What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected Shut Down Internet - Sound - MSFT Licenses

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
The problems started after I had a notification in bottom status bar for windows update. I clicked to install, next time I turned on laptop computer screen was darker (sleep mode) but would not brighten with mouse activity. Could no longer get my internet connection to work. My sound card was disabled and when I tried to run Microsoft office programs license was disabled.

I attempted to run OTL program but close to completion it gets hung up and says something about not being able to connect to server then freezes before I get text file.

Had problems with hijack this had to run as administrator

here is log

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:02:35 AM, on 6/13/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\Owner\Desktop\OTL.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Users\Owner\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
O4 - HKLM\..\Run: [DLSService] "C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [DymoQuickPrint] "C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe" /startup
O4 - HKCU\..\Run: [TaskScheduler] C:\ProWin11\32bit\TaskSch.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User '?')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User '?')
O4 - HKUS\S-1-5-21-300365953-2318020126-303707268-1000\..\Run: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe" (User '?')
O4 - Global Startup: Intuit Data Protect.lnk = C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: QuickBooks_Standard_21.lnk = C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: intu-help-qb3 - {C5E479EA-0A65-4B05-8C6C-2FC8CC682EB4} - C:\Program Files (x86)\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll
O18 - Protocol: intu-help-qb5 - {867FCB77-9823-4CD6-8210-D85F968D466F} - C:\Program Files (x86)\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

–
End of file - 7299 bytes


Please help having to use ancient slow laptop to post to forum. Thanks!
Post #2
Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post





Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
      If suspicious objects are found select skip
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)








Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt and Attach.txt in your next reply
Post #3
OK Thanks Here is TDS txt file 16:23:39.0422 0904 TDSS rootkit removing tool [removed] May 21 2012 16:40:16 16:23:39.0515 0904 ============================================================ 16:23:39.0515 0904 Current date / time: 2012/06/13 16:23:39.0515 16:23:39.0515 0904 SystemInfo: 16:23:39.0515 0904 16:23:39.0515 0904 OS Version: 6.1.7601 ServicePack: 1.0 16:23:39.0515 0904 Product type: Workstation 16:23:39.0515 0904 ComputerName: OWNER-PC 16:23:39.0515 0904 UserName: Owner 16:23:39.0515 0904 Windows directory: C:\Windows 16:23:39.0515 0904 System windows directory: C:\Windows 16:23:39.0515 0904 Running under WOW64 16:23:39.0515 0904 Processor architecture: Intel x64 16:23:39.0515 0904 Number of processors: 3 16:23:39.0515 0904 Page size: 0x1000 16:23:39.0515 0904 Boot type: Normal boot 16:23:39.0515 0904 ============================================================ 16:23:41.0434 0904 Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 16:23:41.0512 0904 Drive \Device\Harddisk2\DR2 - Size: 0x3BA300000 (14.91 Gb), SectorSize: 0x200, Cylinders: 0x79A, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 16:23:41.0528 0904 ============================================================ 16:23:41.0528 0904 \Device\Harddisk0\DR0: 16:23:41.0528 0904 MBR partitions: 16:23:41.0528 0904 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x97FF800 16:23:41.0528 0904 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x9863800, BlocksNum 0x40FF4000 16:23:41.0528 0904 \Device\Harddisk2\DR2: 16:23:41.0528 0904 MBR partitions: 16:23:41.0528 0904 \Device\Harddisk2\DR2\Partition0: MBR, Type 0xC, StartLBA 0x20, BlocksNum 0x1DD17E0 16:23:41.0528 0904 ============================================================ 16:23:41.0559 0904 C: <-> \Device\Harddisk0\DR0\Partition1 16:23:41.0559 0904 ============================================================ 16:23:41.0559 0904 Initialize success 16:23:41.0559 0904 ============================================================ 16:23:52.0931 1720 ============================================================ 16:23:52.0931 1720 Scan started 16:23:52.0931 1720 Mode: Manual; 16:23:52.0931 1720 ============================================================ 16:23:53.0836 1720 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 16:23:53.0836 1720 1394ohci - ok 16:23:53.0867 1720 Accelerometer (3e2427d4966c7606097341e55ab4e105) C:\Windows\system32\DRIVERS\Accelerometer.sys 16:23:53.0867 1720 Accelerometer - ok 16:23:53.0976 1720 ACDaemon (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 16:23:53.0976 1720 ACDaemon - ok 16:23:54.0023 1720 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 16:23:54.0023 1720 ACPI - ok 16:23:54.0054 1720 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 16:23:54.0054 1720 AcpiPmi - ok 16:23:54.0164 1720 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 16:23:54.0164 1720 AdobeARMservice - ok 16:23:54.0304 1720 AdobeFlashPlayerUpdateSvc (f3cd7b20b27d1772c946df993ff3635c) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 16:23:54.0320 1720 AdobeFlashPlayerUpdateSvc - ok 16:23:54.0382 1720 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys 16:23:54.0382 1720 adp94xx - ok 16:23:54.0429 1720 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys 16:23:54.0429 1720 adpahci - ok 16:23:54.0476 1720 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys 16:23:54.0476 1720 adpu320 - ok 16:23:54.0507 1720 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 16:23:54.0507 1720 AeLookupSvc - ok 16:23:54.0569 1720 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys 16:23:54.0585 1720 AFD - ok 16:23:54.0616 1720 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 16:23:54.0632 1720 agp440 - ok 16:23:54.0663 1720 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 16:23:54.0663 1720 ALG - ok 16:23:54.0694 1720 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 16:23:54.0694 1720 aliide - ok 16:23:54.0756 1720 AMD External Events Utility (29c151492510640343b00b63996e4070) C:\Windows\system32\atiesrxx.exe 16:23:54.0756 1720 AMD External Events Utility - ok 16:23:54.0772 1720 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 16:23:54.0772 1720 amdide - ok 16:23:54.0788 1720 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys 16:23:54.0788 1720 AmdK8 - ok 16:23:55.0256 1720 amdkmdag (2c9c4824664c61351ff1e0169262d026) C:\Windows\system32\DRIVERS\atikmdag.sys 16:23:55.0380 1720 amdkmdag - ok 16:23:55.0521 1720 amdkmdap (ef7382689d3b17ac2983202e7a40ab45) C:\Windows\system32\DRIVERS\atikmpag.sys 16:23:55.0521 1720 amdkmdap - ok 16:23:55.0568 1720 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 16:23:55.0568 1720 AmdPPM - ok 16:23:55.0614 1720 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys 16:23:55.0614 1720 amdsata - ok 16:23:55.0661 1720 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys 16:23:55.0661 1720 amdsbs - ok 16:23:55.0708 1720 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys 16:23:55.0708 1720 amdxata - ok 16:23:55.0755 1720 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 16:23:55.0755 1720 AppID - ok 16:23:55.0802 1720 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 16:23:55.0802 1720 AppIDSvc - ok 16:23:55.0833 1720 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll 16:23:55.0833 1720 Appinfo - ok 16:23:55.0880 1720 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys 16:23:55.0880 1720 arc - ok 16:23:55.0895 1720 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys 16:23:55.0895 1720 arcsas - ok 16:23:56.0020 1720 aspnet_state (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 16:23:56.0020 1720 aspnet_state - ok 16:23:56.0051 1720 aswFsBlk (b9da213b5271db5fce962d827e6d620d) C:\Windows\system32\drivers\aswFsBlk.sys 16:23:56.0051 1720 aswFsBlk - ok 16:23:56.0082 1720 aswMonFlt (21c9835d0e5ad2ff0f16134bcb32cc71) C:\Windows\system32\drivers\aswMonFlt.sys 16:23:56.0082 1720 aswMonFlt - ok 16:23:56.0129 1720 aswRdr (1b96a5867abd4fa6135d8298fcccf9c6) C:\Windows\System32\Drivers\aswrdr2.sys 16:23:56.0129 1720 aswRdr - ok 16:23:56.0176 1720 aswSnx (6e98bb288696777a3a8a07a52b0eaee9) C:\Windows\system32\drivers\aswSnx.sys 16:23:56.0192 1720 aswSnx - ok 16:23:56.0207 1720 aswSP (d9fb49f16e4eb02efecae8cbfe4bcb4c) C:\Windows\system32\drivers\aswSP.sys 16:23:56.0223 1720 aswSP - ok 16:23:56.0238 1720 aswTdi (7352bb9a564b94bbd7c9cbf165f55006) C:\Windows\system32\drivers\aswTdi.sys 16:23:56.0254 1720 aswTdi - ok 16:23:56.0285 1720 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 16:23:56.0285 1720 AsyncMac - ok 16:23:56.0301 1720 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 16:23:56.0301 1720 atapi - ok 16:23:56.0800 1720 atikmdag (2c9c4824664c61351ff1e0169262d026) C:\Windows\system32\DRIVERS\atikmdag.sys 16:23:56.0847 1720 atikmdag - ok 16:23:57.0003 1720 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 16:23:57.0018 1720 AudioEndpointBuilder - ok 16:23:57.0018 1720 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 16:23:57.0018 1720 AudioSrv - ok 16:23:57.0096 1720 avast! Antivirus (4041d31508a2a084dfb42c595854090f) C:\Program Files\AVAST Software\Avast\AvastSvc.exe 16:23:57.0096 1720 avast! Antivirus - ok 16:23:57.0143 1720 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll 16:23:57.0143 1720 AxInstSV - ok 16:23:57.0237 1720 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys 16:23:57.0237 1720 b06bdrv - ok 16:23:57.0284 1720 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 16:23:57.0284 1720 b57nd60a - ok 16:23:57.0502 1720 BCM43XX (0e7a9264576b40638a3fbc804de1ff76) C:\Windows\system32\DRIVERS\bcmwl664.sys 16:23:57.0518 1720 BCM43XX - ok 16:23:57.0642 1720 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 16:23:57.0642 1720 BDESVC - ok 16:23:57.0705 1720 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 16:23:57.0705 1720 Beep - ok 16:23:57.0783 1720 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll 16:23:57.0798 1720 BFE - ok 16:23:57.0861 1720 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll 16:23:57.0908 1720 BITS - ok 16:23:57.0954 1720 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 16:23:57.0954 1720 blbdrive - ok 16:23:58.0032 1720 Bonjour Service (73686fe0b2e0469f89fd2075be724704) C:\Program Files (x86)\Bonjour\mDNSResponder.exe 16:23:58.0048 1720 Bonjour Service - ok 16:23:58.0079 1720 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 16:23:58.0095 1720 bowser - ok 16:23:58.0126 1720 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys 16:23:58.0126 1720 BrFiltLo - ok 16:23:58.0142 1720 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys 16:23:58.0142 1720 BrFiltUp - ok 16:23:58.0188 1720 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll 16:23:58.0188 1720 Browser - ok 16:23:58.0235 1720 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 16:23:58.0235 1720 Brserid - ok 16:23:58.0266 1720 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 16:23:58.0282 1720 BrSerWdm - ok 16:23:58.0298 1720 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 16:23:58.0298 1720 BrUsbMdm - ok 16:23:58.0313 1720 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 16:23:58.0313 1720 BrUsbSer - ok 16:23:58.0360 1720 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys 16:23:58.0360 1720 BthEnum - ok 16:23:58.0360 1720 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys 16:23:58.0376 1720 BTHMODEM - ok 16:23:58.0391 1720 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys 16:23:58.0407 1720 BthPan - ok 16:23:58.0469 1720 BTHPORT (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys 16:23:58.0469 1720 BTHPORT - ok 16:23:58.0500 1720 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 16:23:58.0500 1720 bthserv - ok 16:23:58.0516 1720 BTHUSB (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys 16:23:58.0516 1720 BTHUSB - ok 16:23:58.0532 1720 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 16:23:58.0532 1720 cdfs - ok 16:23:58.0563 1720 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys 16:23:58.0578 1720 cdrom - ok 16:23:58.0610 1720 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 16:23:58.0610 1720 CertPropSvc - ok 16:23:58.0641 1720 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys 16:23:58.0641 1720 circlass - ok 16:23:58.0688 1720 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 16:23:58.0688 1720 CLFS - ok 16:23:58.0766 1720 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 16:23:58.0766 1720 clr_optimization_v2.0.50727_32 - ok 16:23:58.0828 1720 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 16:23:58.0828 1720 clr_optimization_v2.0.50727_64 - ok 16:23:58.0906 1720 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 16:23:58.0984 1720 clr_optimization_v4.0.30319_32 - ok 16:23:59.0031 1720 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 16:23:59.0062 1720 clr_optimization_v4.0.30319_64 - ok 16:23:59.0093 1720 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 16:23:59.0093 1720 CmBatt - ok 16:23:59.0109 1720 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 16:23:59.0109 1720 cmdide - ok 16:23:59.0171 1720 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys 16:23:59.0187 1720 CNG - ok 16:23:59.0218 1720 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 16:23:59.0218 1720 Compbatt - ok 16:23:59.0265 1720 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\DRIVERS\CompositeBus.sys 16:23:59.0265 1720 CompositeBus - ok 16:23:59.0265 1720 COMSysApp - ok 16:23:59.0296 1720 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys 16:23:59.0296 1720 crcdisk - ok 16:23:59.0343 1720 CryptSvc (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll 16:23:59.0358 1720 CryptSvc - ok 16:23:59.0405 1720 dc3d (1ca90212a99db6975c344826d11055c9) C:\Windows\system32\DRIVERS\dc3d.sys 16:23:59.0405 1720 dc3d - ok 16:23:59.0483 1720 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 16:23:59.0483 1720 DcomLaunch - ok 16:23:59.0514 1720 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 16:23:59.0530 1720 defragsvc - ok 16:23:59.0561 1720 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 16:23:59.0561 1720 DfsC - ok 16:23:59.0608 1720 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll 16:23:59.0608 1720 Dhcp - ok 16:23:59.0639 1720 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 16:23:59.0639 1720 discache - ok 16:23:59.0686 1720 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys 16:23:59.0686 1720 Disk - ok 16:23:59.0717 1720 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll 16:23:59.0733 1720 Dnscache - ok 16:23:59.0764 1720 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll 16:23:59.0764 1720 dot3svc - ok 16:23:59.0795 1720 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll 16:23:59.0795 1720 DPS - ok 16:23:59.0826 1720 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 16:23:59.0826 1720 drmkaud - ok 16:23:59.0904 1720 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 16:23:59.0904 1720 DXGKrnl - ok 16:24:00.0029 1720 DymoPnpService (16801152c1c1ba0857972c28d35bce33) C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe 16:24:00.0029 1720 DymoPnpService - ok 16:24:00.0076 1720 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 16:24:00.0076 1720 EapHost - ok 16:24:00.0279 1720 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys 16:24:00.0357 1720 ebdrv - ok 16:24:00.0466 1720 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe 16:24:00.0466 1720 EFS - ok 16:24:00.0560 1720 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe 16:24:00.0560 1720 ehRecvr - ok 16:24:00.0591 1720 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 16:24:00.0591 1720 ehSched - ok 16:24:00.0700 1720 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys 16:24:00.0700 1720 elxstor - ok 16:24:00.0716 1720 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 16:24:00.0716 1720 ErrDev - ok 16:24:00.0794 1720 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 16:24:00.0794 1720 EventSystem - ok 16:24:00.0840 1720 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 16:24:00.0840 1720 exfat - ok 16:24:00.0872 1720 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 16:24:00.0872 1720 fastfat - ok 16:24:00.0950 1720 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe 16:24:00.0965 1720 Fax - ok 16:24:00.0981 1720 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys 16:24:00.0981 1720 fdc - ok 16:24:01.0012 1720 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 16:24:01.0012 1720 fdPHost - ok 16:24:01.0043 1720 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 16:24:01.0043 1720 FDResPub - ok 16:24:01.0059 1720 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 16:24:01.0059 1720 FileInfo - ok 16:24:01.0074 1720 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 16:24:01.0074 1720 Filetrace - ok 16:24:01.0199 1720 FLEXnet Licensing Service (227846995afeefa70d328bf5334a86a5) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 16:24:01.0215 1720 FLEXnet Licensing Service - ok 16:24:01.0230 1720 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys 16:24:01.0230 1720 flpydisk - ok 16:24:01.0262 1720 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 16:24:01.0262 1720 FltMgr - ok 16:24:01.0355 1720 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll 16:24:01.0355 1720 FontCache - ok 16:24:01.0418 1720 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 16:24:01.0418 1720 FontCache3.0.0.0 - ok 16:24:01.0464 1720 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 16:24:01.0464 1720 FsDepends - ok 16:24:01.0496 1720 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys 16:24:01.0496 1720 Fs_Rec - ok 16:24:01.0542 1720 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 16:24:01.0542 1720 fvevol - ok 16:24:01.0574 1720 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys 16:24:01.0574 1720 gagp30kx - ok 16:24:01.0620 1720 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll 16:24:01.0636 1720 gpsvc - ok 16:24:01.0698 1720 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 16:24:01.0698 1720 gupdate - ok 16:24:01.0745 1720 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 16:24:01.0745 1720 gupdatem - ok 16:24:01.0761 1720 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 16:24:01.0761 1720 hcw85cir - ok 16:24:01.0823 1720 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 16:24:01.0823 1720 HdAudAddService - ok 16:24:01.0870 1720 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys 16:24:01.0870 1720 HDAudBus - ok 16:24:01.0901 1720 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys 16:24:01.0901 1720 HidBatt - ok 16:24:01.0917 1720 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys 16:24:01.0917 1720 HidBth - ok 16:24:01.0948 1720 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys 16:24:01.0948 1720 HidIr - ok 16:24:01.0979 1720 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll 16:24:01.0979 1720 hidserv - ok 16:24:02.0026 1720 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys 16:24:02.0026 1720 HidUsb - ok 16:24:02.0057 1720 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll 16:24:02.0057 1720 hkmsvc - ok 16:24:02.0073 1720 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll 16:24:02.0088 1720 HomeGroupListener - ok 16:24:02.0120 1720 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll 16:24:02.0120 1720 HomeGroupProvider - ok 16:24:02.0166 1720 hpdskflt (ccbe758967cc0f53f5ba3b271653c4e6) C:\Windows\system32\DRIVERS\hpdskflt.sys 16:24:02.0166 1720 hpdskflt - ok 16:24:02.0198 1720 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 16:24:02.0198 1720 HpSAMD - ok 16:24:02.0213 1720 hpsrv (e2223a37896a76861d7f79fd81a2a193) C:\Windows\system32\Hpservice.exe 16:24:02.0213 1720 hpsrv - ok 16:24:02.0276 1720 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 16:24:02.0291 1720 HTTP - ok 16:24:02.0307 1720 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 16:24:02.0307 1720 hwpolicy - ok 16:24:02.0338 1720 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys 16:24:02.0338 1720 i8042prt - ok 16:24:02.0400 1720 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys 16:24:02.0416 1720 iaStorV - ok 16:24:02.0525 1720 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 16:24:02.0525 1720 idsvc - ok 16:24:02.0572 1720 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys 16:24:02.0572 1720 iirsp - ok 16:24:02.0650 1720 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll 16:24:02.0650 1720 IKEEXT - ok 16:24:02.0681 1720 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 16:24:02.0681 1720 intelide - ok 16:24:02.0712 1720 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\drivers\intelppm.sys 16:24:02.0712 1720 intelppm - ok 16:24:02.0744 1720 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 16:24:02.0759 1720 IPBusEnum - ok 16:24:02.0775 1720 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 16:24:02.0775 1720 IpFilterDriver - ok 16:24:02.0822 1720 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll 16:24:02.0822 1720 iphlpsvc - ok 16:24:02.0837 1720 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 16:24:02.0837 1720 IPMIDRV - ok 16:24:02.0853 1720 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 16:24:02.0853 1720 IPNAT - ok 16:24:02.0884 1720 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 16:24:02.0884 1720 IRENUM - ok 16:24:02.0900 1720 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 16:24:02.0900 1720 isapnp - ok 16:24:02.0931 1720 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 16:24:02.0931 1720 iScsiPrt - ok 16:24:02.0962 1720 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys 16:24:02.0962 1720 kbdclass - ok 16:24:02.0993 1720 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys 16:24:02.0993 1720 kbdhid - ok 16:24:03.0024 1720 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 16:24:03.0024 1720 KeyIso - ok 16:24:03.0040 1720 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys 16:24:03.0040 1720 KSecDD - ok 16:24:03.0056 1720 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys 16:24:03.0056 1720 KSecPkg - ok 16:24:03.0102 1720 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 16:24:03.0102 1720 ksthunk - ok 16:24:03.0134 1720 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 16:24:03.0149 1720 KtmRm - ok 16:24:03.0196 1720 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll 16:24:03.0196 1720 LanmanServer - ok 16:24:03.0212 1720 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll 16:24:03.0227 1720 LanmanWorkstation - ok 16:24:03.0258 1720 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 16:24:03.0258 1720 lltdio - ok 16:24:03.0305 1720 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 16:24:03.0321 1720 lltdsvc - ok 16:24:03.0336 1720 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 16:24:03.0336 1720 lmhosts - ok 16:24:03.0368 1720 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys 16:24:03.0368 1720 LSI_FC - ok 16:24:03.0414 1720 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys 16:24:03.0414 1720 LSI_SAS - ok 16:24:03.0446 1720 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys 16:24:03.0446 1720 LSI_SAS2 - ok 16:24:03.0461 1720 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys 16:24:03.0461 1720 LSI_SCSI - ok 16:24:03.0492 1720 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 16:24:03.0492 1720 luafv - ok 16:24:03.0524 1720 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll 16:24:03.0524 1720 Mcx2Svc - ok 16:24:03.0539 1720 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys 16:24:03.0539 1720 megasas - ok 16:24:03.0586 1720 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys 16:24:03.0586 1720 MegaSR - ok 16:24:03.0680 1720 Microsoft SharePoint Workspace Audit Service - ok 16:24:03.0742 1720 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 16:24:03.0742 1720 MMCSS - ok 16:24:03.0773 1720 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 16:24:03.0773 1720 Modem - ok 16:24:03.0804 1720 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 16:24:03.0804 1720 monitor - ok 16:24:03.0867 1720 MotoConnect Service (bb9de58ac6513da62c005d92e2db4981) C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe 16:24:03.0867 1720 MotoConnect Service - ok 16:24:03.0914 1720 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys 16:24:03.0914 1720 mouclass - ok 16:24:03.0945 1720 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 16:24:03.0945 1720 mouhid - ok 16:24:03.0976 1720 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 16:24:03.0976 1720 mountmgr - ok 16:24:03.0992 1720 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 16:24:03.0992 1720 mpio - ok 16:24:04.0007 1720 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 16:24:04.0023 1720 mpsdrv - ok 16:24:04.0085 1720 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll 16:24:04.0085 1720 MpsSvc - ok 16:24:04.0116 1720 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 16:24:04.0116 1720 MRxDAV - ok 16:24:04.0148 1720 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 16:24:04.0148 1720 mrxsmb - ok 16:24:04.0194 1720 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys 16:24:04.0210 1720 mrxsmb10 - ok 16:24:04.0241 1720 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 16:24:04.0241 1720 mrxsmb20 - ok 16:24:04.0272 1720 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 16:24:04.0272 1720 msahci - ok 16:24:04.0288 1720 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 16:24:04.0288 1720 msdsm - ok 16:24:04.0319 1720 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 16:24:04.0335 1720 MSDTC - ok 16:24:04.0382 1720 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 16:24:04.0382 1720 Msfs - ok 16:24:04.0413 1720 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 16:24:04.0413 1720 mshidkmdf - ok 16:24:04.0428 1720 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 16:24:04.0428 1720 msisadrv - ok 16:24:04.0444 1720 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 16:24:04.0460 1720 MSiSCSI - ok 16:24:04.0460 1720 msiserver - ok 16:24:04.0491 1720 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 16:24:04.0491 1720 MSKSSRV - ok 16:24:04.0506 1720 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 16:24:04.0506 1720 MSPCLOCK - ok 16:24:04.0522 1720 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 16:24:04.0522 1720 MSPQM - ok 16:24:04.0553 1720 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 16:24:04.0569 1720 MsRPC - ok 16:24:04.0584 1720 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys 16:24:04.0584 1720 mssmbios - ok 16:24:04.0616 1720 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 16:24:04.0616 1720 MSTEE - ok 16:24:04.0631 1720 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys 16:24:04.0631 1720 MTConfig - ok 16:24:04.0647 1720 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 16:24:04.0647 1720 Mup - ok 16:24:04.0709 1720 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll 16:24:04.0709 1720 napagent - ok 16:24:04.0772 1720 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 16:24:04.0772 1720 NativeWifiP - ok 16:24:04.0850 1720 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 16:24:04.0865 1720 NDIS - ok 16:24:04.0881 1720 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 16:24:04.0881 1720 NdisCap - ok 16:24:04.0912 1720 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 16:24:04.0912 1720 NdisTapi - ok 16:24:04.0943 1720 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 16:24:04.0959 1720 Ndisuio - ok 16:24:04.0974 1720 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 16:24:04.0974 1720 NdisWan - ok 16:24:05.0006 1720 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 16:24:05.0006 1720 NDProxy - ok 16:24:05.0037 1720 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 16:24:05.0037 1720 NetBIOS - ok 16:24:05.0068 1720 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 16:24:05.0084 1720 NetBT - ok 16:24:05.0115 1720 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 16:24:05.0115 1720 Netlogon - ok 16:24:05.0162 1720 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 16:24:05.0177 1720 Netman - ok 16:24:05.0286 1720 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 16:24:05.0318 1720 NetMsmqActivator - ok 16:24:05.0349 1720 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 16:24:05.0349 1720 NetPipeActivator - ok 16:24:05.0411 1720 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 16:24:05.0411 1720 netprofm - ok 16:24:05.0442 1720 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 16:24:05.0442 1720 NetTcpActivator - ok 16:24:05.0442 1720 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 16:24:05.0442 1720 NetTcpPortSharing - ok 16:24:05.0520 1720 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys 16:24:05.0520 1720 nfrd960 - ok 16:24:05.0567 1720 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll 16:24:05.0583 1720 NlaSvc - ok 16:24:05.0583 1720 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 16:24:05.0598 1720 Npfs - ok 16:24:05.0614 1720 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 16:24:05.0614 1720 nsi - ok 16:24:05.0630 1720 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 16:24:05.0630 1720 nsiproxy - ok 16:24:05.0754 1720 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys 16:24:05.0770 1720 Ntfs - ok 16:24:05.0879 1720 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 16:24:05.0879 1720 Null - ok 16:24:05.0926 1720 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys 16:24:05.0926 1720 nvraid - ok 16:24:05.0957 1720 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys 16:24:05.0973 1720 nvstor - ok 16:24:06.0020 1720 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 16:24:06.0020 1720 nv_agp - ok 16:24:06.0020 1720 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 16:24:06.0020 1720 ohci1394 - ok 16:24:06.0113 1720 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 16:24:06.0113 1720 ose - ok 16:24:06.0503 1720 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 16:24:06.0597 1720 osppsvc - ok 16:24:06.0737 1720 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 16:24:06.0737 1720 p2pimsvc - ok 16:24:06.0784 1720 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 16:24:06.0800 1720 p2psvc - ok 16:24:06.0909 1720 PACSPTISVR-Sound_Organizer (34a947acb48b2085d0fbf2d025169962) C:\Program Files (x86)\Sony\Sound Organizer\Sony.Earth\PACSPTISVR.exe 16:24:06.0909 1720 PACSPTISVR-Sound_Organizer - ok 16:24:06.0956 1720 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys 16:24:06.0956 1720 Parport - ok 16:24:07.0002 1720 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys 16:24:07.0002 1720 partmgr - ok 16:24:07.0034 1720 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 16:24:07.0034 1720 PcaSvc - ok 16:24:07.0080 1720 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 16:24:07.0080 1720 pci - ok 16:24:07.0096 1720 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 16:24:07.0096 1720 pciide - ok 16:24:07.0127 1720 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys 16:24:07.0127 1720 pcmcia - ok 16:24:07.0143 1720 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 16:24:07.0143 1720 pcw - ok 16:24:07.0190 1720 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 16:24:07.0190 1720 PEAUTH - ok 16:24:07.0283 1720 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 16:24:07.0283 1720 PerfHost - ok 16:24:07.0392 1720 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll 16:24:07.0408 1720 pla - ok 16:24:07.0470 1720 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll 16:24:07.0470 1720 PlugPlay - ok 16:24:07.0502 1720 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 16:24:07.0502 1720 PNRPAutoReg - ok 16:24:07.0533 1720 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 16:24:07.0548 1720 PNRPsvc - ok 16:24:07.0611 1720 Point64 (4f0878fd62d5f7444c5f1c4c66d9d293) C:\Windows\system32\DRIVERS\point64.sys 16:24:07.0611 1720 Point64 - ok 16:24:07.0658 1720 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll 16:24:07.0673 1720 PolicyAgent - ok 16:24:07.0704 1720 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 16:24:07.0704 1720 Power - ok 16:24:07.0736 1720 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 16:24:07.0736 1720 PptpMiniport - ok 16:24:07.0751 1720 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys 16:24:07.0767 1720 Processor - ok 16:24:07.0798 1720 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll 16:24:07.0798 1720 ProfSvc - ok 16:24:07.0829 1720 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 16:24:07.0829 1720 ProtectedStorage - ok 16:24:07.0876 1720 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 16:24:07.0876 1720 Psched - ok 16:24:07.0938 1720 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys 16:24:07.0938 1720 PxHlpa64 - ok 16:24:08.0032 1720 QBCFMonitorService (933d92f0bd1d7a9835cd8a8b1235a11e) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe 16:24:08.0032 1720 QBCFMonitorService - ok 16:24:08.0079 1720 QBFCService (6bee1814470dc12fa20c53dfc3c97ebb) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe 16:24:08.0079 1720 QBFCService - ok 16:24:08.0204 1720 QBVSS (25fc19badf78b7fb1d835aac4b0b91a5) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe 16:24:08.0219 1720 QBVSS - ok 16:24:08.0422 1720 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys 16:24:08.0438 1720 ql2300 - ok 16:24:08.0547 1720 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys 16:24:08.0547 1720 ql40xx - ok 16:24:08.0578 1720 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 16:24:08.0594 1720 QWAVE - ok 16:24:08.0609 1720 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 16:24:08.0609 1720 QWAVEdrv - ok 16:24:08.0625 1720 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 16:24:08.0625 1720 RasAcd - ok 16:24:08.0672 1720 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 16:24:08.0672 1720 RasAgileVpn - ok 16:24:08.0703 1720 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 16:24:08.0703 1720 RasAuto - ok 16:24:08.0734 1720 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 16:24:08.0734 1720 Rasl2tp - ok 16:24:08.0781 1720 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll 16:24:08.0796 1720 RasMan - ok 16:24:08.0812 1720 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 16:24:08.0812 1720 RasPppoe - ok 16:24:08.0843 1720 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 16:24:08.0843 1720 RasSstp - ok 16:24:08.0874 1720 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 16:24:08.0874 1720 rdbss - ok 16:24:08.0890 1720 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\drivers\rdpbus.sys 16:24:08.0906 1720 rdpbus - ok 16:24:08.0921 1720 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 16:24:08.0921 1720 RDPCDD - ok 16:24:08.0952 1720 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 16:24:08.0952 1720 RDPENCDD - ok 16:24:08.0968 1720 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 16:24:08.0968 1720 RDPREFMP - ok 16:24:08.0999 1720 RDPWD (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys 16:24:08.0999 1720 RDPWD - ok 16:24:09.0030 1720 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 16:24:09.0046 1720 rdyboost - ok 16:24:09.0062 1720 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 16:24:09.0062 1720 RemoteAccess - ok 16:24:09.0108 1720 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 16:24:09.0108 1720 RemoteRegistry - ok 16:24:09.0155 1720 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys 16:24:09.0155 1720 RFCOMM - ok 16:24:09.0186 1720 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 16:24:09.0186 1720 RpcEptMapper - ok 16:24:09.0202 1720 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 16:24:09.0202 1720 RpcLocator - ok 16:24:09.0249 1720 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 16:24:09.0249 1720 RpcSs - ok 16:24:09.0296 1720 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 16:24:09.0296 1720 rspndr - ok 16:24:09.0358 1720 RTL8167 (4fe1cef69d36e913738234303986fbb3) C:\Windows\system32\DRIVERS\Rt64win7.sys 16:24:09.0358 1720 RTL8167 - ok 16:24:09.0389 1720 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 16:24:09.0389 1720 SamSs - ok 16:24:09.0405 1720 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 16:24:09.0405 1720 sbp2port - ok 16:24:09.0436 1720 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 16:24:09.0436 1720 SCardSvr - ok 16:24:09.0467 1720 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 16:24:09.0467 1720 scfilter - ok 16:24:09.0561 1720 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll 16:24:09.0576 1720 Schedule - ok 16:24:09.0608 1720 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 16:24:09.0608 1720 SCPolicySvc - ok 16:24:09.0639 1720 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll 16:24:09.0639 1720 SDRSVC - ok 16:24:09.0701 1720 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 16:24:09.0701 1720 secdrv - ok 16:24:09.0732 1720 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll 16:24:09.0732 1720 seclogon - ok 16:24:09.0748 1720 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll 16:24:09.0748 1720 SENS - ok 16:24:09.0764 1720 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 16:24:09.0764 1720 SensrSvc - ok 16:24:09.0779 1720 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys 16:24:09.0779 1720 Serenum - ok 16:24:09.0826 1720 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys 16:24:09.0826 1720 Serial - ok 16:24:09.0857 1720 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys 16:24:09.0857 1720 sermouse - ok 16:24:09.0888 1720 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll 16:24:09.0888 1720 SessionEnv - ok 16:24:09.0920 1720 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 16:24:09.0920 1720 sffdisk - ok 16:24:09.0920 1720 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 16:24:09.0920 1720 sffp_mmc - ok 16:24:09.0935 1720 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 16:24:09.0935 1720 sffp_sd - ok 16:24:09.0935 1720 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys 16:24:09.0935 1720 sfloppy - ok 16:24:09.0982 1720 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll 16:24:09.0982 1720 SharedAccess - ok 16:24:10.0044 1720 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll 16:24:10.0044 1720 ShellHWDetection - ok 16:24:10.0091 1720 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys 16:24:10.0091 1720 SiSRaid2 - ok 16:24:10.0107 1720 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys 16:24:10.0107 1720 SiSRaid4 - ok 16:24:10.0154 1720 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 16:24:10.0154 1720 Smb - ok 16:24:10.0185 1720 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 16:24:10.0185 1720 SNMPTRAP - ok 16:24:10.0216 1720 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 16:24:10.0216 1720 spldr - ok 16:24:10.0263 1720 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe 16:24:10.0263 1720 Spooler - ok 16:24:10.0481 1720 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe 16:24:10.0528 1720 sppsvc - ok 16:24:10.0653 1720 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 16:24:10.0653 1720 sppuinotify - ok 16:24:10.0731 1720 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 16:24:10.0731 1720 srv - ok 16:24:10.0778 1720 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 16:24:10.0793 1720 srv2 - ok 16:24:10.0809 1720 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 16:24:10.0809 1720 srvnet - ok 16:24:10.0856 1720 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 16:24:10.0856 1720 SSDPSRV - ok 16:24:10.0871 1720 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 16:24:10.0871 1720 SstpSvc - ok 16:24:10.0902 1720 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys 16:24:10.0902 1720 stexstor - ok 16:24:10.0949 1720 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll 16:24:10.0965 1720 stisvc - ok 16:24:10.0980 1720 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys 16:24:10.0980 1720 swenum - ok 16:24:11.0027 1720 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 16:24:11.0043 1720 swprv - ok 16:24:11.0152 1720 SynTP (961cfac2a5318e212f459d651f28e0a4) C:\Windows\system32\DRIVERS\SynTP.sys 16:24:11.0168 1720 SynTP - ok 16:24:11.0355 1720 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll 16:24:11.0386 1720 SysMain - ok 16:24:11.0480 1720 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll 16:24:11.0480 1720 TabletInputService - ok 16:24:11.0511 1720 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll 16:24:11.0511 1720 TapiSrv - ok 16:24:11.0526 1720 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 16:24:11.0526 1720 TBS - ok 16:24:11.0698 1720 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys 16:24:11.0714 1720 Tcpip - ok 16:24:11.0932 1720 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys 16:24:11.0948 1720 TCPIP6 - ok 16:24:12.0057 1720 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 16:24:12.0057 1720 tcpipreg - ok 16:24:12.0088 1720 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 16:24:12.0088 1720 TDPIPE - ok 16:24:12.0104 1720 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys 16:24:12.0104 1720 TDTCP - ok 16:24:12.0166 1720 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 16:24:12.0166 1720 tdx - ok 16:24:12.0166 1720 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\DRIVERS\termdd.sys 16:24:12.0166 1720 TermDD - ok 16:24:12.0244 1720 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll 16:24:12.0244 1720 TermService - ok 16:24:12.0275 1720 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 16:24:12.0275 1720 Themes - ok 16:24:12.0306 1720 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 16:24:12.0306 1720 THREADORDER - ok 16:24:12.0353 1720 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 16:24:12.0353 1720 TrkWks - ok 16:24:12.0416 1720 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe 16:24:12.0416 1720 TrustedInstaller - ok 16:24:12.0447 1720 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 16:24:12.0447 1720 tssecsrv - ok 16:24:12.0462 1720 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 16:24:12.0478 1720 TsUsbFlt - ok 16:24:12.0494 1720 TsUsbGD (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys 16:24:12.0494 1720 TsUsbGD - ok 16:24:12.0540 1720 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 16:24:12.0540 1720 tunnel - ok 16:24:12.0572 1720 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys 16:24:12.0572 1720 uagp35 - ok 16:24:12.0603 1720 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 16:24:12.0618 1720 udfs - ok 16:24:12.0650 1720 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 16:24:12.0650 1720 UI0Detect - ok 16:24:12.0712 1720 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 16:24:12.0712 1720 uliagpkx - ok 16:24:12.0743 1720 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys 16:24:12.0743 1720 umbus - ok 16:24:12.0774 1720 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys 16:24:12.0790 1720 UmPass - ok 16:24:12.0821 1720 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 16:24:12.0837 1720 upnphost - ok 16:24:12.0868 1720 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys 16:24:12.0884 1720 usbccgp - ok 16:24:12.0915 1720 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 16:24:12.0915 1720 usbcir - ok 16:24:12.0946 1720 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys 16:24:12.0946 1720 usbehci - ok 16:24:12.0993 1720 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys 16:24:12.0993 1720 usbhub - ok 16:24:13.0024 1720 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys 16:24:13.0024 1720 usbohci - ok 16:24:13.0071 1720 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 16:24:13.0071 1720 usbprint - ok 16:24:13.0118 1720 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS 16:24:13.0118 1720 USBSTOR - ok 16:24:13.0149 1720 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys 16:24:13.0149 1720 usbuhci - ok 16:24:13.0180 1720 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\system32\Drivers\usbvideo.sys 16:24:13.0196 1720 usbvideo - ok 16:24:13.0211 1720 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 16:24:13.0211 1720 UxSms - ok 16:24:13.0242 1720 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 16:24:13.0242 1720 VaultSvc - ok 16:24:13.0398 1720 vcsFPService (2662f24c7aee2a32cebdec907a5366f1) C:\Windows\system32\vcsFPService.exe 16:24:13.0430 1720 vcsFPService - ok 16:24:13.0539 1720 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 16:24:13.0539 1720 vdrvroot - ok 16:24:13.0586 1720 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe 16:24:13.0601 1720 vds - ok 16:24:13.0648 1720 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 16:24:13.0648 1720 vga - ok 16:24:13.0664 1720 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 16:24:13.0664 1720 VgaSave - ok 16:24:13.0679 1720 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 16:24:13.0695 1720 vhdmp - ok 16:24:13.0710 1720 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 16:24:13.0710 1720 viaide - ok 16:24:13.0742 1720 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 16:24:13.0742 1720 volmgr - ok 16:24:13.0773 1720 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 16:24:13.0788 1720 volmgrx - ok 16:24:13.0804 1720 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 16:24:13.0820 1720 volsnap - ok 16:24:13.0851 1720 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys 16:24:13.0851 1720 vsmraid - ok 16:24:13.0960 1720 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe 16:24:13.0991 1720 VSS - ok 16:24:14.0100 1720 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys 16:24:14.0100 1720 vwifibus - ok 16:24:14.0116 1720 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys 16:24:14.0116 1720 vwififlt - ok 16:24:14.0147 1720 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys 16:24:14.0147 1720 vwifimp - ok 16:24:14.0194 1720 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 16:24:14.0194 1720 W32Time - ok 16:24:14.0225 1720 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys 16:24:14.0225 1720 WacomPen - ok 16:24:14.0256 1720 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 16:24:14.0256 1720 WANARP - ok 16:24:14.0272 1720 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 16:24:14.0272 1720 Wanarpv6 - ok 16:24:14.0381 1720 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe 16:24:14.0397 1720 WatAdminSvc - ok 16:24:14.0506 1720 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe 16:24:14.0537 1720 wbengine - ok 16:24:14.0631 1720 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 16:24:14.0646 1720 WbioSrvc - ok 16:24:14.0678 1720 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll 16:24:14.0678 1720 wcncsvc - ok 16:24:14.0693 1720 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 16:24:14.0709 1720 WcsPlugInService - ok 16:24:14.0756 1720 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys 16:24:14.0756 1720 Wd - ok 16:24:14.0818 1720 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 16:24:14.0818 1720 Wdf01000 - ok 16:24:14.0849 1720 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 16:24:14.0849 1720 WdiServiceHost - ok 16:24:14.0865 1720 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 16:24:14.0865 1720 WdiSystemHost - ok 16:24:14.0896 1720 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll 16:24:14.0896 1720 WebClient - ok 16:24:14.0912 1720 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 16:24:14.0927 1720 Wecsvc - ok 16:24:14.0943 1720 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 16:24:14.0958 1720 wercplsupport - ok 16:24:14.0974 1720 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 16:24:14.0990 1720 WerSvc - ok 16:24:15.0052 1720 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 16:24:15.0052 1720 WfpLwf - ok 16:24:15.0068 1720 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 16:24:15.0068 1720 WIMMount - ok 16:24:15.0099 1720 WinDefend - ok 16:24:15.0114 1720 WinHttpAutoProxySvc - ok 16:24:15.0177 1720 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 16:24:15.0177 1720 Winmgmt - ok 16:24:15.0317 1720 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll 16:24:15.0348 1720 WinRM - ok 16:24:15.0473 1720 WinUSB (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUSB.sys 16:24:15.0473 1720 WinUSB - ok 16:24:15.0536 1720 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 16:24:15.0551 1720 Wlansvc - ok 16:24:15.0582 1720 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys 16:24:15.0582 1720 WmiAcpi - ok 16:24:15.0645 1720 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 16:24:15.0645 1720 wmiApSrv - ok 16:24:15.0676 1720 WMPNetworkSvc - ok 16:24:15.0707 1720 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 16:24:15.0707 1720 WPCSvc - ok 16:24:15.0738 1720 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll 16:24:15.0738 1720 WPDBusEnum - ok 16:24:15.0770 1720 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 16:24:15.0770 1720 ws2ifsl - ok 16:24:15.0785 1720 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll 16:24:15.0801 1720 wscsvc - ok 16:24:15.0801 1720 WSearch - ok 16:24:15.0941 1720 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll 16:24:15.0972 1720 wuauserv - ok 16:24:16.0082 1720 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 16:24:16.0082 1720 WudfPf - ok 16:24:16.0113 1720 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 16:24:16.0113 1720 WUDFRd - ok 16:24:16.0128 1720 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll 16:24:16.0144 1720 wudfsvc - ok 16:24:16.0160 1720 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 16:24:16.0175 1720 WwanSvc - ok 16:24:16.0206 1720 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 16:24:16.0440 1720 \Device\Harddisk0\DR0 - ok 16:24:16.0440 1720 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk2\DR2 16:24:16.0456 1720 \Device\Harddisk2\DR2 - ok 16:24:16.0456 1720 Boot (0x1200) (1977cf52013956b1462c392df6515417) \Device\Harddisk0\DR0\Partition0 16:24:16.0456 1720 \Device\Harddisk0\DR0\Partition0 - ok 16:24:16.0472 1720 Boot (0x1200) (43ed272cdf4f6e44b65b77d3cd5279c4) \Device\Harddisk0\DR0\Partition1 16:24:16.0472 1720 \Device\Harddisk0\DR0\Partition1 - ok 16:24:16.0472 1720 Boot (0x1200) (003d23d00ec74a24f4c07c1080757ba0) \Device\Harddisk2\DR2\Partition0 16:24:16.0472 1720 \Device\Harddisk2\DR2\Partition0 - ok 16:24:16.0472 1720 ============================================================ 16:24:16.0472 1720 Scan finished 16:24:16.0472 1720 ============================================================ 16:24:16.0487 1828 Detected object count: 0 16:24:16.0487 1828 Actual detected object count: 0 16:24:38.0655 0976 Deinitialize success DDS text . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 16:29:41.87 on Wed 06/13/2012 Internet Explorer: 9.0.8112.16421 . ============== Running Processes =============== . . ============== Pseudo HJT Report =============== . uInternet Settings,ProxyOverride = *.local uURLSearchHooks: H - No File mWinlogon: Userinit=userinit.exe BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll TB: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File {e7df6bff-55a5-4eb7-a673-4ed3e9456d39} uRun: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe" uRun: [DymoQuickPrint] "C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe" /startup uRun: [TaskScheduler] C:\ProWin11\32bit\TaskSch.exe mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui mRun: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot mRun: [DLSService] "C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\INTUIT~1.LNK - C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\KODAKE~1.LNK - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~1.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~2.LNK - C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - C:\Program Files (x86)\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - C:\Program Files (x86)\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\System32\mscoree.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL BHO-X64: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL BHO-X64: URLRedirectionBHO - No File TB-X64: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll TB-X64: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File TB-X64: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe mRun-x64: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL . ============= SERVICES / DRIVERS =============== . . =============== Created Last 30 ================ . 2012-06-08 12:56:02 69000 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{2CD03D9C-7910-4947-9DFE-91799D9FCE3B}\offreg.dll 2012-06-08 12:54:55 8955792 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{2CD03D9C-7910-4947-9DFE-91799D9FCE3B}\mpengine.dll 2012-05-23 13:41:56 ——– d—–w- C:\Program Files (x86)\Sony 2012-05-23 13:41:11 55280 ——w- C:\Windows\System32\drivers\PxHlpa64.sys 2012-05-23 13:41:11 10224 ——w- C:\Windows\System32\drivers\cdralw2k.sys 2012-05-23 13:41:11 10224 ——w- C:\Windows\System32\drivers\cdr4_xp.sys 2012-05-23 13:41:11 ——– d—–w- C:\Program Files (x86)\Common Files\PX Storage Engine 2012-05-23 13:39:53 ——– d—–w- C:\PROGRA~3\Sony Corporation 2012-05-23 00:23:08 163048 —-a-w- C:\PROGRA~3\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin 2012-05-15 12:52:57 ——– d—–w- C:\18b59df3edae0d9e87 . ==================== Find3M ==================== . 2012-06-10 03:26:46 70344 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-06-10 03:26:46 426184 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-05-05 03:51:03 8769696 —-a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe 2012-05-03 02:43:04 476960 —-a-w- C:\Windows\SysWow64\npdeployJava1.dll 2012-05-03 02:43:04 472864 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2012-03-31 06:05:57 5559664 —-a-w- C:\Windows\System32\ntoskrnl.exe 2012-03-31 04:39:37 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-03-31 04:39:37 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-03-31 03:10:03 3146240 —-a-w- C:\Windows\System32\win32k.sys 2012-03-30 11:35:47 1918320 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2012-03-17 07:58:57 75120 —-a-w- C:\Windows\System32\drivers\partmgr.sys . ============= FINISH: 16:30:33.22 ============== And DDS Attach . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 16:29:41.87 on Wed 06/13/2012 Internet Explorer: 9.0.8112.16421 . ============== Running Processes =============== . . ============== Pseudo HJT Report =============== . uInternet Settings,ProxyOverride = *.local uURLSearchHooks: H - No File mWinlogon: Userinit=userinit.exe BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll TB: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File {e7df6bff-55a5-4eb7-a673-4ed3e9456d39} uRun: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe" uRun: [DymoQuickPrint] "C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe" /startup uRun: [TaskScheduler] C:\ProWin11\32bit\TaskSch.exe mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui mRun: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot mRun: [DLSService] "C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\INTUIT~1.LNK - C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\KODAKE~1.LNK - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~1.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~2.LNK - C:\Program Files (x86)\Intuit\QuickBooks 2012\QBW32.EXE mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - C:\Program Files (x86)\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - C:\Program Files (x86)\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\System32\mscoree.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL BHO-X64: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL BHO-X64: URLRedirectionBHO - No File TB-X64: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll TB-X64: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File TB-X64: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe mRun-x64: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL . ============= SERVICES / DRIVERS =============== . . =============== Created Last 30 ================ . 2012-06-08 12:56:02 69000 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{2CD03D9C-7910-4947-9DFE-91799D9FCE3B}\offreg.dll 2012-06-08 12:54:55 8955792 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{2CD03D9C-7910-4947-9DFE-91799D9FCE3B}\mpengine.dll 2012-05-23 13:41:56 ——– d—–w- C:\Program Files (x86)\Sony 2012-05-23 13:41:11 55280 ——w- C:\Windows\System32\drivers\PxHlpa64.sys 2012-05-23 13:41:11 10224 ——w- C:\Windows\System32\drivers\cdralw2k.sys 2012-05-23 13:41:11 10224 ——w- C:\Windows\System32\drivers\cdr4_xp.sys 2012-05-23 13:41:11 ——– d—–w- C:\Program Files (x86)\Common Files\PX Storage Engine 2012-05-23 13:39:53 ——– d—–w- C:\PROGRA~3\Sony Corporation 2012-05-23 00:23:08 163048 —-a-w- C:\PROGRA~3\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin 2012-05-15 12:52:57 ——– d—–w- C:\18b59df3edae0d9e87 . ==================== Find3M ==================== . 2012-06-10 03:26:46 70344 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-06-10 03:26:46 426184 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-05-05 03:51:03 8769696 —-a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe 2012-05-03 02:43:04 476960 —-a-w- C:\Windows\SysWow64\npdeployJava1.dll 2012-05-03 02:43:04 472864 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2012-03-31 06:05:57 5559664 —-a-w- C:\Windows\System32\ntoskrnl.exe 2012-03-31 04:39:37 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-03-31 04:39:37 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-03-31 03:10:03 3146240 —-a-w- C:\Windows\System32\win32k.sys 2012-03-30 11:35:47 1918320 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2012-03-17 07:58:57 75120 —-a-w- C:\Windows\System32\drivers\partmgr.sys . ============= FINISH: 16:30:33.22 ===============
Post #4
Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2



**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #5
Ok here is combo report. (I disable Avast until reboot, didn't realize this program would reboot, no problems running though) ComboFix 12-06-13.04 - Owner 06/13/2012 20:56:55.1.3 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3835.3135 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Owner\AppData\Local\assembly\tmp c:\users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\1452AccountantCenter.html c:\users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\2024AccountantCenter.html c:\users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\3148AccountantCenter.html c:\users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\5040AccountantCenter.html c:\users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\5648AccountantCenter.html c:\users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\ac.js c:\users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\close_pop.png c:\users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\jquery.corner.js c:\users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\jquery.min.js . . ((((((((((((((((((((((((( Files Created from 2012-05-14 to 2012-06-14 ))))))))))))))))))))))))))))))) . . 2012-06-14 01:03 . 2012-06-14 01:03 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-06-14 01:03 . 2012-06-14 01:03 ——– d—–w- c:\users\Administrator\AppData\Local\temp 2012-06-08 12:56 . 2012-06-11 20:57 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2CD03D9C-7910-4947-9DFE-91799D9FCE3B}\offreg.dll 2012-06-08 12:54 . 2012-05-08 17:02 8955792 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2CD03D9C-7910-4947-9DFE-91799D9FCE3B}\mpengine.dll 2012-05-23 13:42 . 2012-06-12 17:09 ——– d—–w- c:\users\Owner\AppData\Roaming\Sony Corporation 2012-05-23 13:41 . 2012-05-23 13:41 ——– d—–w- c:\program files (x86)\Sony 2012-05-23 13:41 . 2012-05-23 13:41 ——– d—–w- c:\program files (x86)\Common Files\PX Storage Engine 2012-05-23 13:41 . 2012-05-23 13:41 55280 ——w- c:\windows\system32\drivers\PxHlpa64.sys 2012-05-23 13:41 . 2012-05-23 13:41 10224 ——w- c:\windows\system32\drivers\cdralw2k.sys 2012-05-23 13:41 . 2012-05-23 13:41 10224 ——w- c:\windows\system32\drivers\cdr4_xp.sys 2012-05-23 13:39 . 2012-06-12 17:09 ——– d—–w- c:\programdata\Sony Corporation 2012-05-23 00:23 . 2012-05-23 00:23 163048 —-a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin 2012-05-15 12:52 . 2012-05-15 12:57 ——– d—–w- C:\18b59df3edae0d9e87 2012-05-15 04:31 . 2012-05-15 04:31 ——– d—–w- c:\program files\Microsoft Silverlight 2012-05-15 04:31 . 2012-05-15 04:31 ——– d—–w- c:\program files (x86)\Microsoft Silverlight . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-10 03:26 . 2012-04-13 22:55 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-10 03:26 . 2011-07-02 19:21 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-05-05 03:51 . 2012-05-05 03:51 8769696 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-05-03 02:43 . 2012-05-03 02:43 476960 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2012-05-03 02:43 . 2012-05-03 02:43 472864 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-03-31 06:05 . 2012-05-10 02:53 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-03-31 04:39 . 2012-05-10 02:53 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-03-31 04:39 . 2012-05-10 02:53 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-03-31 03:10 . 2012-05-10 02:53 3146240 —-a-w- c:\windows\system32\win32k.sys 2012-03-30 11:35 . 2012-05-10 02:51 1918320 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-03-17 07:58 . 2012-05-10 02:52 75120 —-a-w- c:\windows\system32\drivers\partmgr.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DymoQuickPrint"="c:\program files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe" [2011-08-10 1865808] "TaskScheduler"="c:\prowin11\32bit\TaskSch.exe" [2012-05-28 443992] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512] "Intuit SyncManager"="c:\program files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2011-12-06 2215768] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2012-01-09 296056] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Intuit Data Protect.lnk - c:\program files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [2012-3-14 5961048] Kodak EasyShare software.lnk - c:\program files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2011-2-23 323584] QuickBooks Update Agent.lnk - c:\program files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2012-3-14 1175912] QuickBooks_Standard_21.lnk - c:\program files (x86)\Intuit\QuickBooks 2012\QBW32.EXE [2012-3-14 1178984] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-10 257224] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] R4 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R4 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R4 DymoPnpService;DYMO PnP Service;c:\program files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe [2011-08-10 32336] R4 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-03 136176] R4 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-03 136176] R4 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x] R4 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] R4 MotoConnect Service;MotoConnect Service;c:\program files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-01-27 91392] R4 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R4 PACSPTISVR-Sound_Organizer;PACSPTISVR-Sound_Organizer;c:\program files (x86)\Sony\Sound Organizer\Sony.Earth\PACSPTISVR.exe [2010-11-19 157024] R4 QBVSS;QBIDPService;c:\program files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [2011-08-20 1248256] R4 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-23 2192176] R4 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x] S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-06-12 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 03:26] . 2012-05-18 c:\windows\Tasks\EasyShare Registration Task.job - c:\windows\system32\rundll32.exe [2009-07-13 01:14] . 2012-06-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-03 23:07] . 2012-06-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-03 23:07] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2012-03-06 23:15 135408 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport; to Microsoft Excel - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000 IE: Se&nd; to OneNote - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.0.1 Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - c:\program files (x86)\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file) Wow6432Node-HKCU-Run-DW6 - c:\program files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe Wow6432Node-HKLM-Run-DLSService - c:\program files (x86)\DYMO\DYMO Label Software\DLSService.exe WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ChromeHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ChromeHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ChromeHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ChromeHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ChromeHTML" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files\AVAST Software\Avast\AvastSvc.exe c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe . ************************************************************************** . Completion time: 2012-06-13 21:13:41 - machine was rebooted ComboFix-quarantined-files.txt 2012-06-14 01:13 . Pre-Run: 500,407,050,240 bytes free Post-Run: 500,663,570,432 bytes free . - - End Of File - - E4027C2F75388EB4BEF8DE3F462FF50A
Post #6
Please download Malwarebytes Free from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the log please











Next

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is not checked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Back button.
  • Push Finish
http://www.eset.com/onlinescan/





Also tell me how the computer is running now.
Post #7
Here is the mbam log I cannot get an internet connection on the machine that I am having problems with to run the other program on run mbam with updates. Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.04.04.08 Windows 7 Service Pack 1 x64 FAT32 Internet Explorer 9.0.8112.16421 Owner :: OWNER-PC [administrator] 6/14/2012 10:45:08 AM mbam-log-2012-06-14 (10-49-37).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 214695 Time elapsed: 2 minute(s), 35 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Users\Owner\Downloads\DownloadSetup.exe (Affiliate.Downloader) -> No action taken. (end)
Post #8
Please download Farbar Service Scanner and run it on the computer with the issue.
  • Make sure "Include All Files" option remains checked.
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.
Post #9 last edited
Here is the log file btw I brought this laptop to work with me to reply so internet connection is not connected (hard wire at home) Let me know if I need internet cable connected to modem for this program to work properly even though I cant connect to internet. Farbar Service Scanner Version: 09-06-2012 Ran by [removed] (administrator) on 15-06-2012 at 12:52:37 Running from "C:\Users\Owner\Desktop" Microsoft Windows 7 Home Premium Service Pack 1 (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Dnscache Service is not running. Checking service configuration: The start type of Dnscache service is set to Disabled. The default start type is Auto. The ImagePath of Dnscache service is OK. The ServiceDll of Dnscache service is OK. Dhcp Service is not running. Checking service configuration: The start type of Dhcp service is set to Disabled. The default start type is Auto. The ImagePath of Dhcp service is OK. The ServiceDll of Dhcp service is OK. Nsi Service is not running. Checking service configuration: The start type of Nsi service is set to Disabled. The default start type is Auto. The ImagePath of Nsi service is OK. The ServiceDll of Nsi service is OK. Connection Status: ============== Attempt to access Local Host IP returned error: Localhost is blokked: Other errors LAN connected. Attempt to access Google IP returned error: Other errors Attempt to access Google.com returned error: Other errors Attempt to access Yahoo IP returned error: Other errors Attempt to access Yahoo.com returned error: Other errors Windows Firewall: ============= MpsSvc Service is not running. Checking service configuration: The start type of MpsSvc service is OK. The ImagePath of MpsSvc service is OK. The ServiceDll of MpsSvc service is OK. Firewall Disabled Policy: ================== System Restore: ============ SDRSVC Service is not running. Checking service configuration: The start type of SDRSVC service is set to Disabled. The default start type is 3. The ImagePath of SDRSVC service is OK. The ServiceDll of SDRSVC service is OK. System Restore Disabled Policy: ======================== Action Center: ============ Windows Update: ============ BITS Service is not running. Checking service configuration: The start type of BITS service is OK. The ImagePath of BITS service is OK. The ServiceDll of BITS service is OK. EventSystem Service is not running. Checking service configuration: The start type of EventSystem service is set to Disabled. The default start type is Auto. The ImagePath of EventSystem service is OK. The ServiceDll of EventSystem service is OK. Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit C:\Windows\System32\dhcpcore.dll => MD5 is legit C:\Windows\System32\drivers\afd.sys => MD5 is legit C:\Windows\System32\drivers\tdx.sys => MD5 is legit C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit C:\Windows\System32\dnsrslvr.dll => MD5 is legit C:\Windows\System32\mpssvc.dll => MD5 is legit C:\Windows\System32\bfe.dll => MD5 is legit C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit C:\Windows\System32\SDRSVC.dll => MD5 is legit C:\Windows\System32\vssvc.exe => MD5 is legit C:\Windows\System32\wscsvc.dll => MD5 is legit C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit C:\Windows\System32\wuaueng.dll => MD5 is legit C:\Windows\System32\qmgr.dll => MD5 is legit C:\Windows\System32\es.dll => MD5 is legit C:\Windows\System32\cryptsvc.dll => MD5 is legit C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit **** End of log ****
Post #11
Here is log with normal internet setup Farbar Service Scanner Version: 09-06-2012 Ran by [removed] (administrator) on 17-06-2012 at 18:24:37 Running from "C:\Users\Owner\Desktop" Microsoft Windows 7 Home Premium Service Pack 1 (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Dnscache Service is not running. Checking service configuration: The start type of Dnscache service is set to Disabled. The default start type is Auto. The ImagePath of Dnscache service is OK. The ServiceDll of Dnscache service is OK. Dhcp Service is not running. Checking service configuration: The start type of Dhcp service is set to Disabled. The default start type is Auto. The ImagePath of Dhcp service is OK. The ServiceDll of Dhcp service is OK. Nsi Service is not running. Checking service configuration: The start type of Nsi service is set to Disabled. The default start type is Auto. The ImagePath of Nsi service is OK. The ServiceDll of Nsi service is OK. Connection Status: ============== Attempt to access Local Host IP returned error: Localhost is blokked: Other errors LAN connected. Attempt to access Google IP returned error: Other errors Attempt to access Google.com returned error: Other errors Attempt to access Yahoo IP returned error: Other errors Attempt to access Yahoo.com returned error: Other errors Windows Firewall: ============= MpsSvc Service is not running. Checking service configuration: The start type of MpsSvc service is OK. The ImagePath of MpsSvc service is OK. The ServiceDll of MpsSvc service is OK. Firewall Disabled Policy: ================== System Restore: ============ SDRSVC Service is not running. Checking service configuration: The start type of SDRSVC service is set to Disabled. The default start type is 3. The ImagePath of SDRSVC service is OK. The ServiceDll of SDRSVC service is OK. System Restore Disabled Policy: ======================== Action Center: ============ wscsvc Service is not running. Checking service configuration: The start type of wscsvc service is OK. The ImagePath of wscsvc service is OK. The ServiceDll of wscsvc service is OK. Windows Update: ============ wuauserv Service is not running. Checking service configuration: The start type of wuauserv service is OK. The ImagePath of wuauserv service is OK. The ServiceDll of wuauserv service is OK. BITS Service is not running. Checking service configuration: The start type of BITS service is OK. The ImagePath of BITS service is OK. The ServiceDll of BITS service is OK. EventSystem Service is not running. Checking service configuration: The start type of EventSystem service is set to Disabled. The default start type is Auto. The ImagePath of EventSystem service is OK. The ServiceDll of EventSystem service is OK. Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit C:\Windows\System32\dhcpcore.dll => MD5 is legit C:\Windows\System32\drivers\afd.sys => MD5 is legit C:\Windows\System32\drivers\tdx.sys => MD5 is legit C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit C:\Windows\System32\dnsrslvr.dll => MD5 is legit C:\Windows\System32\mpssvc.dll => MD5 is legit C:\Windows\System32\bfe.dll => MD5 is legit C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit C:\Windows\System32\SDRSVC.dll => MD5 is legit C:\Windows\System32\vssvc.exe => MD5 is legit C:\Windows\System32\wscsvc.dll => MD5 is legit C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit C:\Windows\System32\wuaueng.dll => MD5 is legit C:\Windows\System32\qmgr.dll => MD5 is legit C:\Windows\System32\es.dll => MD5 is legit C:\Windows\System32\cryptsvc.dll => MD5 is legit C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit **** End of log ****
Post #12 last edited
Download this tool from here and install

Installer (4.41 MB) http://www.tweaking.com/content/page/windo…all_in_one.html

Go to step 4 and create registry back ups and system restore point.

Then select start repairs
Select all
Select Restart/Shutdown system when finished
Then click start - reboot on completion

After reboot, re run Farbar system scanner and post the new log.Do you have internet back? if so run an updated Malwarebytes scan and also ESET from my earlier post.
Post #13
OK internet is working and screen back lite here is fbar scan log, and malwarebytes log Farbar Service Scanner Version: 09-06-2012 Ran by [removed] (administrator) on 17-06-2012 at 23:03:06 Running from "C:\Users\Owner\Desktop" Microsoft Windows 7 Home Premium Service Pack 1 (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo IP is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabled Policy: ======================== Action Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit C:\Windows\System32\dhcpcore.dll => MD5 is legit C:\Windows\System32\drivers\afd.sys => MD5 is legit C:\Windows\System32\drivers\tdx.sys => MD5 is legit C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit C:\Windows\System32\dnsrslvr.dll => MD5 is legit C:\Windows\System32\mpssvc.dll => MD5 is legit C:\Windows\System32\bfe.dll => MD5 is legit C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit C:\Windows\System32\SDRSVC.dll => MD5 is legit C:\Windows\System32\vssvc.exe => MD5 is legit C:\Windows\System32\wscsvc.dll => MD5 is legit C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit C:\Windows\System32\wuaueng.dll => MD5 is legit C:\Windows\System32\qmgr.dll => MD5 is legit C:\Windows\System32\es.dll => MD5 is legit C:\Windows\System32\cryptsvc.dll => MD5 is legit C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit **** End of log **** Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.06.18.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Owner :: OWNER-PC [administrator] 6/17/2012 10:53:33 PM mbam-log-2012-06-17 (22-53-33).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 228272 Time elapsed: 4 minute(s), 23 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ESET scan C:\Users\Owner\AppData\Roaming\Installer\ticno_m.exe a variant of Win32/Multibar.AC application C:\Users\Owner\Downloads\Larry_Norman_-_45_Albums___Extras.rar_downloader.exe a variant of Win32/InstallCore.W application C:\Users\Owner\Downloads\mozilla firefox setup.exe a variant of Win32/Soft32Downloader.A application Everything seems to be running fine except getting a license error message on mcrsft office (word/excel)
Post #14
Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:files
C:\Users\Owner\AppData\Roaming\Installer\ticno_m.exe 
C:\Users\Owner\Downloads\Larry_Norman_-_45_Albums___Extras.rar_downloader.exe 


:Commands
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI