Spyware / Malware / Virus Removal

Trojan.Agent Found in svchost.exe [Solved]

29 min read

Looking for the outcome? Ask AI

Glad your here! Topic Starter

Post #1June 14, 2012, 12:56 AM UTC

Wifes machine running Windows 7 64 bit
Malwarebytes found Trojan.Agent in svchost.exe after seeing that windows updates have been failing. Saw some other posts on this and need some help on this one. Thank you for being here, greatly appreciated!
Also think that there is a google redirect going on as well.

hijackthis log below

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:32:11 PM, on 6/13/2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.17006)
Boot mode: Normal

Running processes:
C:\Users\Laura\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Laura\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.a…&tbid=60516
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=109935&am;…000842b2b9d5b14
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll
O3 - Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll
O4 - HKLM\..\Run: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Users\Laura\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
O4 - HKCU\..\Run: [Spotify] "C:\Users\Laura\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O4 - Startup: Dropbox.lnk = Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} (DellSystemLite.Scanner) - http://support.dell.com/systemprofiler/DellSystemLite.CAB
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: UMVPFSrv - Logitech Inc. - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 13305 bytes

oldman960

Post #2June 14, 2012, 9:22 AM UTC

Hi Glad your here!, welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Download OTL to your desktop.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
In the window under Custom Scans/Fixes copy and paste the following

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
consrv.dll
/md5stop
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Next

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.

Please post back

both OTL logs
aswMBR log
mbr.zip (attached)

Glad your here!

Post #3June 14, 2012, 12:33 PM UTC

Thanks for the quick response and thank you for the help.

OTL logfile created on: 6/14/2012 8:10:10 AM - Run 1
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Users\Laura\Desktop
64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.87 Gb Total Physical Memory | 3.92 Gb Available Physical Memory | 66.86% Memory free
11.73 Gb Paging File | 9.88 Gb Available in Paging File | 84.25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 289.42 Gb Total Space | 69.54 Gb Free Space | 24.03% Space Free | Partition Type: NTFS
Drive E: | 1397.07 Gb Total Space | 478.13 Gb Free Space | 34.22% Space Free | Partition Type: NTFS

Computer Name: ADMIN-PC | User Name: Laura | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Laura\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\java.exe (Oracle Corporation)
PRC - C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe (Alcor Micro Corp.)
PRC - C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()
PRC - \\.\globalroot\systemroot\svchost.exe ()
PRC - \\.\globalroot\systemroot\svchost.exe ()
PRC - \\.\globalroot\systemroot\svchost.exe ()
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Users\Laura\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe (Octoshape ApS)
PRC - C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
PRC - C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()

========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTCore4.dll ()
MOD - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()
MOD - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll ()
MOD - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (UMVPFSrv) – C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (NIS) – C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe (Symantec Corporation)
SRV - (GoToAssist) – C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) – C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (AdobeActiveFileMonitor7.0) – C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (nmservice) – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
SRV - (LinksysUpdater) – C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()

========== Driver Services (SafeList) ==========

DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (LVUVC64) Logitech Webcam 200(UVC) – C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) – C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SymNetS) – C:\Windows\SysNative\drivers\NISx64\1207020.003\symnets.sys (Symantec Corporation)
DRV:64bit: - (SymIM) – C:\Windows\SysNative\drivers\SymIMV.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\NISx64\1207020.003\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\SysNative\drivers\NISx64\1207020.003\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\NISx64\1207020.003\symefa64.sys (Symantec Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\NISx64\1207020.003\symds64.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\NISx64\1207020.003\ironx64.sys (Symantec Corporation)
DRV:64bit: - (LVPr2Mon) – C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (LVPr2M64) – C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (Impcd) – C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) Intel® – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (k57nd60a) Broadcom NetLink ™ – C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (lvpopf64) – C:\Windows\SysNative\drivers\lvpopf64.sys (Logitech Inc.)
DRV:64bit: - (HECIx64) Intel® – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (pnarp) – C:\Windows\SysNative\drivers\pnarp.sys (Pure Networks, Inc.)
DRV:64bit: - (purendis) – C:\Windows\SysNative\drivers\purendis.sys (Pure Networks, Inc.)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120613.007\IDSviA64.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120613.033\EX64.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120613.033\ENG64.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120531.001\BHDrvx64.sys (Symantec Corporation)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {C3EE7B94-C2A1-41FB-87AC-42E578027ACF}
IE:64bit: - HKLM\..\SearchScopes\{C3EE7B94-C2A1-41FB-87AC-42E578027ACF}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6831B5C9-128F-4E8F-B6E7-89B8AAA6C767}
IE - HKLM\..\SearchScopes\{23088cf8-eaf8-4bb3-a251-9ba61557ac75}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKLM\..\SearchScopes\{34e26447-bf30-4c78-a5b9-61dfa8a55e67}: "URL" = http://s.mysearch.com/search/GGmain.jhtml?…r={searchTerms}
IE - HKLM\..\SearchScopes\{6831B5C9-128F-4E8F-B6E7-89B8AAA6C767}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.a…&tbid=60516
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=109935&am…000842b2b9d5b14
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://g.msn.com/USCON/1
IE - HKCU\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…000842b2b9d5b14
IE - HKCU\..\SearchScopes\{1C81CA55-4A43-4AD5-A613-394A9DB7F5C9}: "URL" = http://www.google.com/search?q={searchTerm…utputEncoding?}
IE - HKCU\..\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}: "URL" = http://www.crawler.com/search/dispatcher.a…&tbid=60516
IE - HKCU\..\SearchScopes\{23088cf8-eaf8-4bb3-a251-9ba61557ac75}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKCU\..\SearchScopes\{34e26447-bf30-4c78-a5b9-61dfa8a55e67}: "URL" = http://s.mysearch.com/search/GGmain.jhtml?…r={searchTerms}
IE - HKCU\..\SearchScopes\{76E9350E-0392-9C19-F83A-99BC015260AF}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?q={SEARCHTERMS}&…o=US&ver=18
IE - HKCU\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://inboxtoolbar.com/search/dispatcher….0105&lng=en
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: [removed]:2.4.6000
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.5
FF - prefs.js..extensions.enabledItems: {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.3
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {ED76C299-85BC-4891-9237-74A140C28832}:1.0.0.15
FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=109935&tt=050412_30b&babsrc=KW_ss&mntrId=225be37c000000000000842b2b9d5b14&q="

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@ei.DailyBibleGuide.com/Plugin: C:\Program Files (x86)\DailyBibleGuideEI\Installr\2.bin\NP2vEISB.dll (DailyBibleGuide)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@octoshape.com/Octoshape Streaming Services,version=1.0: C:\Users\Laura\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1101262-0-npoctoshape.dll (Octoshape ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2012/06/12 17:24:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_9_4 [2012/06/14 07:39:32 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/05/21 15:54:25 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/06/13 22:01:31 | 000,000,000 | —D | M]

[2010/10/11 23:49:22 | 000,000,000 | —D | M] (No name found) – C:\Users\Laura\AppData\Roaming\Mozilla\Extensions
[2012/06/13 22:10:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\extensions
[2011/01/08 12:04:42 | 000,001,919 | —- | M] () – C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\searchplugins\bing-zugo.xml
[2011/02/08 11:09:35 | 000,000,000 | —- | M] () – C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\searchplugins\DailyBibleGuide.xml
[2011/01/12 08:20:28 | 000,000,000 | —- | M] () – C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\searchplugins\FilmFanatic.xml
[2011/02/07 15:53:10 | 000,002,291 | —- | M] () – C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\searchplugins\inbox-search.xml
[2010/11/15 13:52:14 | 000,002,470 | —- | M] () – C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\searchplugins\safesearch.xml
[2011/11/09 22:08:39 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/03/05 19:11:51 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/06/12 17:24:31 | 000,000,000 | —D | M] (Symantec Intrusion Prevention) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN
[2012/04/28 22:22:43 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/10 16:12:54 | 000,002,353 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2011/10/08 22:28:19 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2007/07/26 14:05:16 | 000,001,329 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\crawlersrch.xml
[2011/11/09 22:08:34 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [Desktop Disc Tool] c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe (Alcor Micro Corp.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [Octoshape Streaming Services] C:\Users\Laura\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe (Octoshape ApS)
O4 - HKCU..\Run: [Spotify] "C:\Users\Laura\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart File not found
O4 - Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = File not found
O4 - Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.0)
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB (DellSystemLite.Scanner)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BDBAA6EF-54C6-4C52-8369-EA86A37DD159}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\amd64\puresp4.dll (Cisco Systems, Inc.)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/06/14 08:08:29 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Users\Laura\Desktop\OTL.exe
[2012/06/13 22:01:51 | 000,000,000 | —D | C] – C:\Program Files (x86)\Oracle
[2012/06/13 22:01:31 | 000,772,504 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\npDeployJava1.dll
[2012/06/13 22:01:31 | 000,227,824 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/06/13 22:01:04 | 000,174,064 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/06/13 22:01:04 | 000,174,064 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/06/13 22:00:37 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2012/06/13 21:42:29 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\Windows\svchost.exe
[2012/06/13 20:28:30 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Laura\Desktop\HiJackThis.exe
[2012/06/13 13:54:55 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\photo for blog
[2012/06/13 08:38:48 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\week one for mera lighting for forum
[2012/06/12 20:44:21 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\week one for mera lighting
[2012/06/12 20:17:38 | 000,851,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/06/12 20:17:37 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/06/12 20:17:26 | 000,736,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/06/12 20:17:26 | 000,097,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/06/12 20:17:25 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/06/12 20:17:25 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/06/12 20:17:24 | 000,482,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2012/06/12 20:17:24 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2012/06/12 20:17:24 | 000,256,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2012/06/12 20:17:24 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2012/06/12 20:17:24 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/06/12 20:17:24 | 000,134,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/06/12 20:17:24 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/06/12 20:17:24 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2012/06/12 20:17:24 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2012/06/12 20:17:24 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2012/06/12 20:17:24 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2012/06/12 20:16:17 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorekmts.dll
[2012/06/12 20:16:17 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpwsx.dll
[2012/06/12 20:16:17 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdrmemptylst.exe
[2012/06/12 20:15:51 | 003,213,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msi.dll
[2012/06/12 20:15:46 | 001,460,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2012/06/12 20:15:46 | 000,140,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll
[2012/06/12 17:52:51 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\bubbles for fb try again
[2012/06/12 17:41:56 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\bubbles for fb
[2012/06/12 10:04:32 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\2011 Tax info
[2012/06/12 10:03:05 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\Business Folder
[2012/06/11 17:27:06 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\photos for mera
[2012/06/11 15:54:19 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\mcdonald for book #1
[2012/06/11 15:10:17 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\baby cameron drool!
[2012/06/11 15:01:50 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\karen for class week 1
[2012/06/11 13:30:11 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\week 1 lighting class with mera
[2012/06/09 21:10:42 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\karen and doug for book
[2012/06/08 20:57:35 | 000,043,640 | R— | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\SymIMV.sys
[2012/06/08 20:38:43 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Roaming\Malwarebytes
[2012/06/08 20:38:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/08 20:38:34 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/06/08 20:38:33 | 000,024,904 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/06/08 20:38:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/06/01 10:25:11 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\wedding book for katy and adam
[2012/05/30 06:07:22 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\baby poses
[2012/05/26 10:08:34 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\karen & doug
[2012/05/24 11:08:00 | 000,000,000 | —D | C] – C:\Users\Laura\Documents\BookSmartData
[2012/05/24 11:07:55 | 000,000,000 | —D | C] – C:\Users\Laura\.blurb
[2012/05/24 11:07:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BookSmart
[2012/05/24 11:06:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\BookSmart
[2012/05/23 18:24:03 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Roaming\AVS4YOU
[2012/05/23 18:23:48 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AVS4YOU
[2012/05/23 18:23:08 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVS4YOU
[2012/05/23 18:23:00 | 011,137,024 | —- | C] (Intel Corporation) – C:\Windows\SysWow64\libmfxsw32.dll
[2012/05/23 18:22:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\AVSMedia
[2012/05/23 18:22:24 | 001,700,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\GdiPlus.dll
[2012/05/23 18:22:24 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml3a.dll
[2012/05/23 18:22:24 | 000,000,000 | —D | C] – C:\ProgramData\AVS4YOU
[2012/05/23 18:22:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\AVS4YOU
[2012/05/22 09:24:12 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Local\{6946EA34-54E7-43B0-8D00-04249D41160C}
[2012/05/21 21:10:11 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\Certification Application « Me Ra Koh Photography Blog_files
[2012/05/21 16:00:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/05/21 15:59:59 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2012/05/21 15:59:59 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/05/21 15:54:20 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/05/21 15:54:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2011/03/23 18:37:56 | 000,960,584 | —- | C] (DailyBibleGuide) – C:\Users\Laura\AppData\Local\DailyBibleGuideAuto.exe
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Laura\*.tmp files -> C:\Users\Laura\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/06/14 08:11:08 | 000,000,896 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/14 08:09:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/14 08:08:30 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\Laura\Desktop\OTL.exe
[2012/06/14 07:49:47 | 000,019,392 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/14 07:49:47 | 000,019,392 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/14 07:40:39 | 000,000,892 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/14 07:39:05 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/06/14 07:39:03 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\lvuvc.hs
[2012/06/14 07:38:57 | 429,219,839 | -HS- | M] () – C:\hiberfil.sys
[2012/06/13 22:00:40 | 000,227,824 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/06/13 22:00:40 | 000,174,064 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/06/13 22:00:40 | 000,174,064 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/06/13 20:28:30 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Laura\Desktop\HiJackThis.exe
[2012/06/13 03:29:43 | 005,025,808 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/13 03:11:07 | 000,740,322 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/06/13 03:11:07 | 000,624,162 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/06/13 03:11:07 | 000,106,538 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/06/13 03:09:22 | 000,000,129 | —- | M] () – C:\Windows\SysNative\MRT.INI
[2012/06/12 20:15:30 | 001,805,382 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1207020.003\Cat.DB
[2012/06/12 13:29:28 | 394,959,475 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/06/12 01:12:14 | 000,002,386 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2012/06/12 00:44:16 | 000,002,482 | —- | M] () – C:\Users\Public\Desktop\Norton Internet Security.lnk
[2012/06/09 21:13:52 | 000,001,323 | —- | M] () – C:\Users\Laura\Desktop\MyPublisher.lnk
[2012/06/09 17:14:54 | 000,001,053 | —- | M] () – C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/06/09 17:14:21 | 000,001,021 | —- | M] () – C:\Users\Laura\Desktop\Dropbox.lnk
[2012/06/08 20:38:35 | 000,001,155 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/07 22:08:38 | 000,000,172 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1207020.003\isolate.ini
[2012/06/02 13:34:12 | 000,036,377 | —- | M] () – C:\Users\Laura\Desktop\photo quote by steve jobs.jpg
[2012/05/30 06:02:53 | 000,001,985 | —- | M] () – C:\Users\Laura\Desktop\Mozilla Firefox.lnk
[2012/05/24 11:07:12 | 000,002,013 | —- | M] () – C:\Users\Public\Desktop\BookSmart.lnk
[2012/05/24 11:07:12 | 000,001,959 | —- | M] () – C:\Users\Laura\Application Data\Microsoft\Internet Explorer\Quick Launch\BookSmart.lnk
[2012/05/22 09:58:12 | 000,006,746 | —- | M] () – C:\Users\Laura\Desktop\laura swift photography label.std
[2012/05/21 18:30:26 | 000,001,125 | —- | M] () – C:\Users\Laura\Desktop\Roxio Burn.lnk
[2012/05/21 16:00:41 | 000,001,825 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/05/21 15:54:21 | 000,001,887 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Laura\*.tmp files -> C:\Users\Laura\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/06/09 21:13:52 | 000,001,353 | —- | C] () – C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPublisher.lnk
[2012/06/09 21:13:52 | 000,001,323 | —- | C] () – C:\Users\Laura\Desktop\MyPublisher.lnk
[2012/06/08 20:38:35 | 000,001,155 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/02 13:34:11 | 000,036,377 | —- | C] () – C:\Users\Laura\Desktop\photo quote by steve jobs.jpg
[2012/05/24 11:07:12 | 000,002,013 | —- | C] () – C:\Users\Public\Desktop\BookSmart.lnk
[2012/05/24 11:07:12 | 000,001,959 | —- | C] () – C:\Users\Laura\Application Data\Microsoft\Internet Explorer\Quick Launch\BookSmart.lnk
[2012/05/21 16:00:40 | 000,001,825 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/05/21 15:54:20 | 000,001,887 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/03/13 20:22:07 | 000,044,544 | —- | C] () – C:\Windows\SysWow64\Gif89.dll
[2012/01/18 07:44:00 | 010,920,984 | —- | C] () – C:\Windows\SysWow64\LogiDPP.dll
[2012/01/18 07:44:00 | 000,336,408 | —- | C] () – C:\Windows\SysWow64\DevManagerCore.dll
[2012/01/18 07:44:00 | 000,104,472 | —- | C] () – C:\Windows\SysWow64\LogiDPPApp.exe
[2011/12/16 22:07:50 | 000,001,456 | —- | C] () – C:\Users\Laura\AppData\Local\Adobe Save for Web 12.0 Prefs
[2011/07/19 15:35:26 | 000,000,000 | —- | C] () – C:\Users\Laura\AppData\Local\{E9D8026E-2273-4038-A581-5AD3DC461154}
[2011/07/01 08:56:26 | 000,000,132 | —- | C] () – C:\Users\Laura\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011/01/07 08:36:09 | 000,484,352 | —- | C] () – C:\Windows\SysWow64\lame_enc.dll
[2010/12/26 11:33:45 | 000,000,392 | —- | C] () – C:\Users\Laura\AppData\Roaming\wklnhst.dat
[2010/11/04 20:20:45 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/10/05 17:53:52 | 000,676,224 | —- | C] () – C:\Windows\SysWow64\OGACheckControl.DLL
[2010/09/30 14:07:09 | 000,870,560 | —- | C] () – C:\Windows\SysWow64\igkrng575.bin
[2010/09/30 14:07:09 | 000,208,896 | —- | C] () – C:\Windows\SysWow64\iglhsip32.dll
[2010/09/30 14:07:09 | 000,143,360 | —- | C] () – C:\Windows\SysWow64\iglhcp32.dll
[2010/09/30 14:07:08 | 000,104,636 | —- | C] () – C:\Windows\SysWow64\igfcg575m.bin
[2010/09/30 14:07:06 | 000,127,868 | —- | C] () – C:\Windows\SysWow64\igcompkrng575.bin

========== LOP Check ==========

[2012/04/10 16:12:49 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\Babylon
[2011/01/08 10:21:50 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\Canneverbe Limited
[2011/07/10 20:01:50 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/06/14 07:41:35 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\Dropbox
[2011/01/07 08:36:10 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\FreeAudioPack
[2010/11/03 21:52:39 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\Leadertech
[2010/12/10 20:08:24 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\MyPublisher
[2010/10/26 19:11:48 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\Octoshape
[2011/01/08 10:21:37 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\OpenCandy
[2011/07/01 08:15:50 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010/12/26 11:33:45 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\Template
[2012/06/11 07:11:49 | 000,032,562 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/09/30 14:14:41 | 000,004,670 | RH– | M] () – C:\dell.sdr
[2012/06/14 07:38:57 | 429,219,839 | -HS- | M] () – C:\hiberfil.sys
[2012/06/14 07:39:00 | 2003,951,615 | -HS- | M] () – C:\pagefile.sys
[2012/04/10 16:13:01 | 000,000,251 | —- | M] () – C:\user.js
[2011/01/13 06:30:29 | 000,002,312 | —- | M] () – C:\{230E6303-2091-4D95-AB10-8F754A1A2F88}
[2012/03/26 14:56:18 | 000,002,376 | —- | M] () – C:\{3AFAB1D5-DBBA-4825-9717-9DE7F21351F3}
[2010/11/20 19:38:43 | 000,002,632 | —- | M] () – C:\{B4333337-5E85-4E1B-A5AF-D666F3711FE8}

< %systemroot%\Fonts\*.com >
[2009/07/14 01:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 01:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 01:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 01:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/11/10 02:28:46 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini
[2011/03/26 12:03:53 | 000,000,005 | —- | M] () – C:\Program Files (x86)\eula.txt
[2011/03/26 11:34:21 | 000,000,003 | —- | M] () – C:\Program Files (x86)\option.txt
[2011/03/26 12:03:35 | 000,000,013 | —- | M] () – C:\Program Files (x86)\version.txt

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< MD5 for: EXPLORER.ADML >
[2009/07/13 22:30:02 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\PolicyDefinitions\en-US\Explorer.adml
[2009/07/13 22:30:02 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef5713984067904\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2009/06/10 16:53:55 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\PolicyDefinitions\Explorer.admx
[2009/06/10 16:53:55 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\winsxs\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_71af9b5b0a86e6b7\Explorer.admx

< MD5 for: EXPLORER.EXE >
[2010/09/30 14:11:44 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe
[2011/02/26 02:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\explorer.exe
[2011/02/26 02:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 01:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2010/09/30 14:11:58 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\SysWOW64\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 02:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/09/30 14:11:44 | 002,868,736 | —- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe
[2010/09/30 14:11:49 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/09/30 14:11:58 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2010/09/30 14:11:49 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/09/30 14:11:58 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2010/09/30 14:11:49 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 21:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2010/09/30 14:11:58 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2010/09/30 14:11:44 | 002,868,736 | —- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe
[2011/02/26 02:26:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2010/09/30 14:11:49 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[2010/09/30 14:11:44 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2009/07/13 22:26:48 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\en-US\explorer.exe.mui
[2009/07/13 22:26:48 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui
[2009/07/13 22:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2009/07/13 22:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui

< MD5 for: EXPLORER.EXE-D5E97654.PF >
[2012/06/13 20:15:16 | 000,234,464 | —- | M] () MD5=CA818174DCD554932F86996584113546 – C:\Windows\Prefetch\EXPLORER.EXE-D5E97654.pf

< MD5 for: EXPLORER.ZIP >
[2006/03/06 23:48:08 | 000,020,394 | —- | M] () MD5=B469409C2B2A33C542190B720E11BD79 – C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip

< MD5 for: IEXPLORE.EXE >
[2011/11/05 01:28:03 | 000,696,600 | —- | M] (Microsoft Corporation) MD5=0377589BF14A6E5667B730D6D6DB59B4 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16912_none_0fae4f323e42a646\iexplore.exe
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2012/02/28 01:42:27 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=09F6A10AB424E2DE445153065FA076BF – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16968_none_19d2eba472c68c00\iexplore.exe
[2010/09/08 00:36:39 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=14803EA3E5DD7CB37CB446C74CFDA38F – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20795_none_1a39121b8bff3c23\iexplore.exe
[2012/04/20 01:08:37 | 000,672,856 | —- | M] (Microsoft Corporation) MD5=27019747D97AB5CEFB97677DBB5CF577 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2012/04/20 01:08:37 | 000,672,856 | —- | M] (Microsoft Corporation) MD5=27019747D97AB5CEFB97677DBB5CF577 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.17006_none_1a11a2ba7297e4ee\iexplore.exe
[2011/04/22 16:15:52 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=281C23EC5BCB1853A5D571F1A6E52FB1 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20949_none_101e7c5957724e1d\iexplore.exe
[2009/07/13 21:17:29 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=2C32E3E596CFE660353753EABEFB0540 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_19ba3f8a72d988f3\iexplore.exe
[2011/12/16 04:03:08 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=38668C6CADABC9487C683FADD3D165D0 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16930_none_19eb591872b56d75\iexplore.exe
[2011/08/20 00:35:15 | 000,673,024 | —- | M] (Microsoft Corporation) MD5=41FE5E37EFE0B587A688BA0E4FA41288 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16869_none_19d3ea0872c5a830\iexplore.exe
[2011/11/05 01:34:31 | 000,696,600 | —- | M] (Microsoft Corporation) MD5=441C397A9ECF07747920F7F5E40B419B – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21085_none_0fef13a357968bc7\iexplore.exe
[2012/04/20 00:53:37 | 000,672,856 | —- | M] (Microsoft Corporation) MD5=4866404D6657D6E50619CCAF56B17D27 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21198_none_1a3bf0cd8bfcb2df\iexplore.exe
[2010/09/08 01:37:57 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=4879CB864E290BED38C5BDB641144B1B – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20795_none_0fe467c9579e7a28\iexplore.exe
[2010/09/08 01:49:01 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=498035ABCCF1ED47AE6791D239187587 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16671_none_0f6c69ae3e743d20\iexplore.exe
[2010/11/04 01:54:54 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=58CF468D3FF4CF830339FE5E45356355 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16700_none_1a0bc510729d1f54\iexplore.exe
[2010/09/08 00:31:24 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=61EDBCE47ADF3E52AB0B9F49EE4AEBB8 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16671_none_19c1140072d4ff1b\iexplore.exe
[2011/04/22 15:29:16 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=64EFAF916C4009F1B84153D0BB491FB0 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16800_none_1a0bc6f6729d1c7b\iexplore.exe
[2012/02/28 02:38:39 | 000,696,600 | —- | M] (Microsoft Corporation) MD5=69073D126F71A4F0FFF1DEE5082A0052 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16968_none_0f7e41523e65ca05\iexplore.exe
[2010/11/04 01:54:59 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=6B2258FF6D2332073FE9E90122FA4168 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20831_none_1a75f2618bd22c48\iexplore.exe
[2011/06/21 02:14:22 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=6B2383EDA3956983E3219A62D8408DAB – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20992_none_0fe16ab757a12871\iexplore.exe
[2011/06/21 01:25:30 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=6BB506124872ACDFAC5BD912CA1334CE – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20992_none_1a3615098c01ea6c\iexplore.exe
[2010/12/18 02:17:48 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=700B40EA39DFB25517A81032F03D6D20 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16722_none_0fa37b7a3e4ac7e9\iexplore.exe
[2012/02/28 01:44:39 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=8AFD61FB2D96C8229B7D8604F62FA692 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21158_none_1a67307d8bdc431b\iexplore.exe
[2010/12/18 02:11:10 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=8C6C32E4AF8A3D7155656F5897C504E0 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20861_none_1000d84b5789be20\iexplore.exe
[2011/11/05 00:38:00 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=8ED7C19AEFA3673AADB0D6864B03FBCE – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16912_none_1a02f98472a36841\iexplore.exe
[2010/12/18 01:32:25 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=9321CF0D023528C71E3645F8433C86C8 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20861_none_1a55829d8bea801b\iexplore.exe
[2011/06/21 01:37:00 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=A3AB0A260049BE22AB52E302D9220A92 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16839_none_19f459cc72ad545d\iexplore.exe
[2011/12/16 04:45:57 | 000,696,600 | —- | M] (Microsoft Corporation) MD5=A3F56CED7B94A30BE8954387F0E2B5D2 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16930_none_0f96aec63e54ab7a\iexplore.exe
[2011/11/05 00:39:45 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=A8A14CD0CB499B80412F75D53996AE29 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21085_none_1a43bdf58bf74dc2\iexplore.exe
[2010/12/18 01:33:54 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=AA08B68EF4E35EFA170CF85A44B23B70 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16722_none_19f825cc72ab89e4\iexplore.exe
[2011/02/24 01:45:11 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=AB2BB40A5FE49AD236791AC22BD08869 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_1a9d66118bb386fd\iexplore.exe
[2011/08/20 01:46:07 | 000,696,576 | —- | M] (Microsoft Corporation) MD5=AC1CC7CD5CBE60EFF105BB3C0DC199C5 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16869_none_0f7f3fb63e64e635\iexplore.exe
[2011/06/21 02:21:24 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=B38DE184AC135A4B0AE7D286476FA33F – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16839_none_0f9faf7a3e4c9262\iexplore.exe
[2011/02/24 02:29:19 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=B4881B8F6EDB48CABD44BCC9FB5475C4 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_1048bbbf5752c502\iexplore.exe
[2011/12/16 04:42:35 | 000,696,600 | —- | M] (Microsoft Corporation) MD5=C152529FD67ABB61F0609EF5A299794C – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21108_none_104895c75752f56b\iexplore.exe
[2011/12/16 05:19:51 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=C53E41F92B19EC97D987F968403BEC49 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21108_none_1a9d40198bb3b766\iexplore.exe
[2011/02/24 01:32:52 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C6697A46554E36541E81182B258A19D6 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_19d0e74472c85f04\iexplore.exe
[2011/08/20 01:42:38 | 000,696,576 | —- | M] (Microsoft Corporation) MD5=C66C8BF791F9DB974022506265518EE0 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21033_none_102322ab576fcd64\iexplore.exe
[2011/04/22 16:16:25 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=D6F57A9ECB4606076FB9519D1698FCBA – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16800_none_0fb71ca43e3c5a80\iexplore.exe
[2012/04/20 02:26:39 | 000,696,408 | —- | M] (Microsoft Corporation) MD5=D889681C78E7BFE45587398AC42FC2D4 – C:\Program Files\Internet Explorer\iexplore.exe
[2012/04/20 02:26:39 | 000,696,408 | —- | M] (Microsoft Corporation) MD5=D889681C78E7BFE45587398AC42FC2D4 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.17006_none_0fbcf8683e3722f3\iexplore.exe
[2010/11/04 02:37:41 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=D8E00EA671A1EFE95C69C7566C505AD4 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16700_none_0fb71abe3e3c5d59\iexplore.exe
[2011/02/24 02:32:09 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=E1BBDE0F187194D4B08335234A4B9FC7 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_0f7c3cf23e679d09\iexplore.exe
[2010/11/04 02:42:22 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=E220FB009F54AAF649C6A278A5156764 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20831_none_1021480f57716a4d\iexplore.exe
[2012/02/28 02:56:21 | 000,696,600 | —- | M] (Microsoft Corporation) MD5=EFCA1150F17BCE44357F03BB61A29966 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21158_none_1012862b577b8120\iexplore.exe
[2012/04/20 02:13:05 | 000,696,408 | —- | M] (Microsoft Corporation) MD5=F293ACB373FD8F090E08F183C06E07ED – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21198_none_0fe7467b579bf0e4\iexplore.exe
[2009/07/13 21:43:43 | 000,696,600 | —- | M] (Microsoft Corporation) MD5=F2B0D41E1D08D0B2006DF5AA2E74C81E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_0f6595383e78c6f8\iexplore.exe
[2011/04/22 15:11:29 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=F94877A94996B3C12BB31AD722840457 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20949_none_1a7326ab8bd31018\iexplore.exe
[2011/08/20 00:32:44 | 000,673,024 | —- | M] (Microsoft Corporation) MD5=FA623BE79902A7B49FF4F21117B63C83 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21033_none_1a77ccfd8bd08f5f\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/07/13 22:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/07/13 22:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_09122aaf762607df\iexplore.exe.mui
[2009/07/13 22:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2009/07/13 22:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_1366d501aa86c9da\iexplore.exe.mui

< MD5 for: WINLOGON.ADML >
[2009/07/13 22:25:22 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\PolicyDefinitions\en-US\WinLogon.adml
[2009/07/13 22:25:22 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f0f9032ef6930070\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2009/06/10 17:04:41 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\PolicyDefinitions\WinLogon.admx
[2009/06/10 17:04:41 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_d7024e6992f3424d\WinLogon.admx

< MD5 for: WINLOGON.EXE >
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/07/13 21:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2010/09/30 14:11:58 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010/09/30 14:11:58 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\SysNative\winlogon.exe
[2010/09/30 14:11:58 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2009/07/13 22:29:52 | 000,022,528 | —- | M] (Microsoft Corporation) MD5=56D03B64B8C483C1D12A8E4577B3B332 – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2009/07/13 22:29:52 | 000,022,528 | —- | M] (Microsoft Corporation) MD5=56D03B64B8C483C1D12A8E4577B3B332 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_26ed83321dc778e1\winlogon.exe.mui

< MD5 for: WINLOGON.MFL >
[2009/07/13 22:27:22 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\SysNative\wbem\en-US\winlogon.mfl
[2009/07/13 22:27:22 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_84afd4fd38ffd276\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2009/07/13 16:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\SysNative\wbem\winlogon.mof
[2009/07/13 16:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_dc2dbb778f98e40f\winlogon.mof

< End of report >

OTL Extras logfile created on: 6/14/2012 8:10:10 AM - Run 1
OTL by OldTimer - Version 3.2.48.0 Folder = C:\Users\Laura\Desktop
64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.87 Gb Total Physical Memory | 3.92 Gb Available Physical Memory | 66.86% Memory free
11.73 Gb Paging File | 9.88 Gb Available in Paging File | 84.25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 289.42 Gb Total Space | 69.54 Gb Free Space | 24.03% Space Free | Partition Type: NTFS
Drive E: | 1397.07 Gb Total Space | 478.13 Gb Free Space | 34.22% Space Free | Partition Type: NTFS

Computer Name: ADMIN-PC | User Name: Laura | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] – C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] – C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0009ECA4-19D0-4562-97CF-68C8830BDD98}" = rport=138 | protocol=17 | dir=out | app=system |
"{072C6719-BC6F-4280-ACBA-368AC84D1C71}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{10BCA612-EE37-461F-8B4B-9582378A358A}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{226EB0DA-2F79-44EE-86E8-81DD348CEA5F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{278A3E4C-25BC-4ACB-9B29-7CF51A32DFCE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{32A21EB8-D8FF-4F8A-AFCD-8FDC2A326490}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |
"{33B9DC0C-7DA0-451C-812A-819A026324F8}" = lport=138 | protocol=17 | dir=in | app=system |
"{34E149D1-1E06-4A11-BA9A-76CEAD2BE271}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3756AB1E-392B-48EC-8FC3-745E1FB40E8B}" = rport=445 | protocol=6 | dir=out | app=system |
"{3C3AD95F-44B9-4698-9A17-6E16533B89F0}" = rport=139 | protocol=6 | dir=out | app=system |
"{4029EF89-765E-4F72-9125-91124E4FACF7}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4BC13B1C-17BA-4F0E-A14B-BF1E1A935990}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{582C50AE-6A35-4CDB-9C9B-1ADCA7D9018E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{5CA703F0-4631-4BBD-869E-6D36886C4970}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{7E2E6922-F134-4B49-9808-4EA5917B85FB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8B76AEB0-9EDE-4D98-A346-67C128A9CD1F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{9337F2BD-2F96-49A6-B1B0-458910850F8E}" = lport=139 | protocol=6 | dir=in | app=system |
"{A26982A6-C2CE-416D-A24E-558A5EF5659A}" = rport=137 | protocol=17 | dir=out | app=system |
"{AACEAE37-1E7F-41F9-AC04-3D00D17B8D9E}" = lport=445 | protocol=6 | dir=in | app=system |
"{AE90640C-7006-4552-9385-61B8F20F3B62}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B0ACBAE5-10AD-42DB-9038-C64D00D7B541}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CDA7AC9B-EB18-4267-895E-53666631512D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D2929393-785F-4CAE-90AE-6BB58CF9C875}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{DD04CB6D-8008-4B3A-8A73-16DDD2449F32}" = lport=2869 | protocol=6 | dir=in | app=system |
"{E082C0B6-1400-44CE-BFFC-0AC1BD2A4CB6}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E6ABA05A-AEF4-4DBE-8C8D-5735E4D11905}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{EA2F039E-D06F-411E-B722-74776ACD4CC2}" = lport=2869 | protocol=6 | dir=in | app=system |
"{ED1A0CD6-4F46-4DD9-8C1F-6A5D84C190AB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EFCCE008-08B2-4456-8B7A-882E6BC15C6B}" = lport=137 | protocol=17 | dir=in | app=system |
"{F2BB51AB-7944-4B15-914C-158627458585}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |
"{FDC2F0B9-EB35-47D6-974F-BF95CDACF377}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0095064E-FBCD-460B-9F7E-69210C1BBBC6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{05F38889-61D4-4367-9161-33624865120C}" = protocol=17 | dir=in | app=c:\users\laura\appdata\roaming\dropbox\bin\dropbox.exe |
"{0C39950D-5F61-4DEB-BC60-E3DDA7405B44}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\pure networks shared\platform\nmsrvc.exe |
"{23A882B7-6361-4822-B6E4-B161477D15CC}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{2CB48E88-D535-4CE4-89C9-A88C4863EC63}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2D9C6C00-8CC3-409D-9CCA-7F4A3DE5DE05}" = protocol=17 | dir=in | app=c:\program files (x86)\logitech\vid hd\vid.exe |
"{2F17F6EB-3D8E-4780-9D9E-4F904AD7971B}" = protocol=17 | dir=in | app=c:\users\laura\downloads\mp3convertersetup.exe |
"{35ADD667-F95B-46E6-8D09-D10200159A49}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{37E79D25-44DF-4ED0-9BF2-C5F0A7ECADC8}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{3B514712-EFAC-4732-BFB0-525D303F02E7}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{45FE5B08-2D2B-4E9D-85AC-21B8EC564B57}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{4C41F2E2-5DCB-45F3-83E8-E451693439B6}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{64096927-07A6-430D-A6A6-94892D5232C4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{67FE469D-BF89-47BF-8944-4451B2AA4A83}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6B1BF901-D5AB-4280-9B58-96FE5B1673D0}" = protocol=6 | dir=out | app=system |
"{6C9384C2-4AEE-4842-89E3-710A17593C60}" = protocol=6 | dir=in | app=c:\users\laura\downloads\mp3convertersetup.exe |
"{79E37BDE-01D8-40D9-A727-3317503FE700}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7F830FF0-3E8B-4893-8AAC-2B96A7C87E23}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8B7A8105-AA2F-473B-B403-FEEAF6E0E58F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8BA71E81-DFDE-4220-8AF9-FF506D4E9CFA}" = protocol=6 | dir=in | app=c:\program files (x86)\logitech\vid hd\vid.exe |
"{933034DA-3B4E-4C9B-8255-82C4C5537A40}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd dx\pdvddxsrv.exe |
"{9D1B98CA-9A21-42CB-AE87-F7CD1E41C3E0}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{9E52BD09-CFB1-4880-920B-F03C479B96B2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A22910B5-F4D5-4916-9177-4373E5578280}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{AE50A7DC-94B2-46F6-9D60-8BC6C0B8541B}" = protocol=6 | dir=in | app=c:\users\laura\appdata\roaming\dropbox\bin\dropbox.exe |
"{AF7458DC-6932-49C3-87AD-9B8981B58DAD}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B09E5D8F-1C1A-4D51-8B12-D58DF225CB30}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{B3008055-369C-464B-ACC5-19ABE5D1C569}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B4FF6007-FDBE-4A12-A1FB-984FA8256272}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{BBFF0E40-D51B-46F7-878B-97066B282722}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{BF69E1E2-6FC1-4346-86E2-7F95C404BE02}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\pure networks shared\platform\nmsrvc.exe |
"{CBA3AE1C-FC44-4616-B956-71B3D08BA370}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd dx\powerdvd.exe |
"{D923EB87-068A-4F21-B781-ED5EEA481BA3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DF183F1E-2281-419C-BF14-2770C613CD4A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E5447BCA-AF90-4247-A5D6-32306B5992B7}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{E79C4E4A-061D-42EA-8037-815DB086963A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EC452B79-BD7C-46B7-BAA5-36F090F93C49}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{EEE7D3D5-06EA-45A8-ABB0-E75838FD13D2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{F23EF642-0447-49DE-8481-44CA54CBE5E6}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"TCP Query User{49D75DA1-D7EF-488B-96B8-E5AED9F8D5D8}C:\users\laura\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe" = protocol=6 | dir=in | app=c:\users\laura\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe |
"TCP Query User{7D61B6BB-80F0-4B04-91D5-6E18E1635071}C:\users\laura\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\laura\appdata\roaming\spotify\spotify.exe |
"UDP Query User{17768197-EAFC-4A99-9BAA-FC1CDE42E17A}C:\users\laura\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\laura\appdata\roaming\spotify\spotify.exe |
"UDP Query User{BFE848CF-8FF2-4307-B773-053797AC0CE7}C:\users\laura\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe" = protocol=17 | dir=in | app=c:\users\laura\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0136EF84-8660-4FE0-A9E5-F052F6230085}" = OLYMPUS Raw Codec
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{624C7F0A-89B2-4C49-9CAB-9D69613EC95A}" = Microsoft IntelliPoint 8.2
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{C73A3942-84C8-4597-9F9B-EE227DCBA758}" = Dell Dock
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CF8FFD12-602B-422D-AF1D-511B411E7632}" = iTunes
"{D4F66BBA-D79E-4F11-9B06-70C3D75A2958}" = Adobe Photoshop Lightroom 3.6 64-bit
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"lvdrivers_12.10" = Logitech Webcam Software Driver Package
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"NVIDIA Drivers" = NVIDIA Drivers

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{23B4636C-A780-4FEB-B4C9-A2564E9B9F7C}" = Multimedia Card Reader
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java™ 7 Update 5
"{28EAF1F5-4E32-4A52-ADAC-846CF1C5F06D}" = Pure Networks Platform
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{88D68A69-D247-466B-90DD-575F6BE16230}_is1" = CardRecovery 6.00
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002A-0000-1000-0000000FF1CE}_PROPLUS_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A127C3C0-055E-38CF-B38F-1E85F8BBBFFE}" = Adobe Community Help
"{A33E7B0C-B99C-4EC9-B702-8A328B161AF9}" = Roxio Burn
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1
"{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}" = Roxio Burn
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BF2A74BF-8D12-47F1-8B19-22B30AF6B0D1}" = Linksys EasyLink Advisor
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C9A87D86-FDFD-418B-BF96-EF09320973B3}" = PC Inspector smart recovery
"{CB6075D9-F912-40AE-BEA6-E590DA24F16B}" = Adobe Photoshop Elements 7.0
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DCC2DFE7-B119-43BC-BFF9-6B14D01BEB0B}_is1" = CF Card Recovery
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"Adobe AIR" = Adobe AIR
"Adobe Photoshop Elements 7" = Adobe Photoshop Elements 7.0
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"AVS4YOU Video Converter 7_is1" = AVS Video Converter 8
"BabylonToolbar" = Babylon toolbar on IE
"BookSmart® 3.2.5 3.2.5" = BookSmart® 3.2.5 3.2.5
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Dell Dock" = Dell Dock
"Digital Editions" = Adobe Digital Editions
"EASEUS Data Recovery Wizard Free Edition 5.5.1_is1" = EASEUS Data Recovery Wizard Free Edition 5.5.1
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.2
"Free Mp3 Wma Converter_is1" = Free Mp3 Wma Converter V 1.91
"Google Chrome" = Google Chrome
"GoToAssist" = GoToAssist 8.0.0.514
"iCare Data Recovery_is1" = iCare Data Recovery 4.6.4
"Image Rescue 4_is1" = Image Rescue 4
"InstallShield_{23B4636C-A780-4FEB-B4C9-A2564E9B9F7C}" = Multimedia Card Reader
"Linksys EasyLink Advisor" = Linksys EasyLink Advisor
"Logitech Vid" = Logitech Vid HD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Mozilla Firefox 12.0 (x86 en-US)" = Mozilla Firefox 12.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MVApplication1" = Memorex exPressit Label Design Studio
"NIS" = Norton Internet Security
"PROPLUS" = Microsoft Office Professional Plus 2007
"RescuePRO" = RescuePRO 3.2 DEMO
"ShapeCollage" = Shape Collage
"WinLiveSuite" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"GoToMeeting" = GoToMeeting 4.5.0.457
"Octoshape Streaming Services" = Octoshape Streaming Services

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 5/24/2012 7:27:09 PM | Computer Name = admin-PC | Source = Application Hang | ID = 1002
Description = The program lightroom.exe version 3.6.0.10 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 600 Start
Time: 01cd3a04ad03a6e8 Termination Time: 23 Application Path: C:\Program Files\Adobe\Adobe
Photoshop Lightroom 3.6\lightroom.exe Report Id: f5d6452c-a5f7-11e1-9393-842b2b9d5b14

Error - 6/5/2012 6:33:27 PM | Computer Name = admin-PC | Source = Application Error | ID = 1000
Description = Faulting application name: lightroom.exe, version: 3.6.0.10, time
stamp: 0x4edc3f82 Faulting module name: ui.dll, version: 3.6.0.10, time stamp: 0x4edc3ecc
Exception
code: 0xc0000005 Fault offset: 0x00000000000c5ff6 Faulting process id: 0x16a0 Faulting
application start time: 0x01cd436b3512200e Faulting application path: C:\Program
Files\Adobe\Adobe Photoshop Lightroom 3.6\lightroom.exe Faulting module path: C:\Program
Files\Adobe\Adobe Photoshop Lightroom 3.6\ui.dll Report Id: 77a7359d-af5e-11e1-866b-842b2b9d5b14

Error - 6/5/2012 6:39:03 PM | Computer Name = admin-PC | Source = Application Error | ID = 1000
Description = Faulting application name: lightroom.exe, version: 3.6.0.10, time
stamp: 0x4edc3f82 Faulting module name: ntdll.dll, version: 6.1.7600.16915, time
stamp: 0x4ec4b137 Exception code: 0xc0150010 Fault offset: 0x000000000006da42 Faulting
process id: 0x16a0 Faulting application start time: 0x01cd436b3512200e Faulting application
path: C:\Program Files\Adobe\Adobe Photoshop Lightroom 3.6\lightroom.exe Faulting
module path: C:\Windows\SYSTEM32\ntdll.dll Report Id: 3fd3bf84-af5f-11e1-866b-842b2b9d5b14

Error - 6/7/2012 9:41:43 AM | Computer Name = admin-PC | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 12.0.0.4493 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 1260 Start
Time: 01cd44b2bfbd842d Termination Time: 9 Application Path: C:\Program Files (x86)\Mozilla
Firefox\firefox.exe Report Id: 788d1259-b0a6-11e1-ba1f-842b2b9d5b14

Error - 6/8/2012 10:17:20 PM | Computer Name = admin-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 6/8/2012 10:18:04 PM | Computer Name = admin-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 6/8/2012 10:18:04 PM | Computer Name = admin-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 6/8/2012 10:18:06 PM | Computer Name = admin-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 6/8/2012 10:18:07 PM | Computer Name = admin-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 6/11/2012 4:16:02 PM | Computer Name = admin-PC | Source = Application Error | ID = 1000
Description = Faulting application name: MyPublisher40.exe, version: 0.0.0.0, time
stamp: 0x4ef4bcf2 Faulting module name: ntdll.dll, version: 6.1.7600.16915, time
stamp: 0x4ec49d10 Exception code: 0xc000071c Fault offset: 0x0009ace2 Faulting process
id: 0x1010 Faulting application start time: 0x01cd4808cc10c07e Faulting application
path: C:\Program Files (x86)\MyPublisher\MyPublisher\MyPublisher40.exe Faulting
module path: C:\Windows\SysWOW64\ntdll.dll Report Id: 43ac393c-b402-11e1-a285-842b2b9d5b14

[ Media Center Events ]
Error - 5/22/2012 5:29:45 PM | Computer Name = admin-PC | Source = MCUpdate | ID = 0
Description = 5:29:45 PM - Failed to retrieve SportsSchedule.enc (Error: HTTP status
404: The requested URL does not exist on the server. )

Error - 5/23/2012 5:49:15 AM | Computer Name = admin-PC | Source = MCUpdate | ID = 0
Description = 5:49:10 AM - Failed to retrieve SportsSchedule.enc (Error: HTTP status
404: The requested URL does not exist on the server. )

Error - 6/7/2012 5:36:27 PM | Computer Name = admin-PC | Source = MCUpdate | ID = 0
Description = 5:36:27 PM - Error connecting to the internet. 5:36:27 PM - Unable
to contact server..

Error - 6/7/2012 5:36:39 PM | Computer Name = admin-PC | Source = MCUpdate | ID = 0
Description = 5:36:32 PM - Error connecting to the internet. 5:36:32 PM - Unable
to contact server..

Error - 6/7/2012 6:36:46 PM | Computer Name = admin-PC | Source = MCUpdate | ID = 0
Description = 6:36:46 PM - Error connecting to the internet. 6:36:46 PM - Unable
to contact server..

Error - 6/7/2012 6:36:53 PM | Computer Name = admin-PC | Source = MCUpdate | ID = 0
Description = 6:36:51 PM - Error connecting to the internet. 6:36:51 PM - Unable
to contact server..

Error - 6/7/2012 8:15:43 PM | Computer Name = admin-PC | Source = MCUpdate | ID = 0
Description = 8:15:42 PM - Error connecting to the internet. 8:15:43 PM - Unable
to contact server..

Error - 6/7/2012 8:16:02 PM | Computer Name = admin-PC | Source = MCUpdate | ID = 0
Description = 8:15:49 PM - Error connecting to the internet. 8:15:49 PM - Unable
to contact server..

Error - 6/7/2012 9:16:08 PM | Computer Name = admin-PC | Source = MCUpdate | ID = 0
Description = 9:16:08 PM - Error connecting to the internet. 9:16:08 PM - Unable
to contact server..

Error - 6/7/2012 9:16:14 PM | Computer Name = admin-PC | Source = MCUpdate | ID = 0
Description = 9:16:13 PM - Error connecting to the internet. 9:16:13 PM - Unable
to contact server..

[ System Events ]
Error - 6/13/2012 3:01:54 AM | Computer Name = admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Update for Windows 7 for x64-based Systems (KB2679255).

Error - 6/13/2012 3:02:00 AM | Computer Name = admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2709715).

Error - 6/13/2012 3:09:33 AM | Computer Name = admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2676562).

Error - 6/13/2012 9:46:19 PM | Computer Name = admin-PC | Source = Service Control Manager | ID = 7022
Description = The Windows Font Cache Service service hung on starting.

Error - 6/13/2012 10:22:22 PM | Computer Name = admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Update for Windows 7 for x64-based Systems (KB2679255).

Error - 6/13/2012 10:22:23 PM | Computer Name = admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2709715).

Error - 6/13/2012 10:22:23 PM | Computer Name = admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2676562).

Error - 6/14/2012 7:46:50 AM | Computer Name = admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Update for Windows 7 for x64-based Systems (KB2679255).

Error - 6/14/2012 7:46:50 AM | Computer Name = admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2709715).

Error - 6/14/2012 7:46:50 AM | Computer Name = admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2676562).

< End of report >

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-06-14 08:21:25
—————————–
08:21:25.192 OS Version: Windows x64 6.1.7600
08:21:25.192 Number of processors: 4 586 0x2502
08:21:25.192 ComputerName: ADMIN-PC UserName: Laura
08:21:26.864 Initialize success
08:24:36.550 AVAST engine defs: 12061400
08:24:58.604 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
08:24:58.607 Disk 0 Vendor: WDC_WD3200AAKS-75L9A0 02.03E02 Size: 305245MB BusType: 3
08:24:58.610 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-3
08:24:58.613 Disk 1 Vendor: ST31500341AS CC1H Size: 1430799MB BusType: 3
08:24:58.614 Device \Driver\atapi -> MajorFunction fffffa80068425c4
08:24:58.617 Disk 0 MBR read successfully
08:24:58.618 Disk 0 MBR scan
08:24:58.622 Disk 0 MBR:Alureon-M [Rtk]
08:24:58.624 Disk 0 TDL4@MBR code has been found
08:24:58.626 Disk 0 Windows 7 default MBR code found via API
08:24:58.628 Disk 0 MBR hidden
08:24:58.631 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 62 MB offset 63
08:24:58.641 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 8818 MB offset 129024
08:24:58.660 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 296363 MB offset 18188288
08:24:58.665 Disk 0 MBR [TDL4] **ROOTKIT**
08:24:58.668 Disk 0 trace - called modules:
08:24:58.673 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80068425c4]<<
08:24:58.676 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006275060]
08:24:58.679 3 CLASSPNP.SYS[fffff8800103b43f] -> nt!IofCallDriver -> [0xfffffa80061c8580]
08:24:58.683 5 ACPI.sys[fffff88000e0b781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80061ca060]
08:24:58.686 \Driver\atapi[0xfffffa80066b4360] -> IRP_MJ_CREATE -> 0xfffffa80068425c4
08:25:01.059 AVAST engine scan C:\Windows
08:25:04.155 AVAST engine scan C:\Windows\system32
08:27:29.122 AVAST engine scan C:\Windows\system32\drivers
08:27:44.344 AVAST engine scan C:\Users\Laura
08:28:01.518 Disk 0 MBR has been saved successfully to "C:\Users\Laura\Desktop\MBR.dat"
08:28:01.522 The log file has been saved successfully to "C:\Users\Laura\Desktop\aswMBR.txt"

📎MBR.zip

oldman960

Post #4June 14, 2012, 3:48 PM UTC

Hi Glad your here!,

Download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

🖼Click to load external image (Posted Image)
Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

🖼Click to load external image (Posted Image)
Click the Start Scan button.

🖼Click to load external image (Posted Image)
If a suspicious object is detected, the default action will be Skip, click on Continue.

🖼Click to load external image (Posted Image)
If malicious objects are found, they will show in the Scan results and offer three (3) options.
Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

🖼Click to load external image (Posted Image)
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

Glad your here!

Post #5June 14, 2012, 5:50 PM UTC

Greeting Oldman960 from an older gentleman myself. Do appreciate your help. Log from TDSSKiller. 13:33:00.0917 1328 TDSS rootkit removing tool [removed] Jun 14 2012 08:11:46 13:33:01.0377 1328 ============================================================ 13:33:01.0377 1328 Current date / time: 2012/06/14 13:33:01.0377 13:33:01.0377 1328 SystemInfo: 13:33:01.0377 1328 13:33:01.0377 1328 OS Version: 6.1.7600 ServicePack: 0.0 13:33:01.0377 1328 Product type: Workstation 13:33:01.0377 1328 ComputerName: ADMIN-PC 13:33:01.0378 1328 UserName: Laura 13:33:01.0378 1328 Windows directory: C:\Windows 13:33:01.0378 1328 System windows directory: C:\Windows 13:33:01.0378 1328 Running under WOW64 13:33:01.0378 1328 Processor architecture: Intel x64 13:33:01.0378 1328 Number of processors: 4 13:33:01.0378 1328 Page size: 0x1000 13:33:01.0378 1328 Boot type: Normal boot 13:33:01.0378 1328 ============================================================ 13:33:03.0049 1328 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 13:33:03.0063 1328 Drive \Device\Harddisk1\DR1 - Size: 0x15D50F66000 (1397.27 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 13:33:03.0088 1328 ============================================================ 13:33:03.0088 1328 \Device\Harddisk0\DR0: 13:33:03.0088 1328 MBR partitions: 13:33:03.0088 1328 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1F800, BlocksNum 0x1139000 13:33:03.0088 1328 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1158800, BlocksNum 0x242D5800 13:33:03.0088 1328 \Device\Harddisk1\DR1: 13:33:03.0088 1328 GPT partitions: 13:33:03.0089 1328 \Device\Harddisk1\DR1\Partition0: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {FAD56864-183D-485B-9CF7-7DA49F9C7CDC}, Name: EFI System Partition, StartLBA 0x28, BlocksNum 0x64000 13:33:03.0089 1328 \Device\Harddisk1\DR1\Partition1: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {0BA068B3-D4F5-4B47-812F-525E0247E1FF}, Name: Untitled, StartLBA 0x64800, BlocksNum 0xAEA23000 13:33:03.0089 1328 MBR partitions: 13:33:03.0089 1328 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x64800, BlocksNum 0xAEA23000 13:33:03.0089 1328 ============================================================ 13:33:03.0105 1328 C: <-> \Device\Harddisk0\DR0\Partition1 13:33:03.0121 1328 E: <-> \Device\Harddisk1\DR1\Partition2 13:33:03.0121 1328 ============================================================ 13:33:03.0121 1328 Initialize success 13:33:03.0121 1328 ============================================================ 13:34:04.0866 4612 ============================================================ 13:34:04.0866 4612 Scan started 13:34:04.0866 4612 Mode: Manual; SigCheck; TDLFS; 13:34:04.0866 4612 ============================================================ 13:34:07.0122 4612 1394ohci (969c91060cbb5d17cb8440b5f78b4c51) C:\Windows\system32\DRIVERS\1394ohci.sys 13:34:07.0329 4612 1394ohci - ok 13:34:07.0372 4612 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys 13:34:07.0388 4612 ACPI - ok 13:34:07.0396 4612 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys 13:34:07.0527 4612 AcpiPmi - ok 13:34:07.0713 4612 AdobeActiveFileMonitor7.0 (3fd8dc2c9735c2aa70155102cfb93eda) C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe 13:34:07.0733 4612 AdobeActiveFileMonitor7.0 - ok 13:34:07.0951 4612 AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 13:34:07.0997 4612 AdobeFlashPlayerUpdateSvc - ok 13:34:08.0095 4612 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 13:34:08.0135 4612 adp94xx - ok 13:34:08.0181 4612 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 13:34:08.0203 4612 adpahci - ok 13:34:08.0224 4612 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 13:34:08.0242 4612 adpu320 - ok 13:34:08.0266 4612 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 13:34:08.0452 4612 AeLookupSvc - ok 13:34:08.0537 4612 AFD (db9d6c6b2cd95a9ca414d045b627422e) C:\Windows\system32\drivers\afd.sys 13:34:08.0668 4612 AFD - ok 13:34:08.0690 4612 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys 13:34:08.0730 4612 agp440 - ok 13:34:08.0745 4612 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 13:34:08.0855 4612 ALG - ok 13:34:08.0889 4612 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys 13:34:08.0900 4612 aliide - ok 13:34:08.0918 4612 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys 13:34:08.0928 4612 amdide - ok 13:34:08.0949 4612 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 13:34:09.0052 4612 AmdK8 - ok 13:34:09.0070 4612 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 13:34:09.0102 4612 AmdPPM - ok 13:34:09.0173 4612 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys 13:34:09.0220 4612 amdsata - ok 13:34:09.0257 4612 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 13:34:09.0274 4612 amdsbs - ok 13:34:09.0285 4612 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys 13:34:09.0317 4612 amdxata - ok 13:34:09.0348 4612 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys 13:34:09.0442 4612 AppID - ok 13:34:09.0463 4612 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 13:34:09.0523 4612 AppIDSvc - ok 13:34:09.0548 4612 Appinfo (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll 13:34:09.0609 4612 Appinfo - ok 13:34:09.0727 4612 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 13:34:09.0738 4612 Apple Mobile Device - ok 13:34:09.0844 4612 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll 13:34:09.0930 4612 AppMgmt - ok 13:34:09.0951 4612 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 13:34:09.0972 4612 arc - ok 13:34:10.0011 4612 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 13:34:10.0032 4612 arcsas - ok 13:34:10.0079 4612 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 13:34:10.0131 4612 AsyncMac - ok 13:34:10.0165 4612 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys 13:34:10.0175 4612 atapi - ok 13:34:10.0257 4612 AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll 13:34:10.0326 4612 AudioEndpointBuilder - ok 13:34:10.0331 4612 AudioSrv (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll 13:34:10.0368 4612 AudioSrv - ok 13:34:10.0413 4612 AxInstSV (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll 13:34:10.0533 4612 AxInstSV - ok 13:34:10.0579 4612 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 13:34:10.0667 4612 b06bdrv - ok 13:34:10.0700 4612 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 13:34:10.0742 4612 b57nd60a - ok 13:34:10.0795 4612 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 13:34:10.0889 4612 BDESVC - ok 13:34:10.0896 4612 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 13:34:10.0951 4612 Beep - ok 13:34:11.0024 4612 BFE (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll 13:34:11.0097 4612 BFE - ok 13:34:11.0358 4612 BHDrvx64 (5b1fe9d351c284701c8051da2aa81df6) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120531.001\BHDrvx64.sys 13:34:11.0463 4612 BHDrvx64 - ok 13:34:11.0653 4612 BITS (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\System32\qmgr.dll 13:34:11.0785 4612 BITS - ok 13:34:11.0855 4612 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 13:34:11.0886 4612 blbdrive - ok 13:34:11.0993 4612 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe 13:34:12.0013 4612 Bonjour Service - ok 13:34:12.0094 4612 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys 13:34:12.0182 4612 bowser - ok 13:34:12.0196 4612 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 13:34:12.0226 4612 BrFiltLo - ok 13:34:12.0257 4612 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 13:34:12.0271 4612 BrFiltUp - ok 13:34:12.0348 4612 Browser (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll 13:34:12.0407 4612 Browser - ok 13:34:12.0465 4612 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 13:34:12.0537 4612 Brserid - ok 13:34:12.0551 4612 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 13:34:12.0589 4612 BrSerWdm - ok 13:34:12.0616 4612 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 13:34:12.0656 4612 BrUsbMdm - ok 13:34:12.0676 4612 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 13:34:12.0707 4612 BrUsbSer - ok 13:34:12.0735 4612 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 13:34:12.0769 4612 BTHMODEM - ok 13:34:12.0803 4612 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 13:34:12.0902 4612 bthserv - ok 13:34:12.0945 4612 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 13:34:13.0006 4612 cdfs - ok 13:34:13.0053 4612 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys 13:34:13.0116 4612 cdrom - ok 13:34:13.0141 4612 CertPropSvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll 13:34:13.0202 4612 CertPropSvc - ok 13:34:13.0227 4612 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 13:34:13.0263 4612 circlass - ok 13:34:13.0309 4612 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 13:34:13.0362 4612 CLFS - ok 13:34:13.0433 4612 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 13:34:13.0490 4612 clr_optimization_v2.0.50727_32 - ok 13:34:13.0538 4612 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 13:34:13.0583 4612 clr_optimization_v2.0.50727_64 - ok 13:34:13.0640 4612 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 13:34:13.0684 4612 clr_optimization_v4.0.30319_32 - ok 13:34:13.0717 4612 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 13:34:13.0735 4612 clr_optimization_v4.0.30319_64 - ok 13:34:13.0760 4612 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 13:34:13.0790 4612 CmBatt - ok 13:34:13.0819 4612 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys 13:34:13.0830 4612 cmdide - ok 13:34:13.0911 4612 CNG (937beb186a735aca91d717044a49d17e) C:\Windows\system32\Drivers\cng.sys 13:34:13.0968 4612 CNG - ok 13:34:13.0979 4612 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 13:34:13.0990 4612 Compbatt - ok 13:34:14.0005 4612 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys 13:34:14.0036 4612 CompositeBus - ok 13:34:14.0060 4612 COMSysApp - ok 13:34:14.0070 4612 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 13:34:14.0081 4612 crcdisk - ok 13:34:14.0144 4612 CryptSvc (f02786b66375292e58c8777082d4396d) C:\Windows\system32\cryptsvc.dll 13:34:14.0201 4612 CryptSvc - ok 13:34:14.0270 4612 CSC (4a6173c2279b498cd8f57cae504564cb) C:\Windows\system32\drivers\csc.sys 13:34:14.0376 4612 CSC - ok 13:34:14.0455 4612 CscService (873fbf927c06e5cee04dec617502f8fd) C:\Windows\System32\cscsvc.dll 13:34:14.0516 4612 CscService - ok 13:34:14.0590 4612 DcomLaunch (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll 13:34:14.0651 4612 DcomLaunch - ok 13:34:14.0722 4612 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 13:34:14.0814 4612 defragsvc - ok 13:34:14.0909 4612 DfsC (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys 13:34:15.0025 4612 DfsC - ok 13:34:15.0067 4612 Dhcp (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll 13:34:15.0130 4612 Dhcp - ok 13:34:15.0150 4612 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 13:34:15.0203 4612 discache - ok 13:34:15.0238 4612 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 13:34:15.0250 4612 Disk - ok 13:34:15.0314 4612 Dnscache (85cf424c74a1d5ec33533e1dbff9920a) C:\Windows\System32\dnsrslvr.dll 13:34:15.0407 4612 Dnscache - ok 13:34:15.0473 4612 DockLoginService (0840abbbdf438691ee65a20040635cbe) C:\Program Files\Dell\DellDock\DockLogin.exe 13:34:15.0525 4612 DockLoginService ( UnsignedFile.Multi.Generic ) - warning 13:34:15.0525 4612 DockLoginService - detected UnsignedFile.Multi.Generic (1) 13:34:15.0568 4612 dot3svc (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll 13:34:15.0658 4612 dot3svc - ok 13:34:15.0688 4612 DPS (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll 13:34:15.0722 4612 DPS - ok 13:34:15.0750 4612 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 13:34:15.0793 4612 drmkaud - ok 13:34:15.0901 4612 DXGKrnl (24ce1ecf9d0ae0301775b07f5fea175b) C:\Windows\System32\drivers\dxgkrnl.sys 13:34:15.0983 4612 DXGKrnl - ok 13:34:16.0004 4612 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 13:34:16.0068 4612 EapHost - ok 13:34:16.0316 4612 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 13:34:16.0421 4612 ebdrv - ok 13:34:16.0542 4612 eeCtrl (ba6420c1f7070ed8f1ba372844f3e1ec) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys 13:34:16.0564 4612 eeCtrl - ok 13:34:16.0684 4612 EFS (156f6159457d0aa7e59b62681b56eb90) C:\Windows\System32\lsass.exe 13:34:16.0764 4612 EFS - ok 13:34:16.0885 4612 ehRecvr (47c071994c3f649f23d9cd075ac9304a) C:\Windows\ehome\ehRecvr.exe 13:34:17.0010 4612 ehRecvr - ok 13:34:17.0032 4612 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 13:34:17.0122 4612 ehSched - ok 13:34:17.0180 4612 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 13:34:17.0209 4612 elxstor - ok 13:34:17.0311 4612 EraserUtilRebootDrv (1343df3451bc0c442dc69837c6fba21b) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 13:34:17.0330 4612 EraserUtilRebootDrv - ok 13:34:17.0342 4612 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys 13:34:17.0376 4612 ErrDev - ok 13:34:17.0446 4612 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 13:34:17.0517 4612 EventSystem - ok 13:34:17.0558 4612 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 13:34:17.0613 4612 exfat - ok 13:34:17.0644 4612 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 13:34:17.0704 4612 fastfat - ok 13:34:17.0778 4612 Fax (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe 13:34:17.0884 4612 Fax - ok 13:34:17.0898 4612 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 13:34:17.0934 4612 fdc - ok 13:34:17.0959 4612 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 13:34:17.0993 4612 fdPHost - ok 13:34:18.0005 4612 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 13:34:18.0039 4612 FDResPub - ok 13:34:18.0097 4612 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 13:34:18.0112 4612 FileInfo - ok 13:34:18.0127 4612 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 13:34:18.0183 4612 Filetrace - ok 13:34:18.0308 4612 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 13:34:18.0410 4612 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning 13:34:18.0410 4612 FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1) 13:34:18.0430 4612 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 13:34:18.0465 4612 flpydisk - ok 13:34:18.0512 4612 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys 13:34:18.0533 4612 FltMgr - ok 13:34:18.0649 4612 FontCache (cb5e4b9c319e3c6bb363eb7e58a4a051) C:\Windows\system32\FntCache.dll 13:34:18.0741 4612 FontCache - ok 13:34:18.0815 4612 FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 13:34:18.0845 4612 FontCache3.0.0.0 - ok 13:34:18.0885 4612 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 13:34:18.0896 4612 FsDepends - ok 13:34:18.0942 4612 Fs_Rec (d3e3f93d67821a2db2b3d9fac2dc2064) C:\Windows\system32\drivers\Fs_Rec.sys 13:34:18.0973 4612 Fs_Rec - ok 13:34:19.0024 4612 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys 13:34:19.0085 4612 fvevol - ok 13:34:19.0100 4612 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 13:34:19.0111 4612 gagp30kx - ok 13:34:19.0152 4612 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 13:34:19.0161 4612 GEARAspiWDM - ok 13:34:19.0230 4612 GoToAssist (d3316f6e3c011435f36e3d6e49b3196c) C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe 13:34:19.0253 4612 GoToAssist - ok 13:34:19.0335 4612 gpsvc (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll 13:34:19.0385 4612 gpsvc - ok 13:34:19.0519 4612 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 13:34:19.0528 4612 gupdate - ok 13:34:19.0563 4612 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 13:34:19.0572 4612 gupdatem - ok 13:34:19.0585 4612 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 13:34:19.0647 4612 hcw85cir - ok 13:34:19.0684 4612 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys 13:34:19.0760 4612 HdAudAddService - ok 13:34:19.0815 4612 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys 13:34:19.0848 4612 HDAudBus - ok 13:34:19.0899 4612 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys 13:34:19.0925 4612 HECIx64 - ok 13:34:19.0951 4612 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 13:34:19.0997 4612 HidBatt - ok 13:34:20.0023 4612 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 13:34:20.0071 4612 HidBth - ok 13:34:20.0132 4612 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 13:34:20.0167 4612 HidIr - ok 13:34:20.0207 4612 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll 13:34:20.0256 4612 hidserv - ok 13:34:20.0282 4612 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys 13:34:20.0295 4612 HidUsb - ok 13:34:20.0309 4612 hkmsvc (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll 13:34:20.0374 4612 hkmsvc - ok 13:34:20.0421 4612 HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll 13:34:20.0521 4612 HomeGroupListener - ok 13:34:20.0565 4612 HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll 13:34:20.0578 4612 HomeGroupProvider - ok 13:34:20.0593 4612 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys 13:34:20.0641 4612 HpSAMD - ok 13:34:20.0704 4612 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys 13:34:20.0758 4612 HTTP - ok 13:34:20.0770 4612 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys 13:34:20.0781 4612 hwpolicy - ok 13:34:20.0806 4612 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys 13:34:20.0830 4612 i8042prt - ok 13:34:20.0914 4612 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys 13:34:20.0964 4612 iaStorV - ok 13:34:21.0077 4612 idsvc (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 13:34:21.0136 4612 idsvc - ok 13:34:21.0382 4612 IDSVia64 (4e9e0e5a3b0efeb27491c26be1d97fda) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120613.007\IDSvia64.sys 13:34:21.0428 4612 IDSVia64 - ok 13:34:22.0212 4612 igfx (09ce164afa8483e41808784d7fca154e) C:\Windows\system32\DRIVERS\igdkmd64.sys 13:34:22.0513 4612 igfx - ok 13:34:22.0631 4612 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 13:34:22.0642 4612 iirsp - ok 13:34:22.0717 4612 IKEEXT (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll 13:34:22.0784 4612 IKEEXT - ok 13:34:22.0811 4612 Impcd (dd587a55390ed2295bce6d36ad567da9) C:\Windows\system32\DRIVERS\Impcd.sys 13:34:22.0863 4612 Impcd - ok 13:34:23.0028 4612 IntcAzAudAddService (e9befd8c6a1db3b544b61647dda35f62) C:\Windows\system32\drivers\RTKVHD64.sys 13:34:23.0082 4612 IntcAzAudAddService - ok 13:34:23.0188 4612 IntcDAud (58cf58dee26c909bd6f977b61d246295) C:\Windows\system32\DRIVERS\IntcDAud.sys 13:34:23.0211 4612 IntcDAud - ok 13:34:23.0235 4612 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys 13:34:23.0245 4612 intelide - ok 13:34:23.0275 4612 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 13:34:23.0304 4612 intelppm - ok 13:34:23.0333 4612 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 13:34:23.0390 4612 IPBusEnum - ok 13:34:23.0421 4612 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys 13:34:23.0457 4612 IpFilterDriver - ok 13:34:23.0513 4612 iphlpsvc (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll 13:34:23.0577 4612 iphlpsvc - ok 13:34:23.0617 4612 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys 13:34:23.0630 4612 IPMIDRV - ok 13:34:23.0646 4612 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 13:34:23.0700 4612 IPNAT - ok 13:34:23.0844 4612 iPod Service (50d6ccc6ff5561f9f56946b3e6164fb8) C:\Program Files\iPod\bin\iPodService.exe 13:34:23.0878 4612 iPod Service - ok 13:34:23.0898 4612 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 13:34:23.0912 4612 IRENUM - ok 13:34:23.0926 4612 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys 13:34:23.0936 4612 isapnp - ok 13:34:23.0966 4612 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys 13:34:24.0018 4612 iScsiPrt - ok 13:34:24.0250 4612 k57nd60a (9d7ea8c7215d8d4ae7be110eee61085d) C:\Windows\system32\DRIVERS\k57nd60a.sys 13:34:24.0291 4612 k57nd60a - ok 13:34:24.0308 4612 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys 13:34:24.0334 4612 kbdclass - ok 13:34:24.0360 4612 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys 13:34:24.0388 4612 kbdhid - ok 13:34:24.0451 4612 KeyIso (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 13:34:24.0463 4612 KeyIso - ok 13:34:24.0517 4612 KSecDD (16c1b906fc5ead84769f90b736b6bf0e) C:\Windows\system32\Drivers\ksecdd.sys 13:34:24.0563 4612 KSecDD - ok 13:34:24.0587 4612 KSecPkg (0b711550c56444879d71c7daabda6c83) C:\Windows\system32\Drivers\ksecpkg.sys 13:34:24.0631 4612 KSecPkg - ok 13:34:24.0641 4612 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 13:34:24.0691 4612 ksthunk - ok 13:34:24.0739 4612 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 13:34:24.0834 4612 KtmRm - ok 13:34:24.0893 4612 LanmanServer (81f1d04d4d0e433099365127375fd501) C:\Windows\system32\srvsvc.dll 13:34:24.0969 4612 LanmanServer - ok 13:34:24.0997 4612 LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll 13:34:25.0060 4612 LanmanWorkstation - ok 13:34:25.0172 4612 LinksysUpdater (06dc2fdc6282f0d68910417b1150c848) C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe 13:34:25.0202 4612 LinksysUpdater ( UnsignedFile.Multi.Generic ) - warning 13:34:25.0203 4612 LinksysUpdater - detected UnsignedFile.Multi.Generic (1) 13:34:25.0235 4612 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 13:34:25.0269 4612 lltdio - ok 13:34:25.0308 4612 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 13:34:25.0400 4612 lltdsvc - ok 13:34:25.0438 4612 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 13:34:25.0471 4612 lmhosts - ok 13:34:25.0509 4612 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 13:34:25.0529 4612 LSI_FC - ok 13:34:25.0544 4612 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 13:34:25.0563 4612 LSI_SAS - ok 13:34:25.0577 4612 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 13:34:25.0588 4612 LSI_SAS2 - ok 13:34:25.0606 4612 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 13:34:25.0626 4612 LSI_SCSI - ok 13:34:25.0661 4612 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 13:34:25.0718 4612 luafv - ok 13:34:25.0815 4612 lvpopf64 (b2085e335f2b57077b0cbadb6f1245cd) C:\Windows\system32\DRIVERS\lvpopf64.sys 13:34:25.0841 4612 lvpopf64 - ok 13:34:25.0898 4612 LVPr2M64 (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys 13:34:25.0929 4612 LVPr2M64 - ok 13:34:25.0952 4612 LVPr2Mon (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys 13:34:25.0960 4612 LVPr2Mon - ok 13:34:26.0029 4612 LVRS64 (0c85b2b6fb74b36a251792d45e0ef860) C:\Windows\system32\DRIVERS\lvrs64.sys 13:34:26.0047 4612 LVRS64 - ok 13:34:26.0409 4612 LVUVC64 (ff3a488924b0032b1a9ca6948c1fa9e8) C:\Windows\system32\DRIVERS\lvuvc64.sys 13:34:26.0509 4612 LVUVC64 - ok 13:34:26.0608 4612 Mcx2Svc (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll 13:34:26.0678 4612 Mcx2Svc - ok 13:34:26.0724 4612 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 13:34:26.0737 4612 megasas - ok 13:34:26.0769 4612 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 13:34:26.0816 4612 MegaSR - ok 13:34:26.0842 4612 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 13:34:26.0894 4612 MMCSS - ok 13:34:26.0918 4612 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 13:34:26.0976 4612 Modem - ok 13:34:27.0049 4612 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 13:34:27.0084 4612 monitor - ok 13:34:27.0119 4612 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys 13:34:27.0131 4612 mouclass - ok 13:34:27.0152 4612 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 13:34:27.0165 4612 mouhid - ok 13:34:27.0191 4612 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys 13:34:27.0212 4612 mountmgr - ok 13:34:27.0325 4612 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 13:34:27.0345 4612 MozillaMaintenance - ok 13:34:27.0365 4612 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys 13:34:27.0384 4612 mpio - ok 13:34:27.0402 4612 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 13:34:27.0437 4612 mpsdrv - ok 13:34:27.0510 4612 MpsSvc (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll 13:34:27.0557 4612 MpsSvc - ok 13:34:27.0580 4612 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys 13:34:27.0621 4612 MRxDAV - ok 13:34:27.0688 4612 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys 13:34:27.0777 4612 mrxsmb - ok 13:34:27.0865 4612 mrxsmb10 (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys 13:34:27.0909 4612 mrxsmb10 - ok 13:34:27.0940 4612 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys 13:34:28.0017 4612 mrxsmb20 - ok 13:34:28.0054 4612 msahci (bccf16d5fb1109162380e3e28dc9e4e5) C:\Windows\system32\DRIVERS\msahci.sys 13:34:28.0064 4612 msahci - ok 13:34:28.0092 4612 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys 13:34:28.0111 4612 msdsm - ok 13:34:28.0135 4612 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 13:34:28.0156 4612 MSDTC - ok 13:34:28.0171 4612 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 13:34:28.0204 4612 Msfs - ok 13:34:28.0212 4612 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 13:34:28.0266 4612 mshidkmdf - ok 13:34:28.0293 4612 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys 13:34:28.0303 4612 msisadrv - ok 13:34:28.0339 4612 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 13:34:28.0433 4612 MSiSCSI - ok 13:34:28.0435 4612 msiserver - ok 13:34:28.0473 4612 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 13:34:28.0525 4612 MSKSSRV - ok 13:34:28.0550 4612 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 13:34:28.0584 4612 MSPCLOCK - ok 13:34:28.0591 4612 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 13:34:28.0642 4612 MSPQM - ok 13:34:28.0712 4612 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys 13:34:28.0732 4612 MsRPC - ok 13:34:28.0747 4612 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys 13:34:28.0757 4612 mssmbios - ok 13:34:28.0765 4612 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 13:34:28.0812 4612 MSTEE - ok 13:34:28.0833 4612 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 13:34:28.0861 4612 MTConfig - ok 13:34:28.0884 4612 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 13:34:28.0895 4612 Mup - ok 13:34:28.0948 4612 napagent (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll 13:34:29.0010 4612 napagent - ok 13:34:29.0051 4612 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 13:34:29.0119 4612 NativeWifiP - ok 13:34:29.0224 4612 NAVENG (8043d41f881d6ace40b854ad6e32217f) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120613.033\ENG64.SYS 13:34:29.0243 4612 NAVENG - ok 13:34:29.0530 4612 NAVEX15 (9a9ab2fc45d701daed465d14980f1305) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120613.033\EX64.SYS 13:34:29.0578 4612 NAVEX15 - ok 13:34:29.0769 4612 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys 13:34:29.0807 4612 NDIS - ok 13:34:29.0832 4612 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 13:34:29.0863 4612 NdisCap - ok 13:34:29.0913 4612 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 13:34:29.0966 4612 NdisTapi - ok 13:34:29.0992 4612 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys 13:34:30.0043 4612 Ndisuio - ok 13:34:30.0086 4612 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys 13:34:30.0128 4612 NdisWan - ok 13:34:30.0138 4612 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys 13:34:30.0172 4612 NDProxy - ok 13:34:30.0184 4612 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 13:34:30.0234 4612 NetBIOS - ok 13:34:30.0278 4612 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys 13:34:30.0338 4612 NetBT - ok 13:34:30.0400 4612 Netlogon (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 13:34:30.0413 4612 Netlogon - ok 13:34:30.0470 4612 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 13:34:30.0534 4612 Netman - ok 13:34:30.0586 4612 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 13:34:30.0650 4612 netprofm - ok 13:34:30.0730 4612 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 13:34:30.0749 4612 NetTcpPortSharing - ok 13:34:30.0760 4612 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 13:34:30.0772 4612 nfrd960 - ok 13:34:30.0916 4612 NIS (e78a365cc3e0fbfc018a33dce01909f8) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe 13:34:30.0927 4612 NIS - ok 13:34:30.0958 4612 NlaSvc (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll 13:34:31.0022 4612 NlaSvc - ok 13:34:31.0152 4612 nmservice (0f078c31e9123df22a49c54b26ce556a) C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe 13:34:31.0175 4612 nmservice - ok 13:34:31.0184 4612 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 13:34:31.0237 4612 Npfs - ok 13:34:31.0258 4612 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 13:34:31.0291 4612 nsi - ok 13:34:31.0303 4612 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 13:34:31.0334 4612 nsiproxy - ok 13:34:31.0489 4612 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys 13:34:31.0576 4612 Ntfs - ok 13:34:31.0662 4612 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 13:34:31.0694 4612 Null - ok 13:34:31.0735 4612 NVHDA (cddd4478757288df4bb1494bfd084259) C:\Windows\system32\drivers\nvhda64v.sys 13:34:31.0755 4612 NVHDA - ok 13:34:32.0475 4612 nvlddmkm (a5d0603cae6c334b1386204d94393c04) C:\Windows\system32\DRIVERS\nvlddmkm.sys 13:34:32.0742 4612 nvlddmkm - ok 13:34:32.0891 4612 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys 13:34:32.0911 4612 nvraid - ok 13:34:32.0974 4612 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys 13:34:33.0017 4612 nvstor - ok 13:34:33.0071 4612 nvsvc (268d382fcc6a8a568aab7c6dc8c71bb3) C:\Windows\system32\nvvsvc.exe 13:34:33.0096 4612 nvsvc - ok 13:34:33.0123 4612 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys 13:34:33.0142 4612 nv_agp - ok 13:34:33.0255 4612 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 13:34:33.0304 4612 odserv - ok 13:34:33.0333 4612 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys 13:34:33.0353 4612 ohci1394 - ok 13:34:33.0390 4612 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 13:34:33.0433 4612 ose - ok 13:34:33.0478 4612 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 13:34:33.0574 4612 p2pimsvc - ok 13:34:33.0622 4612 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 13:34:33.0645 4612 p2psvc - ok 13:34:33.0674 4612 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 13:34:33.0697 4612 Parport - ok 13:34:33.0758 4612 partmgr (90061b1acfe8ccaa5345750ffe08d8b8) C:\Windows\system32\drivers\partmgr.sys 13:34:33.0771 4612 partmgr - ok 13:34:33.0792 4612 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 13:34:33.0830 4612 PcaSvc - ok 13:34:33.0873 4612 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys 13:34:33.0891 4612 pci - ok 13:34:33.0904 4612 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys 13:34:33.0915 4612 pciide - ok 13:34:33.0943 4612 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 13:34:33.0996 4612 pcmcia - ok 13:34:34.0016 4612 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 13:34:34.0026 4612 pcw - ok 13:34:34.0072 4612 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 13:34:34.0121 4612 PEAUTH - ok 13:34:34.0246 4612 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll 13:34:34.0332 4612 PeerDistSvc - ok 13:34:34.0412 4612 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 13:34:34.0453 4612 PerfHost - ok 13:34:34.0631 4612 pla (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll 13:34:34.0750 4612 pla - ok 13:34:34.0844 4612 PlugPlay (98b1721b8718164293b9701b98c52d77) C:\Windows\system32\umpnpmgr.dll 13:34:34.0926 4612 PlugPlay - ok 13:34:34.0995 4612 pnarp (328b99e25901d314fdfb31f18a7e302e) C:\Windows\system32\DRIVERS\pnarp.sys 13:34:35.0004 4612 pnarp - ok 13:34:35.0013 4612 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 13:34:35.0047 4612 PNRPAutoReg - ok 13:34:35.0084 4612 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 13:34:35.0098 4612 PNRPsvc - ok 13:34:35.0141 4612 Point64 (4f0878fd62d5f7444c5f1c4c66d9d293) C:\Windows\system32\DRIVERS\point64.sys 13:34:35.0150 4612 Point64 - ok 13:34:35.0205 4612 PolicyAgent (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll 13:34:35.0262 4612 PolicyAgent - ok 13:34:35.0302 4612 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 13:34:35.0359 4612 Power - ok 13:34:35.0402 4612 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys 13:34:35.0500 4612 PptpMiniport - ok 13:34:35.0523 4612 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 13:34:35.0557 4612 Processor - ok 13:34:35.0621 4612 ProfSvc (97293447431311c06703368ad0f6c4be) C:\Windows\system32\profsvc.dll 13:34:35.0696 4612 ProfSvc - ok 13:34:35.0751 4612 ProtectedStorage (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 13:34:35.0764 4612 ProtectedStorage - ok 13:34:35.0803 4612 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys 13:34:35.0844 4612 Psched - ok 13:34:35.0891 4612 purendis (e33ae01d03ebe68cd6a934bf52702bfd) C:\Windows\system32\DRIVERS\purendis.sys 13:34:35.0918 4612 purendis - ok 13:34:35.0956 4612 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys 13:34:35.0988 4612 PxHlpa64 - ok 13:34:36.0123 4612 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 13:34:36.0165 4612 ql2300 - ok 13:34:36.0268 4612 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 13:34:36.0287 4612 ql40xx - ok 13:34:36.0325 4612 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 13:34:36.0387 4612 QWAVE - ok 13:34:36.0400 4612 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 13:34:36.0438 4612 QWAVEdrv - ok 13:34:36.0461 4612 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 13:34:36.0511 4612 RasAcd - ok 13:34:36.0547 4612 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 13:34:36.0581 4612 RasAgileVpn - ok 13:34:36.0595 4612 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 13:34:36.0689 4612 RasAuto - ok 13:34:36.0719 4612 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys 13:34:36.0783 4612 Rasl2tp - ok 13:34:36.0829 4612 RasMan (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll 13:34:36.0883 4612 RasMan - ok 13:34:36.0912 4612 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 13:34:36.0974 4612 RasPppoe - ok 13:34:37.0010 4612 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 13:34:37.0069 4612 RasSstp - ok 13:34:37.0118 4612 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys 13:34:37.0160 4612 rdbss - ok 13:34:37.0173 4612 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 13:34:37.0207 4612 rdpbus - ok 13:34:37.0238 4612 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 13:34:37.0271 4612 RDPCDD - ok 13:34:37.0302 4612 RDPDR (9706b84dbabfc4b4ca46c5a82b14dfa3) C:\Windows\system32\drivers\rdpdr.sys 13:34:37.0426 4612 RDPDR - ok 13:34:37.0438 4612 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 13:34:37.0490 4612 RDPENCDD - ok 13:34:37.0527 4612 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 13:34:37.0560 4612 RDPREFMP - ok 13:34:37.0614 4612 RDPWD (447de7e3dea39d422c1504f245b668b1) C:\Windows\system32\drivers\RDPWD.sys 13:34:37.0676 4612 RDPWD - ok 13:34:37.0701 4612 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys 13:34:37.0718 4612 rdyboost - ok 13:34:37.0739 4612 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 13:34:37.0799 4612 RemoteAccess - ok 13:34:37.0841 4612 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 13:34:37.0933 4612 RemoteRegistry - ok 13:34:37.0961 4612 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 13:34:38.0014 4612 RpcEptMapper - ok 13:34:38.0041 4612 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 13:34:38.0087 4612 RpcLocator - ok 13:34:38.0150 4612 RpcSs (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll 13:34:38.0187 4612 RpcSs - ok 13:34:38.0204 4612 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 13:34:38.0257 4612 rspndr - ok 13:34:38.0273 4612 SamSs (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 13:34:38.0285 4612 SamSs - ok 13:34:38.0318 4612 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys 13:34:38.0340 4612 sbp2port - ok 13:34:38.0364 4612 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 13:34:38.0456 4612 SCardSvr - ok 13:34:38.0477 4612 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys 13:34:38.0524 4612 scfilter - ok 13:34:38.0647 4612 Schedule (624d0f5ff99428bb90a5b8a4123e918e) C:\Windows\system32\schedsvc.dll 13:34:38.0730 4612 Schedule - ok 13:34:38.0751 4612 SCPolicySvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll 13:34:38.0783 4612 SCPolicySvc - ok 13:34:38.0805 4612 SDRSVC (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll 13:34:38.0946 4612 SDRSVC - ok 13:34:39.0047 4612 SeaPort (16a252022535b680046f6e34e136d378) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 13:34:39.0072 4612 SeaPort - ok 13:34:39.0113 4612 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 13:34:39.0166 4612 secdrv - ok 13:34:39.0186 4612 seclogon (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll 13:34:39.0242 4612 seclogon - ok 13:34:39.0277 4612 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll 13:34:39.0311 4612 SENS - ok 13:34:39.0321 4612 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 13:34:39.0378 4612 SensrSvc - ok 13:34:39.0391 4612 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 13:34:39.0404 4612 Serenum - ok 13:34:39.0430 4612 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 13:34:39.0467 4612 Serial - ok 13:34:39.0513 4612 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 13:34:39.0541 4612 sermouse - ok 13:34:39.0580 4612 SessionEnv (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll 13:34:39.0624 4612 SessionEnv - ok 13:34:39.0633 4612 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys 13:34:39.0719 4612 sffdisk - ok 13:34:39.0734 4612 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys 13:34:39.0766 4612 sffp_mmc - ok 13:34:39.0790 4612 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys 13:34:39.0804 4612 sffp_sd - ok 13:34:39.0831 4612 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 13:34:39.0844 4612 sfloppy - ok 13:34:39.0887 4612 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll 13:34:39.0927 4612 SharedAccess - ok 13:34:39.0959 4612 ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll 13:34:40.0000 4612 ShellHWDetection - ok 13:34:40.0021 4612 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 13:34:40.0032 4612 SiSRaid2 - ok 13:34:40.0049 4612 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 13:34:40.0060 4612 SiSRaid4 - ok 13:34:40.0158 4612 SkypeUpdate (db0405d9aad62f0762e0876ac142b7e1) C:\Program Files (x86)\Skype\Updater\Updater.exe 13:34:40.0209 4612 SkypeUpdate - ok 13:34:40.0235 4612 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 13:34:40.0293 4612 Smb - ok 13:34:40.0326 4612 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 13:34:40.0366 4612 SNMPTRAP - ok 13:34:40.0387 4612 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 13:34:40.0397 4612 spldr - ok 13:34:40.0451 4612 Spooler (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\Windows\System32\spoolsv.exe 13:34:40.0524 4612 Spooler - ok 13:34:40.0751 4612 sppsvc (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe 13:34:40.0830 4612 sppsvc - ok 13:34:40.0924 4612 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 13:34:40.0960 4612 sppuinotify - ok 13:34:41.0031 4612 sprtsvc_DellSupportCenter (d630b6f2e8379b6f10dc16e82a426552) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe 13:34:41.0045 4612 sprtsvc_DellSupportCenter - ok 13:34:41.0198 4612 SRTSP (90ef30c3867bcde4579c01a6d6e75a7a) C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS 13:34:41.0247 4612 SRTSP - ok 13:34:41.0264 4612 SRTSPX (c513e8a5e7978da49077f5484344ee1b) C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS 13:34:41.0291 4612 SRTSPX - ok 13:34:41.0362 4612 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys 13:34:41.0483 4612 srv - ok 13:34:41.0516 4612 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys 13:34:41.0559 4612 srv2 - ok 13:34:41.0608 4612 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys 13:34:41.0670 4612 srvnet - ok 13:34:41.0717 4612 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 13:34:41.0770 4612 SSDPSRV - ok 13:34:41.0795 4612 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 13:34:41.0851 4612 SstpSvc - ok 13:34:41.0887 4612 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 13:34:41.0898 4612 stexstor - ok 13:34:41.0955 4612 stisvc (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll 13:34:42.0037 4612 stisvc - ok 13:34:42.0087 4612 StorSvc (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll 13:34:42.0184 4612 StorSvc - ok 13:34:42.0192 4612 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys 13:34:42.0217 4612 swenum - ok 13:34:42.0366 4612 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 13:34:42.0443 4612 SwitchBoard ( UnsignedFile.Multi.Generic ) - warning 13:34:42.0443 4612 SwitchBoard - detected UnsignedFile.Multi.Generic (1) 13:34:42.0483 4612 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 13:34:42.0590 4612 swprv - ok 13:34:42.0697 4612 SymDS (6160145c7a87fc7672e8e3b886888176) C:\Windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS 13:34:42.0743 4612 SymDS - ok 13:34:42.0831 4612 SymEFA (96aeed40d4d3521568b42027687e69e0) C:\Windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS 13:34:42.0887 4612 SymEFA - ok 13:34:42.0956 4612 SymEvent (21a1c2d694c3cf962d31f5e873ab3d6f) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS 13:34:42.0971 4612 SymEvent - ok 13:34:43.0033 4612 SymIM (3aa3b2df451da88c38ab00b19fa3562e) C:\Windows\system32\DRIVERS\SymIMv.sys 13:34:43.0043 4612 SymIM - ok 13:34:43.0099 4612 SymIRON (bd0d711d8cbfcaa19ca123306eaf53a5) C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS 13:34:43.0139 4612 SymIRON - ok 13:34:43.0172 4612 SymNetS (a6adb3d83023f8daa0f7b6fda785d83b) C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS 13:34:43.0189 4612 SymNetS - ok 13:34:43.0320 4612 SysMain (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll 13:34:43.0382 4612 SysMain - ok 13:34:43.0481 4612 TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll 13:34:43.0522 4612 TabletInputService - ok 13:34:43.0565 4612 TapiSrv (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll 13:34:43.0661 4612 TapiSrv - ok 13:34:43.0687 4612 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 13:34:43.0739 4612 TBS - ok 13:34:43.0938 4612 Tcpip (624c5b3aa4c99b3184bb922d9ece3ff0) C:\Windows\system32\drivers\tcpip.sys 13:34:44.0030 4612 Tcpip - ok 13:34:44.0202 4612 TCPIP6 (624c5b3aa4c99b3184bb922d9ece3ff0) C:\Windows\system32\DRIVERS\tcpip.sys 13:34:44.0235 4612 TCPIP6 - ok 13:34:44.0298 4612 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys 13:34:44.0347 4612 tcpipreg - ok 13:34:44.0377 4612 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 13:34:44.0466 4612 TDPIPE - ok 13:34:44.0518 4612 TDTCP (7518f7bcfd4b308abc9192bacaf6c970) C:\Windows\system32\drivers\tdtcp.sys 13:34:44.0582 4612 TDTCP - ok 13:34:44.0597 4612 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys 13:34:44.0656 4612 tdx - ok 13:34:44.0686 4612 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys 13:34:44.0698 4612 TermDD - ok 13:34:44.0773 4612 TermService (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll 13:34:44.0840 4612 TermService - ok 13:34:44.0863 4612 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 13:34:44.0878 4612 Themes - ok 13:34:44.0916 4612 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 13:34:44.0950 4612 THREADORDER - ok 13:34:44.0972 4612 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 13:34:45.0036 4612 TrkWks - ok 13:34:45.0105 4612 TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe 13:34:45.0124 4612 TrustedInstaller - ok 13:34:45.0140 4612 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys 13:34:45.0195 4612 tssecsrv - ok 13:34:45.0242 4612 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys 13:34:45.0307 4612 tunnel - ok 13:34:45.0332 4612 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 13:34:45.0344 4612 uagp35 - ok 13:34:45.0381 4612 udfs (31ba4a33afab6a69ea092b18017f737f) C:\Windows\system32\DRIVERS\udfs.sys 13:34:45.0486 4612 udfs - ok 13:34:45.0503 4612 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 13:34:45.0536 4612 UI0Detect - ok 13:34:45.0558 4612 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys 13:34:45.0569 4612 uliagpkx - ok 13:34:45.0591 4612 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys 13:34:45.0628 4612 umbus - ok 13:34:45.0649 4612 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 13:34:45.0683 4612 UmPass - ok 13:34:45.0723 4612 UmRdpService (af0ac98ee5077eb844413eb54287fde3) C:\Windows\System32\umrdp.dll 13:34:45.0759 4612 UmRdpService - ok 13:34:45.0902 4612 UMVPFSrv (67a95b9d129ed5399e7965cd09cf30e7) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe 13:34:45.0925 4612 UMVPFSrv - ok 13:34:45.0960 4612 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 13:34:46.0010 4612 upnphost - ok 13:34:46.0062 4612 USBAAPL64 (fb251567f41bc61988b26731dec19e4b) C:\Windows\system32\Drivers\usbaapl64.sys 13:34:46.0124 4612 USBAAPL64 - ok 13:34:46.0155 4612 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys 13:34:46.0221 4612 usbaudio - ok 13:34:46.0266 4612 usbccgp (537a4e03d7103c12d42dfd8ffdb5bdc9) C:\Windows\system32\DRIVERS\usbccgp.sys 13:34:46.0373 4612 usbccgp - ok 13:34:46.0398 4612 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys 13:34:46.0442 4612 usbcir - ok 13:34:46.0485 4612 usbehci (fbb21ebe49f6d560db37ac25fbc68e66) C:\Windows\system32\drivers\usbehci.sys 13:34:46.0513 4612 usbehci - ok 13:34:46.0564 4612 usbhub (6b7a8a99c4a459e73c286a6763ea24cc) C:\Windows\system32\DRIVERS\usbhub.sys 13:34:46.0583 4612 usbhub - ok 13:34:46.0634 4612 usbohci (8c88aa7617b4cbc2e4bed61d26b33a27) C:\Windows\system32\drivers\usbohci.sys 13:34:46.0659 4612 usbohci - ok 13:34:46.0686 4612 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 13:34:46.0701 4612 usbprint - ok 13:34:46.0750 4612 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS 13:34:46.0836 4612 USBSTOR - ok 13:34:46.0883 4612 usbuhci (0b5b3b2df3fd1709618acfa50b8392b0) C:\Windows\system32\drivers\usbuhci.sys 13:34:46.0926 4612 usbuhci - ok 13:34:46.0966 4612 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\system32\Drivers\usbvideo.sys 13:34:47.0101 4612 usbvideo - ok 13:34:47.0122 4612 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 13:34:47.0156 4612 UxSms - ok 13:34:47.0200 4612 VaultSvc (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 13:34:47.0212 4612 VaultSvc - ok 13:34:47.0231 4612 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys 13:34:47.0242 4612 vdrvroot - ok 13:34:47.0286 4612 vds (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe 13:34:47.0314 4612 vds - ok 13:34:47.0326 4612 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 13:34:47.0340 4612 vga - ok 13:34:47.0343 4612 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 13:34:47.0391 4612 VgaSave - ok 13:34:47.0421 4612 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys 13:34:47.0473 4612 vhdmp - ok 13:34:47.0500 4612 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys 13:34:47.0511 4612 viaide - ok 13:34:47.0525 4612 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys 13:34:47.0539 4612 volmgr - ok 13:34:47.0566 4612 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys 13:34:47.0585 4612 volmgrx - ok 13:34:47.0616 4612 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys 13:34:47.0637 4612 volsnap - ok 13:34:47.0661 4612 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 13:34:47.0680 4612 vsmraid - ok 13:34:47.0790 4612 VSS (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe 13:34:47.0843 4612 VSS - ok 13:34:47.0964 4612 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys 13:34:47.0979 4612 vwifibus - ok 13:34:48.0024 4612 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 13:34:48.0070 4612 W32Time - ok 13:34:48.0083 4612 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 13:34:48.0112 4612 WacomPen - ok 13:34:48.0152 4612 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 13:34:48.0196 4612 WANARP - ok 13:34:48.0203 4612 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 13:34:48.0234 4612 Wanarpv6 - ok 13:34:48.0342 4612 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe 13:34:48.0415 4612 WatAdminSvc - ok 13:34:48.0522 4612 wbengine (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe 13:34:48.0645 4612 wbengine - ok 13:34:48.0746 4612 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 13:34:48.0776 4612 WbioSrvc - ok 13:34:48.0848 4612 wcncsvc (dd1bae8ebfc653824d29ccf8c9054d68) C:\Windows\System32\wcncsvc.dll 13:34:48.0924 4612 wcncsvc - ok 13:34:48.0934 4612 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 13:34:49.0031 4612 WcsPlugInService - ok 13:34:49.0061 4612 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 13:34:49.0072 4612 Wd - ok 13:34:49.0120 4612 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 13:34:49.0153 4612 Wdf01000 - ok 13:34:49.0167 4612 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 13:34:49.0209 4612 WdiServiceHost - ok 13:34:49.0211 4612 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 13:34:49.0228 4612 WdiSystemHost - ok 13:34:49.0286 4612 WebClient (733006127f235be7c35354ebee7b9a7b) C:\Windows\System32\webclnt.dll 13:34:49.0398 4612 WebClient - ok 13:34:49.0420 4612 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 13:34:49.0509 4612 Wecsvc - ok 13:34:49.0543 4612 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 13:34:49.0611 4612 wercplsupport - ok 13:34:49.0645 4612 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 13:34:49.0680 4612 WerSvc - ok 13:34:49.0699 4612 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 13:34:49.0731 4612 WfpLwf - ok 13:34:49.0742 4612 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 13:34:49.0753 4612 WIMMount - ok 13:34:49.0773 4612 WinDefend - ok 13:34:49.0777 4612 WinHttpAutoProxySvc - ok 13:34:49.0836 4612 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 13:34:49.0892 4612 Winmgmt - ok 13:34:50.0057 4612 WinRM (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll 13:34:50.0142 4612 WinRM - ok 13:34:50.0297 4612 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 13:34:50.0385 4612 Wlansvc - ok 13:34:50.0598 4612 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 13:34:50.0656 4612 wlidsvc - ok 13:34:50.0764 4612 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys 13:34:50.0777 4612 WmiAcpi - ok 13:34:50.0841 4612 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 13:34:50.0902 4612 wmiApSrv - ok 13:34:50.0925 4612 WMPNetworkSvc - ok 13:34:50.0950 4612 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 13:34:51.0025 4612 WPCSvc - ok 13:34:51.0042 4612 WPDBusEnum (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll 13:34:51.0144 4612 WPDBusEnum - ok 13:34:51.0150 4612 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 13:34:51.0204 4612 ws2ifsl - ok 13:34:51.0247 4612 wscsvc (8f9f3969933c02da96eb0f84576db43e) C:\Windows\System32\wscsvc.dll 13:34:51.0321 4612 wscsvc - ok 13:34:51.0323 4612 WSearch - ok 13:34:51.0477 4612 wuauserv (38340204a2d0228f1e87740fc5e554a7) C:\Windows\system32\wuaueng.dll 13:34:51.0556 4612 wuauserv - ok 13:34:51.0679 4612 WudfPf (c63907207b837a5c05cf6d1606aa0008) C:\Windows\system32\drivers\WudfPf.sys 13:34:51.0820 4612 WudfPf - ok 13:34:51.0853 4612 WUDFRd (d885a873d733020f8b9b9ff4b1666158) C:\Windows\system32\DRIVERS\WUDFRd.sys 13:34:51.0871 4612 WUDFRd - ok 13:34:51.0892 4612 wudfsvc (27b9bee5aac00139e3a3af5d6227a0dc) C:\Windows\System32\WUDFSvc.dll 13:34:51.0914 4612 wudfsvc - ok 13:34:51.0951 4612 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 13:34:52.0038 4612 WwanSvc - ok 13:34:52.0043 4612 MBR (0x1B8) (0f84f2562620c40d8a3e1908c8075675) \Device\Harddisk0\DR0 13:34:52.0059 4612 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected 13:34:52.0059 4612 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0) 13:34:52.0102 4612 \Device\Harddisk0\DR0 ( TDSS File System ) - warning 13:34:52.0102 4612 \Device\Harddisk0\DR0 - detected TDSS File System (1) 13:34:52.0105 4612 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1 13:34:52.0205 4612 \Device\Harddisk1\DR1 - ok 13:34:52.0235 4612 Boot (0x1200) (d76d9c6bb60fbcde09d9e770420ecc63) \Device\Harddisk0\DR0\Partition0 13:34:52.0237 4612 \Device\Harddisk0\DR0\Partition0 - ok 13:34:52.0245 4612 Boot (0x1200) (6172a6471c0a11e2d8e7097cc457a062) \Device\Harddisk0\DR0\Partition1 13:34:52.0246 4612 \Device\Harddisk0\DR0\Partition1 - ok 13:34:52.0249 4612 Boot (0x1200) (7d307b81c9f87f79db5eef5803d40bc8) \Device\Harddisk1\DR1\Partition0 13:34:52.0249 4612 \Device\Harddisk1\DR1\Partition0 - ok 13:34:52.0251 4612 Boot (0x1200) (9e5839d7e93b427d6cb75f1cf885968b) \Device\Harddisk1\DR1\Partition1 13:34:52.0253 4612 \Device\Harddisk1\DR1\Partition1 - ok 13:34:52.0255 4612 Boot (0x1200) (9e5839d7e93b427d6cb75f1cf885968b) \Device\Harddisk1\DR1\Partition2 13:34:52.0256 4612 \Device\Harddisk1\DR1\Partition2 - ok 13:34:52.0257 4612 ============================================================ 13:34:52.0257 4612 Scan finished 13:34:52.0257 4612 ============================================================ 13:34:52.0264 4864 Detected object count: 6 13:34:52.0264 4864 Actual detected object count: 6 13:36:57.0233 4864 DockLoginService ( UnsignedFile.Multi.Generic ) - skipped by user 13:36:57.0233 4864 DockLoginService ( UnsignedFile.Multi.Generic ) - User select action: Skip 13:36:57.0233 4864 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user 13:36:57.0233 4864 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 13:36:57.0234 4864 LinksysUpdater ( UnsignedFile.Multi.Generic ) - skipped by user 13:36:57.0234 4864 LinksysUpdater ( UnsignedFile.Multi.Generic ) - User select action: Skip 13:36:57.0235 4864 SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user 13:36:57.0235 4864 SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip 13:36:57.0880 4864 \Device\Harddisk0\DR0\# - copied to quarantine 13:36:57.0880 4864 \Device\Harddisk0\DR0 - copied to quarantine 13:36:57.0931 4864 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine 13:36:57.0933 4864 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine 13:36:57.0938 4864 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine 13:36:57.0943 4864 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine 13:36:57.0960 4864 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine 13:36:57.0971 4864 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine 13:36:57.0972 4864 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine 13:36:57.0974 4864 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine 13:36:57.0975 4864 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine 13:36:57.0978 4864 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine 13:36:57.0980 4864 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine 13:36:57.0982 4864 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine 13:36:57.0984 4864 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot 13:36:57.0984 4864 \Device\Harddisk0\DR0 - ok 13:36:58.0004 4864 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure 13:36:58.0004 4864 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user 13:36:58.0004 4864 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip 13:37:15.0831 4932 Deinitialize success

oldman960

Post #6June 14, 2012, 9:32 PM UTC

Hi

Let's make sure TDSSKiller did it's job, please rerun the tool the same way.

Next
Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Right click on ComboFix.exe, click Run as Administrator & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. If you recieve a message similar to "Illegal operation attempted on registry key that has been marked for deletion" after running combofix please reboot your computer.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log and a new HJT (hijackthis) log.

How's the computer?
Thanks

Glad your here!

Post #7June 15, 2012, 12:38 PM UTC

Morning, Machine doing well. Can't really say though since I have only been on it for this clean up. No complaints from my wife. Logs as requested. Thank you! 07:01:39.0349 3244 TDSS rootkit removing tool [removed] Jun 14 2012 08:11:46 07:01:39.0673 3244 ============================================================ 07:01:39.0673 3244 Current date / time: 2012/06/15 07:01:39.0673 07:01:39.0673 3244 SystemInfo: 07:01:39.0673 3244 07:01:39.0673 3244 OS Version: 6.1.7600 ServicePack: 0.0 07:01:39.0673 3244 Product type: Workstation 07:01:39.0674 3244 ComputerName: ADMIN-PC 07:01:39.0674 3244 UserName: Laura 07:01:39.0674 3244 Windows directory: C:\Windows 07:01:39.0674 3244 System windows directory: C:\Windows 07:01:39.0674 3244 Running under WOW64 07:01:39.0674 3244 Processor architecture: Intel x64 07:01:39.0674 3244 Number of processors: 4 07:01:39.0674 3244 Page size: 0x1000 07:01:39.0674 3244 Boot type: Normal boot 07:01:39.0674 3244 ============================================================ 07:01:41.0067 3244 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 07:01:41.0094 3244 Drive \Device\Harddisk1\DR1 - Size: 0x15D50F66000 (1397.27 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 07:01:41.0110 3244 ============================================================ 07:01:41.0110 3244 \Device\Harddisk0\DR0: 07:01:41.0110 3244 MBR partitions: 07:01:41.0110 3244 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1F800, BlocksNum 0x1139000 07:01:41.0110 3244 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1158800, BlocksNum 0x242D5800 07:01:41.0110 3244 \Device\Harddisk1\DR1: 07:01:41.0110 3244 GPT partitions: 07:01:41.0111 3244 \Device\Harddisk1\DR1\Partition0: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {FAD56864-183D-485B-9CF7-7DA49F9C7CDC}, Name: EFI System Partition, StartLBA 0x28, BlocksNum 0x64000 07:01:41.0111 3244 \Device\Harddisk1\DR1\Partition1: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {0BA068B3-D4F5-4B47-812F-525E0247E1FF}, Name: Untitled, StartLBA 0x64800, BlocksNum 0xAEA23000 07:01:41.0111 3244 MBR partitions: 07:01:41.0111 3244 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x64800, BlocksNum 0xAEA23000 07:01:41.0111 3244 ============================================================ 07:01:41.0132 3244 C: <-> \Device\Harddisk0\DR0\Partition1 07:01:41.0144 3244 E: <-> \Device\Harddisk1\DR1\Partition2 07:01:41.0144 3244 ============================================================ 07:01:41.0144 3244 Initialize success 07:01:41.0144 3244 ============================================================ 07:01:50.0734 2128 ============================================================ 07:01:50.0734 2128 Scan started 07:01:50.0734 2128 Mode: Manual; SigCheck; TDLFS; 07:01:50.0734 2128 ============================================================ 07:01:51.0537 2128 1394ohci (969c91060cbb5d17cb8440b5f78b4c51) C:\Windows\system32\DRIVERS\1394ohci.sys 07:01:51.0651 2128 1394ohci - ok 07:01:51.0693 2128 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys 07:01:51.0712 2128 ACPI - ok 07:01:51.0731 2128 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys 07:01:51.0770 2128 AcpiPmi - ok 07:01:51.0980 2128 AdobeActiveFileMonitor7.0 (3fd8dc2c9735c2aa70155102cfb93eda) C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe 07:01:52.0002 2128 AdobeActiveFileMonitor7.0 - ok 07:01:52.0217 2128 AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 07:01:52.0230 2128 AdobeFlashPlayerUpdateSvc - ok 07:01:52.0276 2128 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 07:01:52.0306 2128 adp94xx - ok 07:01:52.0348 2128 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 07:01:52.0372 2128 adpahci - ok 07:01:52.0391 2128 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 07:01:52.0411 2128 adpu320 - ok 07:01:52.0433 2128 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 07:01:52.0496 2128 AeLookupSvc - ok 07:01:52.0591 2128 AFD (db9d6c6b2cd95a9ca414d045b627422e) C:\Windows\system32\drivers\afd.sys 07:01:52.0645 2128 AFD - ok 07:01:52.0667 2128 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys 07:01:52.0678 2128 agp440 - ok 07:01:52.0695 2128 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 07:01:52.0755 2128 ALG - ok 07:01:52.0774 2128 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys 07:01:52.0785 2128 aliide - ok 07:01:52.0803 2128 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys 07:01:52.0814 2128 amdide - ok 07:01:52.0833 2128 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 07:01:52.0862 2128 AmdK8 - ok 07:01:52.0889 2128 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 07:01:52.0923 2128 AmdPPM - ok 07:01:52.0966 2128 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys 07:01:53.0022 2128 amdsata - ok 07:01:53.0056 2128 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 07:01:53.0076 2128 amdsbs - ok 07:01:53.0087 2128 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys 07:01:53.0097 2128 amdxata - ok 07:01:53.0116 2128 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys 07:01:53.0202 2128 AppID - ok 07:01:53.0215 2128 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 07:01:53.0267 2128 AppIDSvc - ok 07:01:53.0290 2128 Appinfo (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll 07:01:53.0310 2128 Appinfo - ok 07:01:53.0411 2128 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 07:01:53.0421 2128 Apple Mobile Device - ok 07:01:53.0485 2128 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll 07:01:53.0547 2128 AppMgmt - ok 07:01:53.0569 2128 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 07:01:53.0583 2128 arc - ok 07:01:53.0604 2128 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 07:01:53.0618 2128 arcsas - ok 07:01:53.0632 2128 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 07:01:53.0683 2128 AsyncMac - ok 07:01:53.0717 2128 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys 07:01:53.0726 2128 atapi - ok 07:01:53.0767 2128 AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll 07:01:53.0821 2128 AudioEndpointBuilder - ok 07:01:53.0825 2128 AudioSrv (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll 07:01:53.0861 2128 AudioSrv - ok 07:01:53.0915 2128 AxInstSV (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll 07:01:53.0979 2128 AxInstSV - ok 07:01:54.0020 2128 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 07:01:54.0111 2128 b06bdrv - ok 07:01:54.0151 2128 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 07:01:54.0187 2128 b57nd60a - ok 07:01:54.0231 2128 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 07:01:54.0256 2128 BDESVC - ok 07:01:54.0265 2128 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 07:01:54.0320 2128 Beep - ok 07:01:54.0394 2128 BFE (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll 07:01:54.0458 2128 BFE - ok 07:01:54.0721 2128 BHDrvx64 (5b1fe9d351c284701c8051da2aa81df6) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120531.001\BHDrvx64.sys 07:01:54.0747 2128 BHDrvx64 - ok 07:01:54.0870 2128 BITS (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\System32\qmgr.dll 07:01:54.0929 2128 BITS - ok 07:01:54.0983 2128 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 07:01:55.0012 2128 blbdrive - ok 07:01:55.0097 2128 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe 07:01:55.0116 2128 Bonjour Service - ok 07:01:55.0180 2128 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys 07:01:55.0230 2128 bowser - ok 07:01:55.0249 2128 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 07:01:55.0280 2128 BrFiltLo - ok 07:01:55.0302 2128 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 07:01:55.0316 2128 BrFiltUp - ok 07:01:55.0357 2128 Browser (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll 07:01:55.0409 2128 Browser - ok 07:01:55.0447 2128 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 07:01:55.0473 2128 Brserid - ok 07:01:55.0487 2128 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 07:01:55.0501 2128 BrSerWdm - ok 07:01:55.0511 2128 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 07:01:55.0541 2128 BrUsbMdm - ok 07:01:55.0571 2128 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 07:01:55.0602 2128 BrUsbSer - ok 07:01:55.0629 2128 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 07:01:55.0665 2128 BTHMODEM - ok 07:01:55.0698 2128 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 07:01:55.0754 2128 bthserv - ok 07:01:55.0906 2128 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 07:01:55.0942 2128 cdfs - ok 07:01:55.0997 2128 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys 07:01:56.0043 2128 cdrom - ok 07:01:56.0078 2128 CertPropSvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll 07:01:56.0131 2128 CertPropSvc - ok 07:01:56.0156 2128 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 07:01:56.0192 2128 circlass - ok 07:01:56.0233 2128 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 07:01:56.0249 2128 CLFS - ok 07:01:56.0318 2128 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 07:01:56.0331 2128 clr_optimization_v2.0.50727_32 - ok 07:01:56.0373 2128 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 07:01:56.0382 2128 clr_optimization_v2.0.50727_64 - ok 07:01:56.0434 2128 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 07:01:56.0444 2128 clr_optimization_v4.0.30319_32 - ok 07:01:56.0468 2128 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 07:01:56.0477 2128 clr_optimization_v4.0.30319_64 - ok 07:01:56.0505 2128 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 07:01:56.0535 2128 CmBatt - ok 07:01:56.0580 2128 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys 07:01:56.0592 2128 cmdide - ok 07:01:56.0667 2128 CNG (937beb186a735aca91d717044a49d17e) C:\Windows\system32\Drivers\cng.sys 07:01:56.0695 2128 CNG - ok 07:01:56.0707 2128 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 07:01:56.0717 2128 Compbatt - ok 07:01:56.0732 2128 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys 07:01:56.0764 2128 CompositeBus - ok 07:01:56.0766 2128 COMSysApp - ok 07:01:56.0789 2128 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 07:01:56.0800 2128 crcdisk - ok 07:01:56.0853 2128 CryptSvc (f02786b66375292e58c8777082d4396d) C:\Windows\system32\cryptsvc.dll 07:01:56.0906 2128 CryptSvc - ok 07:01:56.0965 2128 CSC (4a6173c2279b498cd8f57cae504564cb) C:\Windows\system32\drivers\csc.sys 07:01:57.0037 2128 CSC - ok 07:01:57.0099 2128 CscService (873fbf927c06e5cee04dec617502f8fd) C:\Windows\System32\cscsvc.dll 07:01:57.0136 2128 CscService - ok 07:01:57.0195 2128 DcomLaunch (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll 07:01:57.0254 2128 DcomLaunch - ok 07:01:57.0322 2128 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 07:01:57.0385 2128 defragsvc - ok 07:01:57.0486 2128 DfsC (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys 07:01:57.0544 2128 DfsC - ok 07:01:57.0584 2128 Dhcp (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll 07:01:57.0633 2128 Dhcp - ok 07:01:57.0653 2128 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 07:01:57.0707 2128 discache - ok 07:01:57.0750 2128 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 07:01:57.0760 2128 Disk - ok 07:01:57.0815 2128 Dnscache (85cf424c74a1d5ec33533e1dbff9920a) C:\Windows\System32\dnsrslvr.dll 07:01:57.0876 2128 Dnscache - ok 07:01:57.0941 2128 DockLoginService (0840abbbdf438691ee65a20040635cbe) C:\Program Files\Dell\DellDock\DockLogin.exe 07:01:57.0974 2128 DockLoginService ( UnsignedFile.Multi.Generic ) - warning 07:01:57.0974 2128 DockLoginService - detected UnsignedFile.Multi.Generic (1) 07:01:58.0018 2128 dot3svc (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll 07:01:58.0078 2128 dot3svc - ok 07:01:58.0107 2128 DPS (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll 07:01:58.0141 2128 DPS - ok 07:01:58.0170 2128 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 07:01:58.0204 2128 drmkaud - ok 07:01:58.0299 2128 DXGKrnl (24ce1ecf9d0ae0301775b07f5fea175b) C:\Windows\System32\drivers\dxgkrnl.sys 07:01:58.0322 2128 DXGKrnl - ok 07:01:58.0340 2128 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 07:01:58.0397 2128 EapHost - ok 07:01:58.0598 2128 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 07:01:58.0683 2128 ebdrv - ok 07:01:58.0799 2128 eeCtrl (ba6420c1f7070ed8f1ba372844f3e1ec) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys 07:01:58.0814 2128 eeCtrl - ok 07:01:58.0937 2128 EFS (156f6159457d0aa7e59b62681b56eb90) C:\Windows\System32\lsass.exe 07:01:58.0990 2128 EFS - ok 07:01:59.0096 2128 ehRecvr (47c071994c3f649f23d9cd075ac9304a) C:\Windows\ehome\ehRecvr.exe 07:01:59.0163 2128 ehRecvr - ok 07:01:59.0184 2128 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 07:01:59.0208 2128 ehSched - ok 07:01:59.0276 2128 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 07:01:59.0307 2128 elxstor - ok 07:01:59.0396 2128 EraserUtilRebootDrv (1343df3451bc0c442dc69837c6fba21b) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 07:01:59.0408 2128 EraserUtilRebootDrv - ok 07:01:59.0419 2128 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys 07:01:59.0454 2128 ErrDev - ok 07:01:59.0518 2128 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 07:01:59.0579 2128 EventSystem - ok 07:01:59.0625 2128 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 07:01:59.0681 2128 exfat - ok 07:01:59.0712 2128 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 07:01:59.0765 2128 fastfat - ok 07:01:59.0839 2128 Fax (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe 07:01:59.0921 2128 Fax - ok 07:01:59.0942 2128 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 07:01:59.0969 2128 fdc - ok 07:02:00.0003 2128 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 07:02:00.0037 2128 fdPHost - ok 07:02:00.0057 2128 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 07:02:00.0091 2128 FDResPub - ok 07:02:00.0106 2128 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 07:02:00.0116 2128 FileInfo - ok 07:02:00.0128 2128 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 07:02:00.0175 2128 Filetrace - ok 07:02:00.0286 2128 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 07:02:00.0321 2128 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning 07:02:00.0321 2128 FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1) 07:02:00.0341 2128 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 07:02:00.0353 2128 flpydisk - ok 07:02:00.0376 2128 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys 07:02:00.0390 2128 FltMgr - ok 07:02:00.0494 2128 FontCache (cb5e4b9c319e3c6bb363eb7e58a4a051) C:\Windows\system32\FntCache.dll 07:02:00.0569 2128 FontCache - ok 07:02:00.0634 2128 FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 07:02:00.0645 2128 FontCache3.0.0.0 - ok 07:02:00.0671 2128 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 07:02:00.0682 2128 FsDepends - ok 07:02:00.0737 2128 Fs_Rec (d3e3f93d67821a2db2b3d9fac2dc2064) C:\Windows\system32\drivers\Fs_Rec.sys 07:02:00.0748 2128 Fs_Rec - ok 07:02:00.0782 2128 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys 07:02:00.0796 2128 fvevol - ok 07:02:00.0818 2128 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 07:02:00.0830 2128 gagp30kx - ok 07:02:00.0879 2128 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 07:02:00.0902 2128 GEARAspiWDM - ok 07:02:01.0045 2128 GoToAssist (d3316f6e3c011435f36e3d6e49b3196c) C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe 07:02:01.0101 2128 GoToAssist - ok 07:02:01.0236 2128 gpsvc (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll 07:02:01.0278 2128 gpsvc - ok 07:02:01.0413 2128 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 07:02:01.0425 2128 gupdate - ok 07:02:01.0449 2128 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 07:02:01.0458 2128 gupdatem - ok 07:02:01.0471 2128 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 07:02:01.0524 2128 hcw85cir - ok 07:02:01.0558 2128 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys 07:02:01.0637 2128 HdAudAddService - ok 07:02:01.0679 2128 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys 07:02:01.0709 2128 HDAudBus - ok 07:02:01.0751 2128 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys 07:02:01.0760 2128 HECIx64 - ok 07:02:01.0770 2128 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 07:02:01.0800 2128 HidBatt - ok 07:02:01.0824 2128 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 07:02:01.0864 2128 HidBth - ok 07:02:01.0892 2128 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 07:02:01.0928 2128 HidIr - ok 07:02:01.0951 2128 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll 07:02:02.0001 2128 hidserv - ok 07:02:02.0034 2128 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys 07:02:02.0047 2128 HidUsb - ok 07:02:02.0068 2128 hkmsvc (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll 07:02:02.0118 2128 hkmsvc - ok 07:02:02.0161 2128 HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll 07:02:02.0181 2128 HomeGroupListener - ok 07:02:02.0215 2128 HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll 07:02:02.0228 2128 HomeGroupProvider - ok 07:02:02.0253 2128 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys 07:02:02.0264 2128 HpSAMD - ok 07:02:02.0312 2128 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys 07:02:02.0353 2128 HTTP - ok 07:02:02.0363 2128 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys 07:02:02.0373 2128 hwpolicy - ok 07:02:02.0390 2128 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys 07:02:02.0405 2128 i8042prt - ok 07:02:02.0478 2128 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys 07:02:02.0500 2128 iaStorV - ok 07:02:02.0593 2128 idsvc (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 07:02:02.0621 2128 idsvc - ok 07:02:02.0862 2128 IDSVia64 (4e9e0e5a3b0efeb27491c26be1d97fda) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120613.007\IDSvia64.sys 07:02:02.0875 2128 IDSVia64 - ok 07:02:03.0465 2128 igfx (09ce164afa8483e41808784d7fca154e) C:\Windows\system32\DRIVERS\igdkmd64.sys 07:02:03.0698 2128 igfx - ok 07:02:03.0800 2128 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 07:02:03.0811 2128 iirsp - ok 07:02:03.0875 2128 IKEEXT (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll 07:02:03.0934 2128 IKEEXT - ok 07:02:03.0978 2128 Impcd (dd587a55390ed2295bce6d36ad567da9) C:\Windows\system32\DRIVERS\Impcd.sys 07:02:04.0041 2128 Impcd - ok 07:02:04.0177 2128 IntcAzAudAddService (e9befd8c6a1db3b544b61647dda35f62) C:\Windows\system32\drivers\RTKVHD64.sys 07:02:04.0213 2128 IntcAzAudAddService - ok 07:02:04.0286 2128 IntcDAud (58cf58dee26c909bd6f977b61d246295) C:\Windows\system32\DRIVERS\IntcDAud.sys 07:02:04.0307 2128 IntcDAud - ok 07:02:04.0321 2128 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys 07:02:04.0331 2128 intelide - ok 07:02:04.0361 2128 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 07:02:04.0390 2128 intelppm - ok 07:02:04.0434 2128 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 07:02:04.0493 2128 IPBusEnum - ok 07:02:04.0514 2128 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys 07:02:04.0551 2128 IpFilterDriver - ok 07:02:04.0589 2128 iphlpsvc (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll 07:02:04.0627 2128 iphlpsvc - ok 07:02:04.0644 2128 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys 07:02:04.0655 2128 IPMIDRV - ok 07:02:04.0672 2128 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 07:02:04.0727 2128 IPNAT - ok 07:02:04.0842 2128 iPod Service (50d6ccc6ff5561f9f56946b3e6164fb8) C:\Program Files\iPod\bin\iPodService.exe 07:02:04.0869 2128 iPod Service - ok 07:02:04.0884 2128 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 07:02:04.0899 2128 IRENUM - ok 07:02:04.0912 2128 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys 07:02:04.0922 2128 isapnp - ok 07:02:04.0940 2128 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys 07:02:04.0959 2128 iScsiPrt - ok 07:02:05.0011 2128 k57nd60a (9d7ea8c7215d8d4ae7be110eee61085d) C:\Windows\system32\DRIVERS\k57nd60a.sys 07:02:05.0024 2128 k57nd60a - ok 07:02:05.0043 2128 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys 07:02:05.0053 2128 kbdclass - ok 07:02:05.0070 2128 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys 07:02:05.0099 2128 kbdhid - ok 07:02:05.0145 2128 KeyIso (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 07:02:05.0155 2128 KeyIso - ok 07:02:05.0210 2128 KSecDD (16c1b906fc5ead84769f90b736b6bf0e) C:\Windows\system32\Drivers\ksecdd.sys 07:02:05.0221 2128 KSecDD - ok 07:02:05.0238 2128 KSecPkg (0b711550c56444879d71c7daabda6c83) C:\Windows\system32\Drivers\ksecpkg.sys 07:02:05.0249 2128 KSecPkg - ok 07:02:05.0261 2128 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 07:02:05.0310 2128 ksthunk - ok 07:02:05.0361 2128 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 07:02:05.0429 2128 KtmRm - ok 07:02:05.0485 2128 LanmanServer (81f1d04d4d0e433099365127375fd501) C:\Windows\system32\srvsvc.dll 07:02:05.0558 2128 LanmanServer - ok 07:02:05.0581 2128 LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll 07:02:05.0638 2128 LanmanWorkstation - ok 07:02:05.0747 2128 LinksysUpdater (06dc2fdc6282f0d68910417b1150c848) C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe 07:02:05.0780 2128 LinksysUpdater ( UnsignedFile.Multi.Generic ) - warning 07:02:05.0780 2128 LinksysUpdater - detected UnsignedFile.Multi.Generic (1) 07:02:05.0812 2128 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 07:02:05.0846 2128 lltdio - ok 07:02:05.0882 2128 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 07:02:05.0944 2128 lltdsvc - ok 07:02:05.0973 2128 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 07:02:06.0025 2128 lmhosts - ok 07:02:06.0077 2128 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 07:02:06.0099 2128 LSI_FC - ok 07:02:06.0111 2128 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 07:02:06.0124 2128 LSI_SAS - ok 07:02:06.0137 2128 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 07:02:06.0148 2128 LSI_SAS2 - ok 07:02:06.0166 2128 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 07:02:06.0179 2128 LSI_SCSI - ok 07:02:06.0240 2128 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 07:02:06.0299 2128 luafv - ok 07:02:06.0387 2128 lvpopf64 (b2085e335f2b57077b0cbadb6f1245cd) C:\Windows\system32\DRIVERS\lvpopf64.sys 07:02:06.0410 2128 lvpopf64 - ok 07:02:06.0459 2128 LVPr2M64 (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys 07:02:06.0473 2128 LVPr2M64 - ok 07:02:06.0479 2128 LVPr2Mon (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys 07:02:06.0487 2128 LVPr2Mon - ok 07:02:06.0552 2128 LVRS64 (0c85b2b6fb74b36a251792d45e0ef860) C:\Windows\system32\DRIVERS\lvrs64.sys 07:02:06.0584 2128 LVRS64 - ok 07:02:06.0860 2128 LVUVC64 (ff3a488924b0032b1a9ca6948c1fa9e8) C:\Windows\system32\DRIVERS\lvuvc64.sys 07:02:06.0942 2128 LVUVC64 - ok 07:02:07.0059 2128 Mcx2Svc (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll 07:02:07.0132 2128 Mcx2Svc - ok 07:02:07.0176 2128 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 07:02:07.0187 2128 megasas - ok 07:02:07.0217 2128 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 07:02:07.0234 2128 MegaSR - ok 07:02:07.0260 2128 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 07:02:07.0313 2128 MMCSS - ok 07:02:07.0346 2128 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 07:02:07.0401 2128 Modem - ok 07:02:07.0476 2128 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 07:02:07.0511 2128 monitor - ok 07:02:07.0546 2128 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys 07:02:07.0557 2128 mouclass - ok 07:02:07.0587 2128 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 07:02:07.0599 2128 mouhid - ok 07:02:07.0617 2128 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys 07:02:07.0628 2128 mountmgr - ok 07:02:07.0734 2128 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 07:02:07.0756 2128 MozillaMaintenance - ok 07:02:07.0774 2128 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys 07:02:07.0795 2128 mpio - ok 07:02:07.0813 2128 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 07:02:07.0845 2128 mpsdrv - ok 07:02:07.0901 2128 MpsSvc (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll 07:02:07.0942 2128 MpsSvc - ok 07:02:07.0956 2128 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys 07:02:07.0999 2128 MRxDAV - ok 07:02:08.0049 2128 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys 07:02:08.0072 2128 mrxsmb - ok 07:02:08.0139 2128 mrxsmb10 (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys 07:02:08.0153 2128 mrxsmb10 - ok 07:02:08.0166 2128 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys 07:02:08.0194 2128 mrxsmb20 - ok 07:02:08.0222 2128 msahci (bccf16d5fb1109162380e3e28dc9e4e5) C:\Windows\system32\DRIVERS\msahci.sys 07:02:08.0233 2128 msahci - ok 07:02:08.0251 2128 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys 07:02:08.0271 2128 msdsm - ok 07:02:08.0294 2128 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 07:02:08.0317 2128 MSDTC - ok 07:02:08.0331 2128 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 07:02:08.0363 2128 Msfs - ok 07:02:08.0373 2128 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 07:02:08.0427 2128 mshidkmdf - ok 07:02:08.0454 2128 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys 07:02:08.0463 2128 msisadrv - ok 07:02:08.0498 2128 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 07:02:08.0540 2128 MSiSCSI - ok 07:02:08.0542 2128 msiserver - ok 07:02:08.0575 2128 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 07:02:08.0627 2128 MSKSSRV - ok 07:02:08.0653 2128 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 07:02:08.0686 2128 MSPCLOCK - ok 07:02:08.0694 2128 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 07:02:08.0725 2128 MSPQM - ok 07:02:08.0750 2128 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys 07:02:08.0764 2128 MsRPC - ok 07:02:08.0774 2128 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys 07:02:08.0783 2128 mssmbios - ok 07:02:08.0792 2128 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 07:02:08.0824 2128 MSTEE - ok 07:02:08.0836 2128 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 07:02:08.0863 2128 MTConfig - ok 07:02:08.0886 2128 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 07:02:08.0896 2128 Mup - ok 07:02:08.0941 2128 napagent (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll 07:02:08.0997 2128 napagent - ok 07:02:09.0034 2128 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 07:02:09.0071 2128 NativeWifiP - ok 07:02:09.0230 2128 NAVENG (8043d41f881d6ace40b854ad6e32217f) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120614.032\ENG64.SYS 07:02:09.0241 2128 NAVENG - ok 07:02:09.0371 2128 NAVEX15 (9a9ab2fc45d701daed465d14980f1305) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120614.032\EX64.SYS 07:02:09.0404 2128 NAVEX15 - ok 07:02:09.0554 2128 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys 07:02:09.0583 2128 NDIS - ok 07:02:09.0611 2128 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 07:02:09.0644 2128 NdisCap - ok 07:02:09.0682 2128 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 07:02:09.0735 2128 NdisTapi - ok 07:02:09.0777 2128 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys 07:02:09.0830 2128 Ndisuio - ok 07:02:09.0870 2128 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys 07:02:09.0914 2128 NdisWan - ok 07:02:09.0923 2128 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys 07:02:09.0955 2128 NDProxy - ok 07:02:09.0969 2128 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 07:02:10.0020 2128 NetBIOS - ok 07:02:10.0059 2128 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys 07:02:10.0108 2128 NetBT - ok 07:02:10.0153 2128 Netlogon (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 07:02:10.0163 2128 Netlogon - ok 07:02:10.0218 2128 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 07:02:10.0268 2128 Netman - ok 07:02:10.0318 2128 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 07:02:10.0377 2128 netprofm - ok 07:02:10.0448 2128 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 07:02:10.0468 2128 NetTcpPortSharing - ok 07:02:10.0496 2128 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 07:02:10.0507 2128 nfrd960 - ok 07:02:10.0642 2128 NIS (e78a365cc3e0fbfc018a33dce01909f8) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe 07:02:10.0653 2128 NIS - ok 07:02:10.0674 2128 NlaSvc (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll 07:02:10.0725 2128 NlaSvc - ok 07:02:10.0846 2128 nmservice (0f078c31e9123df22a49c54b26ce556a) C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe 07:02:10.0869 2128 nmservice - ok 07:02:10.0878 2128 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 07:02:10.0931 2128 Npfs - ok 07:02:10.0961 2128 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 07:02:10.0993 2128 nsi - ok 07:02:11.0004 2128 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 07:02:11.0035 2128 nsiproxy - ok 07:02:11.0170 2128 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys 07:02:11.0211 2128 Ntfs - ok 07:02:11.0290 2128 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 07:02:11.0323 2128 Null - ok 07:02:11.0361 2128 NVHDA (cddd4478757288df4bb1494bfd084259) C:\Windows\system32\drivers\nvhda64v.sys 07:02:11.0369 2128 NVHDA - ok 07:02:11.0939 2128 nvlddmkm (a5d0603cae6c334b1386204d94393c04) C:\Windows\system32\DRIVERS\nvlddmkm.sys 07:02:12.0089 2128 nvlddmkm - ok 07:02:12.0234 2128 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys 07:02:12.0256 2128 nvraid - ok 07:02:12.0309 2128 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys 07:02:12.0355 2128 nvstor - ok 07:02:12.0403 2128 nvsvc (268d382fcc6a8a568aab7c6dc8c71bb3) C:\Windows\system32\nvvsvc.exe 07:02:12.0416 2128 nvsvc - ok 07:02:12.0442 2128 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys 07:02:12.0463 2128 nv_agp - ok 07:02:12.0579 2128 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 07:02:12.0633 2128 odserv - ok 07:02:12.0660 2128 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys 07:02:12.0673 2128 ohci1394 - ok 07:02:12.0709 2128 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 07:02:12.0753 2128 ose - ok 07:02:12.0793 2128 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 07:02:12.0854 2128 p2pimsvc - ok 07:02:12.0895 2128 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 07:02:12.0910 2128 p2psvc - ok 07:02:12.0927 2128 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 07:02:12.0941 2128 Parport - ok 07:02:12.0996 2128 partmgr (90061b1acfe8ccaa5345750ffe08d8b8) C:\Windows\system32\drivers\partmgr.sys 07:02:13.0006 2128 partmgr - ok 07:02:13.0027 2128 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 07:02:13.0058 2128 PcaSvc - ok 07:02:13.0099 2128 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys 07:02:13.0110 2128 pci - ok 07:02:13.0124 2128 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys 07:02:13.0133 2128 pciide - ok 07:02:13.0153 2128 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 07:02:13.0173 2128 pcmcia - ok 07:02:13.0185 2128 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 07:02:13.0195 2128 pcw - ok 07:02:13.0229 2128 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 07:02:13.0273 2128 PEAUTH - ok 07:02:13.0380 2128 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll 07:02:13.0454 2128 PeerDistSvc - ok 07:02:13.0525 2128 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 07:02:13.0557 2128 PerfHost - ok 07:02:13.0717 2128 pla (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll 07:02:13.0796 2128 pla - ok 07:02:13.0857 2128 PlugPlay (98b1721b8718164293b9701b98c52d77) C:\Windows\system32\umpnpmgr.dll 07:02:13.0879 2128 PlugPlay - ok 07:02:13.0947 2128 pnarp (328b99e25901d314fdfb31f18a7e302e) C:\Windows\system32\DRIVERS\pnarp.sys 07:02:13.0956 2128 pnarp - ok 07:02:13.0966 2128 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 07:02:14.0000 2128 PNRPAutoReg - ok 07:02:14.0043 2128 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 07:02:14.0056 2128 PNRPsvc - ok 07:02:14.0101 2128 Point64 (4f0878fd62d5f7444c5f1c4c66d9d293) C:\Windows\system32\DRIVERS\point64.sys 07:02:14.0111 2128 Point64 - ok 07:02:14.0159 2128 PolicyAgent (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll 07:02:14.0215 2128 PolicyAgent - ok 07:02:14.0253 2128 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 07:02:14.0304 2128 Power - ok 07:02:14.0346 2128 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys 07:02:14.0400 2128 PptpMiniport - ok 07:02:14.0425 2128 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 07:02:14.0451 2128 Processor - ok 07:02:14.0505 2128 ProfSvc (97293447431311c06703368ad0f6c4be) C:\Windows\system32\profsvc.dll 07:02:14.0565 2128 ProfSvc - ok 07:02:14.0620 2128 ProtectedStorage (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 07:02:14.0633 2128 ProtectedStorage - ok 07:02:14.0662 2128 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys 07:02:14.0695 2128 Psched - ok 07:02:14.0752 2128 purendis (e33ae01d03ebe68cd6a934bf52702bfd) C:\Windows\system32\DRIVERS\purendis.sys 07:02:14.0778 2128 purendis - ok 07:02:14.0818 2128 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys 07:02:14.0827 2128 PxHlpa64 - ok 07:02:14.0938 2128 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 07:02:14.0984 2128 ql2300 - ok 07:02:15.0077 2128 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 07:02:15.0098 2128 ql40xx - ok 07:02:15.0132 2128 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 07:02:15.0155 2128 QWAVE - ok 07:02:15.0169 2128 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 07:02:15.0207 2128 QWAVEdrv - ok 07:02:15.0230 2128 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 07:02:15.0263 2128 RasAcd - ok 07:02:15.0290 2128 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 07:02:15.0323 2128 RasAgileVpn - ok 07:02:15.0337 2128 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 07:02:15.0391 2128 RasAuto - ok 07:02:15.0419 2128 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys 07:02:15.0483 2128 Rasl2tp - ok 07:02:15.0527 2128 RasMan (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll 07:02:15.0595 2128 RasMan - ok 07:02:15.0621 2128 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 07:02:15.0676 2128 RasPppoe - ok 07:02:15.0712 2128 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 07:02:15.0771 2128 RasSstp - ok 07:02:15.0809 2128 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys 07:02:15.0844 2128 rdbss - ok 07:02:15.0851 2128 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 07:02:15.0885 2128 rdpbus - ok 07:02:15.0907 2128 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 07:02:15.0937 2128 RDPCDD - ok 07:02:15.0970 2128 RDPDR (9706b84dbabfc4b4ca46c5a82b14dfa3) C:\Windows\system32\drivers\rdpdr.sys 07:02:16.0060 2128 RDPDR - ok 07:02:16.0074 2128 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 07:02:16.0125 2128 RDPENCDD - ok 07:02:16.0146 2128 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 07:02:16.0178 2128 RDPREFMP - ok 07:02:16.0233 2128 RDPWD (447de7e3dea39d422c1504f245b668b1) C:\Windows\system32\drivers\RDPWD.sys 07:02:16.0298 2128 RDPWD - ok 07:02:16.0318 2128 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys 07:02:16.0331 2128 rdyboost - ok 07:02:16.0349 2128 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 07:02:16.0385 2128 RemoteAccess - ok 07:02:16.0418 2128 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 07:02:16.0476 2128 RemoteRegistry - ok 07:02:16.0505 2128 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 07:02:16.0559 2128 RpcEptMapper - ok 07:02:16.0586 2128 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 07:02:16.0614 2128 RpcLocator - ok 07:02:16.0670 2128 RpcSs (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll 07:02:16.0708 2128 RpcSs - ok 07:02:16.0722 2128 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 07:02:16.0777 2128 rspndr - ok 07:02:16.0811 2128 SamSs (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 07:02:16.0822 2128 SamSs - ok 07:02:16.0837 2128 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys 07:02:16.0850 2128 sbp2port - ok 07:02:16.0873 2128 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 07:02:16.0932 2128 SCardSvr - ok 07:02:16.0954 2128 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys 07:02:17.0001 2128 scfilter - ok 07:02:17.0102 2128 Schedule (624d0f5ff99428bb90a5b8a4123e918e) C:\Windows\system32\schedsvc.dll 07:02:17.0167 2128 Schedule - ok 07:02:17.0185 2128 SCPolicySvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll 07:02:17.0216 2128 SCPolicySvc - ok 07:02:17.0238 2128 SDRSVC (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll 07:02:17.0265 2128 SDRSVC - ok 07:02:17.0372 2128 SeaPort (16a252022535b680046f6e34e136d378) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 07:02:17.0390 2128 SeaPort - ok 07:02:17.0432 2128 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 07:02:17.0484 2128 secdrv - ok 07:02:17.0506 2128 seclogon (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll 07:02:17.0561 2128 seclogon - ok 07:02:17.0588 2128 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll 07:02:17.0622 2128 SENS - ok 07:02:17.0632 2128 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 07:02:17.0683 2128 SensrSvc - ok 07:02:17.0693 2128 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 07:02:17.0706 2128 Serenum - ok 07:02:17.0724 2128 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 07:02:17.0760 2128 Serial - ok 07:02:17.0799 2128 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 07:02:17.0827 2128 sermouse - ok 07:02:17.0864 2128 SessionEnv (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll 07:02:17.0899 2128 SessionEnv - ok 07:02:17.0910 2128 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys 07:02:17.0962 2128 sffdisk - ok 07:02:17.0970 2128 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys 07:02:18.0003 2128 sffp_mmc - ok 07:02:18.0026 2128 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys 07:02:18.0038 2128 sffp_sd - ok 07:02:18.0049 2128 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 07:02:18.0062 2128 sfloppy - ok 07:02:18.0101 2128 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll 07:02:18.0144 2128 SharedAccess - ok 07:02:18.0167 2128 ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll 07:02:18.0186 2128 ShellHWDetection - ok 07:02:18.0198 2128 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 07:02:18.0209 2128 SiSRaid2 - ok 07:02:18.0225 2128 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 07:02:18.0236 2128 SiSRaid4 - ok 07:02:18.0334 2128 SkypeUpdate (db0405d9aad62f0762e0876ac142b7e1) C:\Program Files (x86)\Skype\Updater\Updater.exe 07:02:18.0345 2128 SkypeUpdate - ok 07:02:18.0370 2128 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 07:02:18.0406 2128 Smb - ok 07:02:18.0428 2128 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 07:02:18.0460 2128 SNMPTRAP - ok 07:02:18.0481 2128 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 07:02:18.0491 2128 spldr - ok 07:02:18.0539 2128 Spooler (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\Windows\System32\spoolsv.exe 07:02:18.0604 2128 Spooler - ok 07:02:18.0796 2128 sppsvc (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe 07:02:18.0863 2128 sppsvc - ok 07:02:18.0933 2128 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 07:02:18.0966 2128 sppuinotify - ok 07:02:19.0031 2128 sprtsvc_DellSupportCenter (d630b6f2e8379b6f10dc16e82a426552) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe 07:02:19.0040 2128 sprtsvc_DellSupportCenter - ok 07:02:19.0174 2128 SRTSP (90ef30c3867bcde4579c01a6d6e75a7a) C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS 07:02:19.0191 2128 SRTSP - ok 07:02:19.0208 2128 SRTSPX (c513e8a5e7978da49077f5484344ee1b) C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS 07:02:19.0215 2128 SRTSPX - ok 07:02:19.0291 2128 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys 07:02:19.0318 2128 srv - ok 07:02:19.0346 2128 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys 07:02:19.0377 2128 srv2 - ok 07:02:19.0424 2128 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys 07:02:19.0437 2128 srvnet - ok 07:02:19.0459 2128 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 07:02:19.0515 2128 SSDPSRV - ok 07:02:19.0547 2128 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 07:02:19.0582 2128 SstpSvc - ok 07:02:19.0598 2128 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 07:02:19.0608 2128 stexstor - ok 07:02:19.0658 2128 stisvc (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll 07:02:19.0707 2128 stisvc - ok 07:02:19.0757 2128 StorSvc (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll 07:02:19.0777 2128 StorSvc - ok 07:02:19.0786 2128 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys 07:02:19.0796 2128 swenum - ok 07:02:19.0936 2128 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 07:02:19.0952 2128 SwitchBoard ( UnsignedFile.Multi.Generic ) - warning 07:02:19.0952 2128 SwitchBoard - detected UnsignedFile.Multi.Generic (1) 07:02:19.0986 2128 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 07:02:20.0066 2128 swprv - ok 07:02:20.0194 2128 SymDS (6160145c7a87fc7672e8e3b886888176) C:\Windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS 07:02:20.0211 2128 SymDS - ok 07:02:20.0281 2128 SymEFA (96aeed40d4d3521568b42027687e69e0) C:\Windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS 07:02:20.0306 2128 SymEFA - ok 07:02:20.0381 2128 SymEvent (21a1c2d694c3cf962d31f5e873ab3d6f) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS 07:02:20.0391 2128 SymEvent - ok 07:02:20.0452 2128 SymIM (3aa3b2df451da88c38ab00b19fa3562e) C:\Windows\system32\DRIVERS\SymIMv.sys 07:02:20.0461 2128 SymIM - ok 07:02:20.0516 2128 SymIRON (bd0d711d8cbfcaa19ca123306eaf53a5) C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS 07:02:20.0526 2128 SymIRON - ok 07:02:20.0555 2128 SymNetS (a6adb3d83023f8daa0f7b6fda785d83b) C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS 07:02:20.0582 2128 SymNetS - ok 07:02:20.0692 2128 SysMain (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll 07:02:20.0738 2128 SysMain - ok 07:02:20.0816 2128 TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll 07:02:20.0850 2128 TabletInputService - ok 07:02:20.0889 2128 TapiSrv (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll 07:02:20.0956 2128 TapiSrv - ok 07:02:20.0981 2128 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 07:02:21.0015 2128 TBS - ok 07:02:21.0166 2128 Tcpip (624c5b3aa4c99b3184bb922d9ece3ff0) C:\Windows\system32\drivers\tcpip.sys 07:02:21.0200 2128 Tcpip - ok 07:02:21.0352 2128 TCPIP6 (624c5b3aa4c99b3184bb922d9ece3ff0) C:\Windows\system32\DRIVERS\tcpip.sys 07:02:21.0384 2128 TCPIP6 - ok 07:02:21.0434 2128 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys 07:02:21.0466 2128 tcpipreg - ok 07:02:21.0479 2128 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 07:02:21.0540 2128 TDPIPE - ok 07:02:21.0587 2128 TDTCP (7518f7bcfd4b308abc9192bacaf6c970) C:\Windows\system32\drivers\tdtcp.sys 07:02:21.0636 2128 TDTCP - ok 07:02:21.0648 2128 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys 07:02:21.0709 2128 tdx - ok 07:02:21.0731 2128 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys 07:02:21.0742 2128 TermDD - ok 07:02:21.0783 2128 TermService (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll 07:02:21.0826 2128 TermService - ok 07:02:21.0841 2128 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 07:02:21.0855 2128 Themes - ok 07:02:21.0876 2128 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 07:02:21.0907 2128 THREADORDER - ok 07:02:21.0922 2128 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 07:02:21.0954 2128 TrkWks - ok 07:02:21.0997 2128 TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe 07:02:22.0010 2128 TrustedInstaller - ok 07:02:22.0025 2128 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys 07:02:22.0081 2128 tssecsrv - ok 07:02:22.0135 2128 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys 07:02:22.0203 2128 tunnel - ok 07:02:22.0226 2128 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 07:02:22.0238 2128 uagp35 - ok 07:02:22.0271 2128 udfs (31ba4a33afab6a69ea092b18017f737f) C:\Windows\system32\DRIVERS\udfs.sys 07:02:22.0305 2128 udfs - ok 07:02:22.0322 2128 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 07:02:22.0335 2128 UI0Detect - ok 07:02:22.0351 2128 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys 07:02:22.0362 2128 uliagpkx - ok 07:02:22.0386 2128 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys 07:02:22.0414 2128 umbus - ok 07:02:22.0435 2128 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 07:02:22.0469 2128 UmPass - ok 07:02:22.0506 2128 UmRdpService (af0ac98ee5077eb844413eb54287fde3) C:\Windows\System32\umrdp.dll 07:02:22.0536 2128 UmRdpService - ok 07:02:22.0665 2128 UMVPFSrv (67a95b9d129ed5399e7965cd09cf30e7) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe 07:02:22.0686 2128 UMVPFSrv - ok 07:02:22.0717 2128 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 07:02:22.0755 2128 upnphost - ok 07:02:22.0805 2128 USBAAPL64 (fb251567f41bc61988b26731dec19e4b) C:\Windows\system32\Drivers\usbaapl64.sys 07:02:22.0853 2128 USBAAPL64 - ok 07:02:22.0890 2128 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys 07:02:22.0923 2128 usbaudio - ok 07:02:22.0967 2128 usbccgp (537a4e03d7103c12d42dfd8ffdb5bdc9) C:\Windows\system32\DRIVERS\usbccgp.sys 07:02:22.0982 2128 usbccgp - ok 07:02:23.0008 2128 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys 07:02:23.0053 2128 usbcir - ok 07:02:23.0096 2128 usbehci (fbb21ebe49f6d560db37ac25fbc68e66) C:\Windows\system32\drivers\usbehci.sys 07:02:23.0124 2128 usbehci - ok 07:02:23.0170 2128 usbhub (6b7a8a99c4a459e73c286a6763ea24cc) C:\Windows\system32\DRIVERS\usbhub.sys 07:02:23.0193 2128 usbhub - ok 07:02:23.0235 2128 usbohci (8c88aa7617b4cbc2e4bed61d26b33a27) C:\Windows\system32\drivers\usbohci.sys 07:02:23.0262 2128 usbohci - ok 07:02:23.0280 2128 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 07:02:23.0294 2128 usbprint - ok 07:02:23.0343 2128 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS 07:02:23.0377 2128 USBSTOR - ok 07:02:23.0419 2128 usbuhci (0b5b3b2df3fd1709618acfa50b8392b0) C:\Windows\system32\drivers\usbuhci.sys 07:02:23.0463 2128 usbuhci - ok 07:02:23.0508 2128 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\system32\Drivers\usbvideo.sys 07:02:23.0568 2128 usbvideo - ok 07:02:23.0591 2128 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 07:02:23.0625 2128 UxSms - ok 07:02:23.0678 2128 VaultSvc (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 07:02:23.0689 2128 VaultSvc - ok 07:02:23.0709 2128 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys 07:02:23.0718 2128 vdrvroot - ok 07:02:23.0756 2128 vds (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe 07:02:23.0784 2128 vds - ok 07:02:23.0795 2128 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 07:02:23.0810 2128 vga - ok 07:02:23.0820 2128 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 07:02:23.0869 2128 VgaSave - ok 07:02:23.0898 2128 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys 07:02:23.0917 2128 vhdmp - ok 07:02:23.0944 2128 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys 07:02:23.0954 2128 viaide - ok 07:02:23.0968 2128 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys 07:02:23.0978 2128 volmgr - ok 07:02:24.0005 2128 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys 07:02:24.0020 2128 volmgrx - ok 07:02:24.0040 2128 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys 07:02:24.0053 2128 volsnap - ok 07:02:24.0078 2128 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 07:02:24.0100 2128 vsmraid - ok 07:02:24.0190 2128 VSS (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe 07:02:24.0246 2128 VSS - ok 07:02:24.0341 2128 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys 07:02:24.0356 2128 vwifibus - ok 07:02:24.0397 2128 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 07:02:24.0435 2128 W32Time - ok 07:02:24.0452 2128 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 07:02:24.0481 2128 WacomPen - ok 07:02:24.0520 2128 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 07:02:24.0553 2128 WANARP - ok 07:02:24.0564 2128 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 07:02:24.0597 2128 Wanarpv6 - ok 07:02:24.0685 2128 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe 07:02:24.0725 2128 WatAdminSvc - ok 07:02:24.0809 2128 wbengine (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe 07:02:24.0882 2128 wbengine - ok 07:02:24.0971 2128 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 07:02:24.0994 2128 WbioSrvc - ok 07:02:25.0065 2128 wcncsvc (dd1bae8ebfc653824d29ccf8c9054d68) C:\Windows\System32\wcncsvc.dll 07:02:25.0136 2128 wcncsvc - ok 07:02:25.0145 2128 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 07:02:25.0201 2128 WcsPlugInService - ok 07:02:25.0230 2128 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 07:02:25.0241 2128 Wd - ok 07:02:25.0281 2128 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 07:02:25.0302 2128 Wdf01000 - ok 07:02:25.0319 2128 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 07:02:25.0353 2128 WdiServiceHost - ok 07:02:25.0356 2128 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 07:02:25.0373 2128 WdiSystemHost - ok 07:02:25.0427 2128 WebClient (733006127f235be7c35354ebee7b9a7b) C:\Windows\System32\webclnt.dll 07:02:25.0450 2128 WebClient - ok 07:02:25.0470 2128 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 07:02:25.0509 2128 Wecsvc - ok 07:02:25.0519 2128 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 07:02:25.0570 2128 wercplsupport - ok 07:02:25.0604 2128 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 07:02:25.0636 2128 WerSvc - ok 07:02:25.0660 2128 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 07:02:25.0692 2128 WfpLwf - ok 07:02:25.0703 2128 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 07:02:25.0713 2128 WIMMount - ok 07:02:25.0742 2128 WinDefend - ok 07:02:25.0746 2128 WinHttpAutoProxySvc - ok 07:02:25.0812 2128 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 07:02:25.0845 2128 Winmgmt - ok 07:02:25.0949 2128 WinRM (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll 07:02:26.0028 2128 WinRM - ok 07:02:26.0154 2128 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 07:02:26.0206 2128 Wlansvc - ok 07:02:26.0378 2128 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 07:02:26.0434 2128 wlidsvc - ok 07:02:26.0501 2128 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys 07:02:26.0513 2128 WmiAcpi - ok 07:02:26.0575 2128 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 07:02:26.0617 2128 wmiApSrv - ok 07:02:26.0645 2128 WMPNetworkSvc - ok 07:02:26.0669 2128 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 07:02:26.0694 2128 WPCSvc - ok 07:02:26.0710 2128 WPDBusEnum (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll 07:02:26.0746 2128 WPDBusEnum - ok 07:02:26.0778 2128 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 07:02:26.0832 2128 ws2ifsl - ok 07:02:26.0875 2128 wscsvc (8f9f3969933c02da96eb0f84576db43e) C:\Windows\System32\wscsvc.dll 07:02:26.0931 2128 wscsvc - ok 07:02:26.0933 2128 WSearch - ok 07:02:27.0064 2128 wuauserv (38340204a2d0228f1e87740fc5e554a7) C:\Windows\system32\wuaueng.dll 07:02:27.0162 2128 wuauserv - ok 07:02:27.0288 2128 WudfPf (c63907207b837a5c05cf6d1606aa0008) C:\Windows\system32\drivers\WudfPf.sys 07:02:27.0356 2128 WudfPf - ok 07:02:27.0387 2128 WUDFRd (d885a873d733020f8b9b9ff4b1666158) C:\Windows\system32\DRIVERS\WUDFRd.sys 07:02:27.0407 2128 WUDFRd - ok 07:02:27.0419 2128 wudfsvc (27b9bee5aac00139e3a3af5d6227a0dc) C:\Windows\System32\WUDFSvc.dll 07:02:27.0451 2128 wudfsvc - ok 07:02:27.0484 2128 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 07:02:27.0506 2128 WwanSvc - ok 07:02:27.0524 2128 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 07:02:27.0804 2128 \Device\Harddisk0\DR0 ( TDSS File System ) - warning 07:02:27.0804 2128 \Device\Harddisk0\DR0 - detected TDSS File System (1) 07:02:27.0806 2128 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1 07:02:27.0883 2128 \Device\Harddisk1\DR1 - ok 07:02:27.0885 2128 Boot (0x1200) (d76d9c6bb60fbcde09d9e770420ecc63) \Device\Harddisk0\DR0\Partition0 07:02:27.0886 2128 \Device\Harddisk0\DR0\Partition0 - ok 07:02:27.0914 2128 Boot (0x1200) (6172a6471c0a11e2d8e7097cc457a062) \Device\Harddisk0\DR0\Partition1 07:02:27.0916 2128 \Device\Harddisk0\DR0\Partition1 - ok 07:02:27.0918 2128 Boot (0x1200) (7d307b81c9f87f79db5eef5803d40bc8) \Device\Harddisk1\DR1\Partition0 07:02:27.0919 2128 \Device\Harddisk1\DR1\Partition0 - ok 07:02:27.0921 2128 Boot (0x1200) (9e5839d7e93b427d6cb75f1cf885968b) \Device\Harddisk1\DR1\Partition1 07:02:27.0923 2128 \Device\Harddisk1\DR1\Partition1 - ok 07:02:27.0925 2128 Boot (0x1200) (9e5839d7e93b427d6cb75f1cf885968b) \Device\Harddisk1\DR1\Partition2 07:02:27.0926 2128 \Device\Harddisk1\DR1\Partition2 - ok 07:02:27.0927 2128 ============================================================ 07:02:27.0927 2128 Scan finished 07:02:27.0927 2128 ============================================================ 07:02:27.0937 3292 Detected object count: 5 07:02:27.0937 3292 Actual detected object count: 5 07:02:33.0345 3292 DockLoginService ( UnsignedFile.Multi.Generic ) - skipped by user 07:02:33.0345 3292 DockLoginService ( UnsignedFile.Multi.Generic ) - User select action: Skip 07:02:33.0345 3292 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user 07:02:33.0345 3292 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 07:02:33.0346 3292 LinksysUpdater ( UnsignedFile.Multi.Generic ) - skipped by user 07:02:33.0346 3292 LinksysUpdater ( UnsignedFile.Multi.Generic ) - User select action: Skip 07:02:33.0347 3292 SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user 07:02:33.0347 3292 SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip 07:02:33.0348 3292 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user 07:02:33.0348 3292 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip 07:02:48.0436 1576 Deinitialize success ComboFix 12-06-15.02 - Laura 06/15/2012 7:12.1.4 - x64 Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.6007.4148 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\DailyBibleGuideEI c:\program files (x86)\DailyBibleGuideEI\Installr\2.bin\2vEIPlug.dll c:\program files (x86)\DailyBibleGuideEI\Installr\2.bin\NP2vEISb.dll c:\program files (x86)\FilmFanaticEI c:\program files (x86)\version.txt c:\users\Laura\AppData\Roaming\Microsoft\Windows\Recent\Thumbs.db c:\users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\searchplugins\bing-zugo.xml c:\users\Laura\g2mdlhlpx.exe c:\windows\svchost.exe . . ((((((((((((((((((((((((( Files Created from 2012-05-15 to 2012-06-15 ))))))))))))))))))))))))))))))) . . 2012-06-15 12:10 . 2012-06-15 12:10 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-06-15 12:10 . 2012-06-15 12:10 ——– d—–w- c:\users\admin\AppData\Local\temp 2012-06-14 17:36 . 2012-06-14 17:36 ——– d—–w- C:\TDSSKiller_Quarantine 2012-06-14 02:01 . 2012-06-14 02:01 ——– d—–w- c:\program files (x86)\Oracle 2012-06-14 02:01 . 2012-05-04 23:29 772504 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-06-13 00:16 . 2012-04-26 05:34 76288 —-a-w- c:\windows\system32\rdpwsx.dll 2012-06-13 00:16 . 2012-04-26 05:34 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-13 00:16 . 2012-04-26 05:28 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-13 00:16 . 2012-05-02 05:32 208896 —-a-w- c:\windows\system32\profsvc.dll 2012-06-13 00:16 . 2012-05-04 10:52 5505392 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-06-13 00:16 . 2012-05-04 10:08 3958128 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-06-13 00:16 . 2012-05-04 10:08 3902320 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-06-13 00:15 . 2012-05-15 01:32 3144192 —-a-w- c:\windows\system32\win32k.sys 2012-06-13 00:15 . 2012-04-28 03:50 204800 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-13 00:15 . 2012-04-07 12:18 3213824 —-a-w- c:\windows\system32\msi.dll 2012-06-13 00:15 . 2012-04-07 11:34 2342400 —-a-w- c:\windows\SysWow64\msi.dll 2012-06-13 00:15 . 2012-04-24 05:59 182272 —-a-w- c:\windows\system32\cryptsvc.dll 2012-06-13 00:15 . 2012-04-24 05:59 1460224 —-a-w- c:\windows\system32\crypt32.dll 2012-06-13 00:15 . 2012-04-24 05:59 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-06-13 00:15 . 2012-04-24 04:47 1156608 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-06-13 00:15 . 2012-04-24 04:47 139264 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-06-13 00:15 . 2012-04-24 04:47 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll 2012-06-11 23:28 . 2012-06-12 04:37 ——– d—–w- c:\windows\system32\drivers\NISx64\1207020.003 2012-06-09 02:20 . 2012-06-09 02:20 ——– d—–w- c:\users\admin\AppData\Local\Logitech® Webcam Software 2012-06-09 02:18 . 2012-06-09 02:18 ——– d—–w- c:\users\admin\AppData\Roaming\Malwarebytes 2012-06-09 00:57 . 2011-03-31 03:04 43640 —-a-r- c:\windows\system32\drivers\SymIMV.sys 2012-06-09 00:38 . 2012-06-09 00:38 ——– d—–w- c:\users\Laura\AppData\Roaming\Malwarebytes 2012-06-09 00:38 . 2012-06-09 00:38 ——– d—–w- c:\programdata\Malwarebytes 2012-06-09 00:38 . 2012-06-09 00:38 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-06-09 00:38 . 2012-04-04 19:56 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-05-24 15:07 . 2012-05-24 16:57 ——– d—–w- c:\users\Laura\.blurb 2012-05-24 15:06 . 2012-05-24 15:07 ——– d—–w- c:\program files (x86)\BookSmart 2012-05-23 22:24 . 2012-05-23 22:24 ——– d—–w- c:\users\Laura\AppData\Roaming\AVS4YOU 2012-05-23 22:23 . 2011-09-16 20:05 11137024 —-a-w- c:\windows\SysWow64\libmfxsw32.dll 2012-05-23 22:22 . 2012-05-23 22:23 ——– d—–w- c:\program files (x86)\Common Files\AVSMedia 2012-05-23 22:22 . 2012-05-23 22:24 ——– d—–w- c:\programdata\AVS4YOU 2012-05-23 22:22 . 2012-05-23 22:23 ——– d—–w- c:\program files (x86)\AVS4YOU 2012-05-23 22:22 . 2011-08-22 20:33 1700352 —-a-w- c:\windows\SysWow64\GdiPlus.dll 2012-05-23 22:22 . 2011-08-22 20:32 24576 —-a-w- c:\windows\SysWow64\msxml3a.dll 2012-05-21 19:59 . 2012-05-21 20:00 ——– d—–w- c:\program files\iTunes 2012-05-21 19:59 . 2012-05-21 19:59 ——– d—–w- c:\program files\iPod . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-08 09:29 . 2011-01-04 22:41 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll 2012-06-08 09:29 . 2010-12-09 23:58 4283672 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2012-06-08 09:28 . 2010-12-09 23:58 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2012-05-16 22:29 . 2010-12-09 23:58 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll 2012-05-16 22:29 . 2011-01-04 22:40 4283672 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2012-05-16 22:28 . 2011-01-04 22:40 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2012-05-05 17:09 . 2012-04-04 11:36 419488 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-05-05 17:09 . 2011-06-30 11:12 70304 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-05-05 17:09 . 2012-04-13 19:09 8744608 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-05-04 23:29 . 2010-09-30 15:25 687504 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-04-19 00:56 . 2012-04-19 00:56 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-04-19 00:56 . 2012-04-19 00:56 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts 2012-03-30 11:09 . 2012-05-10 01:40 1895280 —-a-w- c:\windows\system32\drivers\tcpip.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Octoshape Streaming Services"="c:\users\Laura\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-08 70936] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "ShwiconXP9106"="c:\program files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe" [2010-01-27 237568] "PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2010-01-07 140520] "Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160] "DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064] "LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336] "nmctxth"="c:\program files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-09-14 648488] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-23 402432] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736] . c:\users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384] . c:\users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384] Dropbox.lnk - c:\users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-30 136176] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-15 158856] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-30 136176] R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x] R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [x] R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-29 129976] R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS [x] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS [x] S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120531.001\BHDrvx64.sys [2012-04-02 1160824] S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120613.007\IDSvia64.sys [2012-06-13 488568] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [x] S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [x] S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-09-16 169312] S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648] S2 LinksysUpdater;Linksys Updater;c:\program files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-06-26 204800] S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [2011-04-17 130008] S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-05-31 138912] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x] S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x] S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x] S3 LVUVC64;Logitech Webcam 200(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-06-15 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 17:09] . 2012-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-30 14:26] . 2012-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-30 14:26] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 97792 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 97792 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 97792 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 97792 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-09 10060832] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-07 166424] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-07 391192] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-07 413720] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032] "Logitech Download Assistant"="c:\windows\system32\rundll32.exe" [2009-07-14 45568] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://search.babylon.com/?affID=109935&tt=050412_30b&babsrc=HP_ss&mntrId=225be37c000000000000842b2b9d5b14 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=109935&tt=050412_30b&babsrc=KW_ss&mntrId=225be37c000000000000842b2b9d5b14&q= FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109935&tt=050412_30b FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.id - 225be37c000000000000842b2b9d5b14 FF - user.js: extensions.BabylonToolbar_i.hardId - 225be37c000000000000842b2b9d5b14 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15440 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1716:12 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar_i.instlRef - sst . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-Spotify - c:\users\Laura\AppData\Roaming\Spotify\Spotify.exe SafeBoot-mcmscsvc SafeBoot-MCODS Toolbar-Locked - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\java.exe c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe c:\program files (x86)\Dell Support Center\bin\sprtsvc.exe . ************************************************************************** . Completion time: 2012-06-15 08:25:32 - machine was rebooted ComboFix-quarantined-files.txt 2012-06-15 12:25 . Pre-Run: 69,826,211,840 bytes free Post-Run: 87,350,607,872 bytes free . - - End Of File - - 91605AE27661DA913EABEBE8FFBAD2AA

oldman960

Post #8June 15, 2012, 7:53 PM UTC

Hi Glad your here!,

You have a questionable toolbar, BabylonToolbar. Do you actually use it?

Please rerun TDSSKiller.When presented with

13:34:52.0102 4612 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
13:34:52.0102 4612 \Device\Harddisk0\DR0 - detected TDSS File System (1)

Please use the dropdown menu and select delete.

Next

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

Click the Update tab
Click Check for Updates
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with

TDSSKiller log
MBAM log

Glad your here!

Post #9June 16, 2012, 10:02 AM UTC

Hi, Logs below. 05:44:45.0843 2776 TDSS rootkit removing tool [removed] Jun 15 2012 15:13:31 05:44:47.0844 2776 ============================================================ 05:44:47.0844 2776 Current date / time: 2012/06/16 05:44:47.0844 05:44:47.0844 2776 SystemInfo: 05:44:47.0845 2776 05:44:47.0845 2776 OS Version: 6.1.7600 ServicePack: 0.0 05:44:47.0845 2776 Product type: Workstation 05:44:47.0845 2776 ComputerName: ADMIN-PC 05:44:47.0845 2776 UserName: Laura 05:44:47.0845 2776 Windows directory: C:\Windows 05:44:47.0845 2776 System windows directory: C:\Windows 05:44:47.0845 2776 Running under WOW64 05:44:47.0845 2776 Processor architecture: Intel x64 05:44:47.0845 2776 Number of processors: 4 05:44:47.0845 2776 Page size: 0x1000 05:44:47.0845 2776 Boot type: Normal boot 05:44:47.0845 2776 ============================================================ 05:44:49.0039 2776 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 05:44:49.0061 2776 Drive \Device\Harddisk1\DR1 - Size: 0x15D50F66000 (1397.27 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 05:44:49.0078 2776 ============================================================ 05:44:49.0078 2776 \Device\Harddisk0\DR0: 05:44:49.0078 2776 MBR partitions: 05:44:49.0078 2776 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1F800, BlocksNum 0x1139000 05:44:49.0078 2776 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1158800, BlocksNum 0x242D5800 05:44:49.0078 2776 \Device\Harddisk1\DR1: 05:44:49.0078 2776 GPT partitions: 05:44:49.0079 2776 \Device\Harddisk1\DR1\Partition0: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {FAD56864-183D-485B-9CF7-7DA49F9C7CDC}, Name: EFI System Partition, StartLBA 0x28, BlocksNum 0x64000 05:44:49.0079 2776 \Device\Harddisk1\DR1\Partition1: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {0BA068B3-D4F5-4B47-812F-525E0247E1FF}, Name: Untitled, StartLBA 0x64800, BlocksNum 0xAEA23000 05:44:49.0079 2776 MBR partitions: 05:44:49.0079 2776 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x64800, BlocksNum 0xAEA23000 05:44:49.0079 2776 ============================================================ 05:44:49.0097 2776 C: <-> \Device\Harddisk0\DR0\Partition1 05:44:49.0119 2776 E: <-> \Device\Harddisk1\DR1\Partition2 05:44:49.0120 2776 ============================================================ 05:44:49.0120 2776 Initialize success 05:44:49.0120 2776 ============================================================ 05:44:56.0079 3988 ============================================================ 05:44:56.0079 3988 Scan started 05:44:56.0079 3988 Mode: Manual; SigCheck; TDLFS; 05:44:56.0079 3988 ============================================================ 05:44:58.0029 3988 1394ohci (969c91060cbb5d17cb8440b5f78b4c51) C:\Windows\system32\DRIVERS\1394ohci.sys 05:44:58.0137 3988 1394ohci - ok 05:44:58.0179 3988 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys 05:44:58.0195 3988 ACPI - ok 05:44:58.0205 3988 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys 05:44:58.0291 3988 AcpiPmi - ok 05:44:58.0467 3988 AdobeActiveFileMonitor7.0 (3fd8dc2c9735c2aa70155102cfb93eda) C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe 05:44:58.0479 3988 AdobeActiveFileMonitor7.0 - ok 05:44:58.0681 3988 AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 05:44:58.0706 3988 AdobeFlashPlayerUpdateSvc - ok 05:44:58.0793 3988 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 05:44:58.0819 3988 adp94xx - ok 05:44:58.0864 3988 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 05:44:58.0887 3988 adpahci - ok 05:44:58.0906 3988 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 05:44:58.0927 3988 adpu320 - ok 05:44:58.0957 3988 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 05:44:59.0113 3988 AeLookupSvc - ok 05:44:59.0193 3988 AFD (db9d6c6b2cd95a9ca414d045b627422e) C:\Windows\system32\drivers\afd.sys 05:44:59.0271 3988 AFD - ok 05:44:59.0299 3988 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys 05:44:59.0310 3988 agp440 - ok 05:44:59.0328 3988 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 05:44:59.0397 3988 ALG - ok 05:44:59.0423 3988 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys 05:44:59.0435 3988 aliide - ok 05:44:59.0460 3988 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys 05:44:59.0471 3988 amdide - ok 05:44:59.0491 3988 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 05:44:59.0561 3988 AmdK8 - ok 05:44:59.0578 3988 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 05:44:59.0611 3988 AmdPPM - ok 05:44:59.0655 3988 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys 05:44:59.0669 3988 amdsata - ok 05:44:59.0705 3988 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 05:44:59.0725 3988 amdsbs - ok 05:44:59.0735 3988 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys 05:44:59.0745 3988 amdxata - ok 05:44:59.0764 3988 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys 05:44:59.0853 3988 AppID - ok 05:44:59.0873 3988 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 05:44:59.0924 3988 AppIDSvc - ok 05:44:59.0948 3988 Appinfo (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll 05:45:00.0004 3988 Appinfo - ok 05:45:00.0321 3988 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 05:45:00.0333 3988 Apple Mobile Device - ok 05:45:00.0709 3988 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll 05:45:00.0864 3988 AppMgmt - ok 05:45:01.0001 3988 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 05:45:01.0015 3988 arc - ok 05:45:01.0045 3988 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 05:45:01.0076 3988 arcsas - ok 05:45:01.0100 3988 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 05:45:01.0158 3988 AsyncMac - ok 05:45:01.0202 3988 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys 05:45:01.0212 3988 atapi - ok 05:45:01.0729 3988 AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll 05:45:01.0821 3988 AudioEndpointBuilder - ok 05:45:01.0831 3988 AudioSrv (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll 05:45:01.0868 3988 AudioSrv - ok 05:45:01.0902 3988 AxInstSV (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll 05:45:01.0983 3988 AxInstSV - ok 05:45:02.0044 3988 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 05:45:02.0111 3988 b06bdrv - ok 05:45:02.0150 3988 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 05:45:02.0185 3988 b57nd60a - ok 05:45:02.0230 3988 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 05:45:02.0298 3988 BDESVC - ok 05:45:02.0306 3988 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 05:45:02.0361 3988 Beep - ok 05:45:02.0442 3988 BFE (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll 05:45:02.0523 3988 BFE - ok 05:45:02.0936 3988 BHDrvx64 (5b1fe9d351c284701c8051da2aa81df6) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120531.001\BHDrvx64.sys 05:45:02.0997 3988 BHDrvx64 - ok 05:45:03.0156 3988 BITS (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\system32\qmgr.dll 05:45:03.0227 3988 BITS - ok 05:45:03.0273 3988 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 05:45:03.0302 3988 blbdrive - ok 05:45:03.0388 3988 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe 05:45:03.0404 3988 Bonjour Service - ok 05:45:03.0444 3988 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys 05:45:03.0518 3988 bowser - ok 05:45:03.0530 3988 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 05:45:03.0561 3988 BrFiltLo - ok 05:45:03.0583 3988 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 05:45:03.0595 3988 BrFiltUp - ok 05:45:03.0612 3988 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys 05:45:03.0665 3988 BridgeMP - ok 05:45:03.0714 3988 Browser (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll 05:45:03.0772 3988 Browser - ok 05:45:03.0836 3988 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 05:45:03.0905 3988 Brserid - ok 05:45:03.0918 3988 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 05:45:03.0948 3988 BrSerWdm - ok 05:45:03.0967 3988 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 05:45:04.0007 3988 BrUsbMdm - ok 05:45:04.0027 3988 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 05:45:04.0058 3988 BrUsbSer - ok 05:45:04.0085 3988 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 05:45:04.0120 3988 BTHMODEM - ok 05:45:04.0144 3988 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 05:45:04.0192 3988 bthserv - ok 05:45:04.0219 3988 catchme - ok 05:45:04.0245 3988 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 05:45:04.0308 3988 cdfs - ok 05:45:04.0353 3988 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys 05:45:04.0376 3988 cdrom - ok 05:45:04.0401 3988 CertPropSvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll 05:45:04.0470 3988 CertPropSvc - ok 05:45:04.0520 3988 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 05:45:04.0556 3988 circlass - ok 05:45:04.0598 3988 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 05:45:04.0614 3988 CLFS - ok 05:45:04.0667 3988 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 05:45:04.0681 3988 clr_optimization_v2.0.50727_32 - ok 05:45:04.0721 3988 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 05:45:04.0767 3988 clr_optimization_v2.0.50727_64 - ok 05:45:04.0807 3988 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 05:45:04.0818 3988 clr_optimization_v4.0.30319_32 - ok 05:45:04.0850 3988 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 05:45:04.0860 3988 clr_optimization_v4.0.30319_64 - ok 05:45:04.0886 3988 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 05:45:04.0915 3988 CmBatt - ok 05:45:04.0953 3988 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys 05:45:04.0963 3988 cmdide - ok 05:45:05.0015 3988 CNG (937beb186a735aca91d717044a49d17e) C:\Windows\system32\Drivers\cng.sys 05:45:05.0058 3988 CNG - ok 05:45:05.0071 3988 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 05:45:05.0081 3988 Compbatt - ok 05:45:05.0105 3988 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys 05:45:05.0136 3988 CompositeBus - ok 05:45:05.0138 3988 COMSysApp - ok 05:45:05.0162 3988 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 05:45:05.0173 3988 crcdisk - ok 05:45:05.0218 3988 CryptSvc (f02786b66375292e58c8777082d4396d) C:\Windows\system32\cryptsvc.dll 05:45:05.0279 3988 CryptSvc - ok 05:45:05.0339 3988 CSC (4a6173c2279b498cd8f57cae504564cb) C:\Windows\system32\drivers\csc.sys 05:45:05.0410 3988 CSC - ok 05:45:05.0480 3988 CscService (873fbf927c06e5cee04dec617502f8fd) C:\Windows\System32\cscsvc.dll 05:45:05.0534 3988 CscService - ok 05:45:05.0594 3988 DcomLaunch (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll 05:45:05.0651 3988 DcomLaunch - ok 05:45:05.0720 3988 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 05:45:05.0781 3988 defragsvc - ok 05:45:05.0881 3988 DfsC (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys 05:45:05.0944 3988 DfsC - ok 05:45:05.0983 3988 Dhcp (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll 05:45:06.0072 3988 Dhcp - ok 05:45:06.0092 3988 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 05:45:06.0146 3988 discache - ok 05:45:06.0189 3988 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 05:45:06.0199 3988 Disk - ok 05:45:06.0274 3988 Dnscache (85cf424c74a1d5ec33533e1dbff9920a) C:\Windows\System32\dnsrslvr.dll 05:45:06.0357 3988 Dnscache - ok 05:45:06.0437 3988 DockLoginService (0840abbbdf438691ee65a20040635cbe) C:\Program Files\Dell\DellDock\DockLogin.exe 05:45:06.0480 3988 DockLoginService ( UnsignedFile.Multi.Generic ) - warning 05:45:06.0480 3988 DockLoginService - detected UnsignedFile.Multi.Generic (1) 05:45:06.0525 3988 dot3svc (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll 05:45:06.0602 3988 dot3svc - ok 05:45:06.0630 3988 DPS (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll 05:45:06.0665 3988 DPS - ok 05:45:06.0692 3988 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 05:45:06.0727 3988 drmkaud - ok 05:45:06.0849 3988 DXGKrnl (24ce1ecf9d0ae0301775b07f5fea175b) C:\Windows\System32\drivers\dxgkrnl.sys 05:45:06.0884 3988 DXGKrnl - ok 05:45:06.0897 3988 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 05:45:06.0962 3988 EapHost - ok 05:45:07.0847 3988 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 05:45:07.0957 3988 ebdrv - ok 05:45:08.0288 3988 eeCtrl (ba6420c1f7070ed8f1ba372844f3e1ec) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys 05:45:08.0307 3988 eeCtrl - ok 05:45:08.0436 3988 EFS (156f6159457d0aa7e59b62681b56eb90) C:\Windows\System32\lsass.exe 05:45:08.0488 3988 EFS - ok 05:45:08.0588 3988 ehRecvr (47c071994c3f649f23d9cd075ac9304a) C:\Windows\ehome\ehRecvr.exe 05:45:08.0651 3988 ehRecvr - ok 05:45:08.0674 3988 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 05:45:08.0732 3988 ehSched - ok 05:45:09.0212 3988 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 05:45:09.0238 3988 elxstor - ok 05:45:09.0331 3988 EraserUtilRebootDrv (1343df3451bc0c442dc69837c6fba21b) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 05:45:09.0350 3988 EraserUtilRebootDrv - ok 05:45:09.0368 3988 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys 05:45:09.0401 3988 ErrDev - ok 05:45:09.0474 3988 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 05:45:09.0536 3988 EventSystem - ok 05:45:09.0574 3988 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 05:45:09.0630 3988 exfat - ok 05:45:09.0730 3988 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 05:45:09.0793 3988 fastfat - ok 05:45:09.0854 3988 Fax (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe 05:45:09.0930 3988 Fax - ok 05:45:09.0939 3988 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 05:45:09.0967 3988 fdc - ok 05:45:09.0993 3988 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 05:45:10.0027 3988 fdPHost - ok 05:45:10.0038 3988 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 05:45:10.0070 3988 FDResPub - ok 05:45:10.0079 3988 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 05:45:10.0090 3988 FileInfo - ok 05:45:10.0102 3988 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 05:45:10.0150 3988 Filetrace - ok 05:45:10.0310 3988 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 05:45:10.0378 3988 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning 05:45:10.0378 3988 FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1) 05:45:10.0397 3988 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 05:45:10.0411 3988 flpydisk - ok 05:45:10.0435 3988 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys 05:45:10.0449 3988 FltMgr - ok 05:45:10.0544 3988 FontCache (cb5e4b9c319e3c6bb363eb7e58a4a051) C:\Windows\system32\FntCache.dll 05:45:10.0635 3988 FontCache - ok 05:45:10.0690 3988 FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 05:45:10.0720 3988 FontCache3.0.0.0 - ok 05:45:10.0761 3988 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 05:45:10.0784 3988 FsDepends - ok 05:45:10.0819 3988 Fs_Rec (d3e3f93d67821a2db2b3d9fac2dc2064) C:\Windows\system32\drivers\Fs_Rec.sys 05:45:10.0830 3988 Fs_Rec - ok 05:45:10.0862 3988 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys 05:45:10.0876 3988 fvevol - ok 05:45:10.0900 3988 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 05:45:10.0911 3988 gagp30kx - ok 05:45:10.0945 3988 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 05:45:10.0953 3988 GEARAspiWDM - ok 05:45:11.0014 3988 GoToAssist (d3316f6e3c011435f36e3d6e49b3196c) C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe 05:45:11.0023 3988 GoToAssist - ok 05:45:11.0099 3988 gpsvc (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll 05:45:11.0160 3988 gpsvc - ok 05:45:11.0253 3988 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 05:45:11.0264 3988 gupdate - ok 05:45:11.0280 3988 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 05:45:11.0289 3988 gupdatem - ok 05:45:11.0303 3988 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 05:45:11.0365 3988 hcw85cir - ok 05:45:11.0399 3988 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys 05:45:11.0443 3988 HdAudAddService - ok 05:45:11.0477 3988 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys 05:45:11.0508 3988 HDAudBus - ok 05:45:11.0550 3988 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys 05:45:11.0577 3988 HECIx64 - ok 05:45:11.0602 3988 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 05:45:11.0631 3988 HidBatt - ok 05:45:11.0656 3988 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 05:45:11.0697 3988 HidBth - ok 05:45:11.0724 3988 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 05:45:11.0759 3988 HidIr - ok 05:45:11.0783 3988 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\System32\hidserv.dll 05:45:11.0832 3988 hidserv - ok 05:45:11.0866 3988 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys 05:45:11.0878 3988 HidUsb - ok 05:45:11.0901 3988 hkmsvc (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll 05:45:11.0957 3988 hkmsvc - ok 05:45:12.0064 3988 HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll 05:45:12.0130 3988 HomeGroupListener - ok 05:45:12.0156 3988 HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll 05:45:12.0175 3988 HomeGroupProvider - ok 05:45:12.0202 3988 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys 05:45:12.0213 3988 HpSAMD - ok 05:45:12.0278 3988 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys 05:45:12.0319 3988 HTTP - ok 05:45:12.0329 3988 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys 05:45:12.0338 3988 hwpolicy - ok 05:45:12.0356 3988 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys 05:45:12.0371 3988 i8042prt - ok 05:45:12.0448 3988 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys 05:45:12.0498 3988 iaStorV - ok 05:45:12.0692 3988 idsvc (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 05:45:12.0720 3988 idsvc - ok 05:45:12.0879 3988 IDSVia64 (4e9e0e5a3b0efeb27491c26be1d97fda) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120613.007\IDSvia64.sys 05:45:12.0905 3988 IDSVia64 - ok 05:45:13.0891 3988 igfx (09ce164afa8483e41808784d7fca154e) C:\Windows\system32\DRIVERS\igdkmd64.sys 05:45:14.0146 3988 igfx - ok 05:45:14.0256 3988 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 05:45:14.0268 3988 iirsp - ok 05:45:14.0340 3988 IKEEXT (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll 05:45:14.0408 3988 IKEEXT - ok 05:45:14.0452 3988 Impcd (dd587a55390ed2295bce6d36ad567da9) C:\Windows\system32\DRIVERS\Impcd.sys 05:45:14.0506 3988 Impcd - ok 05:45:14.0657 3988 IntcAzAudAddService (e9befd8c6a1db3b544b61647dda35f62) C:\Windows\system32\drivers\RTKVHD64.sys 05:45:14.0734 3988 IntcAzAudAddService - ok 05:45:14.0826 3988 IntcDAud (58cf58dee26c909bd6f977b61d246295) C:\Windows\system32\DRIVERS\IntcDAud.sys 05:45:14.0847 3988 IntcDAud - ok 05:45:14.0861 3988 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys 05:45:14.0870 3988 intelide - ok 05:45:14.0900 3988 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 05:45:14.0931 3988 intelppm - ok 05:45:14.0975 3988 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 05:45:15.0032 3988 IPBusEnum - ok 05:45:15.0055 3988 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys 05:45:15.0091 3988 IpFilterDriver - ok 05:45:15.0130 3988 iphlpsvc (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll 05:45:15.0194 3988 iphlpsvc - ok 05:45:15.0219 3988 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys 05:45:15.0232 3988 IPMIDRV - ok 05:45:15.0256 3988 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 05:45:15.0319 3988 IPNAT - ok 05:45:15.0441 3988 iPod Service (50d6ccc6ff5561f9f56946b3e6164fb8) C:\Program Files\iPod\bin\iPodService.exe 05:45:15.0469 3988 iPod Service - ok 05:45:15.0483 3988 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 05:45:15.0498 3988 IRENUM - ok 05:45:15.0510 3988 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys 05:45:15.0520 3988 isapnp - ok 05:45:15.0540 3988 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys 05:45:15.0559 3988 iScsiPrt - ok 05:45:15.0610 3988 k57nd60a (9d7ea8c7215d8d4ae7be110eee61085d) C:\Windows\system32\DRIVERS\k57nd60a.sys 05:45:15.0633 3988 k57nd60a - ok 05:45:15.0700 3988 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys 05:45:15.0711 3988 kbdclass - ok 05:45:15.0727 3988 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys 05:45:15.0755 3988 kbdhid - ok 05:45:15.0793 3988 KeyIso (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 05:45:15.0805 3988 KeyIso - ok 05:45:15.0832 3988 KSecDD (16c1b906fc5ead84769f90b736b6bf0e) C:\Windows\system32\Drivers\ksecdd.sys 05:45:15.0843 3988 KSecDD - ok 05:45:15.0861 3988 KSecPkg (0b711550c56444879d71c7daabda6c83) C:\Windows\system32\Drivers\ksecpkg.sys 05:45:15.0872 3988 KSecPkg - ok 05:45:15.0884 3988 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 05:45:15.0933 3988 ksthunk - ok 05:45:15.0976 3988 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 05:45:16.0034 3988 KtmRm - ok 05:45:16.0205 3988 LanmanServer (81f1d04d4d0e433099365127375fd501) C:\Windows\System32\srvsvc.dll 05:45:16.0261 3988 LanmanServer - ok 05:45:16.0288 3988 LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll 05:45:16.0353 3988 LanmanWorkstation - ok 05:45:16.0494 3988 LinksysUpdater (06dc2fdc6282f0d68910417b1150c848) C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe 05:45:16.0528 3988 LinksysUpdater ( UnsignedFile.Multi.Generic ) - warning 05:45:16.0528 3988 LinksysUpdater - detected UnsignedFile.Multi.Generic (1) 05:45:16.0560 3988 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 05:45:16.0594 3988 lltdio - ok 05:45:16.0637 3988 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 05:45:16.0727 3988 lltdsvc - ok 05:45:16.0755 3988 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 05:45:16.0788 3988 lmhosts - ok 05:45:16.0825 3988 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 05:45:16.0839 3988 LSI_FC - ok 05:45:16.0851 3988 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 05:45:16.0864 3988 LSI_SAS - ok 05:45:16.0877 3988 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 05:45:16.0888 3988 LSI_SAS2 - ok 05:45:16.0906 3988 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 05:45:16.0928 3988 LSI_SCSI - ok 05:45:16.0962 3988 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 05:45:17.0011 3988 luafv - ok 05:45:17.0078 3988 lvpopf64 (b2085e335f2b57077b0cbadb6f1245cd) C:\Windows\system32\DRIVERS\lvpopf64.sys 05:45:17.0102 3988 lvpopf64 - ok 05:45:17.0137 3988 LVPr2M64 (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys 05:45:17.0147 3988 LVPr2M64 - ok 05:45:17.0153 3988 LVPr2Mon (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys 05:45:17.0161 3988 LVPr2Mon - ok 05:45:17.0214 3988 LVRS64 (0c85b2b6fb74b36a251792d45e0ef860) C:\Windows\system32\DRIVERS\lvrs64.sys 05:45:17.0231 3988 LVRS64 - ok 05:45:17.0848 3988 LVUVC64 (ff3a488924b0032b1a9ca6948c1fa9e8) C:\Windows\system32\DRIVERS\lvuvc64.sys 05:45:17.0961 3988 LVUVC64 - ok 05:45:18.0171 3988 Mcx2Svc (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll 05:45:18.0213 3988 Mcx2Svc - ok 05:45:18.0258 3988 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 05:45:18.0269 3988 megasas - ok 05:45:18.0313 3988 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 05:45:18.0328 3988 MegaSR - ok 05:45:18.0400 3988 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 05:45:18.0455 3988 MMCSS - ok 05:45:18.0492 3988 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 05:45:18.0552 3988 Modem - ok 05:45:18.0636 3988 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 05:45:18.0704 3988 monitor - ok 05:45:18.0833 3988 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys 05:45:18.0845 3988 mouclass - ok 05:45:18.0878 3988 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 05:45:18.0890 3988 mouhid - ok 05:45:18.0916 3988 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys 05:45:18.0927 3988 mountmgr - ok 05:45:19.0032 3988 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 05:45:19.0046 3988 MozillaMaintenance - ok 05:45:19.0064 3988 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys 05:45:19.0085 3988 mpio - ok 05:45:19.0102 3988 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 05:45:19.0134 3988 mpsdrv - ok 05:45:19.0192 3988 MpsSvc (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll 05:45:19.0242 3988 MpsSvc - ok 05:45:19.0311 3988 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys 05:45:19.0347 3988 MRxDAV - ok 05:45:19.0418 3988 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys 05:45:19.0472 3988 mrxsmb - ok 05:45:19.0548 3988 mrxsmb10 (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys 05:45:19.0563 3988 mrxsmb10 - ok 05:45:19.0581 3988 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys 05:45:19.0608 3988 mrxsmb20 - ok 05:45:19.0646 3988 msahci (bccf16d5fb1109162380e3e28dc9e4e5) C:\Windows\system32\DRIVERS\msahci.sys 05:45:19.0657 3988 msahci - ok 05:45:19.0788 3988 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys 05:45:19.0803 3988 msdsm - ok 05:45:19.0826 3988 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 05:45:19.0848 3988 MSDTC - ok 05:45:19.0863 3988 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 05:45:19.0896 3988 Msfs - ok 05:45:19.0913 3988 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 05:45:19.0966 3988 mshidkmdf - ok 05:45:20.0005 3988 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys 05:45:20.0014 3988 msisadrv - ok 05:45:20.0056 3988 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 05:45:20.0116 3988 MSiSCSI - ok 05:45:20.0118 3988 msiserver - ok 05:45:20.0157 3988 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 05:45:20.0209 3988 MSKSSRV - ok 05:45:20.0226 3988 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 05:45:20.0259 3988 MSPCLOCK - ok 05:45:20.0267 3988 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 05:45:20.0318 3988 MSPQM - ok 05:45:20.0385 3988 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys 05:45:20.0402 3988 MsRPC - ok 05:45:20.0414 3988 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys 05:45:20.0426 3988 mssmbios - ok 05:45:20.0441 3988 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 05:45:20.0487 3988 MSTEE - ok 05:45:20.0523 3988 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 05:45:20.0555 3988 MTConfig - ok 05:45:20.0576 3988 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 05:45:20.0587 3988 Mup - ok 05:45:20.0642 3988 napagent (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll 05:45:20.0729 3988 napagent - ok 05:45:20.0775 3988 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 05:45:20.0818 3988 NativeWifiP - ok 05:45:21.0008 3988 NAVENG (8043d41f881d6ace40b854ad6e32217f) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120614.032\ENG64.SYS 05:45:21.0020 3988 NAVENG - ok 05:45:21.0345 3988 NAVEX15 (9a9ab2fc45d701daed465d14980f1305) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120614.032\EX64.SYS 05:45:21.0422 3988 NAVEX15 - ok 05:45:21.0626 3988 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys 05:45:21.0656 3988 NDIS - ok 05:45:21.0717 3988 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 05:45:21.0752 3988 NdisCap - ok 05:45:21.0771 3988 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 05:45:21.0824 3988 NdisTapi - ok 05:45:21.0859 3988 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys 05:45:21.0911 3988 Ndisuio - ok 05:45:21.0944 3988 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys 05:45:21.0985 3988 NdisWan - ok 05:45:21.0995 3988 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys 05:45:22.0027 3988 NDProxy - ok 05:45:22.0045 3988 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 05:45:22.0093 3988 NetBIOS - ok 05:45:22.0126 3988 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys 05:45:22.0181 3988 NetBT - ok 05:45:22.0235 3988 Netlogon (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 05:45:22.0247 3988 Netlogon - ok 05:45:22.0299 3988 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 05:45:22.0360 3988 Netman - ok 05:45:22.0415 3988 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 05:45:22.0493 3988 netprofm - ok 05:45:22.0649 3988 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 05:45:22.0667 3988 NetTcpPortSharing - ok 05:45:22.0744 3988 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 05:45:22.0756 3988 nfrd960 - ok 05:45:22.0858 3988 NIS (e78a365cc3e0fbfc018a33dce01909f8) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe 05:45:22.0868 3988 NIS - ok 05:45:22.0897 3988 NlaSvc (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll 05:45:22.0965 3988 NlaSvc - ok 05:45:23.0138 3988 nmservice (0f078c31e9123df22a49c54b26ce556a) C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe 05:45:23.0168 3988 nmservice - ok 05:45:23.0192 3988 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 05:45:23.0246 3988 Npfs - ok 05:45:23.0267 3988 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 05:45:23.0299 3988 nsi - ok 05:45:23.0311 3988 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 05:45:23.0342 3988 nsiproxy - ok 05:45:23.0462 3988 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys 05:45:23.0508 3988 Ntfs - ok 05:45:24.0272 3988 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 05:45:24.0320 3988 Null - ok 05:45:24.0361 3988 NVHDA (cddd4478757288df4bb1494bfd084259) C:\Windows\system32\drivers\nvhda64v.sys 05:45:24.0373 3988 NVHDA - ok 05:45:26.0049 3988 nvlddmkm (a5d0603cae6c334b1386204d94393c04) C:\Windows\system32\DRIVERS\nvlddmkm.sys 05:45:26.0315 3988 nvlddmkm - ok 05:45:26.0465 3988 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys 05:45:26.0477 3988 nvraid - ok 05:45:26.0524 3988 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys 05:45:26.0569 3988 nvstor - ok 05:45:26.0633 3988 nvsvc (268d382fcc6a8a568aab7c6dc8c71bb3) C:\Windows\system32\nvvsvc.exe 05:45:26.0656 3988 nvsvc - ok 05:45:26.0774 3988 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys 05:45:26.0797 3988 nv_agp - ok 05:45:27.0166 3988 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 05:45:27.0198 3988 odserv - ok 05:45:27.0267 3988 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys 05:45:27.0279 3988 ohci1394 - ok 05:45:27.0315 3988 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 05:45:27.0326 3988 ose - ok 05:45:27.0391 3988 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 05:45:27.0459 3988 p2pimsvc - ok 05:45:27.0503 3988 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 05:45:27.0521 3988 p2psvc - ok 05:45:27.0573 3988 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 05:45:27.0587 3988 Parport - ok 05:45:27.0635 3988 partmgr (90061b1acfe8ccaa5345750ffe08d8b8) C:\Windows\system32\drivers\partmgr.sys 05:45:27.0647 3988 partmgr - ok 05:45:27.0786 3988 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 05:45:27.0831 3988 PcaSvc - ok 05:45:27.0882 3988 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys 05:45:27.0894 3988 pci - ok 05:45:27.0911 3988 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys 05:45:27.0920 3988 pciide - ok 05:45:27.0944 3988 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 05:45:27.0963 3988 pcmcia - ok 05:45:27.0975 3988 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 05:45:27.0985 3988 pcw - ok 05:45:28.0021 3988 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 05:45:28.0072 3988 PEAUTH - ok 05:45:28.0234 3988 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll 05:45:28.0317 3988 PeerDistSvc - ok 05:45:28.0389 3988 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 05:45:28.0422 3988 PerfHost - ok 05:45:29.0263 3988 pla (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll 05:45:29.0335 3988 pla - ok 05:45:29.0515 3988 PlugPlay (98b1721b8718164293b9701b98c52d77) C:\Windows\system32\umpnpmgr.dll 05:45:29.0568 3988 PlugPlay - ok 05:45:29.0644 3988 pnarp (328b99e25901d314fdfb31f18a7e302e) C:\Windows\system32\DRIVERS\pnarp.sys 05:45:29.0652 3988 pnarp - ok 05:45:29.0716 3988 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 05:45:29.0756 3988 PNRPAutoReg - ok 05:45:29.0957 3988 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 05:45:29.0970 3988 PNRPsvc - ok 05:45:30.0047 3988 Point64 (4f0878fd62d5f7444c5f1c4c66d9d293) C:\Windows\system32\DRIVERS\point64.sys 05:45:30.0117 3988 Point64 - ok 05:45:30.0219 3988 PolicyAgent (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll 05:45:30.0278 3988 PolicyAgent - ok 05:45:30.0365 3988 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 05:45:30.0417 3988 Power - ok 05:45:30.0461 3988 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys 05:45:30.0522 3988 PptpMiniport - ok 05:45:30.0540 3988 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 05:45:30.0574 3988 Processor - ok 05:45:30.0618 3988 ProfSvc (97293447431311c06703368ad0f6c4be) C:\Windows\system32\profsvc.dll 05:45:30.0671 3988 ProfSvc - ok 05:45:30.0752 3988 ProtectedStorage (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 05:45:30.0764 3988 ProtectedStorage - ok 05:45:30.0793 3988 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys 05:45:30.0827 3988 Psched - ok 05:45:30.0875 3988 purendis (e33ae01d03ebe68cd6a934bf52702bfd) C:\Windows\system32\DRIVERS\purendis.sys 05:45:30.0883 3988 purendis - ok 05:45:30.0906 3988 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys 05:45:30.0916 3988 PxHlpa64 - ok 05:45:31.0012 3988 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 05:45:31.0056 3988 ql2300 - ok 05:45:31.0158 3988 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 05:45:31.0181 3988 ql40xx - ok 05:45:31.0215 3988 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 05:45:31.0237 3988 QWAVE - ok 05:45:31.0250 3988 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 05:45:31.0279 3988 QWAVEdrv - ok 05:45:31.0303 3988 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 05:45:31.0353 3988 RasAcd - ok 05:45:31.0397 3988 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 05:45:31.0432 3988 RasAgileVpn - ok 05:45:31.0444 3988 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 05:45:31.0506 3988 RasAuto - ok 05:45:31.0535 3988 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys 05:45:31.0591 3988 Rasl2tp - ok 05:45:31.0625 3988 RasMan (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll 05:45:31.0726 3988 RasMan - ok 05:45:31.0752 3988 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 05:45:31.0807 3988 RasPppoe - ok 05:45:31.0843 3988 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 05:45:31.0893 3988 RasSstp - ok 05:45:31.0931 3988 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys 05:45:31.0967 3988 rdbss - ok 05:45:31.0973 3988 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 05:45:32.0007 3988 rdpbus - ok 05:45:32.0030 3988 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 05:45:32.0061 3988 RDPCDD - ok 05:45:32.0093 3988 RDPDR (9706b84dbabfc4b4ca46c5a82b14dfa3) C:\Windows\system32\drivers\rdpdr.sys 05:45:32.0167 3988 RDPDR - ok 05:45:32.0181 3988 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 05:45:32.0231 3988 RDPENCDD - ok 05:45:32.0252 3988 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 05:45:32.0283 3988 RDPREFMP - ok 05:45:32.0322 3988 RDPWD (447de7e3dea39d422c1504f245b668b1) C:\Windows\system32\drivers\RDPWD.sys 05:45:32.0385 3988 RDPWD - ok 05:45:32.0417 3988 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys 05:45:32.0431 3988 rdyboost - ok 05:45:32.0464 3988 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 05:45:32.0516 3988 RemoteAccess - ok 05:45:32.0558 3988 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 05:45:32.0616 3988 RemoteRegistry - ok 05:45:32.0650 3988 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 05:45:32.0741 3988 RpcEptMapper - ok 05:45:32.0775 3988 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 05:45:32.0803 3988 RpcLocator - ok 05:45:32.0852 3988 RpcSs (7266972e86890e2b30c0c322e906b027) C:\Windows\System32\rpcss.dll 05:45:32.0889 3988 RpcSs - ok 05:45:32.0905 3988 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 05:45:32.0958 3988 rspndr - ok 05:45:32.0993 3988 SamSs (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 05:45:33.0004 3988 SamSs - ok 05:45:33.0019 3988 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys 05:45:33.0040 3988 sbp2port - ok 05:45:33.0064 3988 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 05:45:33.0122 3988 SCardSvr - ok 05:45:33.0143 3988 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys 05:45:33.0191 3988 scfilter - ok 05:45:33.0293 3988 Schedule (624d0f5ff99428bb90a5b8a4123e918e) C:\Windows\system32\schedsvc.dll 05:45:33.0380 3988 Schedule - ok 05:45:33.0401 3988 SCPolicySvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll 05:45:33.0435 3988 SCPolicySvc - ok 05:45:33.0454 3988 SDRSVC (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll 05:45:33.0529 3988 SDRSVC - ok 05:45:33.0620 3988 SeaPort (16a252022535b680046f6e34e136d378) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 05:45:33.0635 3988 SeaPort - ok 05:45:33.0730 3988 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 05:45:33.0765 3988 secdrv - ok 05:45:33.0779 3988 seclogon (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll 05:45:33.0834 3988 seclogon - ok 05:45:33.0870 3988 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\system32\sens.dll 05:45:33.0905 3988 SENS - ok 05:45:33.0913 3988 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 05:45:33.0970 3988 SensrSvc - ok 05:45:33.0983 3988 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 05:45:33.0994 3988 Serenum - ok 05:45:34.0014 3988 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 05:45:34.0049 3988 Serial - ok 05:45:34.0071 3988 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 05:45:34.0100 3988 sermouse - ok 05:45:34.0130 3988 SessionEnv (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll 05:45:34.0174 3988 SessionEnv - ok 05:45:34.0200 3988 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys 05:45:34.0253 3988 sffdisk - ok 05:45:34.0260 3988 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys 05:45:34.0292 3988 sffp_mmc - ok 05:45:34.0316 3988 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys 05:45:34.0328 3988 sffp_sd - ok 05:45:34.0339 3988 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 05:45:34.0351 3988 sfloppy - ok 05:45:34.0392 3988 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll 05:45:34.0437 3988 SharedAccess - ok 05:45:34.0466 3988 ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll 05:45:34.0511 3988 ShellHWDetection - ok 05:45:34.0538 3988 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 05:45:34.0549 3988 SiSRaid2 - ok 05:45:34.0566 3988 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 05:45:34.0577 3988 SiSRaid4 - ok 05:45:34.0666 3988 SkypeUpdate (db0405d9aad62f0762e0876ac142b7e1) C:\Program Files (x86)\Skype\Updater\Updater.exe 05:45:34.0685 3988 SkypeUpdate - ok 05:45:34.0759 3988 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 05:45:34.0813 3988 Smb - ok 05:45:34.0843 3988 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 05:45:34.0874 3988 SNMPTRAP - ok 05:45:34.0896 3988 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 05:45:34.0906 3988 spldr - ok 05:45:35.0022 3988 Spooler (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\Windows\System32\spoolsv.exe 05:45:35.0083 3988 Spooler - ok 05:45:35.0284 3988 sppsvc (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe 05:45:35.0353 3988 sppsvc - ok 05:45:35.0432 3988 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 05:45:35.0468 3988 sppuinotify - ok 05:45:35.0538 3988 sprtsvc_DellSupportCenter (d630b6f2e8379b6f10dc16e82a426552) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe 05:45:35.0549 3988 sprtsvc_DellSupportCenter - ok 05:45:35.0733 3988 SRTSP (90ef30c3867bcde4579c01a6d6e75a7a) C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS 05:45:35.0756 3988 SRTSP - ok 05:45:35.0770 3988 SRTSPX (c513e8a5e7978da49077f5484344ee1b) C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS 05:45:35.0781 3988 SRTSPX - ok 05:45:35.0839 3988 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys 05:45:35.0910 3988 srv - ok 05:45:35.0937 3988 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys 05:45:35.0967 3988 srv2 - ok 05:45:36.0007 3988 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys 05:45:36.0020 3988 srvnet - ok 05:45:36.0049 3988 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 05:45:36.0105 3988 SSDPSRV - ok 05:45:36.0138 3988 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 05:45:36.0172 3988 SstpSvc - ok 05:45:36.0196 3988 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 05:45:36.0207 3988 stexstor - ok 05:45:36.0259 3988 stisvc (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll 05:45:36.0304 3988 stisvc - ok 05:45:36.0355 3988 StorSvc (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll 05:45:36.0417 3988 StorSvc - ok 05:45:36.0427 3988 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys 05:45:36.0437 3988 swenum - ok 05:45:36.0568 3988 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 05:45:36.0583 3988 SwitchBoard ( UnsignedFile.Multi.Generic ) - warning 05:45:36.0583 3988 SwitchBoard - detected UnsignedFile.Multi.Generic (1) 05:45:36.0633 3988 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 05:45:36.0756 3988 swprv - ok 05:45:36.0839 3988 SymDS (6160145c7a87fc7672e8e3b886888176) C:\Windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS 05:45:36.0866 3988 SymDS - ok 05:45:36.0943 3988 SymEFA (96aeed40d4d3521568b42027687e69e0) C:\Windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS 05:45:36.0980 3988 SymEFA - ok 05:45:37.0030 3988 SymEvent (21a1c2d694c3cf962d31f5e873ab3d6f) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS 05:45:37.0049 3988 SymEvent - ok 05:45:37.0089 3988 SymIM (3aa3b2df451da88c38ab00b19fa3562e) C:\Windows\system32\DRIVERS\SymIMv.sys 05:45:37.0099 3988 SymIM - ok 05:45:37.0135 3988 SymIRON (bd0d711d8cbfcaa19ca123306eaf53a5) C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS 05:45:37.0154 3988 SymIRON - ok 05:45:37.0186 3988 SymNetS (a6adb3d83023f8daa0f7b6fda785d83b) C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS 05:45:37.0205 3988 SymNetS - ok 05:45:37.0325 3988 SysMain (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll 05:45:37.0368 3988 SysMain - ok 05:45:37.0456 3988 TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll 05:45:37.0489 3988 TabletInputService - ok 05:45:37.0529 3988 TapiSrv (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll 05:45:37.0596 3988 TapiSrv - ok 05:45:37.0621 3988 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 05:45:37.0656 3988 TBS - ok 05:45:37.0834 3988 Tcpip (624c5b3aa4c99b3184bb922d9ece3ff0) C:\Windows\system32\drivers\tcpip.sys 05:45:37.0891 3988 Tcpip - ok 05:45:38.0033 3988 TCPIP6 (624c5b3aa4c99b3184bb922d9ece3ff0) C:\Windows\system32\DRIVERS\tcpip.sys 05:45:38.0067 3988 TCPIP6 - ok 05:45:38.0124 3988 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys 05:45:38.0155 3988 tcpipreg - ok 05:45:38.0177 3988 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 05:45:38.0230 3988 TDPIPE - ok 05:45:38.0260 3988 TDTCP (7518f7bcfd4b308abc9192bacaf6c970) C:\Windows\system32\drivers\tdtcp.sys 05:45:38.0316 3988 TDTCP - ok 05:45:38.0329 3988 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys 05:45:38.0390 3988 tdx - ok 05:45:38.0413 3988 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys 05:45:38.0424 3988 TermDD - ok 05:45:38.0490 3988 TermService (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll 05:45:38.0559 3988 TermService - ok 05:45:38.0581 3988 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 05:45:38.0598 3988 Themes - ok 05:45:38.0631 3988 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 05:45:38.0664 3988 THREADORDER - ok 05:45:38.0704 3988 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 05:45:38.0761 3988 TrkWks - ok 05:45:38.0820 3988 TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe 05:45:38.0841 3988 TrustedInstaller - ok 05:45:38.0856 3988 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys 05:45:38.0911 3988 tssecsrv - ok 05:45:38.0958 3988 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys 05:45:39.0024 3988 tunnel - ok 05:45:39.0049 3988 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 05:45:39.0061 3988 uagp35 - ok 05:45:39.0090 3988 udfs (31ba4a33afab6a69ea092b18017f737f) C:\Windows\system32\DRIVERS\udfs.sys 05:45:39.0143 3988 udfs - ok 05:45:39.0162 3988 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 05:45:39.0176 3988 UI0Detect - ok 05:45:39.0198 3988 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys 05:45:39.0209 3988 uliagpkx - ok 05:45:39.0226 3988 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys 05:45:39.0252 3988 umbus - ok 05:45:39.0275 3988 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 05:45:39.0308 3988 UmPass - ok 05:45:39.0347 3988 UmRdpService (af0ac98ee5077eb844413eb54287fde3) C:\Windows\System32\umrdp.dll 05:45:39.0384 3988 UmRdpService - ok 05:45:39.0481 3988 UMVPFSrv (67a95b9d129ed5399e7965cd09cf30e7) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe 05:45:39.0510 3988 UMVPFSrv - ok 05:45:39.0541 3988 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 05:45:39.0584 3988 upnphost - ok 05:45:39.0621 3988 USBAAPL64 (fb251567f41bc61988b26731dec19e4b) C:\Windows\system32\Drivers\usbaapl64.sys 05:45:39.0640 3988 USBAAPL64 - ok 05:45:39.0663 3988 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys 05:45:39.0704 3988 usbaudio - ok 05:45:39.0773 3988 usbccgp (537a4e03d7103c12d42dfd8ffdb5bdc9) C:\Windows\system32\DRIVERS\usbccgp.sys 05:45:39.0822 3988 usbccgp - ok 05:45:39.0848 3988 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys 05:45:39.0893 3988 usbcir - ok 05:45:39.0927 3988 usbehci (fbb21ebe49f6d560db37ac25fbc68e66) C:\Windows\system32\drivers\usbehci.sys 05:45:39.0939 3988 usbehci - ok 05:45:39.0978 3988 usbhub (6b7a8a99c4a459e73c286a6763ea24cc) C:\Windows\system32\DRIVERS\usbhub.sys 05:45:40.0000 3988 usbhub - ok 05:45:40.0026 3988 usbohci (8c88aa7617b4cbc2e4bed61d26b33a27) C:\Windows\system32\drivers\usbohci.sys 05:45:40.0037 3988 usbohci - ok 05:45:40.0053 3988 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 05:45:40.0068 3988 usbprint - ok 05:45:40.0100 3988 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS 05:45:40.0160 3988 USBSTOR - ok 05:45:40.0192 3988 usbuhci (0b5b3b2df3fd1709618acfa50b8392b0) C:\Windows\system32\drivers\usbuhci.sys 05:45:40.0235 3988 usbuhci - ok 05:45:40.0274 3988 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\system32\Drivers\usbvideo.sys 05:45:40.0338 3988 usbvideo - ok 05:45:40.0356 3988 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 05:45:40.0390 3988 UxSms - ok 05:45:40.0430 3988 VaultSvc (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe 05:45:40.0441 3988 VaultSvc - ok 05:45:40.0473 3988 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys 05:45:40.0484 3988 vdrvroot - ok 05:45:40.0533 3988 vds (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe 05:45:40.0564 3988 vds - ok 05:45:40.0585 3988 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 05:45:40.0599 3988 vga - ok 05:45:40.0602 3988 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 05:45:40.0650 3988 VgaSave - ok 05:45:40.0698 3988 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys 05:45:40.0715 3988 vhdmp - ok 05:45:40.0742 3988 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys 05:45:40.0752 3988 viaide - ok 05:45:40.0766 3988 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys 05:45:40.0776 3988 volmgr - ok 05:45:40.0805 3988 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys 05:45:40.0820 3988 volmgrx - ok 05:45:40.0847 3988 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys 05:45:40.0862 3988 volsnap - ok 05:45:40.0885 3988 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 05:45:40.0906 3988 vsmraid - ok 05:45:41.0008 3988 VSS (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe 05:45:41.0061 3988 VSS - ok 05:45:41.0156 3988 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys 05:45:41.0170 3988 vwifibus - ok 05:45:41.0195 3988 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 05:45:41.0237 3988 W32Time - ok 05:45:41.0249 3988 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 05:45:41.0278 3988 WacomPen - ok 05:45:41.0309 3988 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 05:45:41.0343 3988 WANARP - ok 05:45:41.0345 3988 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 05:45:41.0376 3988 Wanarpv6 - ok 05:45:41.0476 3988 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe 05:45:41.0513 3988 WatAdminSvc - ok 05:45:41.0612 3988 wbengine (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe 05:45:41.0722 3988 wbengine - ok 05:45:41.0805 3988 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 05:45:41.0836 3988 WbioSrvc - ok 05:45:41.0879 3988 wcncsvc (dd1bae8ebfc653824d29ccf8c9054d68) C:\Windows\System32\wcncsvc.dll 05:45:41.0942 3988 wcncsvc - ok 05:45:41.0952 3988 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 05:45:42.0024 3988 WcsPlugInService - ok 05:45:42.0054 3988 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 05:45:42.0065 3988 Wd - ok 05:45:42.0115 3988 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 05:45:42.0136 3988 Wdf01000 - ok 05:45:42.0151 3988 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 05:45:42.0185 3988 WdiServiceHost - ok 05:45:42.0187 3988 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 05:45:42.0203 3988 WdiSystemHost - ok 05:45:42.0243 3988 WebClient (733006127f235be7c35354ebee7b9a7b) C:\Windows\System32\webclnt.dll 05:45:42.0308 3988 WebClient - ok 05:45:42.0328 3988 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 05:45:42.0387 3988 Wecsvc - ok 05:45:42.0410 3988 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 05:45:42.0470 3988 wercplsupport - ok 05:45:42.0495 3988 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 05:45:42.0530 3988 WerSvc - ok 05:45:42.0542 3988 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 05:45:42.0573 3988 WfpLwf - ok 05:45:42.0585 3988 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 05:45:42.0595 3988 WIMMount - ok 05:45:42.0624 3988 WinDefend - ok 05:45:42.0651 3988 WinHttpAutoProxySvc - ok 05:45:42.0712 3988 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 05:45:42.0812 3988 Winmgmt - ok 05:45:42.0948 3988 WinRM (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll 05:45:43.0036 3988 WinRM - ok 05:45:43.0179 3988 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 05:45:43.0238 3988 Wlansvc - ok 05:45:43.0423 3988 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 05:45:43.0482 3988 wlidsvc - ok 05:45:43.0591 3988 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys 05:45:43.0604 3988 WmiAcpi - ok 05:45:43.0666 3988 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 05:45:43.0687 3988 wmiApSrv - ok 05:45:43.0752 3988 WMPNetworkSvc - ok 05:45:43.0777 3988 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 05:45:43.0799 3988 WPCSvc - ok 05:45:43.0818 3988 WPDBusEnum (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll 05:45:43.0893 3988 WPDBusEnum - ok 05:45:43.0902 3988 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 05:45:43.0954 3988 ws2ifsl - ok 05:45:44.0008 3988 wscsvc (8f9f3969933c02da96eb0f84576db43e) C:\Windows\system32\wscsvc.dll 05:45:44.0072 3988 wscsvc - ok 05:45:44.0074 3988 WSearch - ok 05:45:44.0219 3988 wuauserv (38340204a2d0228f1e87740fc5e554a7) C:\Windows\system32\wuaueng.dll 05:45:44.0298 3988 wuauserv - ok 05:45:44.0413 3988 WudfPf (c63907207b837a5c05cf6d1606aa0008) C:\Windows\system32\drivers\WudfPf.sys 05:45:44.0489 3988 WudfPf - ok 05:45:44.0520 3988 WUDFRd (d885a873d733020f8b9b9ff4b1666158) C:\Windows\system32\DRIVERS\WUDFRd.sys 05:45:44.0540 3988 WUDFRd - ok 05:45:44.0551 3988 wudfsvc (27b9bee5aac00139e3a3af5d6227a0dc) C:\Windows\System32\WUDFSvc.dll 05:45:44.0565 3988 wudfsvc - ok 05:45:44.0598 3988 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 05:45:44.0641 3988 WwanSvc - ok 05:45:44.0697 3988 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 05:45:44.0980 3988 \Device\Harddisk0\DR0 ( TDSS File System ) - warning 05:45:44.0980 3988 \Device\Harddisk0\DR0 - detected TDSS File System (1) 05:45:45.0002 3988 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1 05:45:45.0095 3988 \Device\Harddisk1\DR1 - ok 05:45:45.0128 3988 Boot (0x1200) (d76d9c6bb60fbcde09d9e770420ecc63) \Device\Harddisk0\DR0\Partition0 05:45:45.0130 3988 \Device\Harddisk0\DR0\Partition0 - ok 05:45:45.0138 3988 Boot (0x1200) (6172a6471c0a11e2d8e7097cc457a062) \Device\Harddisk0\DR0\Partition1 05:45:45.0140 3988 \Device\Harddisk0\DR0\Partition1 - ok 05:45:45.0142 3988 Boot (0x1200) (7d307b81c9f87f79db5eef5803d40bc8) \Device\Harddisk1\DR1\Partition0 05:45:45.0143 3988 \Device\Harddisk1\DR1\Partition0 - ok 05:45:45.0145 3988 Boot (0x1200) (9e5839d7e93b427d6cb75f1cf885968b) \Device\Harddisk1\DR1\Partition1 05:45:45.0146 3988 \Device\Harddisk1\DR1\Partition1 - ok 05:45:45.0149 3988 Boot (0x1200) (9e5839d7e93b427d6cb75f1cf885968b) \Device\Harddisk1\DR1\Partition2 05:45:45.0150 3988 \Device\Harddisk1\DR1\Partition2 - ok 05:45:45.0150 3988 ============================================================ 05:45:45.0151 3988 Scan finished 05:45:45.0151 3988 ============================================================ 05:45:45.0159 4880 Detected object count: 5 05:45:45.0159 4880 Actual detected object count: 5 05:45:56.0030 4880 DockLoginService ( UnsignedFile.Multi.Generic ) - skipped by user 05:45:56.0030 4880 DockLoginService ( UnsignedFile.Multi.Generic ) - User select action: Skip 05:45:56.0030 4880 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user 05:45:56.0030 4880 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 05:45:56.0031 4880 LinksysUpdater ( UnsignedFile.Multi.Generic ) - skipped by user 05:45:56.0031 4880 LinksysUpdater ( UnsignedFile.Multi.Generic ) - User select action: Skip 05:45:56.0033 4880 SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user 05:45:56.0033 4880 SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip 05:45:56.0046 4880 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine 05:45:56.0048 4880 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine 05:45:56.0052 4880 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine 05:45:56.0056 4880 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine 05:45:56.0106 4880 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine 05:45:56.0114 4880 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine 05:45:56.0115 4880 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine 05:45:56.0116 4880 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine 05:45:56.0117 4880 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine 05:45:56.0119 4880 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine 05:45:56.0121 4880 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine 05:45:56.0123 4880 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine 05:45:56.0123 4880 \Device\Harddisk0\DR0\TDLFS - deleted 05:45:56.0123 4880 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Delete 05:46:33.0424 4088 Deinitialize success Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.06.16.01 Windows 7 x64 NTFS Internet Explorer 8.0.7600.16385 Laura :: ADMIN-PC [administrator] 6/16/2012 5:47:56 AM mbam-log-2012-06-16 (05-47-56).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 239835 Time elapsed: 2 minute(s), 41 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

oldman960

Post #10June 16, 2012, 5:34 PM UTC

Hi Glad your here!,

Babylon Toolbar, if you don't use it or know how it got on your computer I suggest you uninstall it.
http://www.systemlookup.com/CLSID/71915-Ba…arTlbr_dll.html

so far these logs look good. One more scan to check our handiwork.

As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.

Do not use this instance of your browser for anything besides doing this scan
When the scan is complete and the results saved, close that instance of your browser
Open a new one the usual way and post the results in this topic.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
When the scan completes, click List of found threats
click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
Include the contents of this report in your next reply

Note - when ESET doesn't find any threats, no report will be created.
Push the back button.
Push Finish
Re-enable your Antivirus software.

After the ESET scan open OTL and click the Quick Scan button. Please post the log produced.

Please post back with

Eset log if there was one
OTL.txt

Any problems?

Glad your here!

Post #11June 17, 2012, 6:25 PM UTC

Hi Oldtimer960,

Used Spybot to take care of Babylon. Seemed to do the job. Looks like Eset found some things.

Machine working well.

Thank you again for your help with this.

C:\Hold from Lacie\Sarah\Desktop\Install_AIM.exe Win32/Adware.WBug.A application
C:\Program Files (x86)\FoxTabAudioConverter\AudioConverter.exe a variant of Win32/InstallCore.A application
C:\Program Files (x86)\FoxTabFLVPlayer\FLVPlayer.exe a variant of Win32/InstallCore.A application
C:\ProgramData\Microsoft\Windows\DRM\D886.tmp Win64/Olmarik.AD trojan
C:\ProgramData\Microsoft\Windows\DRM\D896.tmp Win64/Olmarik.AD trojan
C:\Qoobox\Quarantine\C\Program Files (x86)\DailyBibleGuideEI\Installr\2.bin\2vEIPlug.dll.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files (x86)\DailyBibleGuideEI\Installr\2.bin\NP2vEISb.dll.vir Win32/Toolbar.MyWebSearch application
C:\Users\All Users\Microsoft\Windows\DRM\D886.tmp Win64/Olmarik.AD trojan
C:\Users\All Users\Microsoft\Windows\DRM\D896.tmp Win64/Olmarik.AD trojan
C:\Users\Laura\AppData\Local\DailyBibleGuideAuto.exe probably a variant of Win32/Toolbar.MyWebSearch.L application
C:\Users\Laura\Downloads\cnet2_RescuePRO-v32-DEMO-setup_zip.exe a variant of Win32/InstallCore.D application
C:\Users\Laura\Downloads\Setup_FreeConverter.exe Win32/Toolbar.Widgi application

OTL logfile created on: 6/17/2012 2:17:38 PM - Run 3
OTL by OldTimer - Version 3.2.49.0 Folder = C:\Users\Laura\Desktop
64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.87 Gb Total Physical Memory | 3.30 Gb Available Physical Memory | 56.25% Memory free
11.73 Gb Paging File | 9.52 Gb Available in Paging File | 81.16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 289.42 Gb Total Space | 75.48 Gb Free Space | 26.08% Space Free | Partition Type: NTFS
Drive E: | 1397.07 Gb Total Space | 462.83 Gb Free Space | 33.13% Space Free | Partition Type: NTFS
Drive G: | 7.45 Gb Total Space | 4.73 Gb Free Space | 63.52% Space Free | Partition Type: FAT32

Computer Name: ADMIN-PC | User Name: Laura | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Laura\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\java.exe (Oracle Corporation)
PRC - C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe (Alcor Micro Corp.)
PRC - C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
PRC - C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QTCore4.dll ()
MOD - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()
MOD - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll ()
MOD - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (UMVPFSrv) – C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (NIS) – C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe (Symantec Corporation)
SRV - (GoToAssist) – C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) – C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (AdobeActiveFileMonitor7.0) – C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (nmservice) – C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
SRV - (LinksysUpdater) – C:\Program Files (x86)\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()

========== Driver Services (SafeList) ==========

DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (LVUVC64) Logitech Webcam 200(UVC) – C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) – C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SymNetS) – C:\Windows\SysNative\drivers\NISx64\1207020.003\symnets.sys (Symantec Corporation)
DRV:64bit: - (SymIM) – C:\Windows\SysNative\drivers\SymIMV.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\NISx64\1207020.003\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\SysNative\drivers\NISx64\1207020.003\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\NISx64\1207020.003\symefa64.sys (Symantec Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\NISx64\1207020.003\symds64.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\NISx64\1207020.003\ironx64.sys (Symantec Corporation)
DRV:64bit: - (LVPr2Mon) – C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (LVPr2M64) – C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (Impcd) – C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) Intel® – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (k57nd60a) Broadcom NetLink ™ – C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (lvpopf64) – C:\Windows\SysNative\drivers\lvpopf64.sys (Logitech Inc.)
DRV:64bit: - (HECIx64) Intel® – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (pnarp) – C:\Windows\SysNative\drivers\pnarp.sys (Pure Networks, Inc.)
DRV:64bit: - (purendis) – C:\Windows\SysNative\drivers\purendis.sys (Pure Networks, Inc.)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120613.007\IDSviA64.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120616.009\EX64.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120616.009\ENG64.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120531.001\BHDrvx64.sys (Symantec Corporation)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {C3EE7B94-C2A1-41FB-87AC-42E578027ACF}
IE:64bit: - HKLM\..\SearchScopes\{C3EE7B94-C2A1-41FB-87AC-42E578027ACF}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6831B5C9-128F-4E8F-B6E7-89B8AAA6C767}
IE - HKLM\..\SearchScopes\{23088cf8-eaf8-4bb3-a251-9ba61557ac75}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKLM\..\SearchScopes\{34e26447-bf30-4c78-a5b9-61dfa8a55e67}: "URL" = http://s.mysearch.com/search/GGmain.jhtml?…r={searchTerms}
IE - HKLM\..\SearchScopes\{6831B5C9-128F-4E8F-B6E7-89B8AAA6C767}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…000842b2b9d5b14
IE - HKCU\..\SearchScopes\{1C81CA55-4A43-4AD5-A613-394A9DB7F5C9}: "URL" = http://www.google.com/search?q={searchTerm…utputEncoding?}
IE - HKCU\..\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}: "URL" = http://www.crawler.com/search/dispatcher.a…&tbid=60516
IE - HKCU\..\SearchScopes\{23088cf8-eaf8-4bb3-a251-9ba61557ac75}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKCU\..\SearchScopes\{34e26447-bf30-4c78-a5b9-61dfa8a55e67}: "URL" = http://s.mysearch.com/search/GGmain.jhtml?…r={searchTerms}
IE - HKCU\..\SearchScopes\{76E9350E-0392-9C19-F83A-99BC015260AF}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?q={SEARCHTERMS}&…o=US&ver=18
IE - HKCU\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://inboxtoolbar.com/search/dispatcher….0105&lng=en
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: [removed]:2.4.6000
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.5
FF - prefs.js..extensions.enabledItems: {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.3
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {ED76C299-85BC-4891-9237-74A140C28832}:1.0.0.15
FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=109935&tt=050412_30b&babsrc=KW_ss&mntrId=225be37c000000000000842b2b9d5b14&q="

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@ei.DailyBibleGuide.com/Plugin: C:\Program Files (x86)\DailyBibleGuideEI\Installr\2.bin\NP2vEISB.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@octoshape.com/Octoshape Streaming Services,version=1.0: C:\Users\Laura\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1101262-0-npoctoshape.dll (Octoshape ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2012/06/12 17:24:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_9_4 [2012/06/17 08:48:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/17 01:02:39 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/06/13 22:01:31 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/17 01:02:39 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/06/13 22:01:31 | 000,000,000 | —D | M]

[2010/10/11 23:49:22 | 000,000,000 | —D | M] (No name found) – C:\Users\Laura\AppData\Roaming\Mozilla\Extensions
[2012/06/13 22:10:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\extensions
[2011/02/08 11:09:35 | 000,000,000 | —- | M] () – C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\searchplugins\DailyBibleGuide.xml
[2011/01/12 08:20:28 | 000,000,000 | —- | M] () – C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\searchplugins\FilmFanatic.xml
[2011/02/07 15:53:10 | 000,002,291 | —- | M] () – C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\searchplugins\inbox-search.xml
[2010/11/15 13:52:14 | 000,002,470 | —- | M] () – C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\xb550wrj.default\searchplugins\safesearch.xml
[2011/11/09 22:08:39 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/03/05 19:11:51 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/06/12 17:24:31 | 000,000,000 | —D | M] (Symantec Intrusion Prevention) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPLGN
[2012/06/17 01:02:39 | 000,085,472 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/10 16:12:54 | 000,002,353 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012/06/17 01:02:37 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2007/07/26 14:05:16 | 000,001,329 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\crawlersrch.xml
[2012/06/17 01:02:37 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

O1 HOSTS File: ([2012/06/15 08:19:02 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [Desktop Disc Tool] c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe (Alcor Micro Corp.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [Octoshape Streaming Services] C:\Users\Laura\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe (Octoshape ApS)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = File not found
O4 - Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16:64bit: - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.0)
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB (DellSystemLite.Scanner)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BDBAA6EF-54C6-4C52-8369-EA86A37DD159}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\amd64\puresp4.dll (Cisco Systems, Inc.)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/17 13:53:32 | 000,595,968 | —- | C] (OldTimer Tools) – C:\Users\Laura\Desktop\OTL.exe
[2012/06/17 09:56:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2012/06/17 09:51:28 | 002,322,184 | —- | C] (ESET) – C:\Users\Laura\Desktop\esetsmartinstaller_enu.exe
[2012/06/17 08:31:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012/06/17 08:30:59 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2012/06/17 08:30:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\Spybot - Search & Destroy
[2012/06/17 08:28:39 | 016,409,960 | —- | C] (Safer Networking Limited ) – C:\Users\Laura\Desktop\spybotsd162.exe
[2012/06/16 11:21:36 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\mcdonald for CD large files
[2012/06/16 11:17:56 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\mcdonald for CD
[2012/06/16 10:54:19 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\for bev taylor -small files
[2012/06/16 10:49:29 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\for bev taylor
[2012/06/16 09:48:23 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\Seth & Stephanie for DVD
[2012/06/15 15:24:49 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\Seth & Stephanie_
[2012/06/15 15:15:16 | 002,127,960 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Laura\Desktop\TDSSKiller.exe
[2012/06/15 11:04:18 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/06/15 08:25:34 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/06/15 07:10:17 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/06/15 07:10:17 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/06/15 07:10:17 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/06/15 07:10:10 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2012/06/15 07:10:06 | 000,000,000 | —D | C] – C:\Qoobox
[2012/06/15 07:04:26 | 004,558,642 | R— | C] (Swearware) – C:\Users\Laura\Desktop\ComboFix.exe
[2012/06/14 16:27:53 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\seth & stephanie #2
[2012/06/14 13:36:57 | 000,000,000 | —D | C] – C:\TDSSKiller_Quarantine
[2012/06/14 11:19:19 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\bev taylor retires
[2012/06/14 10:47:04 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\firetruck for blog
[2012/06/14 08:20:52 | 004,731,392 | —- | C] (AVAST Software) – C:\Users\Laura\Desktop\aswMBR.exe
[2012/06/13 22:01:51 | 000,000,000 | —D | C] – C:\Program Files (x86)\Oracle
[2012/06/13 22:00:37 | 000,000,000 | —D | C] – C:\Config.Msi
[2012/06/13 20:28:30 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Laura\Desktop\HiJackThis.exe
[2012/06/13 13:54:55 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\photo for blog
[2012/06/13 08:38:48 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\week one for mera lighting for forum
[2012/06/12 20:44:21 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\week one for mera lighting
[2012/06/12 17:52:51 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\bubbles for fb try again
[2012/06/12 17:41:56 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\bubbles for fb
[2012/06/12 10:04:32 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\2011 Tax info
[2012/06/12 10:03:05 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\Business Folder
[2012/06/11 17:27:06 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\photos for mera
[2012/06/11 15:01:50 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\karen for class week 1
[2012/06/11 13:30:11 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\week 1 lighting class with mera
[2012/06/09 21:10:42 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\karen and doug for book
[2012/06/08 20:57:35 | 000,043,640 | R— | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\SymIMV.sys
[2012/06/08 20:38:43 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Roaming\Malwarebytes
[2012/06/08 20:38:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/08 20:38:34 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/06/08 20:38:33 | 000,024,904 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/06/08 20:38:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/06/01 10:25:11 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\wedding book for katy and adam
[2012/05/30 06:07:22 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\baby poses
[2012/05/26 10:08:34 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\karen & doug
[2012/05/24 11:08:00 | 000,000,000 | —D | C] – C:\Users\Laura\Documents\BookSmartData
[2012/05/24 11:07:55 | 000,000,000 | —D | C] – C:\Users\Laura\.blurb
[2012/05/24 11:07:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BookSmart
[2012/05/24 11:06:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\BookSmart
[2012/05/23 18:24:03 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Roaming\AVS4YOU
[2012/05/23 18:23:48 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AVS4YOU
[2012/05/23 18:23:08 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVS4YOU
[2012/05/23 18:22:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\AVSMedia
[2012/05/23 18:22:24 | 000,000,000 | —D | C] – C:\ProgramData\AVS4YOU
[2012/05/23 18:22:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\AVS4YOU
[2012/05/22 09:24:12 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Local\{6946EA34-54E7-43B0-8D00-04249D41160C}
[2012/05/21 21:10:11 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\Certification Application « Me Ra Koh Photography Blog_files
[2012/05/21 16:00:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/05/21 15:59:59 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2012/05/21 15:59:59 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/05/21 15:54:20 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/05/21 15:54:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2011/03/23 18:37:56 | 000,960,584 | —- | C] (DailyBibleGuide) – C:\Users\Laura\AppData\Local\DailyBibleGuideAuto.exe
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Laura\*.tmp files -> C:\Users\Laura\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/06/17 14:11:00 | 000,000,896 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/17 14:09:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/17 13:53:33 | 000,595,968 | —- | M] (OldTimer Tools) – C:\Users\Laura\Desktop\OTL.exe
[2012/06/17 09:51:29 | 002,322,184 | —- | M] (ESET) – C:\Users\Laura\Desktop\esetsmartinstaller_enu.exe
[2012/06/17 08:55:40 | 000,019,392 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/17 08:55:40 | 000,019,392 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/17 08:48:50 | 000,000,892 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/17 08:48:11 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/06/17 08:48:10 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\lvuvc.hs
[2012/06/17 08:48:02 | 429,219,839 | -HS- | M] () – C:\hiberfil.sys
[2012/06/17 08:31:04 | 000,001,328 | —- | M] () – C:\Users\Laura\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/06/17 08:31:04 | 000,001,304 | —- | M] () – C:\Users\Laura\Desktop\Spybot - Search & Destroy.lnk
[2012/06/17 08:29:17 | 016,409,960 | —- | M] (Safer Networking Limited ) – C:\Users\Laura\Desktop\spybotsd162.exe
[2012/06/16 05:44:35 | 002,127,960 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Laura\Desktop\TDSSKiller.exe
[2012/06/16 05:43:53 | 002,109,032 | —- | M] () – C:\Users\Laura\Desktop\tdsskiller.zip
[2012/06/15 08:19:02 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2012/06/15 07:04:30 | 004,558,642 | R— | M] (Swearware) – C:\Users\Laura\Desktop\ComboFix.exe
[2012/06/15 03:00:52 | 001,808,754 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1207020.003\Cat.DB
[2012/06/14 08:29:01 | 000,000,586 | —- | M] () – C:\Users\Laura\Desktop\MBR.zip
[2012/06/14 08:28:01 | 000,000,512 | —- | M] () – C:\Users\Laura\Desktop\MBR.dat
[2012/06/14 08:21:10 | 004,731,392 | —- | M] (AVAST Software) – C:\Users\Laura\Desktop\aswMBR.exe
[2012/06/13 20:28:30 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Laura\Desktop\HiJackThis.exe
[2012/06/13 03:29:43 | 005,025,808 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/13 03:11:07 | 000,740,322 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/06/13 03:11:07 | 000,624,162 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/06/13 03:11:07 | 000,106,538 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/06/13 03:09:22 | 000,000,129 | —- | M] () – C:\Windows\SysNative\MRT.INI
[2012/06/12 13:29:28 | 394,959,475 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/06/12 01:12:14 | 000,002,386 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2012/06/12 00:44:16 | 000,002,482 | —- | M] () – C:\Users\Public\Desktop\Norton Internet Security.lnk
[2012/06/09 21:13:52 | 000,001,323 | —- | M] () – C:\Users\Laura\Desktop\MyPublisher.lnk
[2012/06/09 17:14:54 | 000,001,053 | —- | M] () – C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/06/09 17:14:21 | 000,001,021 | —- | M] () – C:\Users\Laura\Desktop\Dropbox.lnk
[2012/06/08 20:38:35 | 000,001,155 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/07 22:08:38 | 000,000,172 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1207020.003\isolate.ini
[2012/06/02 13:34:12 | 000,036,377 | —- | M] () – C:\Users\Laura\Desktop\photo quote by steve jobs.jpg
[2012/05/30 06:02:53 | 000,001,985 | —- | M] () – C:\Users\Laura\Desktop\Mozilla Firefox.lnk
[2012/05/24 11:07:12 | 000,002,013 | —- | M] () – C:\Users\Public\Desktop\BookSmart.lnk
[2012/05/24 11:07:12 | 000,001,959 | —- | M] () – C:\Users\Laura\Application Data\Microsoft\Internet Explorer\Quick Launch\BookSmart.lnk
[2012/05/22 09:58:12 | 000,006,746 | —- | M] () – C:\Users\Laura\Desktop\laura swift photography label.std
[2012/05/21 18:30:26 | 000,001,125 | —- | M] () – C:\Users\Laura\Desktop\Roxio Burn.lnk
[2012/05/21 16:00:41 | 000,001,825 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/05/21 15:54:21 | 000,001,887 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Laura\*.tmp files -> C:\Users\Laura\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/06/17 08:31:04 | 000,001,328 | —- | C] () – C:\Users\Laura\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/06/17 08:31:03 | 000,001,304 | —- | C] () – C:\Users\Laura\Desktop\Spybot - Search & Destroy.lnk
[2012/06/16 05:43:52 | 002,109,032 | —- | C] () – C:\Users\Laura\Desktop\tdsskiller.zip
[2012/06/15 07:10:17 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/06/15 07:10:17 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/06/15 07:10:17 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/06/15 07:10:17 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/06/15 07:10:17 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/06/14 08:29:01 | 000,000,586 | —- | C] () – C:\Users\Laura\Desktop\MBR.zip
[2012/06/14 08:28:01 | 000,000,512 | —- | C] () – C:\Users\Laura\Desktop\MBR.dat
[2012/06/09 21:13:52 | 000,001,353 | —- | C] () – C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPublisher.lnk
[2012/06/09 21:13:52 | 000,001,323 | —- | C] () – C:\Users\Laura\Desktop\MyPublisher.lnk
[2012/06/08 20:38:35 | 000,001,155 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/02 13:34:11 | 000,036,377 | —- | C] () – C:\Users\Laura\Desktop\photo quote by steve jobs.jpg
[2012/05/24 11:07:12 | 000,002,013 | —- | C] () – C:\Users\Public\Desktop\BookSmart.lnk
[2012/05/24 11:07:12 | 000,001,959 | —- | C] () – C:\Users\Laura\Application Data\Microsoft\Internet Explorer\Quick Launch\BookSmart.lnk
[2012/05/21 16:00:40 | 000,001,825 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/05/21 15:54:20 | 000,001,887 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/03/13 20:22:07 | 000,044,544 | —- | C] () – C:\Windows\SysWow64\Gif89.dll
[2012/01/18 07:44:00 | 010,920,984 | —- | C] () – C:\Windows\SysWow64\LogiDPP.dll
[2012/01/18 07:44:00 | 000,336,408 | —- | C] () – C:\Windows\SysWow64\DevManagerCore.dll
[2012/01/18 07:44:00 | 000,104,472 | —- | C] () – C:\Windows\SysWow64\LogiDPPApp.exe
[2011/12/16 22:07:50 | 000,001,456 | —- | C] () – C:\Users\Laura\AppData\Local\Adobe Save for Web 12.0 Prefs
[2011/07/19 15:35:26 | 000,000,000 | —- | C] () – C:\Users\Laura\AppData\Local\{E9D8026E-2273-4038-A581-5AD3DC461154}
[2011/07/01 08:56:26 | 000,000,132 | —- | C] () – C:\Users\Laura\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011/01/07 08:36:09 | 000,484,352 | —- | C] () – C:\Windows\SysWow64\lame_enc.dll
[2010/12/26 11:33:45 | 000,000,392 | —- | C] () – C:\Users\Laura\AppData\Roaming\wklnhst.dat
[2010/11/04 20:20:45 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/10/05 17:53:52 | 000,676,224 | —- | C] () – C:\Windows\SysWow64\OGACheckControl.DLL
[2010/09/30 14:07:09 | 000,870,560 | —- | C] () – C:\Windows\SysWow64\igkrng575.bin
[2010/09/30 14:07:09 | 000,208,896 | —- | C] () – C:\Windows\SysWow64\iglhsip32.dll
[2010/09/30 14:07:09 | 000,143,360 | —- | C] () – C:\Windows\SysWow64\iglhcp32.dll
[2010/09/30 14:07:08 | 000,104,636 | —- | C] () – C:\Windows\SysWow64\igfcg575m.bin
[2010/09/30 14:07:06 | 000,127,868 | —- | C] () – C:\Windows\SysWow64\igcompkrng575.bin

========== LOP Check ==========

[2011/01/08 10:21:50 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\Canneverbe Limited
[2011/07/10 20:01:50 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/06/17 09:40:02 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\Dropbox
[2011/01/07 08:36:10 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\FreeAudioPack
[2010/11/03 21:52:39 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\Leadertech
[2010/12/10 20:08:24 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\MyPublisher
[2010/10/26 19:11:48 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\Octoshape
[2011/01/08 10:21:37 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\OpenCandy
[2011/07/01 08:15:50 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010/12/26 11:33:45 | 000,000,000 | —D | M] – C:\Users\Laura\AppData\Roaming\Template
[2012/06/11 07:11:49 | 000,032,562 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

oldman960

Post #12June 18, 2012, 2:57 PM UTC

Hi Glad your here!,

Nothing too serious in the ESET scan, a couple of false positives and some quarantined files.

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
IE - HKLM\..\SearchScopes\{23088cf8-eaf8-4bb3-a251-9ba61557ac75}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…000842b2b9d5b14
IE - HKCU\..\SearchScopes\{23088cf8-eaf8-4bb3-a251-9ba61557ac75}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=109935&tt=050412_30b&babsrc=KW_ss&mntrId=225be37c000000000000842b2b9d5b14&q="
[2012/04/10 16:12:54 | 000,002,353 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml

:Files
C:\ProgramData\Microsoft\Windows\DRM\D886.tmp
C:\ProgramData\Microsoft\Windows\DRM\D896.tmp
C:\Users\All Users\Microsoft\Windows\DRM\D886.tmp
C:\Users\All Users\Microsoft\Windows\DRM\D896.tmp
C:\Users\Laura\Downloads\Setup_FreeConverter.exe
 
:Commands
[emptytemp]
[createrestorepoint]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.
Reboot your computer

Please post the OTL fix log.

Any problems?

Glad your here!

Post #13June 19, 2012, 11:02 AM UTC

Morning, FYI, Norton deletes OTL any chance it gets. No other noticed issues. Thank you for your help. All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{23088cf8-eaf8-4bb3-a251-9ba61557ac75}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23088cf8-eaf8-4bb3-a251-9ba61557ac75}\ not found. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{23088cf8-eaf8-4bb3-a251-9ba61557ac75}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23088cf8-eaf8-4bb3-a251-9ba61557ac75}\ not found. Prefs.js: "Search the web (Babylon)" removed from browser.search.defaultenginename Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1 Prefs.js: "http://search.babylon.com/?affID=109935&tt=050412_30b&babsrc=KW_ss&mntrId=225be37c000000000000842b2b9d5b14&q=" removed from keyword.URL C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml moved successfully. ========== FILES ========== C:\ProgramData\Microsoft\Windows\DRM\D886.tmp moved successfully. C:\ProgramData\Microsoft\Windows\DRM\D896.tmp moved successfully. File\Folder C:\Users\All Users\Microsoft\Windows\DRM\D886.tmp not found. File\Folder C:\Users\All Users\Microsoft\Windows\DRM\D896.tmp not found. C:\Users\Laura\Downloads\Setup_FreeConverter.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: admin ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 8003126 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 64232013 bytes ->Flash cache emptied: 1780 bytes User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 56468 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Laura ->Temp folder emptied: 73739 bytes ->Temporary Internet Files folder emptied: 2254647 bytes ->Java cache emptied: 1 bytes ->FireFox cache emptied: 1040111308 bytes ->Google Chrome cache emptied: 10460362 bytes ->Flash cache emptied: 311746 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 3066798 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 66784 bytes %systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 757 bytes RecycleBin emptied: 1378844369 bytes Total Files Cleaned = 2,391.00 mb Restore point Set: OTL Restore Point OTL by OldTimer - Version 3.2.49.0 log created on 06192012_065335 Files\Folders moved on Reboot… C:\Users\Laura\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. Registry entries deleted on Reboot…

oldman960

Post #14June 19, 2012, 11:14 PM UTC

Hi Glad your here!,

You're welcome.

Norton deletes OTL any chance it gets.

I suppose it would be a novel idea if the AVs went after the bad guys and left our tools alone. Just joking, I realize the AVs are playing catchup. First the infection then the detection. But thanks for letting me know, it will be something to watch for.

Let's clean up. Since Norton doesn't like some of our tools it would probably be best to disable it while removing the tools. This includes the removal of combofix.

From your desktop, please delete, if present

any notepads/logs that we created
mbr.zip
mbr.dat
aswMBR.exe
TDSSKiller

You can also delete this folder C:\TDSSKiller_Quarantine

Next

Please locate combofix.exe on your desktop, right click it and click delete. Please download a new copy from HEREor and save it to you desktop. We will not be running it but we need it for the uninstall to work properly.

Next

Click your start button. In the search box copy and paste the following line and hit enter

Combofix /uninstall

Next

pen OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.

I suggest you keep MBAM. Keep it updated and use it regularly.

Updates and upgrades

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum If you choose Foxit, decline the Foxit Toolbar offered during the install.

In either case you should uninstall Adobe Reader 9.5.1 first. Be sure to move any PDF documents to another folder first though.

Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. With the Norton Internt Security and Spybot you should be covered.

You can use Spybot to install a Custom Hosts file.
1-Left-click the "Spybot - Search & Destroy" shortcut to open the program
2-Right-click an item in the list of immunizations and click "Deselect All."
3-Scroll down to the bottom of the list and click the checkbox to the left of "Global (Hosts)" under the "Windows" header.
4-Click "Immunize" on the Spybot toolbar.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.

-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

- Make sure you have reset Windows Updates to your chosen option. Click your start button > Control Panel > System > Windows updates (lower left) > change settings

- Keep your antivirus program updated, as well as any other security programs you have.

-More tips and programs can be found HERE

Please post back if you have any problems.

Take care

Glad your here!

Post #15June 20, 2012, 11:27 AM UTC

Thanks again for you help, really appreciated! Think that closes this one out.

When did Microsoft put out Microsoft Security Essentials? Thoughts on it?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Trojan.Agent Found in svchost.exe [Solved]

✨ Ask AI

Ask AI