012-05-18 00:01 . 2010-11-20 12:21 189952 —-a-w- c:\windows\SysWow64\sqmapi.dll 2012-05-18 00:01 . 2010-11-20 12:17 209920 —-a-w- c:\windows\SysWow64\PkgMgr.exe 2012-05-18 00:01 . 2010-11-20 12:18 323072 —-a-w- c:\windows\SysWow64\drvstore.dll 2012-05-18 00:01 . 2010-11-20 12:18 257024 —-a-w- c:\windows\SysWow64\dpx.dll 2012-05-18 00:01 . 2010-11-20 12:21 363008 —-a-w- c:\windows\SysWow64\wbemcomn.dll 2012-05-18 00:01 . 2010-11-20 12:21 189952 —-a-w- c:\program files (x86)\Windows Portable Devices\sqmapi.dll 2012-05-18 00:01 . 2010-11-20 12:19 606208 —-a-w- c:\windows\SysWow64\wbem\fastprox.dll 2012-05-18 00:00 . 2010-11-20 13:27 524288 —-a-w- c:\windows\system32\wmicmiplugin.dll 2012-05-18 00:00 . 2010-11-20 13:27 529408 —-a-w- c:\windows\system32\wbemcomn.dll 2012-05-18 00:00 . 2010-11-20 13:27 1225216 —-a-w- c:\windows\system32\wbem\wbemcore.dll 2012-05-18 00:00 . 2010-11-20 13:27 244736 —-a-w- c:\program files\Windows Portable Devices\sqmapi.dll 2012-05-18 00:00 . 2010-11-20 13:27 244736 —-a-w- c:\windows\system32\sqmapi.dll 2012-05-18 00:00 . 2010-11-20 13:27 933376 —-a-w- c:\windows\system32\SmiEngine.dll 2012-05-18 00:00 . 2010-11-20 13:25 199168 —-a-w- c:\windows\system32\PkgMgr.exe 2012-05-18 00:00 . 2010-11-20 13:26 422912 —-a-w- c:\windows\system32\drvstore.dll 2012-05-18 00:00 . 2010-11-20 13:26 399872 —-a-w- c:\windows\system32\dpx.dll 2012-05-17 23:42 . 2012-03-30 11:35 1918320 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-05-17 23:40 . 2012-03-31 05:42 1732096 —-a-w- c:\program files\Windows Journal\NBDoc.DLL 2012-05-17 23:40 . 2012-03-31 05:40 1367552 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2012-05-17 23:40 . 2010-11-20 13:24 2164224 —-a-w- c:\program files\Windows Journal\Journal.exe 2012-05-17 23:40 . 2012-03-31 05:40 1402880 —-a-w- c:\program files\Windows Journal\JNWDRV.dll 2012-05-17 23:40 . 2012-03-31 05:40 1393664 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll 2012-05-17 23:40 . 2012-03-31 04:29 936960 —-a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2012-05-17 23:17 . 2012-05-17 23:17 ——– d—–w- c:\program files (x86)\Oracle 2012-05-17 23:17 . 2012-04-05 01:47 772504 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-05-17 23:08 . 2012-04-21 01:19 97208 —-a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll 2012-05-15 20:38 . 2012-05-15 20:38 ——– d—–w- c:\program files (x86)\Common Files\Skype 2012-05-13 00:17 . 2012-05-13 00:17 ——– d—–w- c:\users\JSmith\AppData\Local\TechSmith 2012-05-13 00:14 . 2012-05-13 00:14 ——– d—–w- c:\windows\SysWow64\QuickTime 2012-05-13 00:13 . 2012-05-13 00:16 ——– d—–w- c:\programdata\TechSmith 2012-05-13 00:13 . 2012-05-13 00:13 ——– d—–w- c:\program files (x86)\Common Files\TechSmith Shared 2012-05-13 00:13 . 2012-05-13 00:13 ——– d—–w- c:\program files (x86)\TechSmith 2012-05-13 00:04 . 2012-05-13 00:04 ——– d—–w- c:\program files (x86)\WinPcap 2012-05-13 00:01 . 2012-05-13 00:09 ——– d—–w- c:\program files (x86)\WMR14 2012-05-12 23:39 . 2012-05-12 23:39 ——– d—–w- c:\program files (x86)\CamStudio 2.6b 2012-05-12 23:39 . 2010-10-24 07:56 49664 —-a-w- c:\windows\system32\CamCodec.dll 2012-05-10 00:12 . 2012-05-10 00:12 ——– d—–w- c:\program files (x86)\Fiddler2 2012-05-04 17:46 . 2012-05-04 18:46 8744608 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-05-04 17:12 . 2012-05-04 18:46 419488 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-05-04 16:01 . 2012-03-01 06:46 23408 —-a-w- c:\windows\system32\drivers\fs_rec.sys 2012-05-04 16:01 . 2012-03-01 06:38 220672 —-a-w- c:\windows\system32\wintrust.dll 2012-05-04 16:01 . 2012-03-01 06:33 81408 —-a-w- c:\windows\system32\imagehlp.dll 2012-05-04 16:01 . 2012-03-01 06:28 5120 —-a-w- c:\windows\system32\wmi.dll 2012-05-04 16:01 . 2012-03-01 05:37 172544 —-a-w- c:\windows\SysWow64\wintrust.dll 2012-05-04 16:01 . 2012-03-01 05:33 159232 —-a-w- c:\windows\SysWow64\imagehlp.dll 2012-05-04 16:01 . 2012-03-01 05:29 5120 —-a-w- c:\windows\SysWow64\wmi.dll 2012-05-04 03:22 . 2012-05-18 20:09 ——– d—–w- c:\program files (x86)\Mozilla Maintenance Service 2012-05-04 03:22 . 2012-04-21 01:19 157352 —-a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe 2012-05-04 03:22 . 2012-04-21 01:19 129976 —-a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe 2012-04-29 21:50 . 2012-04-29 21:51 ——– d—–w- c:\program files (x86)\Photosynth . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-05-19 05:09 . 2011-02-02 17:20 564544 —-a-w- c:\programdata\Microsoft\VWDExpress\10.0\1033\ResourceCache.dll 2012-05-18 20:20 . 2009-07-14 02:36 152576 —-a-w- c:\windows\SysWow64\msclmd.dll 2012-05-18 20:20 . 2009-07-14 02:36 175616 —-a-w- c:\windows\system32\msclmd.dll 2012-05-04 18:46 . 2011-07-12 05:04 70304 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-04-29 18:57 . 2012-04-29 18:57 10630568 —-a-r- c:\users\JSmith\AppData\Roaming\Microsoft\Installer\{62939D22-F2E8-44BD-A655-0D1F41D5EBA2}\PhotoSceneEditor.exe 2012-04-19 03:56 . 2012-04-19 03:56 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-04-19 03:56 . 2012-04-19 03:56 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts 2012-04-05 01:47 . 2010-08-16 17:39 687504 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-04-04 22:56 . 2012-01-11 20:58 24904 —-a-w- c:\windows\system32\drivers\mbam.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\JSmith\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\JSmith\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\JSmith\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\JSmith\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\P4EXPCheckoutOverlay] @="{80E008A4-EAE7-4867-AEB0-1A245F070F25}" [HKEY_CLASSES_ROOT\CLSID\{80E008A4-EAE7-4867-AEB0-1A245F070F25}] 2010-12-02 00:02 873472 —-a-w- c:\program files\Perforce\p4exp.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\P4EXPSyncdOverlay] @="{ADF262C1-E8FE-49BE-AD63-F77CD4A6CCD9}" [HKEY_CLASSES_ROOT\CLSID\{ADF262C1-E8FE-49BE-AD63-F77CD4A6CCD9}] 2010-12-02 00:02 873472 —-a-w- c:\program files\Perforce\p4exp.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\P4EXPUpdateOverlay] @="{C550CDA2-37D7-4838-A9D7-65ECB1EB5AB2}" [HKEY_CLASSES_ROOT\CLSID\{C550CDA2-37D7-4838-A9D7-65ECB1EB5AB2}] 2010-12-02 00:02 873472 —-a-w- c:\program files\Perforce\p4exp.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ooVoo.exe"="c:\program files (x86)\ooVoo\ooVoo.exe" [2011-11-20 22453840] "MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "PWMTRV"="c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2011-10-04 1631296] "OfficeScanNT Monitor"="c:\program files (x86)\Trend Micro\OfficeScan Client\pccntmon.exe" [2012-01-19 1378784] "Communicator"="c:\program files (x86)\Microsoft Office Communicator\communicator.exe" [2011-09-06 5152096] "LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536] "AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-23 402432] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-23 150528] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "HttpWatch_RegIEPlugin"="c:\program files (x86)\HttpWatch\regieplugin.exe" [2011-08-10 599336] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] "AeXAgentLogon"="c:\program files (x86)\Altiris\Altiris Agent\AeXAgentActivate.exe" [2010-09-17 228136] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Samsung.PCSync"="c:\program files (x86)\Samsung\Samsung PC Studio 7\PcSync2.exe" [2009-06-04 1294336] . c:\users\JSmith\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\JSmith\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-14 24246216] Password Safe.lnk - c:\program files (x86)\Password Safe\pwsafe.exe [2009-6-27 2256896] Trillian.lnk - c:\program files (x86)\Trillian\trillian.exe [2011-8-19 2068832] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files (x86)\Digital Line Detect\DLG.exe [2012-1-11 50688] HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ SetTaskbar.vbs [2010-6-24 5301] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au] "NoAutoUpdate"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux6"=wdmaud.drv . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-4027829005-1107895287-290554039-30973\Scripts\Logon\0\0] "Script"=\\corp.local\NETLOGON\admpwupd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-4027829005-1107895287-290554039-30973\Scripts\Logon\1\0] "Script"=\\corp.local\netlogon\teamviewer\corp-teamviewerinstall.bat . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-4027829005-1107895287-290554039-30973\Scripts\Logon\2\0] "Script"=\\corp.local\NETLOGON\CABEL\KIX32.EXE . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-27 136176] R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2011-07-13 101736] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856] R2 TmFilter;Trend Micro Filter;c:\program files (x86)\Trend Micro\OfficeScan Client\TmXPFlt.sys [2011-07-12 342288] R2 TmPreFilter;Trend Micro PreFilter;c:\program files (x86)\Trend Micro\OfficeScan Client\TmPreFlt.sys [2011-07-12 42768] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 257696] R3 AltirisAgentProvider;AltirisAgentProvider;c:\program files (x86)\Altiris\Altiris Agent\Agents\WMIProviderAgent\AltirisAgentProvider.exe [2010-09-17 619816] R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [x] R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [2009-12-18 17864] R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x] R3 f5ipfw;F5 Networks StoneWall Filter;c:\windows\system32\drivers\urfltv64.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-27 136176] R3 ioatdma1;ioatdma1;c:\windows\System32\Drivers\qd162x64.sys [x] R3 ioatdma2;Intel® QuickData Technology device ver.2;c:\windows\System32\Drivers\qd262x64.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-05-04 129976] R3 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2011-01-07 63304] R3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x] R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2011-10-04 89152] R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [2011-10-04 175168] R3 ReportServer;SQL Server Reporting Services (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2011-09-23 2084712] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TmPfw;OfficeScan NT Firewall;c:\program files (x86)\Trend Micro\OfficeScan Client\TmPfw.exe [2010-06-29 596032] R3 TmProxy;OfficeScan NT Proxy Service;c:\program files (x86)\Trend Micro\OfficeScan Client\TmProxy.exe [2010-04-25 917768] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [x] R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x] R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [x] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2010-04-03 59744] R4 RsFx0105;RsFx0105 Driver;c:\windows\system32\DRIVERS\RsFx0105.sys [x] R4 RsFx0151;RsFx0151 Driver;c:\windows\system32\DRIVERS\RsFx0151.sys [x] R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2011-06-18 431456] S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys [x] S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiifx64.sys [x] S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-08-08 1166848] S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-06-03 134928] S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136] S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [2011-07-13 133992] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x] S2 tmwfp;Trend Micro WFP Callout Driver;c:\windows\system32\DRIVERS\tmwfp.sys [x] S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [2011-07-13 145256] S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2011-07-13 142696] S2 WebFarmService;Web Farm Controller Service;c:\program files\IIS\Microsoft Web Farm Framework\WebFarmService.exe [2011-01-20 15640] S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [x] S3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [x] S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x] S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [x] S3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2011-10-04 478056] S3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y62x64.sys [x] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [x] S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x] S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\covpnv64.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] iissvcs REG_MULTI_SZ w3svc was apphost REG_MULTI_SZ apphostsvc hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2012-05-29 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 18:46] . 2012-05-29 c:\windows\Tasks\Defraggler Volume C Task.job - c:\program files (x86)\Defraggler\df.exe [2010-09-20 16:18] . 2012-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-27 18:45] . 2012-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-27 18:45] . 2012-05-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4027829005-1107895287-290554039-30973Core.job - c:\users\JSmith\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-02 21:25] . 2012-05-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4027829005-1107895287-290554039-30973UA.job - c:\users\JSmith\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-02 21:25] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\JSmith\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\JSmith\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\JSmith\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\JSmith\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\P4EXPCheckoutOverlay] @="{80E008A4-EAE7-4867-AEB0-1A245F070F25}" [HKEY_CLASSES_ROOT\CLSID\{80E008A4-EAE7-4867-AEB0-1A245F070F25}] 2010-12-02 00:02 1122816 —-a-w- c:\program files\Perforce\p4exp64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\P4EXPSyncdOverlay] @="{ADF262C1-E8FE-49BE-AD63-F77CD4A6CCD9}" [HKEY_CLASSES_ROOT\CLSID\{ADF262C1-E8FE-49BE-AD63-F77CD4A6CCD9}] 2010-12-02 00:02 1122816 —-a-w- c:\program files\Perforce\p4exp64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\P4EXPUpdateOverlay] @="{C550CDA2-37D7-4838-A9D7-65ECB1EB5AB2}" [HKEY_CLASSES_ROOT\CLSID\{C550CDA2-37D7-4838-A9D7-65ECB1EB5AB2}] 2010-12-02 00:02 1122816 —-a-w- c:\program files\Perforce\p4exp64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2008-11-02 14:26 91648 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2008-11-02 14:26 91648 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2008-11-02 14:26 91648 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2008-11-02 14:26 91648 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2008-11-02 14:26 91648 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2008-11-02 14:26 91648 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2008-11-02 14:26 91648 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2008-11-02 14:26 91648 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2008-11-02 14:26 91648 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208] "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1873256] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 162328] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 417304] "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-11-19 307768] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = www.google.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local Trusted Zone: cengage.com\access Trusted Zone: cengage.com\magellan Trusted Zone: cengage.com\magellantest Trusted Zone: concursolutions.com\www Trusted Zone: OHCINTESTW7348 Trusted Zone: OHCINTESTW7348\OHCINTESTW7348 TCP: DhcpNameServer = 192.168.0.1 DPF: {195538FD-1C39-44B1-A7C3-5D7137A8A8F1} - hxxps://access.cengage.com/vdesk/terminal/f5opswati.cab#Version=7060,2012,419,1901 DPF: {30CF9713-6614-4556-B5F5-66F8C7F9DEF1} - hxxps://access.cengage.com/vdesk/terminal/f5opswati.cab#Version=7060,2012,419,1901 DPF: {49EC7987-E331-44E3-B170-748B58A268B9} - hxxps://access.cengage.com/vdesk/terminal/f5opswati.cab#Version=7060,2012,419,1901 DPF: {831FB9D5-7704-46BE-B4AE-BD946EE97F4C} - hxxp://magellan.cengage.com/sales_enu/20433/applets/SiebelAx_OutBound_mail.cab DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - hxxp://magellan.cengage.com/sales_enu/20433/applets/SiebelAx_Desktop_Integration.cab DPF: {A62585A1-D5ED-4505-9A71-0268DD51982C} - hxxp://magellan.cengage.com/sales_enu/20433/applets/SiebelAx_HI_Client.cab DPF: {E16AD7BB-6189-4C16-985A-7314EF875AC8} - hxxp://magellan.cengage.com/sales_enu/20433/applets/SiebelAx_Calendar.cab DPF: {E734BF43-7194-4E3A-832F-307606DDF665} - hxxps://ash-cs6.conferenceservers.com/components/WDPLUGIN.CAB DPF: {EBDC91CB-F23F-477D-B152-3F7243760D04} - hxxps://access.cengage.com/vdesk/terminal/f5opswati.cab#Version=7060,2012,419,1901 FF - ProfilePath - c:\users\JSmith\AppData\Roaming\Mozilla\Firefox\Profiles\c7qjzvzk.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Toolbar-Locked - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe HKLM-Run-(Default) - (no file) HKLM-Run-AuditWizard - \\ohcinaudit\scanner$\scan32.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe . . "ImagePath"="system32\drivers\btusbflt.sys" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\C:/Program Files/Perforce] – . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc] "ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Communications] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\eXpress\NS Client] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-05-29 13:41:43 ComboFix-quarantined-files.txt 2012-05-29 20:41 . Pre-Run: 52,887,855,104 bytes free Post-Run: 61,644,427,264 bytes free . - - End Of File - - EEFB5B41BA1597CB3D031C129087B0DE