Spyware / Malware / Virus Removal

TDSSKiller Found igfx and VzCdbsvc unsigned items, seems serious, shou

5 min read

Looking for the outcome? Ask AI

willbuxtonfarms Topic Starter

Post #1June 7, 2012, 2:45 PM UTC

Hello all,

I hope I'm posting this in the right forum. So first of all I'm not having any functional problems with my computer, it seems to be running fine. I run MalwareBytes and TDSSKiller daily to keep my system clean. I also run Norton IS 2012 as my primary virus protection software. Usually nothing serious comes up as being found my MalwareBytes or TDSSKiller until I ran TDSSKiller today with the "verify file digital signatures" option. It flagged 6 files as being unsigned and "suspicious item, medium risk".

Here are the items that TDSSKiller flagged:

1. Service: igfx
Service Type: Kernal Driver (0x1)
Service Start: (Demand (0x3)
File: C:/Windows/system32/Drivers/igdkmd64.sys

2. Service: Impcd
Service Type: Kernal Driver (0x1)
Service Start: (Demand (0x3)
File: C:/Windows/system32/Drivers/Impcd.sys

3. Service: IntcDAud
Service Type: Kernal Driver (0x1)
Service Start: (Demand (0x3)
File: C:/Windows/system32/Drivers/IntcDAud.sys

4. Service: SampleCollector
Service start: Demand (0x3)
File: C/Program Files/Sony/VAIO Care/Collsvc.exe

5. Service: Vaio Entertainment TV Device Arbitration Service
Service start: Demand (0x3)
File: C/Program Files(x86)/Common Files/Sony Shared/VAIO Entertainment Platform/VzHardwareResourceManager/VzHardwareResourceManager/VzHardwareResourceManager/.exe

6. Service: VzCdbsvc
Service Start: Demand (0x3)
File: C/Program Files(x86)/Common Files/Sony Shared/VAIO Entertainment Platform/VzCdb/VzCdbSvc.exe

I am worried about igfx and VzCdbsvc particular because I have read on other forums that VzCdbsvc can be corrupted by malware and I get the "AMD:CCC AEM CAPTURING background is waiting to close" error whenever I shut down my laptop and I don't know if that's related to igfx or not. Should I be worried? If so, how can I fix these? I've been telling TDSSKiller to just "skp" these for now.

Thanks!

mrp

Post #2June 9, 2012, 8:18 PM UTC

Hello and welcome to What the Tech.

My name is Michael and I will be helping you with your computer problems.

Be aware that I am currently in training, which means that my replies must first be approved by one of my teachers. This may cause a slight delay in my responses, but keep in mind that this process is only to ensure you are receiving advice of the utmost accuracy.

Please keep the following points in mind:

Malware research is often a time consuming process and sometimes multiple tools/methods will have to be employed before an infection is completely dealt with. Please be patient during the process of removal.
Read my instructions carefully before carrying them out. Also, consider printing out any instructions in case you lose your Internet connection.
If you have any questions, please ask before carrying out a fix. Clearing up any confusion beforehand will save time in the long run. That said, I will try to post instructions as clearly and concisely as possible.
Please reply to this thread. Do not start a new topic, and do not request help on other forums during the course of the cleaning process.
If you do not reply after three (3) days, your thread will be closed.

IMPORTANT NOTE: Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

I will be back as soon as possible with a response.

willbuxtonfarms

Post #3June 9, 2012, 8:24 PM UTC

Am I supposed to reply every 3 days even if nobody else replies? I'm confused.

mrp

Post #4June 10, 2012, 3:48 AM UTC

3 days after one of my replies. If for some reason I can't respond within that time period, someone else will assist you, so don't worry about that.

Please copy/paste your latest TDSSKiller log in your next reply. It should be located in the root in your C: drive. Also, please carry out the following instructions:

OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Select All Users
Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /rp /s
DRIVES
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Post both logs

[*]aswMBR

Please download aswMBR and save it to your desktop.

Double click aswMBR.exe to start the tool.
When prompted to download virus definitions, please do so.
Click Scan. Note: Do NOT attempt any Fix yet.
When the scan completes, click Save log, save it to your desktop and post it in your next reply.
There should also be another file that is created on your desktop named MBR.dat. Please right-click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

mrp

Post #5June 13, 2012, 11:33 PM UTC

Hello willbuxtonfarms, Do you still need help?

willbuxtonfarms

Post #6June 14, 2012, 2:48 AM UTC

Hello willbuxtonfarms,

Do you still need help?

Yes I do. But whenever I try to run OTL, Norton warns me against running it and then when I run OTL, after about 10 seconds Norton's SONAR blocks it from running and deletes it automatically b/c it says it is "behaving suspiciously".

Should I temporarily disable Norton? Is OTL a safe program to run?

mrp

Post #7June 14, 2012, 10:43 PM UTC

Yes, it would probably be a good idea to temporarily disable your anti-virus. Instructions for doing so can be found here.

And yes, OTL is safe. You can see in other topics that we ask most of our users to run OTL.

willbuxtonfarms

Post #8June 15, 2012, 2:40 PM UTC

Here are the logs you requested, please note that OTL only created 1 log.

**********************************OTL Log***************************************************************************

OTL logfile created on: 6/14/2012 9:29:02 PM - Run 2
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Users\v\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.86 Gb Total Physical Memory | 1.95 Gb Available Physical Memory | 50.46% Memory free
4.72 Gb Paging File | 2.61 Gb Available in Paging File | 55.27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 282.38 Gb Total Space | 0.42 Gb Free Space | 0.15% Space Free | Partition Type: NTFS

Computer Name: v-VAIO | User Name: v | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/06/14 21:27:50 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\v\Desktop\OTL.exe
PRC - [2011/08/04 00:18:43 | 000,126,400 | R— | M] (Symantec Corporation) – C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccsvchst.exe
PRC - [2010/01/21 22:40:10 | 000,182,664 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe
PRC - [2010/01/19 23:58:42 | 000,035,328 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe
PRC - [2010/01/19 23:58:42 | 000,016,384 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe
PRC - [2010/01/19 23:58:40 | 000,017,920 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe
PRC - [2009/12/14 16:06:24 | 002,320,920 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2009/12/14 16:06:08 | 000,268,824 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2009/12/02 01:03:52 | 000,204,648 | —- | M] (Sony Corporation) – C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
PRC - [2009/12/02 01:03:52 | 000,112,488 | —- | M] (Sony Corporation) – C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
PRC - [2009/11/20 18:25:24 | 000,013,336 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2009/11/20 18:25:22 | 000,284,696 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
PRC - [2009/10/24 06:18:54 | 000,360,224 | —- | M] (Sony Corporation) – c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
PRC - [2009/10/24 06:18:52 | 000,597,792 | —- | M] (Sony Corporation) – C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
PRC - [2009/09/14 22:24:08 | 000,206,336 | —- | M] (Sony Corporation) – C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
PRC - [2009/09/14 21:53:48 | 000,642,416 | —- | M] (Sony Corporation) – C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
PRC - [2009/09/06 09:06:20 | 000,169,312 | —- | M] (Adobe Systems Incorporated) – c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
PRC - [2009/08/26 22:24:00 | 000,320,880 | —- | M] (Sony Corporation) – C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
PRC - [2008/09/18 13:59:10 | 000,104,960 | —- | M] (ArcSoft, Inc.) – C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
PRC - [2007/07/24 14:15:14 | 000,185,632 | —- | M] (Protexis Inc.) – C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
PRC - [2007/01/04 22:48:50 | 000,112,152 | —- | M] (InterVideo) – C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe

========== Modules (No Company Name) ==========

MOD - [2012/06/13 12:24:12 | 011,833,344 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll
MOD - [2012/06/13 12:22:54 | 012,436,480 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/13 12:22:44 | 001,591,808 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/05/10 21:05:11 | 000,771,584 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012/05/10 21:04:40 | 000,025,600 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\2ec98ab0193d64e95b7d09d094deed97\Accessibility.ni.dll
MOD - [2012/05/10 21:04:29 | 003,347,968 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012/05/10 21:04:25 | 005,452,800 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/05/10 21:04:22 | 000,971,264 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/05/10 21:04:21 | 007,967,232 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/05/10 21:04:16 | 011,492,864 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012/04/23 18:35:09 | 000,630,784 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2012/03/21 18:32:36 | 005,025,792 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2012/01/03 22:51:03 | 003,190,784 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2011/12/25 16:42:15 | 005,255,168 | —- | M] () – C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
MOD - [2010/11/04 21:58:14 | 002,048,000 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2010/11/04 21:58:10 | 000,303,104 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2010/11/04 21:58:09 | 000,385,024 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
MOD - [2010/01/21 22:40:10 | 000,182,664 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe
MOD - [2010/01/21 22:40:10 | 000,109,568 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\DevicePanel.dll
MOD - [2010/01/19 23:58:42 | 000,125,440 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\SonyCommonLib.dll
MOD - [2010/01/19 23:58:42 | 000,035,328 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe
MOD - [2010/01/19 23:58:42 | 000,027,648 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.BtPower.dll
MOD - [2010/01/19 23:58:42 | 000,023,040 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.Generic.dll
MOD - [2010/01/19 23:58:42 | 000,018,944 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\DictionaryLookup.dll
MOD - [2010/01/19 23:58:42 | 000,016,384 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe
MOD - [2010/01/19 23:58:42 | 000,015,360 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.NativeWifiThirdPartyApp.dll
MOD - [2010/01/19 23:58:42 | 000,009,728 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.TosBtThirdPartyApp.dll
MOD - [2010/01/19 23:58:42 | 000,007,680 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\DebugMsg.dll
MOD - [2010/01/19 23:58:42 | 000,005,120 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.ThirdPartyApp.dll
MOD - [2010/01/19 23:58:42 | 000,004,608 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.Power.dll
MOD - [2010/01/19 23:58:40 | 000,017,920 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe
MOD - [2010/01/19 23:58:40 | 000,015,360 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\SharedInterfaces.dll
MOD - [2010/01/19 23:58:40 | 000,011,264 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\MessageXML.dll
MOD - [2010/01/19 23:58:40 | 000,009,728 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\Resources.dll
MOD - [2010/01/19 23:58:40 | 000,006,656 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.WlanPower.dll
MOD - [2010/01/19 23:58:40 | 000,005,632 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\SystemPowerDLL.dll
MOD - [2010/01/19 23:58:40 | 000,005,120 | —- | M] () – C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.Generic.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/09/23 15:37:08 | 001,429,608 | —- | M] (Sony Corporation) [On_Demand | Running] – C:\Program Files\Sony\VAIO Update Common\VUAgent.exe – (VUAgent)
SRV:64bit: - [2010/01/27 16:10:56 | 000,202,752 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2009/11/30 22:51:18 | 000,571,248 | —- | M] (Sony Corporation) [On_Demand | Running] – C:\Program Files\Sony\VAIO Power Management\SPMService.exe – (VAIO Power Management)
SRV:64bit: - [2009/09/17 02:28:42 | 000,167,424 | —- | M] (Intel Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Care\collsvc.exe – (SampleCollector) Intel®
SRV:64bit: - [2009/09/16 16:27:12 | 000,480,624 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe – (VcmIAlzMgr)
SRV:64bit: - [2009/09/08 21:09:20 | 000,110,960 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe – (VcmXmlIfHelper)
SRV:64bit: - [2009/09/04 16:35:12 | 000,873,248 | —- | M] (Broadcom Corporation.) [Auto | Running] – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe – (btwdins)
SRV:64bit: - [2009/09/02 00:42:00 | 000,361,840 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe – (VcmINSMgr)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2009/07/13 21:40:01 | 000,193,536 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\appmgmts.dll – (AppMgmt)
SRV - [2012/06/07 17:29:56 | 000,113,120 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/05/05 07:10:18 | 000,257,696 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2011/08/04 00:18:43 | 000,126,400 | R— | M] (Symantec Corporation) [Auto | Running] – C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe – (NIS)
SRV - [2010/08/24 16:09:47 | 000,867,080 | —- | M] (Acresso Software Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2010/03/18 14:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/12/14 16:06:24 | 002,320,920 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe – (UNS) Intel®
SRV - [2009/12/14 16:06:08 | 000,268,824 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe – (LMS) Intel®
SRV - [2009/12/02 01:03:52 | 000,204,648 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe – (VAIO Event Service)
SRV - [2009/11/20 18:25:24 | 000,013,336 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe – (IAStorDataMgrSvc) Intel®
SRV - [2009/10/24 06:18:54 | 000,360,224 | —- | M] (Sony Corporation) [Auto | Running] – c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe – (PMBDeviceInfoProvider)
SRV - [2009/10/20 14:19:48 | 000,117,264 | —- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\WinPcap\rpcapd.exe – (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2009/10/15 19:34:36 | 000,427,304 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe – (SOHDms)
SRV - [2009/10/15 19:34:36 | 000,091,432 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe – (SOHPlMgr)
SRV - [2009/10/15 19:34:36 | 000,075,048 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe – (SOHDs)
SRV - [2009/10/15 19:34:34 | 000,120,104 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe – (SOHCImp)
SRV - [2009/10/15 19:34:34 | 000,070,952 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe – (SOHDBSvr)
SRV - [2009/09/28 12:42:50 | 000,109,056 | —- | M] (ArcSoft Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe – (ACDaemon)
SRV - [2009/09/14 22:24:08 | 000,206,336 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe – (VzCdbSvc)
SRV - [2009/09/14 22:24:08 | 000,069,632 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe – (VAIO Entertainment TV Device Arbitration Service)
SRV - [2009/09/14 21:53:48 | 000,642,416 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe – (VCFw)
SRV - [2009/09/06 09:06:20 | 000,169,312 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe – (AdobeActiveFileMonitor8.0)
SRV - [2009/08/31 04:59:30 | 000,362,992 | —- | M] (Sonic Solutions) [Auto | Stopped] – C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe – (Roxio Upnp Server 10)
SRV - [2009/08/31 04:59:18 | 000,313,840 | —- | M] (Sonic Solutions) [On_Demand | Stopped] – C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe – (Roxio UPnP Renderer 10)
SRV - [2009/06/10 17:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2008/09/18 13:59:10 | 000,104,960 | —- | M] (ArcSoft, Inc.) [Auto | Running] – C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe – (uCamMonitor)
SRV - [2007/07/24 14:15:14 | 000,185,632 | —- | M] (Protexis Inc.) [Auto | Running] – C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe – (PSI_SVC_2)
SRV - [2007/01/04 22:48:50 | 000,112,152 | —- | M] (InterVideo) [Auto | Running] – C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe – (IviRegMgr)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/03/01 02:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2011/08/21 22:53:36 | 000,451,704 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\NISx64\1109000.00C\symtdiv.sys – (SYMTDIv)
DRV:64bit: - [2011/08/21 22:53:35 | 000,221,304 | —- | M] (Symantec Corporation) [File_System | Boot | Running] – C:\Windows\SysNative\drivers\NISx64\1109000.00C\symefa64.sys – (SymEFA)
DRV:64bit: - [2011/08/04 00:19:26 | 000,593,544 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\NISx64\1109000.00C\cchpx64.sys – (ccHP)
DRV:64bit: - [2011/03/11 02:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 02:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/11/20 09:34:02 | 000,360,832 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\vpcvmm.sys – (vpcvmm)
DRV:64bit: - [2010/11/20 09:34:02 | 000,194,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\vpchbus.sys – (vpcbus)
DRV:64bit: - [2010/11/20 09:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/20 07:35:32 | 000,095,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\vpcusb.sys – (vpcusb)
DRV:64bit: - [2010/11/20 07:35:20 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\vpcnfltr.sys – (vpcnfltr)
DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/20 05:37:42 | 000,109,056 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\sdbus.sys – (sdbus)
DRV:64bit: - [2010/09/02 23:58:52 | 000,173,104 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS – (SymEvent)
DRV:64bit: - [2010/07/21 17:59:28 | 000,045,456 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\point64.sys – (Point64)
DRV:64bit: - [2010/07/07 19:18:58 | 000,051,600 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\dc3d.sys – (dc3d) MS Hardware Device Detection Driver (USB)
DRV:64bit: - [2010/04/29 01:03:51 | 000,150,064 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\NISx64\1109000.00C\ironx64.sys – (SymIRON)
DRV:64bit: - [2010/04/21 22:29:51 | 000,505,392 | —- | M] (Symantec Corporation) [File_System | On_Demand | Running] – C:\Windows\SysNative\drivers\NISx64\1109000.00C\srtsp64.sys – (SRTSP)
DRV:64bit: - [2010/04/21 22:29:51 | 000,032,304 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\NISx64\1109000.00C\srtspx64.sys – (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV:64bit: - [2010/01/27 16:10:59 | 006,106,624 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (atikmdag)
DRV:64bit: - [2009/12/16 16:03:59 | 000,244,736 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\IntcDAud.sys – (IntcDAud) Intel®
DRV:64bit: - [2009/12/16 16:03:42 | 000,151,936 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\Impcd.sys – (Impcd)
DRV:64bit: - [2009/12/16 16:03:04 | 007,778,176 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2009/12/15 22:49:48 | 000,213,280 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\RtHDMIVX.sys – (RTHDMIAzAudService)
DRV:64bit: - [2009/12/14 16:06:07 | 000,056,344 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\HECIx64.sys – (HECIx64) Intel®
DRV:64bit: - [2009/11/20 18:09:48 | 000,537,112 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\iaStor.sys – (iaStor)
DRV:64bit: - [2009/11/18 00:30:44 | 000,021,160 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\btwrchid.sys – (btwrchid)
DRV:64bit: - [2009/11/18 00:30:32 | 000,132,648 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\btwavdt.sys – (btwavdt)
DRV:64bit: - [2009/11/18 00:30:32 | 000,098,344 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\btwaudio.sys – (btwaudio)
DRV:64bit: - [2009/11/18 00:30:21 | 000,052,264 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\btusbflt.sys – (btusbflt)
DRV:64bit: - [2009/11/18 00:23:46 | 000,035,104 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\btwl2cap.sys – (btwl2cap)
DRV:64bit: - [2009/11/12 16:16:19 | 000,395,264 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\yk62x64.sys – (yukonw7)
DRV:64bit: - [2009/11/12 16:06:44 | 001,542,656 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\athrx.sys – (athr)
DRV:64bit: - [2009/11/06 16:27:30 | 000,093,696 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\rimssne64.sys – (rimspci)
DRV:64bit: - [2009/11/04 05:59:59 | 000,253,488 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Apfiltr.sys – (ApfiltrService)
DRV:64bit: - [2009/10/20 14:19:54 | 000,047,632 | —- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\npf.sys – (NPF)
DRV:64bit: - [2009/09/15 16:09:08 | 000,075,776 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\risdsne64.sys – (risdsnpe)
DRV:64bit: - [2009/08/29 20:17:18 | 000,433,200 | R— | M] (Symantec Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\NISx64\1109000.00C\symds64.sys – (SymDS)
DRV:64bit: - [2009/08/19 16:09:21 | 000,011,392 | —- | M] (Sony Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SFEP.sys – (SFEP)
DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/05/26 17:32:04 | 000,019,968 | —- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys – (ArcSoftKsUFilter)
DRV:64bit: - [2009/05/20 06:00:00 | 000,055,280 | —- | M] (Sonic Solutions) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\PxHlpa64.sys – (PxHlpa64)
DRV:64bit: - [2007/04/17 14:51:50 | 000,014,112 | —- | M] (InterVideo) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\regi.sys – (regi)
DRV - [2012/06/13 19:06:38 | 000,488,568 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20120613.007\IDSviA64.sys – (IDSVia64)
DRV - [2012/05/30 22:43:39 | 000,484,512 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys – (eeCtrl)
DRV - [2012/05/30 22:43:39 | 000,138,912 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2012/05/19 04:23:32 | 002,068,600 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20120614.018\EX64.SYS – (NAVEX15)
DRV - [2012/05/19 04:23:32 | 000,120,440 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20120614.018\ENG64.SYS – (NAVENG)
DRV - [2012/04/02 19:38:04 | 001,160,824 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20120531.001\BHDrvx64.sys – (BHDrvx64)
DRV - [2009/07/13 21:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7SNNT
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?br…T&bmod;=SNNT
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?br…T&bmod;=SNNT
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7SNNT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-408617068-3671341003-1933957367-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?br…T&bmod;=SNNT
IE - HKU\S-1-5-21-408617068-3671341003-1933957367-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-408617068-3671341003-1933957367-1001\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-408617068-3671341003-1933957367-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKU\S-1-5-21-408617068-3671341003-1933957367-1001\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…1I7SNNT_enUS395
IE - HKU\S-1-5-21-408617068-3671341003-1933957367-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKU\S-1-5-21-408617068-3671341003-1933957367-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:3.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: widevinemediatransformer@widevine:4.5.0.2341
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [removed]:2.8
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:2010.9.0.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\ [2011/08/08 12:55:19 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn_2010_9_0_6 [2012/06/13 12:18:58 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/07 17:29:57 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/04/16 13:28:19 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/07 17:29:57 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/04/16 13:28:19 | 000,000,000 | —D | M]

[2010/09/04 12:16:43 | 000,000,000 | —D | M] (No name found) – C:\Users\v\AppData\Roaming\Mozilla\Extensions
[2012/06/04 13:30:42 | 000,000,000 | —D | M] (No name found) – C:\Users\v\AppData\Roaming\Mozilla\Firefox\Profiles\4zbqo5v8.default\extensions
[2012/05/19 23:20:34 | 000,000,000 | —D | M] (Greasemonkey) – C:\Users\v\AppData\Roaming\Mozilla\Firefox\Profiles\4zbqo5v8.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2012/04/26 08:45:14 | 000,000,000 | —D | M] (TooManyTabs) – C:\Users\v\AppData\Roaming\Mozilla\Firefox\Profiles\4zbqo5v8.default\extensions\[removed]
[2011/02/13 20:09:48 | 000,000,000 | —D | M] (Widevine Media Transformer Plugin) – C:\Users\v\AppData\Roaming\Mozilla\Firefox\Profiles\4zbqo5v8.default\extensions\widevinemediatransformer@widevine
[2012/04/26 08:45:18 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/05/12 22:10:59 | 000,080,359 | —- | M] () (No name found) – C:\USERS\v\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4ZBQO5V8.DEFAULT\EXTENSIONS\{5E594888-3E8E-47DA-B2C6-B0B545112F84}.XPI
[2012/04/26 08:45:14 | 000,634,964 | —- | M] () (No name found) – C:\USERS\v\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4ZBQO5V8.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012/06/04 13:30:42 | 000,091,556 | —- | M] () (No name found) – C:\USERS\v\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4ZBQO5V8.DEFAULT\EXTENSIONS\{EDA7B1D7-F793-4E03-B074-E6F303317FB0}.XPI
[2011/11/11 00:35:15 | 000,014,961 | —- | M] () (No name found) – C:\USERS\v\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4ZBQO5V8.DEFAULT\EXTENSIONS\[removed]
[2012/04/05 12:15:48 | 000,031,748 | —- | M] () (No name found) – C:\USERS\v\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4ZBQO5V8.DEFAULT\EXTENSIONS\[removed]
[2012/06/07 17:29:56 | 000,085,472 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/05 12:19:54 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/06/07 17:29:54 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/06/07 17:29:54 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\coieplg.dll (Symantec Corporation)
O3:64bit: - HKU\S-1-5-21-408617068-3671341003-1933957367-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\S-1-5-21-408617068-3671341003-1933957367-1001\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-408617068-3671341003-1933957367-1001\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [PMBVolumeWatcher] c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKLM..\Run: [SmartWiHelper] C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe (Sony Electronics Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-408617068-3671341003-1933957367-1001..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Append Link Target to Existing PDF - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Append to Existing PDF - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert Link Target to Adobe PDF - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O8:64bit: - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Append Link Target to Existing PDF - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth; Device… - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - c:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - c:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{597649FD-27A4-4D35-AFDB-8328C72AAAD8}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F1AB48D3-620A-412A-B77D-05020B395317}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\SysWow64\VESWinlogon.dll (Sony Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/06/14 21:27:49 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Users\v\Desktop\OTL.exe
[2012/06/13 22:26:45 | 004,731,392 | —- | C] (AVAST Software) – C:\Users\v\Desktop\aswMBR.exe
[2012/06/13 18:01:13 | 000,000,000 | —D | C] – C:\Windows\rescache
[2012/06/07 10:14:14 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\v\Desktop\HiJackThis.exe
[2012/06/06 15:44:10 | 000,000,000 | —D | C] – C:\Users\v\AppData\Local\{54F780EE-BD29-49D6-9D60-AE0065213484}
[2012/06/06 15:43:31 | 000,000,000 | —D | C] – C:\Users\v\AppData\Local\{D8A751FE-DCD9-4A5D-AB72-F41C4AE4CEC0}
[2012/06/03 17:45:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avidemux
[2012/06/03 17:45:25 | 000,000,000 | —D | C] – C:\Program Files\Avidemux 2.5

========== Files - Modified Within 30 Days ==========

[2012/06/14 21:32:04 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/14 21:27:50 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\v\Desktop\OTL.exe
[2012/06/14 21:25:07 | 000,000,512 | —- | M] () – C:\Users\v\Desktop\MBR.dat
[2012/06/14 21:10:02 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/14 09:32:02 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/13 22:26:51 | 004,731,392 | —- | M] (AVAST Software) – C:\Users\v\Desktop\aswMBR.exe
[2012/06/13 18:56:56 | 000,014,160 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/13 18:56:56 | 000,014,160 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/13 12:18:32 | 000,387,880 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/13 12:18:32 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/06/13 12:17:47 | 3106,455,552 | -HS- | M] () – C:\hiberfil.sys
[2012/06/13 12:09:34 | 000,743,068 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/06/13 12:09:34 | 000,626,024 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/06/13 12:09:34 | 000,107,358 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/06/07 10:14:14 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\v\Desktop\HiJackThis.exe
[2012/06/03 17:45:30 | 000,000,854 | —- | M] () – C:\Users\Public\Desktop\Avidemux 2.5.lnk
[2012/06/01 13:41:02 | 003,780,218 | —- | M] () – C:\Users\v\Desktop\toyota_rav4_owners_manual_2005.pdf
[2012/05/28 19:02:09 | 004,263,529 | —- | M] () – C:\Users\v\Desktop\SX4_Owners_Manual.pdf
[2012/05/27 11:59:58 | 000,002,052 | —- | M] () – C:\Windows\epplauncher.mif

========== Files Created - No Company Name ==========

[2012/06/14 21:25:07 | 000,000,512 | —- | C] () – C:\Users\v\Desktop\MBR.dat
[2012/06/01 13:40:58 | 003,780,218 | —- | C] () – C:\Users\v\Desktop\toyota_rav4_owners_manual_2005.pdf
[2012/05/28 19:02:05 | 004,263,529 | —- | C] () – C:\Users\v\Desktop\SX4_Owners_Manual.pdf
[2012/05/27 11:59:58 | 000,002,052 | —- | C] () – C:\Windows\epplauncher.mif
[2012/05/11 07:15:28 | 000,007,605 | —- | C] () – C:\Users\v\AppData\Local\Resmon.ResmonCfg

========== LOP Check ==========

[2012/06/12 15:40:56 | 000,000,000 | —D | M] – C:\Users\v\AppData\Roaming\avidemux
[2011/04/04 07:48:32 | 000,000,000 | —D | M] – C:\Users\v\AppData\Roaming\GetRightToGo
[2012/04/05 09:55:16 | 000,000,000 | —D | M] – C:\Users\v\AppData\Roaming\HandBrake
[2012/04/23 21:03:40 | 000,000,000 | —D | M] – C:\Users\v\AppData\Roaming\VBBE Forms Wizard v3
[2012/02/16 00:16:00 | 000,000,000 | —D | M] – C:\Users\v\AppData\Roaming\Windows Live Writer
[2009/07/14 01:08:49 | 000,028,380 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/02/26 02:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 01:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 02:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/08/03 02:19:07 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 02:34:59 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 01:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 09:24:45 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 02:38:38 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 01:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 21:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 02:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 02:26:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 02:17:37 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

< MD5 for: SVCHOST.EXE >
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/13 21:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009/07/13 21:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 21:39:48 | 000,030,208 | —- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 09:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SysNative\userinit.exe
[2010/11/20 09:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010/11/20 09:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/20 09:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 21:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 03:01:57 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 02:24:40 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: Hitachi HTS545032B9SA00
Partitions: 3
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 -
Interface type: IDE
Media Type:
Model: Ricoh Memory Stick Disk Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 -
Interface type: IDE
Media Type:
Model: Ricoh SD/MMC Disk Device
Partitions: 0
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 16.00GB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 0.00GB
Starting Offset: 16760438784
Hidden sectors: 0

DeviceID: Disk #0, Partition #2
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 282.00GB
Starting Offset: 16865296384
Hidden sectors: 0

< End of report >

********************************TDSS Killer Log*******************************************

21:45:51.0943 6700 TDSS rootkit removing tool 2.7.39.0 Jun 14 2012 08:11:46
21:45:53.0908 6700 ============================================================
21:45:53.0908 6700 Current date / time: 2012/06/14 21:45:53.0908
21:45:53.0908 6700 SystemInfo:
21:45:53.0908 6700
21:45:53.0908 6700 OS Version: 6.1.7601 ServicePack: 1.0
21:45:53.0908 6700 Product type: Workstation
21:45:53.0908 6700 ComputerName: v-VAIO
21:45:53.0908 6700 UserName: v
21:45:53.0908 6700 Windows directory: C:\Windows
21:45:53.0908 6700 System windows directory: C:\Windows
21:45:53.0908 6700 Running under WOW64
21:45:53.0908 6700 Processor architecture: Intel x64
21:45:53.0908 6700 Number of processors: 4
21:45:53.0908 6700 Page size: 0x1000
21:45:53.0908 6700 Boot type: Normal boot
21:45:53.0908 6700 ============================================================
21:45:54.0813 6700 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:45:54.0829 6700 ============================================================
21:45:54.0829 6700 \Device\Harddisk0\DR0:
21:45:54.0829 6700 MBR partitions:
21:45:54.0829 6700 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1F38000, BlocksNum 0x32000
21:45:54.0829 6700 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1F6A000, BlocksNum 0x234C42B0
21:45:54.0829 6700 ============================================================
21:45:54.0876 6700 C: <-> \Device\Harddisk0\DR0\Partition1
21:45:54.0876 6700 ============================================================
21:45:54.0876 6700 Initialize success
21:45:54.0876 6700 ============================================================
21:46:00.0819 5872 ============================================================
21:46:00.0819 5872 Scan started
21:46:00.0819 5872 Mode: Manual; SigCheck; TDLFS;
21:46:00.0819 5872 ============================================================
21:46:02.0738 5872 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
21:46:03.0066 5872 1394ohci - ok
21:46:03.0175 5872 ACDaemon (35f57598f0589feb3c3abc1621bf329f) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
21:46:03.0986 5872 ACDaemon - ok
21:46:04.0282 5872 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
21:46:04.0329 5872 ACPI - ok
21:46:04.0438 5872 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
21:46:04.0563 5872 AcpiPmi - ok
21:46:04.0860 5872 AdobeActiveFileMonitor8.0 (4451cc2275b04043ec2bcc757af97291) c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
21:46:04.0891 5872 AdobeActiveFileMonitor8.0 - ok
21:46:05.0078 5872 AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
21:46:05.0125 5872 AdobeFlashPlayerUpdateSvc - ok
21:46:05.0187 5872 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys
21:46:05.0234 5872 adp94xx - ok
21:46:05.0265 5872 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys
21:46:05.0296 5872 adpahci - ok
21:46:05.0328 5872 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys
21:46:05.0343 5872 adpu320 - ok
21:46:05.0390 5872 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
21:46:05.0562 5872 AeLookupSvc - ok
21:46:05.0624 5872 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
21:46:05.0718 5872 AFD - ok
21:46:05.0749 5872 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
21:46:05.0764 5872 agp440 - ok
21:46:05.0796 5872 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
21:46:05.0874 5872 ALG - ok
21:46:05.0889 5872 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
21:46:05.0920 5872 aliide - ok
21:46:05.0936 5872 AMD External Events Utility (3260756e234083bd2bd1709c60b6e6d7) C:\Windows\system32\atiesrxx.exe
21:46:06.0014 5872 AMD External Events Utility - ok
21:46:06.0045 5872 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
21:46:06.0061 5872 amdide - ok
21:46:06.0092 5872 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys
21:46:06.0154 5872 AmdK8 - ok
21:46:06.0186 5872 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys
21:46:06.0248 5872 AmdPPM - ok
21:46:06.0279 5872 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
21:46:06.0310 5872 amdsata - ok
21:46:06.0342 5872 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys
21:46:06.0373 5872 amdsbs - ok
21:46:06.0388 5872 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
21:46:06.0404 5872 amdxata - ok
21:46:06.0466 5872 ApfiltrService (1661f9c9e4b0049fa0a5e30264375a87) C:\Windows\system32\DRIVERS\Apfiltr.sys
21:46:06.0498 5872 ApfiltrService - ok
21:46:06.0513 5872 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
21:46:06.0716 5872 AppID - ok
21:46:06.0747 5872 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
21:46:06.0810 5872 AppIDSvc - ok
21:46:06.0841 5872 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
21:46:06.0919 5872 Appinfo - ok
21:46:06.0950 5872 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
21:46:07.0012 5872 AppMgmt - ok
21:46:07.0075 5872 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys
21:46:07.0106 5872 arc - ok
21:46:07.0153 5872 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys
21:46:07.0184 5872 arcsas - ok
21:46:07.0200 5872 ArcSoftKsUFilter (c130bc4a51b1382b2be8e44579ec4c0a) C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys
21:46:07.0215 5872 ArcSoftKsUFilter - ok
21:46:07.0246 5872 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
21:46:07.0324 5872 AsyncMac - ok
21:46:07.0356 5872 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
21:46:07.0387 5872 atapi - ok
21:46:07.0512 5872 athr (0acc06fcf46f64ed4f11e57ee461c1f4) C:\Windows\system32\DRIVERS\athrx.sys
21:46:07.0621 5872 athr - ok
21:46:08.0260 5872 atikmdag (f3a362b683b6158cc47d7e8e58b7ddc9) C:\Windows\system32\DRIVERS\atikmdag.sys
21:46:08.0494 5872 atikmdag - ok
21:46:08.0682 5872 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:46:08.0791 5872 AudioEndpointBuilder - ok
21:46:08.0791 5872 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:46:08.0853 5872 AudioSrv - ok
21:46:08.0884 5872 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
21:46:08.0994 5872 AxInstSV - ok
21:46:09.0072 5872 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys
21:46:09.0150 5872 b06bdrv - ok
21:46:09.0212 5872 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
21:46:09.0259 5872 b57nd60a - ok
21:46:09.0290 5872 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
21:46:09.0384 5872 BDESVC - ok
21:46:09.0415 5872 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
21:46:09.0462 5872 Beep - ok
21:46:09.0540 5872 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
21:46:09.0618 5872 BFE - ok
21:46:09.0867 5872 BHDrvx64 (5b1fe9d351c284701c8051da2aa81df6) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20120531.001\BHDrvx64.sys
21:46:09.0914 5872 BHDrvx64 - ok
21:46:10.0117 5872 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
21:46:10.0226 5872 BITS - ok
21:46:10.0288 5872 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\drivers\blbdrive.sys
21:46:10.0335 5872 blbdrive - ok
21:46:10.0366 5872 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
21:46:10.0429 5872 bowser - ok
21:46:10.0444 5872 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys
21:46:10.0538 5872 BrFiltLo - ok
21:46:10.0554 5872 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys
21:46:10.0585 5872 BrFiltUp - ok
21:46:10.0647 5872 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
21:46:10.0725 5872 Browser - ok
21:46:10.0788 5872 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
21:46:10.0881 5872 Brserid - ok
21:46:10.0897 5872 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
21:46:10.0944 5872 BrSerWdm - ok
21:46:11.0006 5872 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
21:46:11.0084 5872 BrUsbMdm - ok
21:46:11.0115 5872 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
21:46:11.0162 5872 BrUsbSer - ok
21:46:11.0209 5872 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys
21:46:11.0287 5872 BthEnum - ok
21:46:11.0302 5872 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
21:46:11.0334 5872 BTHMODEM - ok
21:46:11.0365 5872 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
21:46:11.0412 5872 BthPan - ok
21:46:11.0490 5872 BTHPORT (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys
21:46:11.0568 5872 BTHPORT - ok
21:46:11.0646 5872 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
21:46:11.0724 5872 bthserv - ok
21:46:11.0739 5872 BTHUSB (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys
21:46:11.0755 5872 BTHUSB - ok
21:46:11.0786 5872 btusbflt (6e04458e98daf28826482e41a7a62df5) C:\Windows\system32\drivers\btusbflt.sys
21:46:11.0802 5872 btusbflt - ok
21:46:11.0833 5872 btwaudio (4bdbdb86abba924e029fb2683be7c505) C:\Windows\system32\drivers\btwaudio.sys
21:46:11.0848 5872 btwaudio - ok
21:46:11.0880 5872 btwavdt (5c849bd7c78791c5cee9f4651d7fe38d) C:\Windows\system32\drivers\btwavdt.sys
21:46:11.0911 5872 btwavdt - ok
21:46:12.0036 5872 btwdins (31da517946ffe416442e864592548f8a) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
21:46:12.0082 5872 btwdins - ok
21:46:12.0114 5872 btwl2cap (6149301dc3f81d6f9667a3fbac410975) C:\Windows\system32\DRIVERS\btwl2cap.sys
21:46:12.0129 5872 btwl2cap - ok
21:46:12.0145 5872 btwrchid (3e1991afa851a36dc978b0a1b0535c8b) C:\Windows\system32\DRIVERS\btwrchid.sys
21:46:12.0160 5872 btwrchid - ok
21:46:12.0270 5872 ccHP (37f1baec39b505b3b51893a35c8337ea) C:\Windows\system32\drivers\NISx64\1109000.00C\ccHPx64.sys
21:46:12.0316 5872 ccHP - ok
21:46:12.0348 5872 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
21:46:12.0410 5872 cdfs - ok
21:46:12.0457 5872 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
21:46:12.0488 5872 cdrom - ok
21:46:12.0519 5872 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:46:12.0597 5872 CertPropSvc - ok
21:46:12.0644 5872 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys
21:46:12.0722 5872 circlass - ok
21:46:13.0034 5872 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
21:46:13.0081 5872 CLFS - ok
21:46:13.0174 5872 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:46:13.0221 5872 clr_optimization_v2.0.50727_32 - ok
21:46:13.0284 5872 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:46:13.0315 5872 clr_optimization_v2.0.50727_64 - ok
21:46:13.0408 5872 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:46:13.0440 5872 clr_optimization_v4.0.30319_32 - ok
21:46:13.0486 5872 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:46:13.0518 5872 clr_optimization_v4.0.30319_64 - ok
21:46:13.0533 5872 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys
21:46:13.0564 5872 CmBatt - ok
21:46:13.0627 5872 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
21:46:13.0658 5872 cmdide - ok
21:46:13.0720 5872 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
21:46:13.0783 5872 CNG - ok
21:46:13.0798 5872 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys
21:46:13.0830 5872 Compbatt - ok
21:46:13.0845 5872 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
21:46:13.0876 5872 CompositeBus - ok
21:46:13.0876 5872 COMSysApp - ok
21:46:13.0908 5872 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys
21:46:13.0923 5872 crcdisk - ok
21:46:13.0970 5872 CryptSvc (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
21:46:14.0032 5872 CryptSvc - ok
21:46:14.0110 5872 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
21:46:14.0188 5872 CSC - ok
21:46:14.0266 5872 CscService (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
21:46:14.0344 5872 CscService - ok
21:46:14.0376 5872 dc3d (76e02db615a03801d698199a2bc4a06a) C:\Windows\system32\DRIVERS\dc3d.sys
21:46:14.0391 5872 dc3d - ok
21:46:14.0516 5872 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:46:14.0610 5872 DcomLaunch - ok
21:46:14.0703 5872 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
21:46:14.0781 5872 defragsvc - ok
21:46:14.0813 5872 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
21:46:14.0906 5872 DfsC - ok
21:46:14.0953 5872 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
21:46:15.0015 5872 Dhcp - ok
21:46:15.0047 5872 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
21:46:15.0125 5872 discache - ok
21:46:15.0140 5872 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys
21:46:15.0156 5872 Disk - ok
21:46:15.0203 5872 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
21:46:15.0281 5872 Dnscache - ok
21:46:15.0312 5872 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
21:46:15.0374 5872 dot3svc - ok
21:46:15.0421 5872 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
21:46:15.0468 5872 DPS - ok
21:46:15.0499 5872 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
21:46:15.0515 5872 drmkaud - ok
21:46:15.0671 5872 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
21:46:15.0717 5872 DXGKrnl - ok
21:46:15.0764 5872 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
21:46:15.0858 5872 EapHost - ok
21:46:16.0154 5872 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys
21:46:16.0248 5872 ebdrv - ok
21:46:16.0373 5872 eeCtrl (ba6420c1f7070ed8f1ba372844f3e1ec) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
21:46:16.0419 5872 eeCtrl - ok
21:46:16.0529 5872 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
21:46:16.0653 5872 EFS - ok
21:46:16.0763 5872 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
21:46:16.0872 5872 ehRecvr - ok
21:46:16.0903 5872 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
21:46:16.0997 5872 ehSched - ok
21:46:17.0121 5872 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys
21:46:17.0168 5872 elxstor - ok
21:46:17.0262 5872 EraserUtilRebootDrv (1343df3451bc0c442dc69837c6fba21b) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
21:46:17.0293 5872 EraserUtilRebootDrv - ok
21:46:17.0324 5872 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
21:46:17.0340 5872 ErrDev - ok
21:46:17.0418 5872 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
21:46:17.0480 5872 EventSystem - ok
21:46:17.0527 5872 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
21:46:17.0589 5872 exfat - ok
21:46:17.0636 5872 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
21:46:17.0683 5872 fastfat - ok
21:46:17.0777 5872 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
21:46:17.0855 5872 Fax - ok
21:46:17.0870 5872 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys
21:46:17.0901 5872 fdc - ok
21:46:17.0933 5872 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
21:46:17.0995 5872 fdPHost - ok
21:46:18.0011 5872 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
21:46:18.0057 5872 FDResPub - ok
21:46:18.0073 5872 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
21:46:18.0089 5872 FileInfo - ok
21:46:18.0104 5872 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
21:46:18.0135 5872 Filetrace - ok
21:46:18.0276 5872 FLEXnet Licensing Service (abedfd48ac042c6aaad32452e77217a1) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
21:46:18.0338 5872 FLEXnet Licensing Service - ok
21:46:18.0354 5872 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys
21:46:18.0369 5872 flpydisk - ok
21:46:18.0416 5872 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
21:46:18.0432 5872 FltMgr - ok
21:46:18.0541 5872 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
21:46:18.0635 5872 FontCache - ok
21:46:18.0713 5872 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:46:18.0744 5872 FontCache3.0.0.0 - ok
21:46:18.0775 5872 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
21:46:18.0806 5872 FsDepends - ok
21:46:18.0822 5872 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
21:46:18.0853 5872 Fs_Rec - ok
21:46:18.0884 5872 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
21:46:18.0915 5872 fvevol - ok
21:46:18.0931 5872 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys
21:46:18.0947 5872 gagp30kx - ok
21:46:19.0025 5872 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
21:46:19.0134 5872 gpsvc - ok
21:46:19.0227 5872 gupdate (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
21:46:19.0305 5872 gupdate - ok
21:46:19.0352 5872 gupdatem (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
21:46:19.0383 5872 gupdatem - ok
21:46:19.0430 5872 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
21:46:19.0461 5872 gusvc - ok
21:46:19.0493 5872 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
21:46:19.0555 5872 hcw85cir - ok
21:46:19.0664 5872 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
21:46:19.0727 5872 HdAudAddService - ok
21:46:19.0742 5872 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
21:46:19.0789 5872 HDAudBus - ok
21:46:19.0820 5872 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\drivers\HECIx64.sys
21:46:19.0836 5872 HECIx64 - ok
21:46:19.0867 5872 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys
21:46:19.0898 5872 HidBatt - ok
21:46:19.0914 5872 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys
21:46:19.0945 5872 HidBth - ok
21:46:19.0976 5872 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys
21:46:19.0992 5872 HidIr - ok
21:46:20.0039 5872 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
21:46:20.0085 5872 hidserv - ok
21:46:20.0117 5872 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys
21:46:20.0132 5872 HidUsb - ok
21:46:20.0163 5872 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
21:46:20.0241 5872 hkmsvc - ok
21:46:20.0288 5872 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
21:46:20.0335 5872 HomeGroupListener - ok
21:46:20.0382 5872 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
21:46:20.0444 5872 HomeGroupProvider - ok
21:46:20.0475 5872 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
21:46:20.0507 5872 HpSAMD - ok
21:46:20.0600 5872 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
21:46:20.0709 5872 HTTP - ok
21:46:20.0741 5872 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
21:46:20.0756 5872 hwpolicy - ok
21:46:20.0787 5872 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
21:46:20.0803 5872 i8042prt - ok
21:46:20.0881 5872 iaStor (073a606333b6f7bbf20aa856df7f0997) C:\Windows\system32\drivers\iaStor.sys
21:46:20.0928 5872 iaStor - ok
21:46:20.0990 5872 IAStorDataMgrSvc (cc800d2d9fd467542bac7c186c4774ad) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
21:46:21.0021 5872 IAStorDataMgrSvc - ok
21:46:21.0115 5872 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
21:46:21.0162 5872 iaStorV - ok
21:46:21.0302 5872 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:46:21.0349 5872 idsvc - ok
21:46:21.0645 5872 IDSVia64 (4e9e0e5a3b0efeb27491c26be1d97fda) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20120613.007\IDSvia64.sys
21:46:21.0692 5872 IDSVia64 - ok
21:46:22.0457 5872 igfx (31d1aff484d8a0906cf8d44251ec390f) C:\Windows\system32\DRIVERS\igdkmd64.sys
21:46:22.0706 5872 igfx ( UnsignedFile.Multi.Generic ) - warning
21:46:22.0706 5872 igfx - detected UnsignedFile.Multi.Generic (1)
21:46:22.0862 5872 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys
21:46:22.0893 5872 iirsp - ok
21:46:22.0987 5872 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
21:46:23.0096 5872 IKEEXT - ok
21:46:23.0127 5872 Impcd (36fdf367a1dabff903e2214023d71368) C:\Windows\system32\drivers\Impcd.sys
21:46:23.0159 5872 Impcd ( UnsignedFile.Multi.Generic ) - warning
21:46:23.0159 5872 Impcd - detected UnsignedFile.Multi.Generic (1)
21:46:23.0377 5872 IntcAzAudAddService (0f144e5f46cb9043004b5e84aa4bca6a) C:\Windows\system32\drivers\RTKVHD64.sys
21:46:23.0439 5872 IntcAzAudAddService - ok
21:46:23.0595 5872 IntcDAud (408b401cd7cdb075c7470b0ff7ba8d0b) C:\Windows\system32\DRIVERS\IntcDAud.sys
21:46:23.0658 5872 IntcDAud ( UnsignedFile.Multi.Generic ) - warning
21:46:23.0658 5872 IntcDAud - detected UnsignedFile.Multi.Generic (1)
21:46:23.0689 5872 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
21:46:23.0705 5872 intelide - ok
21:46:23.0736 5872 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\drivers\intelppm.sys
21:46:23.0767 5872 intelppm - ok
21:46:23.0783 5872 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
21:46:23.0845 5872 IPBusEnum - ok
21:46:23.0876 5872 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:46:23.0939 5872 IpFilterDriver - ok
21:46:24.0001 5872 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
21:46:24.0095 5872 iphlpsvc - ok
21:46:24.0126 5872 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
21:46:24.0173 5872 IPMIDRV - ok
21:46:24.0204 5872 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
21:46:24.0282 5872 IPNAT - ok
21:46:24.0297 5872 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
21:46:24.0344 5872 IRENUM - ok
21:46:24.0375 5872 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
21:46:24.0391 5872 isapnp - ok
21:46:24.0453 5872 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
21:46:24.0485 5872 iScsiPrt - ok
21:46:24.0563 5872 IviRegMgr (213822072085b5bbad9af30ab577d817) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
21:46:24.0609 5872 IviRegMgr - ok
21:46:24.0641 5872 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
21:46:24.0672 5872 kbdclass - ok
21:46:24.0703 5872 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
21:46:24.0734 5872 kbdhid - ok
21:46:24.0765 5872 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:46:24.0781 5872 KeyIso - ok
21:46:24.0812 5872 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
21:46:24.0828 5872 KSecDD - ok
21:46:24.0843 5872 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
21:46:24.0859 5872 KSecPkg - ok
21:46:24.0890 5872 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
21:46:24.0937 5872 ksthunk - ok
21:46:24.0999 5872 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
21:46:25.0077 5872 KtmRm - ok
21:46:25.0124 5872 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
21:46:25.0187 5872 LanmanServer - ok
21:46:25.0218 5872 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
21:46:25.0265 5872 LanmanWorkstation - ok
21:46:25.0296 5872 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
21:46:25.0343 5872 lltdio - ok
21:46:25.0389 5872 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
21:46:25.0452 5872 lltdsvc - ok
21:46:25.0483 5872 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
21:46:25.0514 5872 lmhosts - ok
21:46:25.0686 5872 LMS (5460828f8951d310b42b442877603b8d) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
21:46:25.0717 5872 LMS - ok
21:46:25.0748 5872 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys
21:46:25.0779 5872 LSI_FC - ok
21:46:25.0795 5872 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys
21:46:25.0826 5872 LSI_SAS - ok
21:46:25.0842 5872 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys
21:46:25.0857 5872 LSI_SAS2 - ok
21:46:25.0889 5872 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys
21:46:25.0904 5872 LSI_SCSI - ok
21:46:25.0935 5872 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
21:46:26.0013 5872 luafv - ok
21:46:26.0060 5872 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
21:46:26.0076 5872 Mcx2Svc - ok
21:46:26.0091 5872 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys
21:46:26.0107 5872 megasas - ok
21:46:26.0169 5872 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys
21:46:26.0201 5872 MegaSR - ok
21:46:26.0216 5872 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:46:26.0279 5872 MMCSS - ok
21:46:26.0294 5872 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
21:46:26.0372 5872 Modem - ok
21:46:26.0403 5872 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
21:46:26.0435 5872 monitor - ok
21:46:26.0466 5872 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
21:46:26.0497 5872 mouclass - ok
21:46:26.0528 5872 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
21:46:26.0544 5872 mouhid - ok
21:46:26.0637 5872 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
21:46:26.0669 5872 mountmgr - ok
21:46:26.0762 5872 MozillaMaintenance (6380ff81dd4d78b23398752d2f46ea43) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
21:46:26.0809 5872 MozillaMaintenance - ok
21:46:26.0856 5872 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
21:46:26.0887 5872 mpio - ok
21:46:26.0918 5872 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
21:46:26.0981 5872 mpsdrv - ok
21:46:27.0090 5872 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
21:46:27.0183 5872 MpsSvc - ok
21:46:27.0230 5872 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
21:46:27.0277 5872 MRxDAV - ok
21:46:27.0324 5872 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:46:27.0386 5872 mrxsmb - ok
21:46:27.0433 5872 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:46:27.0480 5872 mrxsmb10 - ok
21:46:27.0511 5872 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:46:27.0527 5872 mrxsmb20 - ok
21:46:27.0573 5872 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
21:46:27.0589 5872 msahci - ok
21:46:27.0651 5872 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
21:46:27.0667 5872 msdsm - ok
21:46:27.0714 5872 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
21:46:27.0745 5872 MSDTC - ok
21:46:27.0792 5872 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
21:46:27.0839 5872 Msfs - ok
21:46:27.0854 5872 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
21:46:27.0901 5872 mshidkmdf - ok
21:46:27.0917 5872 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
21:46:27.0932 5872 msisadrv - ok
21:46:27.0979 5872 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
21:46:28.0057 5872 MSiSCSI - ok
21:46:28.0057 5872 msiserver - ok
21:46:28.0073 5872 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
21:46:28.0119 5872 MSKSSRV - ok
21:46:28.0166 5872 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
21:46:28.0244 5872 MSPCLOCK - ok
21:46:28.0260 5872 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
21:46:28.0307 5872 MSPQM - ok
21:46:28.0353 5872 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
21:46:28.0385 5872 MsRPC - ok
21:46:28.0416 5872 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
21:46:28.0431 5872 mssmbios - ok
21:46:28.0463 5872 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
21:46:28.0525 5872 MSTEE - ok
21:46:28.0556 5872 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys
21:46:28.0634 5872 MTConfig - ok
21:46:28.0665 5872 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
21:46:28.0697 5872 Mup - ok
21:46:28.0743 5872 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
21:46:28.0821 5872 napagent - ok
21:46:28.0868 5872 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
21:46:28.0915 5872 NativeWifiP - ok
21:46:29.0040 5872 NAVENG (8043d41f881d6ace40b854ad6e32217f) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20120614.018\ENG64.SYS
21:46:29.0071 5872 NAVENG - ok
21:46:29.0258 5872 NAVEX15 (9a9ab2fc45d701daed465d14980f1305) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20120614.018\EX64.SYS
21:46:29.0336 5872 NAVEX15 - ok
21:46:29.0555 5872 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
21:46:29.0617 5872 NDIS - ok
21:46:29.0664 5872 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
21:46:29.0711 5872 NdisCap - ok
21:46:29.0726 5872 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
21:46:29.0773 5872 NdisTapi - ok
21:46:29.0804 5872 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
21:46:29.0851 5872 Ndisuio - ok
21:46:29.0882 5872 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
21:46:29.0960 5872 NdisWan - ok
21:46:29.0991 5872 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
21:46:30.0038 5872 NDProxy - ok
21:46:30.0069 5872 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
21:46:30.0116 5872 NetBIOS - ok
21:46:30.0163 5872 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
21:46:30.0257 5872 NetBT - ok
21:46:30.0288 5872 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:46:30.0303 5872 Netlogon - ok
21:46:30.0366 5872 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
21:46:30.0444 5872 Netman - ok
21:46:30.0491 5872 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
21:46:30.0584 5872 netprofm - ok
21:46:30.0678 5872 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
21:46:30.0771 5872 NetTcpPortSharing - ok
21:46:30.0818 5872 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys
21:46:30.0849 5872 nfrd960 - ok
21:46:30.0943 5872 NIS (b4187346f54e362daffe647b25a58d50) C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe
21:46:30.0990 5872 NIS - ok
21:46:31.0037 5872 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
21:46:31.0115 5872 NlaSvc - ok
21:46:31.0177 5872 NPF (c31fa031335eff434b2d94278e74bcce) C:\Windows\system32\drivers\npf.sys
21:46:31.0208 5872 NPF - ok
21:46:31.0239 5872 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
21:46:31.0286 5872 Npfs - ok
21:46:31.0302 5872 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
21:46:31.0364 5872 nsi - ok
21:46:31.0380 5872 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
21:46:31.0427 5872 nsiproxy - ok
21:46:31.0567 5872 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
21:46:31.0629 5872 Ntfs - ok
21:46:31.0754 5872 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
21:46:31.0832 5872 Null - ok
21:46:31.0863 5872 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
21:46:31.0879 5872 nvraid - ok
21:46:31.0941 5872 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
21:46:31.0973 5872 nvstor - ok
21:46:32.0019 5872 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
21:46:32.0051 5872 nv_agp - ok
21:46:32.0066 5872 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
21:46:32.0113 5872 ohci1394 - ok
21:46:32.0222 5872 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:46:32.0269 5872 ose - ok
21:46:32.0768 5872 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:46:32.0955 5872 osppsvc - ok
21:46:33.0158 5872 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:46:33.0236 5872 p2pimsvc - ok
21:46:33.0283 5872 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
21:46:33.0330 5872 p2psvc - ok
21:46:33.0392 5872 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys
21:46:33.0423 5872 Parport - ok
21:46:33.0470 5872 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
21:46:33.0486 5872 partmgr - ok
21:46:33.0517 5872 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
21:46:33.0564 5872 PcaSvc - ok
21:46:33.0626 5872 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
21:46:33.0657 5872 pci - ok
21:46:33.0673 5872 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
21:46:33.0689 5872 pciide - ok
21:46:33.0720 5872 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys
21:46:33.0735 5872 pcmcia - ok
21:46:33.0767 5872 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
21:46:33.0782 5872 pcw - ok
21:46:33.0860 5872 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
21:46:33.0954 5872 PEAUTH - ok
21:46:34.0079 5872 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
21:46:34.0172 5872 PeerDistSvc - ok
21:46:34.0266 5872 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
21:46:34.0313 5872 PerfHost - ok
21:46:34.0547 5872 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
21:46:34.0640 5872 pla - ok
21:46:34.0718 5872 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
21:46:34.0812 5872 PlugPlay - ok
21:46:34.0905 5872 PMBDeviceInfoProvider (627fa58adc043704f9d14ca44340956f) c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
21:46:34.0952 5872 PMBDeviceInfoProvider - ok
21:46:34.0968 5872 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
21:46:35.0015 5872 PNRPAutoReg - ok
21:46:35.0061 5872 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:46:35.0093 5872 PNRPsvc - ok
21:46:35.0139 5872 Point64 (b8d8ec78b0f9ed8e220506181274f3d3) C:\Windows\system32\DRIVERS\point64.sys
21:46:35.0171 5872 Point64 - ok
21:46:35.0233 5872 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
21:46:35.0311 5872 PolicyAgent - ok
21:46:35.0373 5872 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
21:46:35.0436 5872 Power - ok
21:46:35.0467 5872 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
21:46:35.0529 5872 PptpMiniport - ok
21:46:35.0607 5872 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys
21:46:35.0654 5872 Processor - ok
21:46:35.0685 5872 ProfSvc (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll
21:46:35.0748 5872 ProfSvc - ok
21:46:35.0795 5872 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:46:35.0826 5872 ProtectedStorage - ok
21:46:35.0857 5872 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
21:46:35.0919 5872 Psched - ok
21:46:35.0997 5872 PSI_SVC_2 (a6a7ad767bf5141665f5c675f671b3e1) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
21:46:36.0060 5872 PSI_SVC_2 - ok
21:46:36.0107 5872 PxHlpa64 (aed797cca02783296c68aa10d0cff8a9) C:\Windows\system32\Drivers\PxHlpa64.sys
21:46:36.0138 5872 PxHlpa64 - ok
21:46:36.0278 5872 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys
21:46:36.0341 5872 ql2300 - ok
21:46:36.0481 5872 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys
21:46:36.0528 5872 ql40xx - ok
21:46:36.0621 5872 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
21:46:36.0668 5872 QWAVE - ok
21:46:36.0684 5872 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
21:46:36.0715 5872 QWAVEdrv - ok
21:46:36.0731 5872 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
21:46:36.0777 5872 RasAcd - ok
21:46:36.0809 5872 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
21:46:36.0840 5872 RasAgileVpn - ok
21:46:36.0855 5872 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
21:46:36.0902 5872 RasAuto - ok
21:46:36.0933 5872 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:46:36.0996 5872 Rasl2tp - ok
21:46:37.0058 5872 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
21:46:37.0121 5872 RasMan - ok
21:46:37.0152 5872 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
21:46:37.0214 5872 RasPppoe - ok
21:46:37.0230 5872 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
21:46:37.0292 5872 RasSstp - ok
21:46:37.0323 5872 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
21:46:37.0417 5872 rdbss - ok
21:46:37.0448 5872 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
21:46:37.0479 5872 rdpbus - ok
21:46:37.0495 5872 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:46:37.0557 5872 RDPCDD - ok
21:46:37.0651 5872 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
21:46:37.0698 5872 RDPDR - ok
21:46:37.0729 5872 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
21:46:37.0807 5872 RDPENCDD - ok
21:46:37.0838 5872 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
21:46:37.0869 5872 RDPREFMP - ok
21:46:37.0916 5872 RDPWD (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
21:46:37.0994 5872 RDPWD - ok
21:46:38.0041 5872 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
21:46:38.0072 5872 rdyboost - ok
21:46:38.0103 5872 regi (4d9afddda0efe97cdbfd3b5fa48b05f6) C:\Windows\system32\drivers\regi.sys
21:46:38.0119 5872 regi - ok
21:46:38.0166 5872 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
21:46:38.0259 5872 RemoteAccess - ok
21:46:38.0291 5872 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
21:46:38.0369 5872 RemoteRegistry - ok
21:46:38.0415 5872 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
21:46:38.0462 5872 RFCOMM - ok
21:46:38.0509 5872 rimspci (5ca4abd888b602551b59baa26941c167) C:\Windows\system32\drivers\rimssne64.sys
21:46:38.0571 5872 rimspci - ok
21:46:38.0618 5872 risdsnpe (bb6e138aeb351728959da5e2731d8140) C:\Windows\system32\drivers\risdsne64.sys
21:46:38.0665 5872 risdsnpe - ok
21:46:38.0759 5872 Roxio UPnP Renderer 10 (d151224bc11078895a60fa970728ff59) C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
21:46:38.0805 5872 Roxio UPnP Renderer 10 - ok
21:46:38.0852 5872 Roxio Upnp Server 10 (5022a927944878bd750960bd21e751af) C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe
21:46:38.0883 5872 Roxio Upnp Server 10 - ok
21:46:38.0930 5872 rpcapd (a780d3eaa74582ea1deb6bd9c7a3d9c9) C:\Program Files (x86)\WinPcap\rpcapd.exe
21:46:38.0961 5872 rpcapd - ok
21:46:38.0993 5872 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
21:46:39.0055 5872 RpcEptMapper - ok
21:46:39.0086 5872 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
21:46:39.0133 5872 RpcLocator - ok
21:46:39.0195 5872 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:46:39.0258 5872 RpcSs - ok
21:46:39.0320 5872 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
21:46:39.0383 5872 rspndr - ok
21:46:39.0429 5872 RTHDMIAzAudService (4e821c740a675f6d040be41d59a62b1d) C:\Windows\system32\drivers\RtHDMIVX.sys
21:46:39.0445 5872 RTHDMIAzAudService - ok
21:46:39.0492 5872 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
21:46:39.0554 5872 s3cap - ok
21:46:39.0804 5872 SampleCollector (6b318f9443740a907d1c8f3460c19009) C:\Program Files\Sony\VAIO Care\collsvc.exe
21:46:39.0866 5872 SampleCollector ( UnsignedFile.Multi.Generic ) - warning
21:46:39.0866 5872 SampleCollector - detected UnsignedFile.Multi.Generic (1)
21:46:39.0960 5872 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:46:39.0991 5872 SamSs - ok
21:46:40.0116 5872 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
21:46:40.0147 5872 sbp2port - ok
21:46:40.0256 5872 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
21:46:40.0319 5872 SCardSvr - ok
21:46:40.0381 5872 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
21:46:40.0428 5872 scfilter - ok
21:46:41.0489 5872 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
21:46:41.0629 5872 Schedule - ok
21:46:41.0660 5872 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:46:41.0707 5872 SCPolicySvc - ok
21:46:41.0769 5872 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys
21:46:41.0801 5872 sdbus - ok
21:46:41.0816 5872 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
21:46:41.0879 5872 SDRSVC - ok
21:46:41.0910 5872 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
21:46:41.0972 5872 secdrv - ok
21:46:42.0019 5872 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
21:46:42.0113 5872 seclogon - ok
21:46:42.0144 5872 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
21:46:42.0191 5872 SENS - ok
21:46:42.0222 5872 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
21:46:42.0237 5872 SensrSvc - ok
21:46:42.0269 5872 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys
21:46:42.0300 5872 Serenum - ok
21:46:42.0331 5872 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys
21:46:42.0347 5872 Serial - ok
21:46:42.0378 5872 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys
21:46:42.0409 5872 sermouse - ok
21:46:42.0456 5872 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
21:46:42.0518 5872 SessionEnv - ok
21:46:42.0534 5872 SFEP (70f9c476b62de4f2823e918a6c181ade) C:\Windows\system32\drivers\SFEP.sys
21:46:42.0596 5872 SFEP - ok
21:46:42.0643 5872 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
21:46:42.0690 5872 sffdisk - ok
21:46:42.0705 5872 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
21:46:42.0737 5872 sffp_mmc - ok
21:46:42.0768 5872 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
21:46:42.0815 5872 sffp_sd - ok
21:46:42.0846 5872 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys
21:46:42.0861 5872 sfloppy - ok
21:46:42.0939 5872 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
21:46:43.0017 5872 SharedAccess - ok
21:46:43.0080 5872 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
21:46:43.0158 5872 ShellHWDetection - ok
21:46:43.0173 5872 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys
21:46:43.0189 5872 SiSRaid2 - ok
21:46:43.0220 5872 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys
21:46:43.0236 5872 SiSRaid4 - ok
21:46:43.0251 5872 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
21:46:43.0283 5872 Smb - ok
21:46:43.0329 5872 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
21:46:43.0345 5872 SNMPTRAP - ok
21:46:43.0439 5872 SOHCImp (98886c88a1cb13d61672ae2c638b7e1c) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe
21:46:43.0485 5872 SOHCImp - ok
21:46:43.0501 5872 SOHDBSvr (442a13f395546f4564c377296d43b564) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe
21:46:43.0532 5872 SOHDBSvr - ok
21:46:43.0579 5872 SOHDms (556681be668d71dc162391a45422b52c) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe
21:46:43.0626 5872 SOHDms - ok
21:46:43.0673 5872 SOHDs (72b46103e4111439109acf5882627c24) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe
21:46:43.0688 5872 SOHDs - ok
21:46:43.0719 5872 SOHPlMgr (725b6e9cd1959271ac993dc035e1606d) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe
21:46:43.0735 5872 SOHPlMgr - ok
21:46:43.0782 5872 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
21:46:43.0797 5872 spldr - ok
21:46:43.0875 5872 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
21:46:43.0938 5872 Spooler - ok
21:46:44.0234 5872 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
21:46:44.0437 5872 sppsvc - ok
21:46:44.0624 5872 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
21:46:44.0733 5872 sppuinotify - ok
21:46:44.0843 5872 SRTSP (96babc4906ecdb1c69d1176f8647ad8e) C:\Windows\System32\Drivers\NISx64\1109000.00C\SRTSP64.SYS
21:46:44.0889 5872 SRTSP - ok
21:46:44.0905 5872 SRTSPX (c7f491a290e0e4222f5cdcd50eeb8167) C:\Windows\system32\drivers\NISx64\1109000.00C\SRTSPX64.SYS
21:46:44.0921 5872 SRTSPX - ok
21:46:45.0014 5872 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
21:46:45.0108 5872 srv - ok
21:46:45.0170 5872 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
21:46:45.0264 5872 srv2 - ok
21:46:45.0311 5872 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
21:46:45.0357 5872 srvnet - ok
21:46:45.0420 5872 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
21:46:45.0498 5872 SSDPSRV - ok
21:46:45.0529 5872 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
21:46:45.0576 5872 SstpSvc - ok
21:46:45.0654 5872 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys
21:46:45.0685 5872 stexstor - ok
21:46:45.0763 5872 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
21:46:45.0825 5872 stisvc - ok
21:46:45.0841 5872 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
21:46:45.0857 5872 storflt - ok
21:46:45.0888 5872 StorSvc (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll
21:46:45.0950 5872 StorSvc - ok
21:46:45.0997 5872 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
21:46:46.0013 5872 storvsc - ok
21:46:46.0044 5872 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
21:46:46.0059 5872 swenum - ok
21:46:46.0122 5872 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
21:46:46.0215 5872 swprv - ok
21:46:46.0293 5872 SymDS (659b227a72b76115975a6a9491b2fe1f) C:\Windows\system32\drivers\NISx64\1109000.00C\SYMDS64.SYS
21:46:46.0325 5872 SymDS - ok
21:46:46.0371 5872 SymEFA (9f5783a4a03d0091cdbdaa858b566926) C:\Windows\system32\drivers\NISx64\1109000.00C\SYMEFA64.SYS
21:46:46.0403 5872 SymEFA - ok
21:46:46.0449 5872 SymEvent (3f9d5fe52585e2653e59fdbfdf09a94c) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
21:46:46.0465 5872 SymEvent - ok
21:46:46.0496 5872 SymIRON (f57588546e738db1583981d8f44e9bc2) C:\Windows\system32\drivers\NISx64\1109000.00C\Ironx64.SYS
21:46:46.0543 5872 SymIRON - ok
21:46:46.0605 5872 SYMTDIv (3adfb72f0797ae3832509fe030755e21) C:\Windows\System32\Drivers\NISx64\1109000.00C\SYMTDIV.SYS
21:46:46.0637 5872 SYMTDIv - ok
21:46:46.0808 5872 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
21:46:46.0933 5872 SysMain - ok
21:46:47.0105 5872 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
21:46:47.0151 5872 TabletInputService - ok
21:46:47.0183 5872 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
21:46:47.0245 5872 TapiSrv - ok
21:46:47.0276 5872 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
21:46:47.0323 5872 TBS - ok
21:46:47.0541 5872 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
21:46:47.0619 5872 Tcpip - ok
21:46:47.0931 5872 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
21:46:47.0978 5872 TCPIP6 - ok
21:46:48.0119 5872 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
21:46:48.0181 5872 tcpipreg - ok
21:46:48.0212 5872 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
21:46:48.0259 5872 TDPIPE - ok
21:46:48.0290 5872 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
21:46:48.0321 5872 TDTCP - ok
21:46:48.0353 5872 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
21:46:48.0399 5872 tdx - ok
21:46:48.0431 5872 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
21:46:48.0446 5872 TermDD - ok
21:46:48.0524 5872 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
21:46:48.0602 5872 TermService - ok
21:46:48.0665 5872 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
21:46:48.0711 5872 Themes - ok
21:46:48.0743 5872 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:46:48.0789 5872 THREADORDER - ok
21:46:48.0821 5872 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
21:46:48.0852 5872 TrkWks - ok
21:46:48.0914 5872 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
21:46:49.0008 5872 TrustedInstaller - ok
21:46:49.0039 5872 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:46:49.0086 5872 tssecsrv - ok
21:46:49.0117 5872 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
21:46:49.0179 5872 TsUsbFlt - ok
21:46:49.0211 5872 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
21:46:49.0289 5872 tunnel - ok
21:46:49.0320 5872 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys
21:46:49.0335 5872 uagp35 - ok
21:46:49.0398 5872 uCamMonitor (63f6d08c54d5b3c1b12a6172032055c7) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
21:46:49.0429 5872 uCamMonitor - ok
21:46:49.0491 5872 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
21:46:49.0554 5872 udfs - ok
21:46:49.0647 5872 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
21:46:49.0679 5872 UI0Detect - ok
21:46:49.0710 5872 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
21:46:49.0725 5872 uliagpkx - ok
21:46:49.0757 5872 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
21:46:49.0803 5872 umbus - ok
21:46:49.0835 5872 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys
21:46:49.0866 5872 UmPass - ok
21:46:49.0913 5872 UmRdpService (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
21:46:49.0928 5872 UmRdpService - ok
21:46:50.0193 5872 UNS (9e89c2d6945389270de067ce51ff7425) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
21:46:50.0287 5872 UNS - ok
21:46:50.0427 5872 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
21:46:50.0505 5872 upnphost - ok
21:46:50.0552 5872 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
21:46:50.0646 5872 usbccgp - ok
21:46:50.0693 5872 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
21:46:50.0708 5872 usbcir - ok
21:46:50.0755 5872 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
21:46:50.0802 5872 usbehci - ok
21:46:50.0849 5872 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
21:46:50.0880 5872 usbhub - ok
21:46:50.0911 5872 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
21:46:50.0927 5872 usbohci - ok
21:46:50.0958 5872 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\drivers\usbprint.sys
21:46:50.0989 5872 usbprint - ok
21:46:51.0036 5872 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:46:51.0083 5872 USBSTOR - ok
21:46:51.0114 5872 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
21:46:51.0129 5872 usbuhci - ok
21:46:51.0192 5872 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
21:46:51.0239 5872 usbvideo - ok
21:46:51.0270 5872 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
21:46:51.0317 5872 UxSms - ok
21:46:51.0426 5872 VAIO Entertainment TV Device Arbitration Service (4e7135d6d0127067e4cfee12259f895d) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
21:46:51.0457 5872 VAIO Entertainment TV Device Arbitration Service ( UnsignedFile.Multi.Generic ) - warning
21:46:51.0457 5872 VAIO Entertainment TV Device Arbitration Service - detected UnsignedFile.Multi.Generic (1)
21:46:51.0551 5872 VAIO Event Service (d4197cf0c8567046fd4af28ff47af528) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
21:46:51.0597 5872 VAIO Event Service - ok
21:46:51.0753 5872 VAIO Power Management (b8c9a7010afd5cbbe194cb9ef7c4fd14) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
21:46:51.0785 5872 VAIO Power Management - ok
21:46:51.0816 5872 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:46:51.0831 5872 VaultSvc - ok
21:46:51.0925 5872 VCFw (6a740f5ff3246c3be3dd317299efc88e) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
21:46:51.0972 5872 VCFw - ok
21:46:52.0050 5872 VcmIAlzMgr (fd03ac6cd1571aa8b2ff56d3c600e26e) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
21:46:52.0097 5872 VcmIAlzMgr - ok
21:46:52.0159 5872 VcmINSMgr (9d9b34b430b4dc683112f59c80d20ab8) C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
21:46:52.0206 5872 VcmINSMgr - ok
21:46:52.0284 5872 VcmXmlIfHelper (dfe10c68ef4684f7754fcca39a4cc6ba) C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe
21:46:52.0299 5872 VcmXmlIfHelper - ok
21:46:52.0440 5872 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
21:46:52.0471 5872 vdrvroot - ok
21:46:52.0533 5872 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
21:46:52.0596 5872 vds - ok
21:46:52.0643 5872 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
21:46:52.0689 5872 vga - ok
21:46:52.0705 5872 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
21:46:52.0752 5872 VgaSave - ok
21:46:52.0814 5872 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
21:46:52.0845 5872 vhdmp - ok
21:46:52.0877 5872 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
21:46:52.0892 5872 viaide - ok
21:46:52.0923 5872 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
21:46:52.0955 5872 vmbus - ok
21:46:53.0001 5872 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
21:46:53.0017 5872 VMBusHID - ok
21:46:53.0048 5872 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
21:46:53.0064 5872 volmgr - ok
21:46:53.0095 5872 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
21:46:53.0126 5872 volmgrx - ok
21:46:53.0157 5872 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
21:46:53.0189 5872 volsnap - ok
21:46:53.0235 5872 vpcbus (b4a73ca4ef9a02b9738cea9ad5fe5917) C:\Windows\system32\DRIVERS\vpchbus.sys
21:46:53.0251 5872 vpcbus - ok
21:46:53.0282 5872 vpcnfltr (e675fb2b48c54f09895482e2253b289c) C:\Windows\system32\DRIVERS\vpcnfltr.sys
21:46:53.0329 5872 vpcnfltr - ok
21:46:53.0376 5872 vpcusb (5fb42082b0d19a0268705f1dd343df20) C:\Windows\system32\DRIVERS\vpcusb.sys
21:46:53.0423 5872 vpcusb - ok
21:46:53.0485 5872 vpcvmm (207b6539799cc1c112661a9b620dd233) C:\Windows\system32\drivers\vpcvmm.sys
21:46:53.0532 5872 vpcvmm - ok
21:46:53.0579 5872 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys
21:46:53.0610 5872 vsmraid - ok
21:46:53.0766 5872 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
21:46:53.0859 5872 VSS - ok
21:46:54.0093 5872 VUAgent (d62d16e057be87f5b84a54d1b83822c4) C:\Program Files\Sony\VAIO Update Common\VUAgent.exe
21:46:54.0140 5872 VUAgent - ok
21:46:54.0281 5872 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
21:46:54.0327 5872 vwifibus - ok
21:46:54.0343 5872 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
21:46:54.0374 5872 vwififlt - ok
21:46:54.0405 5872 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
21:46:54.0421 5872 vwifimp - ok
21:46:54.0515 5872 VzCdbSvc (d8bef4ac1eac809dbdbd441d6cff6c4c) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
21:46:54.0577 5872 VzCdbSvc ( UnsignedFile.Multi.Generic ) - warning
21:46:54.0577 5872 VzCdbSvc - detected UnsignedFile.Multi.Generic (1)
21:46:54.0624 5872 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
21:46:54.0717 5872 W32Time - ok
21:46:54.0749 5872 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys
21:46:54.0764 5872 WacomPen - ok
21:46:54.0811 5872 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:46:54.0873 5872 WANARP - ok
21:46:54.0873 5872 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:46:54.0920 5872 Wanarpv6 - ok
21:46:55.0061 5872 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
21:46:55.0107 5872 WatAdminSvc - ok
21:46:55.0263 5872 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
21:46:55.0326 5872 wbengine - ok
21:46:55.0466 5872 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
21:46:55.0513 5872 WbioSrvc - ok
21:46:55.0560 5872 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
21:46:55.0622 5872 wcncsvc - ok
21:46:55.0638 5872 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
21:46:55.0669 5872 WcsPlugInService - ok
21:46:55.0731 5872 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys
21:46:55.0763 5872 Wd - ok
21:46:55.0841 5872 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
21:46:55.0887 5872 Wdf01000 - ok
21:46:55.0919 5872 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:46:56.0028 5872 WdiServiceHost - ok
21:46:56.0028 5872 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:46:56.0059 5872 WdiSystemHost - ok
21:46:56.0090 5872 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
21:46:56.0153 5872 WebClient - ok
21:46:56.0199 5872 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
21:46:56.0293 5872 Wecsvc - ok
21:46:56.0324 5872 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
21:46:56.0371 5872 wercplsupport - ok
21:46:56.0402 5872 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
21:46:56.0433 5872 WerSvc - ok
21:46:56.0496 5872 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
21:46:56.0558 5872 WfpLwf - ok
21:46:56.0589 5872 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
21:46:56.0605 5872 WIMMount - ok
21:46:56.0636 5872 WinDefend - ok
21:46:56.0636 5872 WinHttpAutoProxySvc - ok
21:46:56.0714 5872 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
21:46:56.0808 5872 Winmgmt - ok
21:46:57.0026 5872 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
21:46:57.0104 5872 WinRM - ok
21:46:57.0291 5872 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
21:46:57.0354 5872 Wlansvc - ok
21:46:57.0619 5872 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
21:46:57.0681 5872 wlidsvc - ok
21:46:57.0822 5872 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
21:46:57.0853 5872 WmiAcpi - ok
21:46:57.0931 5872 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
21:46:58.0009 5872 wmiApSrv - ok
21:46:58.0071 5872 WMPNetworkSvc - ok
21:46:58.0103 5872 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
21:46:58.0181 5872 WPCSvc - ok
21:46:58.0227 5872 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
21:46:58.0274 5872 WPDBusEnum - ok
21:46:58.0305 5872 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
21:46:58.0383 5872 ws2ifsl - ok
21:46:58.0430 5872 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
21:46:58.0493 5872 wscsvc - ok
21:46:58.0493 5872 WSearch - ok
21:46:58.0727 5872 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
21:46:58.0867 5872 wuauserv - ok
21:46:59.0054 5872 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
21:46:59.0148 5872 WudfPf - ok
21:46:59.0179 5872 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
21:46:59.0226 5872 WUDFRd - ok
21:46:59.0273 5872 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
21:46:59.0304 5872 wudfsvc - ok
21:46:59.0351 5872 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
21:46:59.0413 5872 WwanSvc - ok
21:46:59.0475 5872 yukonw7 (64f88af327aa74e03658ae32b48ccb8b) C:\Windows\system32\DRIVERS\yk62x64.sys
21:46:59.0538 5872 yukonw7 - ok
21:46:59.0569 5872 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
21:46:59.0975 5872 \Device\Harddisk0\DR0 - ok
21:46:59.0975 5872 Boot (0x1200) (6fbfd6f141b022d768b3cbbd4216b9ac) \Device\Harddisk0\DR0\Partition0
21:46:59.0975 5872 \Device\Harddisk0\DR0\Partition0 - ok
21:47:00.0021 5872 Boot (0x1200) (2ce67dd3f52b18875a3bfe39e41b5cd4) \Device\Harddisk0\DR0\Partition1
21:47:00.0021 5872 \Device\Harddisk0\DR0\Partition1 - ok
21:47:00.0021 5872 ============================================================
21:47:00.0021 5872 Scan finished
21:47:00.0021 5872 ============================================================
21:47:00.0021 6716 Detected object count: 6
21:47:00.0021 6716 Actual detected object count: 6
21:47:07.0213 6716 igfx ( UnsignedFile.Multi.Generic ) - skipped by user
21:47:07.0213 6716 igfx ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:47:07.0213 6716 Impcd ( UnsignedFile.Multi.Generic ) - skipped by user
21:47:07.0213 6716 Impcd ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:47:07.0213 6716 IntcDAud ( UnsignedFile.Multi.Generic ) - skipped by user
21:47:07.0213 6716 IntcDAud ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:47:07.0213 6716 SampleCollector ( UnsignedFile.Multi.Generic ) - skipped by user
21:47:07.0213 6716 SampleCollector ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:47:07.0213 6716 VAIO Entertainment TV Device Arbitration Service ( UnsignedFile.Multi.Generic ) - skipped by user
21:47:07.0213 6716 VAIO Entertainment TV Device Arbitration Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:47:07.0213 6716 VzCdbSvc ( UnsignedFile.Multi.Generic ) - skipped by user
21:47:07.0213 6716 VzCdbSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip

*****************************************aswMBR Log************************************
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-06-14 20:53:48
—————————–
20:53:48.281 OS Version: Windows x64 6.1.7601 Service Pack 1
20:53:48.281 Number of processors: 4 586 0x2505
20:53:48.281 ComputerName: V-VAIO UserName: V
20:53:49.935 Initialize success
20:54:34.940 AVAST engine defs: 12061401
20:54:48.044 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
20:54:48.044 Disk 0 Vendor: Hitachi_ PB3O Size: 305245MB BusType: 3
20:54:48.044 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000077
20:54:48.044 Disk 1 Vendor: RICOH 02 Size: 305245MB BusType: 0
20:54:48.060 Disk 2 \Device\Harddisk2\DR2 -> \Device\00000078
20:54:48.060 Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
20:54:48.075 Disk 0 MBR read successfully
20:54:48.075 Disk 0 MBR scan
20:54:48.091 Disk 0 Windows 7 default MBR code
20:54:48.107 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 15983 MB offset 2048
20:54:48.122 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 32735232
20:54:48.138 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 289160 MB offset 32940032
20:54:48.185 Disk 0 scanning C:\Windows\system32\drivers
20:55:03.239 Service scanning
20:55:43.003 Modules scanning
20:55:43.003 Disk 0 trace - called modules:
20:55:43.034 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
20:55:43.050 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006398060]
20:55:43.050 3 CLASSPNP.SYS[fffff88001a0143f] -> nt!IofCallDriver -> [0xfffffa8003570040]
20:55:43.050 5 ACPI.sys[fffff88000eed7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004320050]
20:55:44.532 AVAST engine scan C:\Windows
20:55:47.278 AVAST engine scan C:\Windows\system32
21:01:22.273 AVAST engine scan C:\Windows\system32\drivers
21:01:55.610 AVAST engine scan C:\Users\V
21:08:41.830 AVAST engine scan C:\ProgramData
21:22:34.715 Scan finished successfully
21:25:07.680 Disk 0 MBR has been saved successfully to "C:\Users\V\Desktop\MBR.dat"
21:25:07.680 The log file has been saved successfully to "C:\Users\V\Desktop\aswMBR.txt"

📎MBR.zip

mrp

Post #9June 16, 2012, 1:03 AM UTC

ComboFix

Refer to the ComboFix User's Guide
Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
You can get help on disabling your protection programs here
Double click on ComboFix.exe & follow the prompts.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouse click ComboFix's window whilst it's running. That may cause it to stall.

———————————————————————————————
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

———————————————————————————————

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

willbuxtonfarms

Post #10June 16, 2012, 12:39 PM UTC

Here is my ComboFix Log. Please note that after running ComboFix I couldn't get on the internet with my Norton Firewall activated for some reason. I didn't change anything in Norton but the firewall was all of a sudden blocking me from accessing any internet sites whatsoever. I fiddled with Norton's settings and even called tech support but to no avail. Only after updating Norton was I able to have the firewall active and still get on the internet. I don't know what ComboFix did but it wasn't good. And I ran TDSSKiller again after ComboFix and the 6 unsigned files are still there. ******************************************************************************** ******************************************************************************** ComboFix 12-06-15.06 - V 06/15/2012 21:38:55.1.4 - x64 Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3950.2227 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-05-16 to 2012-06-16 ))))))))))))))))))))))))))))))) . . 2012-06-15 12:21 . 2012-06-15 12:21 ——– d—–w- c:\users\V\AppData\Local\Macromedia 2012-06-13 22:01 . 2012-06-13 22:02 ——– d—–w- c:\windows\rescache 2012-06-13 15:56 . 2012-05-01 05:40 209920 —-a-w- c:\windows\system32\profsvc.dll 2012-06-13 15:56 . 2012-04-07 12:31 3216384 —-a-w- c:\windows\system32\msi.dll 2012-06-13 15:56 . 2012-04-07 11:26 2342400 —-a-w- c:\windows\SysWow64\msi.dll 2012-06-13 15:56 . 2012-04-26 05:41 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-06-13 15:56 . 2012-04-26 05:41 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-13 15:56 . 2012-04-26 05:34 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-13 15:56 . 2012-05-04 11:06 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-06-13 15:56 . 2012-05-04 10:03 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-06-13 15:56 . 2012-05-04 10:03 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-06-13 15:56 . 2012-04-28 03:55 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-13 15:55 . 2012-05-15 01:32 3146752 —-a-w- c:\windows\system32\win32k.sys 2012-06-13 15:55 . 2012-04-24 05:37 184320 —-a-w- c:\windows\system32\cryptsvc.dll 2012-06-13 15:55 . 2012-04-24 05:37 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-06-13 15:55 . 2012-04-24 05:37 1462272 —-a-w- c:\windows\system32\crypt32.dll 2012-06-13 15:55 . 2012-04-24 04:36 140288 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-06-13 15:55 . 2012-04-24 04:36 1158656 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-06-13 15:55 . 2012-04-24 04:36 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll 2012-06-07 21:29 . 2012-06-07 21:29 770384 —-a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll 2012-06-07 21:29 . 2012-06-07 21:29 421200 —-a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll 2012-06-03 21:45 . 2012-06-03 21:45 ——– d—–w- c:\program files\Avidemux 2.5 . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-15 11:57 . 2012-04-05 03:36 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-15 11:57 . 2011-08-08 16:59 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-05-05 11:10 . 2012-05-02 04:10 8744608 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-04-05 16:19 . 2010-09-04 16:20 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-04-05 16:07 . 2012-04-05 16:07 525544 —-a-w- c:\windows\system32\deployJava1.dll 2012-04-05 13:55 . 2012-04-05 13:55 12872 —-a-w- c:\windows\system32\bootdelete.exe 2012-04-04 19:56 . 2012-04-05 13:15 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-30 11:35 . 2012-05-11 00:15 1918320 —-a-w- c:\windows\system32\drivers\tcpip.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2009-11-20 284696] "SmartWiHelper"="c:\program files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" [2010-01-20 82944] "ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-08-27 320880] "PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2009-10-24 597792] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 1081632] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2009-12-02 05:03 98304 —-a-w- c:\windows\System32\VESWinlogon.dll . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-24 135664] R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-08-31 362992] R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-24 135664] R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [x] R3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-15 113120] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-08-31 313840] R3 SampleCollector;Intel® Sample Collector;c:\program files\Sony\VAIO Care\collsvc.exe [2009-09-17 167424] R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-10-15 120104] R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-10-15 70952] R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-10-15 427304] R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-10-15 75048] R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-10-15 91432] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-09-16 480624] R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2009-09-02 361840] R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-09-09 110960] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1109000.00C\SYMDS64.SYS [x] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1109000.00C\SYMEFA64.SYS [x] S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20120531.001\BHDrvx64.sys [2012-04-02 1160824] S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NISx64\1109000.00C\ccHPx64.sys [x] S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20120613.007\IDSvia64.sys [2012-06-13 488568] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1109000.00C\Ironx64.SYS [x] S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NISx64\1109000.00C\SYMTDIV.SYS [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-09-06 169312] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-11-20 13336] S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe [2011-08-04 126400] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x] S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224] S2 regi;regi;c:\windows\system32\drivers\regi.sys [x] S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [x] S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [x] S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-12-14 2320920] S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-09-15 642416] S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x] S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-05-31 138912] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [x] S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x] S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [x] S3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2009-12-01 571248] S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2011-09-23 1429608] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-24 20:17] . 2012-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-24 20:17] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-16 9636896] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = about:blank mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod;=SNNT mLocal Page = c:\windows\SysWOW64\blank.htm IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport; to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html IE: Se&nd; to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 IE: Send image to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\V\AppData\Roaming\Mozilla\Firefox\Profiles\4zbqo5v8.default\ FF - prefs.js: browser.startup.homepage - www.google.com . - - - - ORPHANS REMOVED - - - - . HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\17.9.0.12\diMaster.dll\" /prefetch:1" – . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector] "ImagePath"="\"c:\program files\Sony\VAIO Care\collsvc.exe\" \"/service\" \"/counter=\Processor(_Total)\% Processor Time:5\" \"/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:5\" \"/counter=\Network Interface(*)\Bytes Total/sec:5\" \"/directory=inteldata\"" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-408617068-3671341003-1933957367-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-408617068-3671341003-1933957367-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000001 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe c:\program files (x86)\Sony\VAIO Event Service\VESMgr.exe c:\program files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe c:\windows\SysWOW64\DllHost.exe c:\program files (x86)\Sony\VAIO Event Service\VESMgrSub.exe c:\program files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe . ************************************************************************** . Completion time: 2012-06-15 22:04:19 - machine was rebooted ComboFix-quarantined-files.txt 2012-06-16 02:04 . Pre-Run: 1,347,170,304 bytes free Post-Run: 1,425,260,544 bytes free . - - End Of File - - 9552A04B8B49E422C9A103CF6AA54DE7

mrp

Post #11June 16, 2012, 2:47 PM UTC

willbuxtonfarms,

Unsigned file detections by TDSSKiller are not necessarily malicious. There is a reason that the default action for those detections is skip.

Your logs look good so far, but let's run one last scan just to make sure nothing is lurking.

TFC

Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run.
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish its job.
- Once it's finished it should automatically reboot your machine.
- If it doesn't, manually reboot to ensure a complete clean.
ESET Online Scanner

Please disable any real-time security programs such as your anti-virus before proceeding with this scan.
- Open Internet Explorer.
- Download ESET Online Scanner.
- Put a checkmark in the checkbox next to YES, I accept the Terms of Use.
- Click Start.
- When prompted by your web browser, click Install.
- Uncheck Remove found threats.
- Check Scan archives.
- Click Start and let the scanner finish downloading virus signatures. The scan will begin afterward.
- When the scan completes, click List of found threats.
- Click Export to text file… and save the file to your desktop.
- Click Back.
- Click Finish.

Please post the ESET log in your next reply or advise if it didn't produce one.

willbuxtonfarms

Post #12June 16, 2012, 7:11 PM UTC

The TFC scan came up clean. The ESE scan found 1 threat, a Trojan, here is the log: C:\Users\V\AppData\Roaming\Mozilla\Firefox\Profiles\4zbqo5v8.default\extensions\[removed] JS/Redirector.NBX trojan What should I do? Is that a dangerous Trojan?

mrp

Post #13June 16, 2012, 8:22 PM UTC

That threat falls under the category of programs or scripts that redirect users from one website to another without their knowledge or consent. Let's take care of that now.

OTL

Run OTL.exe.

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.

:Files
C:\Users\V\AppData\Roaming\Mozilla\Firefox\Profiles\4zbqo5v8.default\extensions\[removed]
ipconfig /flushdns /c

:Commands
[createrestorepoint]
[purity]
[emptytemp]

Click the Run Fix button.
OTL will now process the instructions.
When finished a box will open asking you to open the fix log, click OK.
The fix log will open.
Copy/Paste the log in your next reply please.

Note: If necessary, OTL may reboot your computer, or request that you do so. If it does, please go ahead and reboot your machine. After rebooting, open up Windows Explorer (Windows Key +E) and navigate to C:\_OTL\MovedFiles. Within, you should find a .log file with the format mmddyyyy_hhmmss, which represents the date and time the fix was run. Please copy and paste the contents of that file, making sure Word Wrap is off beforehand, if necessary.

Please advise how your computer is running and if there are any outstanding issues.

willbuxtonfarms

Post #14June 16, 2012, 10:36 PM UTC last edited June 16, 2012, 10:37 PM UTC

Looks like it worked. Should I run ESE again to make sure the system is clean? Here is the log:

All processes killed
========== FILES ==========
C:\Users\V\AppData\Roaming\Mozilla\Firefox\Profiles\4zbqo5v8.default\extensions\[removed] moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\V\Desktop\cmd.bat deleted successfully.
C:\Users\V\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
System Restore Service not available.

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: V
->Temp folder emptied: 79 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 12649246 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 608 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 12.00 mb

OTL by OldTimer - Version 3.2.49.0 log created on 06162012_182841

mrp

Post #15June 17, 2012, 12:07 AM UTC

Please download Farbar Service Scanner and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please post the log in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

TDSSKiller Found igfx and VzCdbsvc unsigned items, seems serious, shou

✨ Ask AI

Ask AI