Good Evening:
Hello
vonxeric and welcome to the
WTT forum.
My name is
Satchfan and I would be glad to help you with your computer problem.
Please read the following guidelines which will help to make cleaning your machine easier: please follow all instructions in the order posted please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear all logs/reports, etc. must be posted in Notepad . Please ensure that word wrap is un checked . In Notepad click Format , uncheck Word wrap if it is checked if you don't understand something, please don't hesitate to ask for clarification before proceeding the fixes are specific to your problem and should only be used for this issue on this machine. please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed! IMPORTANT :
Please
DO NOT install/uninstall any programs unless asked to.
Please
DO NOT run any scans other than those requested
I am looking at your log now and will reply with instructions shortly
Satchfan
Hello again vonxeric
Run DDS
Please download DDS by sUBs from one of the following links and save it to your desktop.
DDS.scr DDS.pif
disable any script blocking protection (How to Disable your Security Programs ) double click DDS icon to run the tool (may take up to 3 minutes to run) when done, DDS.txt will open. after a few moments, attach.txt will open in a second window. save both reports to your desktop. Post DDS.txt and Attach.txt reports in your next reply
===================================================
Run aswMBR download aswMBR.exe double click aswMBR.exe to run it if asked, accept the AVAST virus definition download click the "Scan" button to start scan on completion of the scan click Save log , save it to your desktop and post in your next reply
===========================================
Run Security Check
Download
Security Check by screen317 from
here or
here .
save it to your Desktop. double click SecurityCheck.exe and follow the onscreen instructions inside of the black box. a Notepad document should open automatically called checkup.txt ; please post the contents of that document. Please include the following in your next post :
DDS.txt
Thanks
Satchfan
Good Afternoon Satchfan:``````````````Antivirus/Firewall Check:`````````````` Windows Security Center service is not running! This report may not be accurate! `````````Anti-malware/Other Utilities Check:````````` Java version out of Date! Flash Player out of Date! Firefox out of Date! ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` ````````````````````End of Log``````````````````````
Hi vonxeric
You have
AVG and
Norton Internet Security, (NIS) . You
can not run more than one real-time antivirus at the same time. Although many have different methods of searching for and recognising threats, they will all be 'fighting' in memory to kick each other out, rendering them all ineffective. This can also make your computer slow and unstable.
Which one you uninstall is your choice but if you uninstall
NIS you will have to enable Windows firewall.
Uninstall programs click on Start, Control Panel click Uninstall Programs (it may take time for the list to appear, so be patient) scroll down the list and look for any the programs you are uninstalling click on it/them one at a time and then on Remove . If you have uninstalled AVG :
If you chose to uninstall AVG, there will still be some remnants of it on your computer even after the uninstall so please download and run AVG Removal Tool from
here If you have uninstalled NIS :
Enable Windows firewall:
click on Start, Control Pane, Windows Firewall on the left, click on Turn Windows Firewall on or off click Turn on Windows Firewall under each network location that you want to help protect, and then click OK
If you want the firewall to prevent all programs from communicating, including programs that you have previously allowed to communicate through the firewall, select the
Block all incoming connections, including those in the list of allowed programs check box.
======================================================
Run TDSSKiller
Please download
TDSSKiller.zip
======================================================
Download and run ComboFix
Download
Combofix from either of the links below, and save it to your desktop.
Link 1 Link 2 **Note: It
MUST be saved directly to your desktop. Choose
save as and then make sure you choose
Desktop
——————————————————————–
IMPORTANT -
Disable your AntiVirus and AntiSpyware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
here
——————————————————————–
Double click on
ComboFix.exe & follow the prompts.
when finished, it will produce a report for you. please post the C:\ComboFix.txt for further review. Logs to include with next post :
TDSSKiller log
Thanks
Satchfan
Good Afternoon Satchfan:
Norton Internet Security was never installed and does not show up on my program list. It was included with the computer software but not activated to my knowledge. I downloaded and used AVG from the time of purchase.
Windows will not let me turn on the firewall. It is giving me an error when I try to turn on.
The logs you requested follow, thank you for your help in advance.
ComboFix 12-06-21.02 - SPOONFAMILY 06/21/2012 17:11:19.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6092.4862 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\SPOONFAMILY\AppData\Local\Microsoft\Windows\Temporary Internet Files\{043F060B-A900-452E-8E98-A1286086F908}.xps
c:\users\SPOONFAMILY\AppData\Local\Microsoft\Windows\Temporary Internet Files\{09D7D598-89A3-4F3E-ABC9-70FF9FCEDB2A}.xps
c:\users\SPOONFAMILY\AppData\Local\Microsoft\Windows\Temporary Internet Files\{311ACC72-79B8-4E64-9336-E783C83032BA}.xps
c:\users\SPOONFAMILY\AppData\Local\Microsoft\Windows\Temporary Internet Files\{45116532-1EE8-4FA0-81E4-5882BCDDCCCE}.xps
c:\users\SPOONFAMILY\AppData\Local\Microsoft\Windows\Temporary Internet Files\{4E8F8A4D-3AEF-49ED-817C-9F05A281E0A9}.xps
c:\users\SPOONFAMILY\AppData\Local\Microsoft\Windows\Temporary Internet Files\{7E0CF97C-2E43-45EB-9310-49E2481C5C7C}.xps
c:\users\SPOONFAMILY\AppData\Local\Microsoft\Windows\Temporary Internet Files\{CAA44375-0E6A-4268-A4B6-5C6D5323DA9D}.xps
c:\users\SPOONFAMILY\AppData\Local\Microsoft\Windows\Temporary Internet Files\{EAE750F9-C93E-4FD0-ACFC-E306A9C0DE6A}.xps
c:\users\SPOONFAMILY\AppData\Local\Microsoft\Windows\Temporary Internet Files\{EC2933F0-2902-4197-8B1C-82A1AB038581}.xps
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\@
c:\windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\L\00000004.@
c:\windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\L\1afb2d56
c:\windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\L\201d3dde
c:\windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\U\00000004.@
c:\windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\U\00000008.@
c:\windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\U\000000cb.@
c:\windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\U\80000000.@
c:\windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\U\80000032.@
c:\windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\U\80000064.@
.
Infected copy of c:\windows\system32\services.exe was found and disinfected
Restored copy from - c:\32788r22fwjfw\HarddiskVolumeShadowCopy7_!Windows!System32!services.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-05-22 to 2012-06-22 )))))))))))))))))))))))))))))))
.
.
2012-06-22 00:16 . 2012-06-22 00:16 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-06-20 01:23 . 2012-06-20 01:25 117182464 —-a-w- c:\users\SPOONFAMILY\kavkis.msi
2012-06-20 01:20 . 2012-06-20 01:21 ——– d—–w- c:\program files (x86)\CompuClever
2012-06-20 01:20 . 2012-06-20 01:20 ——– d—–w- c:\users\SPOONFAMILY\AppData\Roaming\CompuClever
2012-06-19 02:38 . 2012-06-19 02:38 ——– d-sh–w- c:\windows\SysWow64\%APPDATA%
2012-06-15 21:27 . 2012-06-15 21:27 ——– d—–w- c:\program files (x86)\Common Files\InstallShield
2012-06-12 22:33 . 2012-04-26 05:41 77312 —-a-w- c:\windows\system32\rdpwsx.dll
2012-06-09 00:50 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-09 00:50 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll
2012-06-09 00:50 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-09 00:50 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll
2012-06-09 00:50 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll
2012-06-09 00:50 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll
2012-06-09 00:50 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll
2012-06-09 00:50 . 2012-06-02 22:19 186752 —-a-w- c:\windows\system32\wuwebv.dll
2012-06-09 00:50 . 2012-06-02 22:15 36864 —-a-w- c:\windows\system32\wuapp.exe
2012-06-06 00:34 . 2012-06-06 00:34 ——– d—–w- c:\users\SPOONFAMILY\AppData\Local\Windows Live
2012-05-30 02:40 . 2012-05-30 02:40 ——– d—–w- c:\users\SPOONFAMILY\AppData\Local\AuthenTec
2012-05-29 03:43 . 2012-05-29 03:43 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2012-05-29 03:43 . 2012-05-29 03:43 4283672 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-05-29 03:43 . 2012-05-29 03:43 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-05-29 03:43 . 2012-05-29 03:43 539984 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-05-28 20:48 . 2012-05-28 20:48 ——– d—–w- c:\program files (x86)\Google
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-12 06:27 . 2012-05-12 05:54 419488 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-12 06:27 . 2011-10-16 02:36 70304 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-12 06:27 . 2012-05-12 06:27 8769696 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-05-12 05:34 . 2011-03-29 01:36 19352 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-04-29 10:09 . 2012-04-29 10:09 75776 —-a-w- c:\windows\SysWow64\psisrndr.ax
2012-04-29 10:09 . 2012-04-29 10:09 613888 —-a-w- c:\windows\system32\psisdecd.dll
2012-04-29 10:09 . 2012-04-29 10:09 465408 —-a-w- c:\windows\SysWow64\psisdecd.dll
2012-04-29 10:09 . 2012-04-29 10:09 108032 —-a-w- c:\windows\system32\psisrndr.ax
2012-04-29 10:08 . 2012-04-29 10:08 861696 —-a-w- c:\windows\system32\oleaut32.dll
2012-04-29 10:08 . 2012-04-29 10:08 571904 —-a-w- c:\windows\SysWow64\oleaut32.dll
2012-04-29 10:08 . 2012-04-29 10:08 331776 —-a-w- c:\windows\system32\oleacc.dll
2012-04-29 10:08 . 2012-04-29 10:08 233472 —-a-w- c:\windows\SysWow64\oleacc.dll
2012-04-19 11:50 . 2012-04-19 11:50 28480 —-a-w- c:\windows\system32\drivers\avgidsha.sys
2012-04-05 01:47 . 2012-05-19 02:23 772504 —-a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-04-05 01:47 . 2012-05-19 02:23 687504 —-a-w- c:\windows\SysWow64\deployJava1.dll
2012-03-30 11:35 . 2012-05-13 00:07 1918320 —-a-w- c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-06-11 22:45 2068536 —-a-w- c:\program files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll" [2012-06-11 2068536]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-10-08 169528]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008]
"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-06-11 1104440]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-28 116648]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-12 257696]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-08-01 195320]
R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-28 116648]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-21 129976]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [x]
S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\avgidsagent.exe [2012-04-30 5106744]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-07-20 249648]
S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2012\TrueSuiteService.exe [2011-08-26 260424]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-10 86072]
S2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2011-02-17 682040]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-03-14 197504]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-03-05 35200]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-20 13592]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-08-29 2424424]
S2 jhi_service;Intel® Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [2011-02-24 212944]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-22 2656280]
S2 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe [2012-06-11 935480]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfiltera.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-12 06:27]
.
2012-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-28 20:48]
.
2012-06-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-28 20:48]
.
2012-06-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90196078-743679549-3009314732-1000Core.job
- c:\users\SPOONFAMILY\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-13 02:16]
.
2012-06-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90196078-743679549-3009314732-1000UA.job
- c:\users\SPOONFAMILY\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-13 02:16]
.
2012-06-17 c:\windows\Tasks\HPCeeScheduleForSPOONFAMILY-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 11:43]
.
2012-06-17 c:\windows\Tasks\HPCeeScheduleForSPOONFAMILY.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 11:43]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-15 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-15 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-15 416024]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-09-08 1424896]
"SetDefault"="c:\program files\Hewlett-Packard\HP LaunchBox\SetDefault.exe" [2011-06-27 42808]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll
FF - ProfilePath - c:\users\SPOONFAMILY\AppData\Roaming\Mozilla\Firefox\Profiles\6ktmfifv.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7Beae4e930-1d62-4510-8637-942656fb67af%7D&mid=c1db3518920d47d08b03a9aaf389d444-8dd6905fb5122891f698d9f55554baa3cc7a2df2&ds=AVG&v=11.1.0.7&lang=en&pr=fr&d=2012-05-11%2022%3A52%3A04&sap=ku&q=
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109935&tt=100512_2_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 92900f4a00000000000078e3b56d3db7
FF - user.js: extensions.BabylonToolbar_i.hardId - 92900f4a00000000000078e3b56d3db7
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15479
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1718:33
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHANS REMOVED - - - -
.
HKLM_Wow6432Node-ActiveSetup-{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1} - msiexec
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
.
**************************************************************************
.
Completion time: 2012-06-21 17:47:05 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-22 00:47
.
Pre-Run: 415,500,611,584 bytes free
Post-Run: 415,673,393,152 bytes free
.
- - End Of File - - 6554D1DFD37CA48389B4AFBEAF8C1DD0
16:49:40.0784 6320 TDSS rootkit removing tool [removed] Jun 20 2012 20:53:32
16:49:41.0390 6320 ============================================================
16:49:41.0390 6320 Current date / time: 2012/06/21 16:49:41.0390
16:49:41.0390 6320 SystemInfo:
16:49:41.0390 6320
16:49:41.0390 6320 OS Version: 6.1.7601 ServicePack: 1.0
16:49:41.0390 6320 Product type: Workstation
16:49:41.0391 6320 ComputerName: SPOONFAMILY-HP
16:49:41.0391 6320 UserName: SPOONFAMILY
16:49:41.0391 6320 Windows directory: C:\Windows
16:49:41.0391 6320 System windows directory: C:\Windows
16:49:41.0392 6320 Running under WOW64
16:49:41.0392 6320 Processor architecture: Intel x64
16:49:41.0392 6320 Number of processors: 4
16:49:41.0392 6320 Page size: 0x1000
16:49:41.0392 6320 Boot type: Normal boot
16:49:41.0392 6320 ============================================================
16:49:41.0819 6320 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:49:41.0823 6320 ============================================================
16:49:41.0823 6320 \Device\Harddisk0\DR0:
16:49:41.0823 6320 MBR partitions:
16:49:41.0823 6320 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800
16:49:41.0823 6320 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x3719A000
16:49:41.0823 6320 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x371FE000, BlocksNum 0x2998000
16:49:41.0823 6320 \Device\Harddisk0\DR0\Partition3: MBR, Type 0xC, StartLBA 0x39B96000, BlocksNum 0x7EF800
16:49:41.0823 6320 ============================================================
16:49:41.0844 6320 C: <-> \Device\Harddisk0\DR0\Partition1
16:49:41.0888 6320 D: <-> \Device\Harddisk0\DR0\Partition2
16:49:41.0906 6320 E: <-> \Device\Harddisk0\DR0\Partition3
16:49:41.0906 6320 ============================================================
16:49:41.0906 6320 Initialize success
16:49:41.0906 6320 ============================================================
16:49:49.0478 6880 ============================================================
16:49:49.0478 6880 Scan started
16:49:49.0478 6880 Mode: Manual;
16:49:49.0478 6880 ============================================================
16:49:52.0050 6880 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
16:49:52.0052 6880 1394ohci - ok
16:49:52.0085 6880 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
16:49:52.0087 6880 ACPI - ok
16:49:52.0123 6880 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
16:49:52.0124 6880 AcpiPmi - ok
16:49:52.0236 6880 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
16:49:52.0238 6880 AdobeARMservice - ok
16:49:52.0433 6880 AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
16:49:52.0439 6880 AdobeFlashPlayerUpdateSvc - ok
16:49:52.0535 6880 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys
16:49:52.0545 6880 adp94xx - ok
16:49:52.0598 6880 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys
16:49:52.0603 6880 adpahci - ok
16:49:52.0644 6880 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys
16:49:52.0646 6880 adpu320 - ok
16:49:52.0704 6880 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
16:49:52.0705 6880 AeLookupSvc - ok
16:49:52.0746 6880 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
16:49:52.0750 6880 AFD - ok
16:49:52.0783 6880 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
16:49:52.0784 6880 agp440 - ok
16:49:52.0790 6880 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
16:49:52.0791 6880 ALG - ok
16:49:52.0830 6880 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
16:49:52.0831 6880 aliide - ok
16:49:52.0851 6880 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
16:49:52.0851 6880 amdide - ok
16:49:52.0890 6880 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys
16:49:52.0892 6880 AmdK8 - ok
16:49:52.0902 6880 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys
16:49:52.0903 6880 AmdPPM - ok
16:49:52.0953 6880 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
16:49:52.0955 6880 amdsata - ok
16:49:52.0992 6880 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys
16:49:52.0994 6880 amdsbs - ok
16:49:53.0012 6880 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
16:49:53.0012 6880 amdxata - ok
16:49:53.0040 6880 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
16:49:53.0041 6880 AppID - ok
16:49:53.0080 6880 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
16:49:53.0081 6880 AppIDSvc - ok
16:49:53.0117 6880 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
16:49:53.0120 6880 Appinfo - ok
16:49:53.0168 6880 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys
16:49:53.0170 6880 arc - ok
16:49:53.0217 6880 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys
16:49:53.0220 6880 arcsas - ok
16:49:53.0265 6880 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
16:49:53.0267 6880 AsyncMac - ok
16:49:53.0307 6880 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
16:49:53.0307 6880 atapi - ok
16:49:53.0367 6880 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
16:49:53.0371 6880 AudioEndpointBuilder - ok
16:49:53.0380 6880 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
16:49:53.0384 6880 AudioSrv - ok
16:49:53.0631 6880 AVGIDSAgent (ba60fd7a64b9759a14c0fba4a9ed4c7b) C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe
16:49:53.0700 6880 AVGIDSAgent - ok
16:49:53.0817 6880 AVGIDSDriver (1b2e9fcdc26dc7c81d4131430e2dc936) C:\Windows\system32\DRIVERS\avgidsdrivera.sys
16:49:53.0819 6880 AVGIDSDriver - ok
16:49:53.0829 6880 AVGIDSFilter (0f293406f64b48d5d2f0d3a1117f3a83) C:\Windows\system32\DRIVERS\avgidsfiltera.sys
16:49:53.0830 6880 AVGIDSFilter - ok
16:49:53.0838 6880 AVGIDSHA (cffc3a4a638f462e0561cb368b9a7a3a) C:\Windows\system32\DRIVERS\avgidsha.sys
16:49:53.0838 6880 AVGIDSHA - ok
16:49:53.0870 6880 Avgldx64 (59955b4c288dd2a8b9fd2cd5158355c5) C:\Windows\system32\DRIVERS\avgldx64.sys
16:49:53.0873 6880 Avgldx64 - ok
16:49:53.0891 6880 Avgmfx64 (a6aec362aae5e2dda7445e7690cb0f33) C:\Windows\system32\DRIVERS\avgmfx64.sys
16:49:53.0894 6880 Avgmfx64 - ok
16:49:53.0937 6880 Avgrkx64 (645c7f0a0e39758a0024a9b1748273c0) C:\Windows\system32\DRIVERS\avgrkx64.sys
16:49:53.0938 6880 Avgrkx64 - ok
16:49:53.0953 6880 Avgtdia (1bee674ad792b1c63bb0dac5fa724b23) C:\Windows\system32\DRIVERS\avgtdia.sys
16:49:53.0958 6880 Avgtdia - ok
16:49:54.0027 6880 avgwd (ea1145debcd508fd25bd1e95c4346929) C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
16:49:54.0029 6880 avgwd - ok
16:49:54.0075 6880 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
16:49:54.0077 6880 AxInstSV - ok
16:49:54.0128 6880 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys
16:49:54.0133 6880 b06bdrv - ok
16:49:54.0175 6880 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
16:49:54.0182 6880 b57nd60a - ok
16:49:54.0237 6880 BBSvc (28a4012e68bc9597bcb9b26b51aac4b6) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
16:49:54.0240 6880 BBSvc - ok
16:49:54.0273 6880 BBUpdate (785de7abda13309d6065305542829e76) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
16:49:54.0276 6880 BBUpdate - ok
16:49:54.0364 6880 BCM43XX (9e84a931dbee0292e38ed672f6293a99) C:\Windows\system32\DRIVERS\bcmwl664.sys
16:49:54.0379 6880 BCM43XX - ok
16:49:54.0415 6880 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
16:49:54.0417 6880 BDESVC - ok
16:49:54.0462 6880 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
16:49:54.0463 6880 Beep - ok
16:49:54.0515 6880 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
16:49:54.0524 6880 BITS - ok
16:49:54.0542 6880 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\drivers\blbdrive.sys
16:49:54.0543 6880 blbdrive - ok
16:49:54.0566 6880 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
16:49:54.0567 6880 bowser - ok
16:49:54.0590 6880 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys
16:49:54.0591 6880 BrFiltLo - ok
16:49:54.0601 6880 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys
16:49:54.0602 6880 BrFiltUp - ok
16:49:54.0631 6880 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
16:49:54.0632 6880 Browser - ok
16:49:54.0671 6880 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
16:49:54.0674 6880 Brserid - ok
16:49:54.0679 6880 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
16:49:54.0680 6880 BrSerWdm - ok
16:49:54.0704 6880 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
16:49:54.0704 6880 BrUsbMdm - ok
16:49:54.0707 6880 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
16:49:54.0708 6880 BrUsbSer - ok
16:49:54.0738 6880 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\drivers\bthmodem.sys
16:49:54.0739 6880 BTHMODEM - ok
16:49:54.0774 6880 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
16:49:54.0775 6880 bthserv - ok
16:49:54.0800 6880 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
16:49:54.0802 6880 cdfs - ok
16:49:54.0842 6880 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
16:49:54.0843 6880 cdrom - ok
16:49:54.0882 6880 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
16:49:54.0884 6880 CertPropSvc - ok
16:49:54.0900 6880 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys
16:49:54.0901 6880 circlass - ok
16:49:54.0927 6880 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
16:49:54.0930 6880 CLFS - ok
16:49:54.0988 6880 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:49:54.0989 6880 clr_optimization_v2.0.50727_32 - ok
16:49:55.0025 6880 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
16:49:55.0026 6880 clr_optimization_v2.0.50727_64 - ok
16:49:55.0104 6880 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:49:55.0106 6880 clr_optimization_v4.0.30319_32 - ok
16:49:55.0159 6880 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
16:49:55.0163 6880 clr_optimization_v4.0.30319_64 - ok
16:49:55.0205 6880 clwvd (50f92c943f18b070f166d019dfab3d9a) C:\Windows\system32\DRIVERS\clwvd.sys
16:49:55.0206 6880 clwvd - ok
16:49:55.0251 6880 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys
16:49:55.0253 6880 CmBatt - ok
16:49:55.0272 6880 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
16:49:55.0274 6880 cmdide - ok
16:49:55.0331 6880 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
16:49:55.0335 6880 CNG - ok
16:49:55.0372 6880 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys
16:49:55.0373 6880 Compbatt - ok
16:49:55.0427 6880 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
16:49:55.0428 6880 CompositeBus - ok
16:49:55.0447 6880 COMSysApp - ok
16:49:55.0497 6880 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys
16:49:55.0499 6880 crcdisk - ok
16:49:55.0558 6880 CryptSvc (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
16:49:55.0560 6880 CryptSvc - ok
16:49:55.0612 6880 dc3d (7af9dac504fbd047cbc3e64ae52c92bf) C:\Windows\system32\DRIVERS\dc3d.sys
16:49:55.0613 6880 dc3d - ok
16:49:55.0669 6880 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
16:49:55.0674 6880 DcomLaunch - ok
16:49:55.0725 6880 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
16:49:55.0728 6880 defragsvc - ok
16:49:55.0767 6880 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
16:49:55.0769 6880 DfsC - ok
16:49:55.0829 6880 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
16:49:55.0831 6880 Dhcp - ok
16:49:55.0907 6880 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
16:49:55.0908 6880 discache - ok
16:49:55.0953 6880 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys
16:49:55.0954 6880 Disk - ok
16:49:56.0006 6880 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
16:49:56.0008 6880 Dnscache - ok
16:49:56.0064 6880 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
16:49:56.0067 6880 dot3svc - ok
16:49:56.0081 6880 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
16:49:56.0082 6880 DPS - ok
16:49:56.0123 6880 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
16:49:56.0125 6880 drmkaud - ok
16:49:56.0199 6880 DXGKrnl (a4f408ad1065c7ad2ed332c68025b435) C:\Windows\System32\drivers\dxgkrnl.sys
16:49:56.0215 6880 DXGKrnl - ok
16:49:56.0249 6880 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
16:49:56.0251 6880 EapHost - ok
16:49:56.0371 6880 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys
16:49:56.0401 6880 ebdrv - ok
16:49:56.0493 6880 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
16:49:56.0494 6880 EFS - ok
16:49:56.0564 6880 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
16:49:56.0571 6880 ehRecvr - ok
16:49:56.0592 6880 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
16:49:56.0594 6880 ehSched - ok
16:49:56.0653 6880 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys
16:49:56.0658 6880 elxstor - ok
16:49:56.0688 6880 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
16:49:56.0689 6880 ErrDev - ok
16:49:56.0755 6880 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
16:49:56.0761 6880 EventSystem - ok
16:49:56.0788 6880 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
16:49:56.0791 6880 exfat - ok
16:49:56.0816 6880 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
16:49:56.0819 6880 fastfat - ok
16:49:56.0874 6880 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
16:49:56.0884 6880 Fax - ok
16:49:56.0907 6880 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys
16:49:56.0909 6880 fdc - ok
16:49:56.0931 6880 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
16:49:56.0932 6880 fdPHost - ok
16:49:56.0943 6880 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
16:49:56.0945 6880 FDResPub - ok
16:49:56.0978 6880 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
16:49:56.0979 6880 FileInfo - ok
16:49:56.0990 6880 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
16:49:56.0991 6880 Filetrace - ok
16:49:57.0003 6880 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys
16:49:57.0004 6880 flpydisk - ok
16:49:57.0033 6880 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
16:49:57.0036 6880 FltMgr - ok
16:49:57.0105 6880 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
16:49:57.0116 6880 FontCache - ok
16:49:57.0198 6880 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
16:49:57.0200 6880 FontCache3.0.0.0 - ok
16:49:57.0319 6880 FPLService (f80bdc0d9e7b9595e74b434446ad3781) C:\Program Files (x86)\HP SimplePass 2012\TrueSuiteService.exe
16:49:57.0323 6880 FPLService - ok
16:49:57.0419 6880 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
16:49:57.0421 6880 FsDepends - ok
16:49:57.0484 6880 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
16:49:57.0485 6880 Fs_Rec - ok
16:49:57.0514 6880 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
16:49:57.0517 6880 fvevol - ok
16:49:57.0563 6880 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys
16:49:57.0566 6880 gagp30kx - ok
16:49:57.0629 6880 GamesAppService (c403c5db49a0f9aaf4f2128edc0106d8) C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
16:49:57.0633 6880 GamesAppService - ok
16:49:57.0697 6880 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
16:49:57.0707 6880 gpsvc - ok
16:49:57.0774 6880 gupdate (506708142bc63daba64f2d3ad1dcd5bf) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:49:57.0775 6880 gupdate - ok
16:49:57.0780 6880 gupdatem (506708142bc63daba64f2d3ad1dcd5bf) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:49:57.0781 6880 gupdatem - ok
16:49:57.0809 6880 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
16:49:57.0810 6880 hcw85cir - ok
16:49:57.0856 6880 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
16:49:57.0860 6880 HdAudAddService - ok
16:49:57.0899 6880 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys
16:49:57.0900 6880 HDAudBus - ok
16:49:57.0920 6880 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys
16:49:57.0921 6880 HidBatt - ok
16:49:57.0932 6880 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys
16:49:57.0933 6880 HidBth - ok
16:49:57.0973 6880 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys
16:49:57.0974 6880 HidIr - ok
16:49:58.0002 6880 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
16:49:58.0003 6880 hidserv - ok
16:49:58.0046 6880 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
16:49:58.0047 6880 HidUsb - ok
16:49:58.0068 6880 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
16:49:58.0070 6880 hkmsvc - ok
16:49:58.0094 6880 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
16:49:58.0097 6880 HomeGroupListener - ok
16:49:58.0130 6880 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
16:49:58.0133 6880 HomeGroupProvider - ok
16:49:58.0230 6880 HP Support Assistant Service (13bb1114451c63bfb41ba7daa4d70a29) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
16:49:58.0230 6880 HP Support Assistant Service - ok
16:49:58.0307 6880 HPAuto (7b8c1b09c11e8db7c4480abd7d17e821) C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe
16:49:58.0313 6880 HPAuto - ok
16:49:58.0353 6880 HPClientSvc (6a181452d4e240b8ecc7614b9a19bde9) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
16:49:58.0357 6880 HPClientSvc - ok
16:49:58.0428 6880 HPDrvMntSvc.exe (02ce63d8dd5e6dd5ceff336191c0859e) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
16:49:58.0433 6880 HPDrvMntSvc.exe - ok
16:49:58.0506 6880 hpqwmiex (e7c7829ba0395e48f8c8fe16b8832344) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
16:49:58.0513 6880 hpqwmiex - ok
16:49:58.0641 6880 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
16:49:58.0643 6880 HpSAMD - ok
16:49:58.0699 6880 HPWMISVC (2bec76bdcd1bc080210325e7b5094834) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
16:49:58.0699 6880 HPWMISVC - ok
16:49:58.0746 6880 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
16:49:58.0755 6880 HTTP - ok
16:49:58.0770 6880 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
16:49:58.0771 6880 hwpolicy - ok
16:49:58.0809 6880 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
16:49:58.0810 6880 i8042prt - ok
16:49:58.0854 6880 iaStor (2fdaec4b02729c48c0fd1b0b4695995b) C:\Windows\system32\DRIVERS\iaStor.sys
16:49:58.0858 6880 iaStor - ok
16:49:58.0941 6880 IAStorDataMgrSvc (d41861e56e7552c13674d7f147a02464) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
16:49:58.0942 6880 IAStorDataMgrSvc - ok
16:49:58.0988 6880 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
16:49:58.0993 6880 iaStorV - ok
16:49:59.0123 6880 IconMan_R (634bcd82fb1ce4b475b3d64935f3d2cc) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
16:49:59.0145 6880 IconMan_R - ok
16:49:59.0259 6880 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
16:49:59.0269 6880 idsvc - ok
16:49:59.0908 6880 igfx (33faa40b288002c89529dbd14f3ab72c) C:\Windows\system32\DRIVERS\igdkmd64.sys
16:50:00.0147 6880 igfx - ok
16:50:00.0248 6880 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys
16:50:00.0250 6880 iirsp - ok
16:50:00.0326 6880 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
16:50:00.0335 6880 IKEEXT - ok
16:50:00.0382 6880 IntcDAud (fc727061c0f47c8059e88e05d5c8e381) C:\Windows\system32\DRIVERS\IntcDAud.sys
16:50:00.0386 6880 IntcDAud - ok
16:50:00.0434 6880 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
16:50:00.0435 6880 intelide - ok
16:50:00.0467 6880 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
16:50:00.0468 6880 intelppm - ok
16:50:00.0500 6880 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
16:50:00.0503 6880 IPBusEnum - ok
16:50:00.0543 6880 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:50:00.0546 6880 IpFilterDriver - ok
16:50:00.0567 6880 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
16:50:00.0569 6880 IPMIDRV - ok
16:50:00.0576 6880 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
16:50:00.0578 6880 IPNAT - ok
16:50:00.0602 6880 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
16:50:00.0603 6880 IRENUM - ok
16:50:00.0618 6880 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
16:50:00.0619 6880 isapnp - ok
16:50:00.0638 6880 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
16:50:00.0642 6880 iScsiPrt - ok
16:50:00.0762 6880 jhi_service (6c85719a21b3f62c2c76280f4bd36c7b) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
16:50:00.0764 6880 jhi_service - ok
16:50:00.0804 6880 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
16:50:00.0805 6880 kbdclass - ok
16:50:00.0821 6880 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
16:50:00.0822 6880 kbdhid - ok
16:50:00.0848 6880 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:50:00.0849 6880 KeyIso - ok
16:50:00.0862 6880 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
16:50:00.0863 6880 KSecDD - ok
16:50:00.0878 6880 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
16:50:00.0879 6880 KSecPkg - ok
16:50:00.0908 6880 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
16:50:00.0909 6880 ksthunk - ok
16:50:00.0958 6880 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
16:50:00.0962 6880 KtmRm - ok
16:50:01.0019 6880 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
16:50:01.0022 6880 LanmanServer - ok
16:50:01.0053 6880 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
16:50:01.0056 6880 LanmanWorkstation - ok
16:50:01.0097 6880 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
16:50:01.0098 6880 lltdio - ok
16:50:01.0151 6880 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
16:50:01.0156 6880 lltdsvc - ok
16:50:01.0180 6880 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
16:50:01.0181 6880 lmhosts - ok
16:50:01.0296 6880 LMS (d7e0bed3ea21d7bddd410ade51708d90) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
16:50:01.0301 6880 LMS - ok
16:50:01.0357 6880 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys
16:50:01.0360 6880 LSI_FC - ok
16:50:01.0397 6880 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys
16:50:01.0400 6880 LSI_SAS - ok
16:50:01.0427 6880 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys
16:50:01.0428 6880 LSI_SAS2 - ok
16:50:01.0451 6880 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys
16:50:01.0452 6880 LSI_SCSI - ok
16:50:01.0487 6880 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
16:50:01.0487 6880 luafv - ok
16:50:01.0524 6880 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
16:50:01.0526 6880 Mcx2Svc - ok
16:50:01.0579 6880 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys
16:50:01.0580 6880 megasas - ok
16:50:01.0611 6880 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys
16:50:01.0614 6880 MegaSR - ok
16:50:01.0671 6880 MEIx64 (a6518dcc42f7a6e999bb3bea8fd87567) C:\Windows\system32\DRIVERS\HECIx64.sys
16:50:01.0673 6880 MEIx64 - ok
16:50:01.0691 6880 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
16:50:01.0692 6880 MMCSS - ok
16:50:01.0703 6880 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
16:50:01.0704 6880 Modem - ok
16:50:01.0744 6880 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
16:50:01.0744 6880 monitor - ok
16:50:01.0779 6880 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
16:50:01.0780 6880 mouclass - ok
16:50:01.0789 6880 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
16:50:01.0790 6880 mouhid - ok
16:50:01.0810 6880 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
16:50:01.0811 6880 mountmgr - ok
16:50:01.0888 6880 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
16:50:01.0889 6880 MozillaMaintenance - ok
16:50:01.0919 6880 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
16:50:01.0922 6880 mpio - ok
16:50:01.0939 6880 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
16:50:01.0941 6880 mpsdrv - ok
16:50:01.0964 6880 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
16:50:01.0966 6880 MRxDAV - ok
16:50:02.0008 6880 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
16:50:02.0009 6880 mrxsmb - ok
16:50:02.0037 6880 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:50:02.0039 6880 mrxsmb10 - ok
16:50:02.0060 6880 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:50:02.0061 6880 mrxsmb20 - ok
16:50:02.0079 6880 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
16:50:02.0080 6880 msahci - ok
16:50:02.0105 6880 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
16:50:02.0107 6880 msdsm - ok
16:50:02.0140 6880 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
16:50:02.0143 6880 MSDTC - ok
16:50:02.0158 6880 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
16:50:02.0158 6880 Msfs - ok
16:50:02.0182 6880 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
16:50:02.0183 6880 mshidkmdf - ok
16:50:02.0206 6880 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
16:50:02.0207 6880 msisadrv - ok
16:50:02.0240 6880 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
16:50:02.0243 6880 MSiSCSI - ok
16:50:02.0246 6880 msiserver - ok
16:50:02.0287 6880 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
16:50:02.0288 6880 MSKSSRV - ok
16:50:02.0308 6880 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
16:50:02.0309 6880 MSPCLOCK - ok
16:50:02.0321 6880 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
16:50:02.0322 6880 MSPQM - ok
16:50:02.0354 6880 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
16:50:02.0356 6880 MsRPC - ok
16:50:02.0384 6880 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
16:50:02.0384 6880 mssmbios - ok
16:50:02.0418 6880 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
16:50:02.0419 6880 MSTEE - ok
16:50:02.0449 6880 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys
16:50:02.0450 6880 MTConfig - ok
16:50:02.0456 6880 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
16:50:02.0457 6880 Mup - ok
16:50:02.0500 6880 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
16:50:02.0506 6880 napagent - ok
16:50:02.0548 6880 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
16:50:02.0550 6880 NativeWifiP - ok
16:50:02.0606 6880 NDIS (c38b8ae57f78915905064a9a24dc1586) C:\Windows\system32\drivers\ndis.sys
16:50:02.0612 6880 NDIS - ok
16:50:02.0651 6880 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
16:50:02.0652 6880 NdisCap - ok
16:50:02.0688 6880 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
16:50:02.0689 6880 NdisTapi - ok
16:50:02.0702 6880 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
16:50:02.0703 6880 Ndisuio - ok
16:50:02.0711 6880 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
16:50:02.0713 6880 NdisWan - ok
16:50:02.0723 6880 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
16:50:02.0724 6880 NDProxy - ok
16:50:02.0754 6880 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
16:50:02.0755 6880 NetBIOS - ok
16:50:02.0767 6880 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
16:50:02.0769 6880 NetBT - ok
16:50:02.0803 6880 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:50:02.0804 6880 Netlogon - ok
16:50:02.0849 6880 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
16:50:02.0858 6880 Netman - ok
16:50:02.0881 6880 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
16:50:02.0886 6880 netprofm - ok
16:50:02.0939 6880 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:50:02.0940 6880 NetTcpPortSharing - ok
16:50:02.0996 6880 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys
16:50:02.0998 6880 nfrd960 - ok
16:50:03.0047 6880 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
16:50:03.0052 6880 NlaSvc - ok
16:50:03.0071 6880 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
16:50:03.0073 6880 Npfs - ok
16:50:03.0093 6880 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
16:50:03.0094 6880 nsi - ok
16:50:03.0109 6880 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
16:50:03.0109 6880 nsiproxy - ok
16:50:03.0236 6880 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
16:50:03.0254 6880 Ntfs - ok
16:50:03.0428 6880 NuidFltr (317020d31f1696334679b9d0416eb62e) C:\Windows\system32\DRIVERS\NuidFltr.sys
16:50:03.0430 6880 NuidFltr - ok
16:50:03.0470 6880 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
16:50:03.0471 6880 Null - ok
16:50:03.0506 6880 NVENETFD (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
16:50:03.0510 6880 NVENETFD - ok
16:50:03.0547 6880 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
16:50:03.0550 6880 nvraid - ok
16:50:03.0584 6880 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
16:50:03.0586 6880 nvstor - ok
16:50:03.0648 6880 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
16:50:03.0652 6880 nv_agp - ok
16:50:03.0705 6880 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
16:50:03.0708 6880 ohci1394 - ok
16:50:03.0823 6880 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:50:03.0826 6880 ose - ok
16:50:04.0106 6880 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
16:50:04.0133 6880 osppsvc - ok
16:50:04.0234 6880 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
16:50:04.0239 6880 p2pimsvc - ok
16:50:04.0262 6880 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
16:50:04.0267 6880 p2psvc - ok
16:50:04.0309 6880 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys
16:50:04.0310 6880 Parport - ok
16:50:04.0340 6880 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
16:50:04.0341 6880 partmgr - ok
16:50:04.0375 6880 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
16:50:04.0377 6880 PcaSvc - ok
16:50:04.0418 6880 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
16:50:04.0419 6880 pci - ok
16:50:04.0446 6880 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
16:50:04.0446 6880 pciide - ok
16:50:04.0536 6880 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys
16:50:04.0541 6880 pcmcia - ok
16:50:04.0568 6880 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
16:50:04.0569 6880 pcw - ok
16:50:04.0603 6880 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
16:50:04.0608 6880 PEAUTH - ok
16:50:04.0692 6880 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
16:50:04.0694 6880 PerfHost - ok
16:50:04.0772 6880 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
16:50:04.0787 6880 pla - ok
16:50:04.0834 6880 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
16:50:04.0837 6880 PlugPlay - ok
16:50:04.0853 6880 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
16:50:04.0855 6880 PNRPAutoReg - ok
16:50:04.0880 6880 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
16:50:04.0883 6880 PNRPsvc - ok
16:50:04.0930 6880 Point64 (4f0878fd62d5f7444c5f1c4c66d9d293) C:\Windows\system32\DRIVERS\point64.sys
16:50:04.0931 6880 Point64 - ok
16:50:04.0971 6880 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
16:50:04.0977 6880 PolicyAgent - ok
16:50:05.0004 6880 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
16:50:05.0006 6880 Power - ok
16:50:05.0045 6880 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
16:50:05.0047 6880 PptpMiniport - ok
16:50:05.0071 6880 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys
16:50:05.0073 6880 Processor - ok
16:50:05.0103 6880 ProfSvc (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll
16:50:05.0105 6880 ProfSvc - ok
16:50:05.0148 6880 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:50:05.0149 6880 ProtectedStorage - ok
16:50:05.0171 6880 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
16:50:05.0173 6880 Psched - ok
16:50:05.0299 6880 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys
16:50:05.0324 6880 ql2300 - ok
16:50:05.0424 6880 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys
16:50:05.0427 6880 ql40xx - ok
16:50:05.0466 6880 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
16:50:05.0473 6880 QWAVE - ok
16:50:05.0490 6880 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
16:50:05.0491 6880 QWAVEdrv - ok
16:50:05.0513 6880 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
16:50:05.0514 6880 RasAcd - ok
16:50:05.0553 6880 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
16:50:05.0555 6880 RasAgileVpn - ok
16:50:05.0575 6880 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
16:50:05.0577 6880 RasAuto - ok
16:50:05.0592 6880 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
16:50:05.0594 6880 Rasl2tp - ok
16:50:05.0628 6880 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
16:50:05.0634 6880 RasMan - ok
16:50:05.0671 6880 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
16:50:05.0673 6880 RasPppoe - ok
16:50:05.0678 6880 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
16:50:05.0680 6880 RasSstp - ok
16:50:05.0707 6880 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
16:50:05.0711 6880 rdbss - ok
16:50:05.0729 6880 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\drivers\rdpbus.sys
16:50:05.0730 6880 rdpbus - ok
16:50:05.0749 6880 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
16:50:05.0749 6880 RDPCDD - ok
16:50:05.0778 6880 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
16:50:05.0779 6880 RDPENCDD - ok
16:50:05.0794 6880 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
16:50:05.0794 6880 RDPREFMP - ok
16:50:05.0831 6880 RDPWD (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
16:50:05.0833 6880 RDPWD - ok
16:50:05.0876 6880 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
16:50:05.0877 6880 rdyboost - ok
16:50:05.0922 6880 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
16:50:05.0924 6880 RemoteAccess - ok
16:50:05.0952 6880 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
16:50:05.0955 6880 RemoteRegistry - ok
16:50:05.0973 6880 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
16:50:05.0975 6880 RpcEptMapper - ok
16:50:05.0990 6880 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
16:50:05.0992 6880 RpcLocator - ok
16:50:06.0018 6880 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
16:50:06.0022 6880 RpcSs - ok
16:50:06.0062 6880 RSPCIESTOR (c897d551ee0dfcd8e638bf78e21d4d7f) C:\Windows\system32\DRIVERS\RtsPStor.sys
16:50:06.0066 6880 RSPCIESTOR - ok
16:50:06.0100 6880 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
16:50:06.0101 6880 rspndr - ok
16:50:06.0153 6880 RTL8167 (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys
16:50:06.0160 6880 RTL8167 - ok
16:50:06.0233 6880 RTL8192Ce (f33e70e48a54a7a1bfbeeb4f3b273e4a) C:\Windows\system32\DRIVERS\rtl8192Ce.sys
16:50:06.0245 6880 RTL8192Ce - ok
16:50:06.0271 6880 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:50:06.0272 6880 SamSs - ok
16:50:06.0296 6880 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
16:50:06.0298 6880 sbp2port - ok
16:50:06.0328 6880 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
16:50:06.0331 6880 SCardSvr - ok
16:50:06.0347 6880 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
16:50:06.0348 6880 scfilter - ok
16:50:06.0392 6880 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
16:50:06.0403 6880 Schedule - ok
16:50:06.0440 6880 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
16:50:06.0441 6880 SCPolicySvc - ok
16:50:06.0479 6880 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\DRIVERS\sdbus.sys
16:50:06.0480 6880 sdbus - ok
16:50:06.0507 6880 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
16:50:06.0511 6880 SDRSVC - ok
16:50:06.0527 6880 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
16:50:06.0528 6880 secdrv - ok
16:50:06.0548 6880 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
16:50:06.0550 6880 seclogon - ok
16:50:06.0573 6880 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
16:50:06.0575 6880 SENS - ok
16:50:06.0624 6880 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
16:50:06.0626 6880 SensrSvc - ok
16:50:06.0657 6880 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys
16:50:06.0658 6880 Serenum - ok
16:50:06.0678 6880 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys
16:50:06.0679 6880 Serial - ok
16:50:06.0713 6880 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys
16:50:06.0714 6880 sermouse - ok
16:50:06.0742 6880 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
16:50:06.0744 6880 SessionEnv - ok
16:50:06.0764 6880 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
16:50:06.0765 6880 sffdisk - ok
16:50:06.0780 6880 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
16:50:06.0781 6880 sffp_mmc - ok
16:50:06.0790 6880 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
16:50:06.0791 6880 sffp_sd - ok
16:50:06.0818 6880 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys
16:50:06.0819 6880 sfloppy - ok
16:50:06.0860 6880 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
16:50:06.0864 6880 ShellHWDetection - ok
16:50:06.0903 6880 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys
16:50:06.0904 6880 SiSRaid2 - ok
16:50:06.0921 6880 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys
16:50:06.0922 6880 SiSRaid4 - ok
16:50:06.0998 6880 SkypeUpdate (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files (x86)\Skype\Updater\Updater.exe
16:50:07.0001 6880 SkypeUpdate - ok
16:50:07.0045 6880 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
16:50:07.0047 6880 Smb - ok
16:50:07.0084 6880 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
16:50:07.0085 6880 SNMPTRAP - ok
16:50:07.0101 6880 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
16:50:07.0101 6880 spldr - ok
16:50:07.0150 6880 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
16:50:07.0154 6880 Spooler - ok
16:50:07.0526 6880 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
16:50:07.0621 6880 sppsvc - ok
16:50:07.0705 6880 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
16:50:07.0708 6880 sppuinotify - ok
16:50:07.0768 6880 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
16:50:07.0771 6880 srv - ok
16:50:07.0803 6880 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
16:50:07.0806 6880 srv2 - ok
16:50:07.0849 6880 SrvHsfHDA (0c4540311e11664b245a263e1154cef8) C:\Windows\system32\DRIVERS\VSTAZL6.SYS
16:50:07.0853 6880 SrvHsfHDA - ok
16:50:07.0907 6880 SrvHsfV92 (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS
16:50:07.0922 6880 SrvHsfV92 - ok
16:50:08.0043 6880 SrvHsfWinac (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
16:50:08.0051 6880 SrvHsfWinac - ok
16:50:08.0077 6880 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
16:50:08.0079 6880 srvnet - ok
16:50:08.0111 6880 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
16:50:08.0115 6880 SSDPSRV - ok
16:50:08.0130 6880 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
16:50:08.0134 6880 SstpSvc - ok
16:50:08.0215 6880 STacSV (7bf818b11c1fedc3e76d233124470a30) C:\Program Files\IDT\WDM\STacSV64.exe
16:50:08.0218 6880 STacSV - ok
16:50:08.0254 6880 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys
16:50:08.0256 6880 stexstor - ok
16:50:08.0320 6880 STHDA (ebc1a5e076a9be314d3d9e8ed19abb0a) C:\Windows\system32\DRIVERS\stwrt64.sys
16:50:08.0326 6880 STHDA - ok
16:50:08.0382 6880 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
16:50:08.0386 6880 stisvc - ok
16:50:08.0413 6880 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
16:50:08.0414 6880 swenum - ok
16:50:08.0459 6880 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
16:50:08.0465 6880 swprv - ok
16:50:08.0557 6880 SynTP (cc13ee4af170abb99f6449cbb62ab219) C:\Windows\system32\DRIVERS\SynTP.sys
16:50:08.0575 6880 SynTP - ok
16:50:08.0720 6880 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
16:50:08.0743 6880 SysMain - ok
16:50:08.0832 6880 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
16:50:08.0835 6880 TabletInputService - ok
16:50:08.0856 6880 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
16:50:08.0862 6880 TapiSrv - ok
16:50:08.0875 6880 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
16:50:08.0877 6880 TBS - ok
16:50:09.0028 6880 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
16:50:09.0046 6880 Tcpip - ok
16:50:09.0308 6880 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
16:50:09.0321 6880 TCPIP6 - ok
16:50:09.0525 6880 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
16:50:09.0526 6880 tcpipreg - ok
16:50:09.0544 6880 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
16:50:09.0545 6880 TDPIPE - ok
16:50:09.0574 6880 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
16:50:09.0576 6880 TDTCP - ok
16:50:09.0597 6880 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
16:50:09.0599 6880 tdx - ok
16:50:09.0627 6880 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
16:50:09.0628 6880 TermDD - ok
16:50:09.0720 6880 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
16:50:09.0728 6880 TermService - ok
16:50:09.0746 6880 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
16:50:09.0748 6880 Themes - ok
16:50:09.0771 6880 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
16:50:09.0772 6880 THREADORDER - ok
16:50:09.0797 6880 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
16:50:09.0799 6880 TrkWks - ok
16:50:09.0872 6880 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
16:50:09.0874 6880 TrustedInstaller - ok
16:50:09.0911 6880 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
16:50:09.0913 6880 tssecsrv - ok
16:50:09.0942 6880 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
16:50:09.0943 6880 TsUsbFlt - ok
16:50:09.0967 6880 TsUsbGD (9cc2ccae8a84820eaecb886d477cbcb8) C:\Windows\system32\drivers\TsUsbGD.sys
16:50:09.0969 6880 TsUsbGD - ok
16:50:10.0029 6880 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
16:50:10.0032 6880 tunnel - ok
16:50:10.0068 6880 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys
16:50:10.0069 6880 uagp35 - ok
16:50:10.0134 6880 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
16:50:10.0143 6880 udfs - ok
16:50:10.0184 6880 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
16:50:10.0186 6880 UI0Detect - ok
16:50:10.0216 6880 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
16:50:10.0217 6880 uliagpkx - ok
16:50:10.0259 6880 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
16:50:10.0260 6880 umbus - ok
16:50:10.0272 6880 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys
16:50:10.0273 6880 UmPass - ok
16:50:10.0461 6880 UNS (a678e5ddd974903dd71f503bdcaca218) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
16:50:10.0487 6880 UNS - ok
16:50:10.0579 6880 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
16:50:10.0585 6880 upnphost - ok
16:50:10.0619 6880 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
16:50:10.0621 6880 usbccgp - ok
16:50:10.0642 6880 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
16:50:10.0644 6880 usbcir - ok
16:50:10.0676 6880 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
16:50:10.0677 6880 usbehci - ok
16:50:10.0705 6880 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
16:50:10.0709 6880 usbhub - ok
16:50:10.0726 6880 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
16:50:10.0727 6880 usbohci - ok
16:50:10.0753 6880 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
16:50:10.0754 6880 usbprint - ok
16:50:10.0782 6880 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:50:10.0784 6880 USBSTOR - ok
16:50:10.0797 6880 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
16:50:10.0798 6880 usbuhci - ok
16:50:10.0828 6880 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\system32\Drivers\usbvideo.sys
16:50:10.0831 6880 usbvideo - ok
16:50:10.0852 6880 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
16:50:10.0854 6880 UxSms - ok
16:50:10.0882 6880 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:50:10.0883 6880 VaultSvc - ok
16:50:10.0905 6880 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
16:50:10.0905 6880 vdrvroot - ok
16:50:10.0941 6880 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
16:50:10.0948 6880 vds - ok
16:50:10.0960 6880 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
16:50:10.0961 6880 vga - ok
16:50:10.0977 6880 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
16:50:10.0977 6880 VgaSave - ok
16:50:11.0011 6880 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
16:50:11.0014 6880 vhdmp - ok
16:50:11.0039 6880 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
16:50:11.0040 6880 viaide - ok
16:50:11.0065 6880 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
16:50:11.0066 6880 volmgr - ok
16:50:11.0094 6880 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
16:50:11.0096 6880 volmgrx - ok
16:50:11.0117 6880 volsnap (df8126bd41180351a093a3ad2fc8903b) C:\Windows\system32\drivers\volsnap.sys
16:50:11.0120 6880 volsnap - ok
16:50:11.0154 6880 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys
16:50:11.0156 6880 vsmraid - ok
16:50:11.0296 6880 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
16:50:11.0316 6880 VSS - ok
16:50:11.0486 6880 vToolbarUpdater11.1.0 (5fa45791413acce628d5361458f32dde) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe
16:50:11.0500 6880 vToolbarUpdater11.1.0 - ok
16:50:11.0594 6880 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
16:50:11.0595 6880 vwifibus - ok
16:50:11.0627 6880 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
16:50:11.0628 6880 vwififlt - ok
16:50:11.0665 6880 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
16:50:11.0670 6880 W32Time - ok
16:50:11.0703 6880 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys
16:50:11.0704 6880 WacomPen - ok
16:50:11.0750 6880 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
16:50:11.0753 6880 WANARP - ok
16:50:11.0761 6880 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
16:50:11.0764 6880 Wanarpv6 - ok
16:50:11.0850 6880 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
16:50:11.0863 6880 WatAdminSvc - ok
16:50:11.0945 6880 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
16:50:11.0961 6880 wbengine - ok
16:50:12.0066 6880 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
16:50:12.0069 6880 WbioSrvc - ok
16:50:12.0088 6880 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
16:50:12.0093 6880 wcncsvc - ok
16:50:12.0108 6880 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
16:50:12.0109 6880 WcsPlugInService - ok
16:50:12.0165 6880 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys
16:50:12.0167 6880 Wd - ok
16:50:12.0224 6880 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
16:50:12.0231 6880 Wdf01000 - ok
16:50:12.0263 6880 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
16:50:12.0267 6880 WdiServiceHost - ok
16:50:12.0270 6880 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
16:50:12.0273 6880 WdiSystemHost - ok
16:50:12.0299 6880 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
16:50:12.0303 6880 WebClient - ok
16:50:12.0314 6880 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
16:50:12.0318 6880 Wecsvc - ok
16:50:12.0334 6880 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
16:50:12.0337 6880 wercplsupport - ok
16:50:12.0358 6880 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
16:50:12.0360 6880 WerSvc - ok
16:50:12.0413 6880 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
16:50:12.0414 6880 WfpLwf - ok
16:50:12.0437 6880 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
16:50:12.0438 6880 WIMMount - ok
16:50:12.0445 6880 WinHttpAutoProxySvc - ok
16:50:12.0511 6880 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
16:50:12.0513 6880 Winmgmt - ok
16:50:12.0600 6880 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
16:50:12.0622 6880 WinRM - ok
16:50:12.0770 6880 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
16:50:12.0773 6880 WinUsb - ok
16:50:12.0837 6880 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
16:50:12.0849 6880 Wlansvc - ok
16:50:12.0929 6880 wlcrasvc (06c8fa1cf39de6a735b54d906ba791c6) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
16:50:12.0931 6880 wlcrasvc - ok
16:50:13.0076 6880 wlidsvc (2bacd71123f42cea603f4e205e1ae337) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
16:50:13.0097 6880 wlidsvc - ok
16:50:13.0249 6880 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
16:50:13.0250 6880 WmiAcpi - ok
16:50:13.0305 6880 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
16:50:13.0308 6880 wmiApSrv - ok
16:50:13.0355 6880 WMPNetworkSvc - ok
16:50:13.0388 6880 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
16:50:13.0389 6880 WPCSvc - ok
16:50:13.0420 6880 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
16:50:13.0423 6880 WPDBusEnum - ok
16:50:13.0463 6880 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
16:50:13.0463 6880 ws2ifsl - ok
16:50:13.0466 6880 WSearch - ok
16:50:13.0658 6880 wuauserv (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll
16:50:13.0682 6880 wuauserv - ok
16:50:13.0793 6880 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
16:50:13.0796 6880 WudfPf - ok
16:50:13.0846 6880 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
16:50:13.0850 6880 WUDFRd - ok
16:50:13.0884 6880 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
16:50:13.0886 6880 wudfsvc - ok
16:50:13.0911 6880 WwanSvc (ce8cf9de9cbfdaa318bd04d8be3fcada) C:\Windows\System32\wwansvc.dll
16:50:13.0915 6880 WwanSvc - ok
16:50:13.0956 6880 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
16:50:14.0127 6880 \Device\Harddisk0\DR0 - ok
16:50:14.0131 6880 Boot (0x1200) (9012f45d39dd6b3089f519893b7ccc1a) \Device\Harddisk0\DR0\Partition0
16:50:14.0133 6880 \Device\Harddisk0\DR0\Partition0 - ok
16:50:14.0159 6880 Boot (0x1200) (6df917a0242ea16118f167207d1dc663) \Device\Harddisk0\DR0\Partition1
16:50:14.0162 6880 \Device\Harddisk0\DR0\Partition1 - ok
16:50:14.0197 6880 Boot (0x1200) (02024cc55ae2b84f903f480ad7a00dc4) \Device\Harddisk0\DR0\Partition2
16:50:14.0198 6880 \Device\Harddisk0\DR0\Partition2 - ok
16:50:14.0220 6880 Boot (0x1200) (028bd4d4725146e21402feb9d0d962eb) \Device\Harddisk0\DR0\Partition3
16:50:14.0221 6880 \Device\Harddisk0\DR0\Partition3 - ok
16:50:14.0221 6880 ============================================================
16:50:14.0221 6880 Scan finished
16:50:14.0221 6880 ============================================================
16:50:14.0231 6036 Detected object count: 0
16:50:14.0231 6036 Actual detected object count: 0
Hi vonxeric
There I evidence of Kaspersky and a so-called “tweaking” program that have been created in the last couple of days.
I specifically asked that you do not install or run anything unless instructed as it is
very unhelpful when we are cleaning an infected computer in a specific order.
I strongly advise you to get rid of anything made by
CompuClever and any other cleaner/optimizer/booster/tuneup/tweak type utilities that you have on this or any other computer.
One of the malware experts, miekiemoes, has an excellent write-up
here
Another excellent article by Bill Castner is located
here
=========================================
Remove remnants of Norton
Norton was in the installed list of your DDS log. The trial versions are known to be difficult to remove but there is a tool that may work here.
download the Norton Removal Tool from here double click on Norton_Removal_Tool.exe to run the tool. follow the on-screen instructions.
Your computer may be restarted more than once, and you may be asked to repeat some steps after the computer restarts.
=========================================
ComboFix did a good job and may have got the infection but when you have completed the Norton removal I’d like you to run both
DDS and
aswMBR again please.
Can you also tell me what error message appears when you try to turn on Windows firewall. If there is no message, please describe what happens.
Thanks
Satchfan
Good Morning Satchfan:
The Kaspersky was installed by my son BEFORE I contacted whatthetech and I removed it before I had even posted. Can you be more specific on the "tweaking" program? I did not add or run anything that I am aware of so would like to know the name in case it was inadvertantly installed.
The Windows firewall now shows a status of 'On" , so not sure what happened there as before, as noted, I could access the status.
Norton is now removed.
Here are the logs you requested, thank you again for your help.
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.1
Run by [removed] at 6:03:05 on 2012-06-22
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6092.4245 [GMT -7:00]
.
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\PROGRA~2\AVG\AVG2012\avgrsa.exe
C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\HP SimplePass 2012\TrueSuiteService.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe
C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe
C:\Program Files (x86)\AVG\AVG2012\avgemca.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\HP SimplePass 2012\TouchControl.exe
C:\Program Files (x86)\HP SimplePass 2012\BioMonitor.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files (x86)\AVG Secure Search\vprot.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: AVG Do Not Track: {31332eef-cb9f-458f-afeb-d30e9a66b6ba} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
BHO: TrueSuite Website Log On: {8590886e-ec8c-43c1-a32c-e4c2b0b6395b} - C:\Program Files (x86)\HP SimplePass 2012\IEBHO.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
mRun: [HPQuickWebProxy] "C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{FC0B36F1-024D-4F3A-A391-2D6FD93F1441} : DhcpNameServer = 75.75.75.75 75.75.76.76
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll
BHO-X64: AVG Do Not Track - No File
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
BHO-X64: TrueSuite Website Log On: {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2012\IEBHO.dll
BHO-X64: TSBHO Class - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
mRun-x64: [HPQuickWebProxy] "C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
mRun-x64: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun-x64: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
IE-X64: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\SPOONFAMILY\AppData\Roaming\Mozilla\Firefox\Profiles\6ktmfifv.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7Beae4e930-1d62-4510-8637-942656fb67af%7D&mid=c1db3518920d47d08b03a9aaf389d444-8dd6905fb5122891f698d9f55554baa3cc7a2df2&ds=AVG&v=11.1.0.7&lang=en&pr=fr&d=2012-05-11%2022%3A52%3A04&sap=ku&q=
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\npsitesafety.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\SPOONFAMILY\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
—- FIREFOX POLICIES —-
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109935&tt=100512_2_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 92900f4a00000000000078e3b56d3db7
FF - user.js: extensions.BabylonToolbar_i.hardId - 92900f4a00000000000078e3b56d3db7
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15479
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1718:33:51
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHA;AVGIDSHA;C:\Windows\system32\DRIVERS\avgidsha.sys –> C:\Windows\system32\DRIVERS\avgidsha.sys [?]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys –> C:\Windows\system32\DRIVERS\avgrkx64.sys [?]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys –> C:\Windows\system32\DRIVERS\avgldx64.sys [?]
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys –> C:\Windows\system32\DRIVERS\avgmfx64.sys [?]
R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys –> C:\Windows\system32\DRIVERS\avgtdia.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-4-3 63928]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe [2012-4-30 5106744]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-2-14 193288]
R2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-7-20 249648]
R2 FPLService;TrueSuiteService;C:\Program Files (x86)\HP SimplePass 2012\TrueSuiteService.exe [2011-8-26 260424]
R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-9-9 86072]
R2 HPAuto;HP Auto;C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [2011-2-16 682040]
R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-3-14 197504]
R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-3-5 35200]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-4-29 13592]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-4-29 2424424]
R2 jhi_service;Intel® Identity Protection Technology Host Interface Service;C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [2011-2-24 212944]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-4-29 2656280]
R2 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe [2012-6-11 935480]
R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\avgidsdrivera.sys –> C:\Windows\system32\DRIVERS\avgidsdrivera.sys [?]
R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\avgidsfiltera.sys –> C:\Windows\system32\DRIVERS\avgidsfiltera.sys [?]
R3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-8-1 195320]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\system32\DRIVERS\clwvd.sys –> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys –> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys –> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\Windows\system32\DRIVERS\rtl8192Ce.sys –> C:\Windows\system32\DRIVERS\rtl8192Ce.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-5-28 116648]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-5-11 257696]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-5-28 116648]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-11 129976]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\system32\DRIVERS\RtsPStor.sys –> C:\Windows\system32\DRIVERS\RtsPStor.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS –> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS –> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS –> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys –> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-06-22 12:53:16 ——– d—–w- C:\Users\SPOONFAMILY\AppData\Roaming\Symantec
2012-06-22 00:44:39 ——– d—–w- C:\$RECYCLE.BIN
2012-06-22 00:09:24 98816 —-a-w- C:\Windows\sed.exe
2012-06-22 00:09:24 518144 —-a-w- C:\Windows\SWREG.exe
2012-06-22 00:09:24 256000 —-a-w- C:\Windows\PEV.exe
2012-06-22 00:09:24 208896 —-a-w- C:\Windows\MBR.exe
2012-06-20 01:23:45 117182464 —-a-w- C:\Users\SPOONFAMILY\kavkis.msi
2012-06-20 01:20:15 ——– d—–w- C:\Users\SPOONFAMILY\AppData\Roaming\CompuClever
2012-06-20 01:20:15 ——– d—–w- C:\Program Files (x86)\CompuClever
2012-06-19 02:38:28 ——– d-sh–w- C:\Windows\SysWow64\%APPDATA%
2012-06-12 22:33:31 9216 —-a-w- C:\Windows\System32\rdrmemptylst.exe
2012-06-09 00:50:25 2622464 —-a-w- C:\Windows\System32\wucltux.dll
2012-06-09 00:50:21 99840 —-a-w- C:\Windows\System32\wudriver.dll
2012-06-09 00:50:08 36864 —-a-w- C:\Windows\System32\wuapp.exe
2012-06-09 00:50:08 186752 —-a-w- C:\Windows\System32\wuwebv.dll
2012-06-06 00:34:03 ——– d—–w- C:\Users\SPOONFAMILY\AppData\Local\Windows Live
2012-06-06 00:34:03 ——– d—–w- C:\Users\SPOONFAMILY\AppData\Local\{1CB3B3AC-4D02-4EA9-8351-48F0DBCE3150}
2012-06-06 00:33:47 ——– d—–w- C:\Users\SPOONFAMILY\AppData\Local\{9725931E-1A33-46DD-8F63-8799BD568C83}
2012-06-06 00:33:47 ——– d—–w- C:\Users\SPOONFAMILY\AppData\Local\{5A9C2473-F998-4BDA-BDDB-787E6F056AF7}
2012-05-30 02:40:32 ——– d—–w- C:\Users\SPOONFAMILY\AppData\Local\AuthenTec
2012-05-29 03:43:33 737072 —-a-w- C:\ProgramData\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2012-05-29 03:43:20 4283672 —-a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-05-29 03:43:09 42776 —-a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-05-29 03:43:01 539984 —-a-w- C:\ProgramData\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
.
==================== Find3M ====================
.
2012-05-18 02:06:48 2311680 —-a-w- C:\Windows\System32\jscript9.dll
2012-05-18 01:59:14 1392128 —-a-w- C:\Windows\System32\wininet.dll
2012-05-18 01:58:39 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl
2012-05-18 01:55:22 173056 —-a-w- C:\Windows\System32\ieUnatt.exe
2012-05-18 01:51:30 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2012-05-17 22:45:37 1800192 —-a-w- C:\Windows\SysWow64\jscript9.dll
2012-05-17 22:35:47 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll
2012-05-17 22:35:39 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-05-17 22:29:45 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-05-17 22:24:45 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2012-05-15 01:32:33 3146752 —-a-w- C:\Windows\System32\win32k.sys
2012-05-12 06:27:13 70304 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-12 06:27:13 419488 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-05-12 06:27:06 8769696 —-a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe
2012-05-04 11:06:22 5559664 —-a-w- C:\Windows\System32\ntoskrnl.exe
2012-05-04 10:03:53 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03:50 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-05-01 05:40:20 209920 —-a-w- C:\Windows\System32\profsvc.dll
2012-04-29 10:09:12 75776 —-a-w- C:\Windows\SysWow64\psisrndr.ax
2012-04-29 10:09:12 613888 —-a-w- C:\Windows\System32\psisdecd.dll
2012-04-29 10:09:12 465408 —-a-w- C:\Windows\SysWow64\psisdecd.dll
2012-04-29 10:09:12 108032 —-a-w- C:\Windows\System32\psisrndr.ax
2012-04-29 10:08:50 861696 —-a-w- C:\Windows\System32\oleaut32.dll
2012-04-29 10:08:50 571904 —-a-w- C:\Windows\SysWow64\oleaut32.dll
2012-04-29 10:08:50 331776 —-a-w- C:\Windows\System32\oleacc.dll
2012-04-29 10:08:50 233472 —-a-w- C:\Windows\SysWow64\oleacc.dll
2012-04-28 03:55:21 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-04-26 05:41:56 77312 —-a-w- C:\Windows\System32\rdpwsx.dll
2012-04-26 05:41:55 149504 —-a-w- C:\Windows\System32\rdpcorekmts.dll
2012-04-24 05:37:37 184320 —-a-w- C:\Windows\System32\cryptsvc.dll
2012-04-24 05:37:37 140288 —-a-w- C:\Windows\System32\cryptnet.dll
2012-04-24 05:37:36 1462272 —-a-w- C:\Windows\System32\crypt32.dll
2012-04-24 04:36:42 140288 —-a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-04-24 04:36:42 1158656 —-a-w- C:\Windows\SysWow64\crypt32.dll
2012-04-24 04:36:42 103936 —-a-w- C:\Windows\SysWow64\cryptnet.dll
2012-04-19 11:50:26 28480 —-a-w- C:\Windows\System32\drivers\avgidsha.sys
2012-04-07 12:31:40 3216384 —-a-w- C:\Windows\System32\msi.dll
2012-04-07 11:26:29 2342400 —-a-w- C:\Windows\SysWow64\msi.dll
2012-04-05 01:47:08 772504 —-a-w- C:\Windows\SysWow64\npDeployJava1.dll
2012-04-05 01:47:02 687504 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2012-03-30 11:35:47 1918320 —-a-w- C:\Windows\System32\drivers\tcpip.sys
.
============= FINISH: 6:03:32.42 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 5/11/2012 9:54:53 PM
System Uptime: 6/22/2012 5:52:34 AM (1 hours ago)
.
Motherboard: Hewlett-Packard | | 1695
Processor: Intel® Core™ i3-2350M CPU @ 2.30GHz | CPU1 | 2300/1333mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 441 GiB total, 386.937 GiB free.
D: is FIXED (NTFS) - 21 GiB total, 2.242 GiB free.
E: is FIXED (FAT32) - 4 GiB total, 1.078 GiB free.
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP21: 5/26/2012 1:37:29 PM - Removed HP Power Manager
RP22: 5/26/2012 1:37:47 PM - Installed HP Power Manager
RP23: 6/4/2012 10:15:26 PM - Windows Update
RP24: 6/8/2012 5:49:50 PM - Windows Update
RP25: 6/8/2012 11:29:17 PM - Windows Update
RP26: 6/12/2012 11:01:06 PM - Windows Update
RP27: 6/15/2012 2:27:50 PM - Installed Command and ConquerTM Generals Zero Hour
RP28: 6/19/2012 6:28:59 PM - Installed Kaspersky Anti-Virus 2011.
RP29: 6/19/2012 7:06:51 PM - HPSF Applying updates
.
==== Installed Programs ======================
.
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.3) MUI
Adobe Shockwave Player 11.6
Bejeweled 3
Bing Bar
Blackhawk Striker 2
Blio
Chuzzle Deluxe
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Cradle of Rome 2
CyberLink YouCam
D3DX10
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dora's World Adventure
ESU for Microsoft Windows 7 SP1
Evernote v. 4.2.3
Farm Frenzy
Farmscapes
FATE
Final Drive Fury
Google Chrome
Google Earth Plug-in
Google Update Helper
Hewlett-Packard ACLM.NET v1.1.2.0
Hoyle Card Games
HP Customer Experience Enhancements
HP Documentation
HP Games
HP MovieStore
HP On Screen Display
HP Power Manager
HP Quick Launch
HP QuickWeb
HP Recovery Manager
HP Setup
HP Setup Manager
HP SimplePass PE 2012
HP Software Framework
HP Support Assistant
IDT Audio
Intel® Control Center
Intel® Identity Protection Technology 1.1.2.0
Intel® Management Engine Components
Intel® Processor Graphics
Intel® Rapid Storage Technology
Java Auto Updater
Java™ 7 Update 4
JavaFX 2.1.0
Jewel Match 3
Jewel Quest Mysteries: The Seventh Gate Collector's Edition
John Deere Drive Green
Junk Mail filter update
Letters from Nowhere 2
Luxor HD
Mah Jong Medley
Mesh Runtime
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Home and Student 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Word MUI (English) 2010
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft WSE 3.0 Runtime
Mozilla Firefox 12.0 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
opensource
Penguins!
Plants vs. Zombies - Game of the Year
PlayReady PC Runtime x86
Poker Superstars III
Polar Bowler
Polar Golfer
Realtek Ethernet Controller Driver
Realtek PCIE Card Reader
REALTEK Wireless LAN Driver
RollerCoaster Tycoon 3: Platinum
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)
Security Update for Microsoft Visio Viewer 2010 (KB2597981) 32-Bit Edition
Skype Click to Call
Skype™ 5.8
swMSM
The Treasures of Mystery Island: The Ghost Ship
Torchlight
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update Installer for WildTangent Games App
VIP Access SDK (1.0.1.2)
Virtual Villagers 4 - The Tree of Life
Visual Studio 2008 x64 Redistributables
WildTangent Games App (HP Games)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Zuma's Revenge
.
==== Event Viewer Messages From Past Week ========
.
6/21/2012 5:17:05 PM, Error: Service Control Manager [7023] - The Windows Defender service terminated with the following error: The specified module could not be found.
6/21/2012 5:16:48 AM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
6/21/2012 5:16:47 AM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
6/21/2012 5:16:10 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
6/21/2012 5:15:37 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
6/21/2012 5:13:04 PM, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147024891
6/21/2012 5:13:04 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: %%-2147024891
6/21/2012 5:09:40 PM, Error: Service Control Manager [7000] - The HP Support Assistant Service service failed to start due to the following error: A device attached to the system is not functioning.
6/21/2012 5:07:33 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
6/18/2012 7:25:45 PM, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 10.0.0.7. The computer with the IP address 10.0.0.3 did not allow the name to be claimed by this computer.
.
==== End Of File ===========================
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-06-22 06:08:12
—————————–
06:08:12.722 OS Version: Windows x64 6.1.7601 Service Pack 1
06:08:12.722 Number of processors: 4 586 0x2A07
06:08:12.723 ComputerName: SPOONFAMILY-HP UserName: SPOONFAMILY
06:08:14.412 Initialize success
06:09:10.864 AVAST engine defs: 12062200
06:09:15.361 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
06:09:15.366 Disk 0 Vendor: TOSHIBA_ GS00 Size: 476940MB BusType: 3
06:09:15.392 Disk 0 MBR read successfully
06:09:15.396 Disk 0 MBR scan
06:09:15.403 Disk 0 Windows 7 default MBR code
06:09:15.427 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048
06:09:15.462 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 451380 MB offset 409600
06:09:15.510 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 21296 MB offset 924835840
06:09:15.533 Disk 0 Partition 4 00 0C FAT32 LBA MSDOS5.0 4063 MB offset 968450048
06:09:15.575 Disk 0 scanning C:\Windows\system32\drivers
06:09:26.092 Service scanning
06:09:58.989 Modules scanning
06:09:59.006 Disk 0 trace - called modules:
06:09:59.063 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
06:09:59.066 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008ab8060]
06:09:59.070 3 CLASSPNP.SYS[fffff88001a5143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8006294050]
06:10:00.699 AVAST engine scan C:\Windows
06:10:03.555 AVAST engine scan C:\Windows\system32
06:12:14.589 AVAST engine scan C:\Windows\system32\drivers
06:12:25.901 AVAST engine scan C:\Users\SPOONFAMILY
06:17:58.631 AVAST engine scan C:\ProgramData
06:18:26.832 Scan finished successfully
06:20:10.518 Disk 0 MBR has been saved successfully to "C:\Users\SPOONFAMILY\Desktop\MBR.dat"
06:20:10.522 The log file has been saved successfully to "C:\Users\SPOONFAMILY\Desktop\aswMBR1.txt"
Hi
I can’t say “Good afternoon” as I’m not sure what time it is where you are – it is 7.45 pm here in the UK
Can you be more specific on the "tweaking" program? I did not add or run anything that I am aware of so would like to know the name in case it was inadvertantly installed.
2012-06-20 01:20:15 ——– d—–w- C:\Users\SPOONFAMILY\AppData\Roaming\CompuClever CompuClever
Those look much better and the baddies have gone.
Download Malwarebytes-Anti-Malware
Click
here double-click mbam-setup.exe and follow the prompts to install the program. at the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware , then click Finish. . if an update is found, it will download and install the latest version. once the program has loaded, select Perform quick scan , then click Scan . when the scan is complete, click OK , then Show Results to view the results. be sure that everything is checked, and click Remove Selected . when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below) the log is automatically saved and can be viewed by clicking the Logs tab in MBAM. copy and paste the contents of that report in your next reply and exit MBAM. NOTE : If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
Failure to reboot will prevent MBAM from removing all the malware .
Please include
Mbam.txt in the next post
Thanks
Satchfan
Good Evening Satchfan…
I am in Washington State…so not sure what time there in UK..but I know its late at night.
Here is the Malware bites log….thank you again for all your help…
Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org
Database version: v2012.06.22.12
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
SPOONFAMILY :: SPOONFAMILY-HP [administrator]
Protection: Enabled
6/22/2012 4:46:29 PM
mbam-log-2012-06-22 (16-46-29).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 208417
Time elapsed: 1 minute(s), 55 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 1
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLab) -> Quarantined and deleted successfully.
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 2
C:\$RECYCLE.BIN\S-1-5-21-90196078-743679549-3009314732-1000\$RSAA9B3.exe (PUP.Adware.InstallCore) -> Quarantined and deleted successfully.
C:\Users\SPOONFAMILY\AppData\Local\Temp\ICReinstall_DownloadManagerSetup.exe (PUP.Adware.InstallCore) -> Quarantined and deleted successfully.
(end)
You are 9 hours behind so at 11.45 pm on the 22nd in Washington, it is now 7.45 am 23rd here in the UK.
Have a good night.
That’s looking good too.
We’'ll run a final scan and if there are no more issues, we can tidy up.
Run ESET Online Scan Note : You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read
here .
Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan 1. Click the
Eset online Scanner button.
2.
For alternate browsers only : (Microsoft Internet Explorer users can skip these steps)
• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
3. Check
Yes, I accept the Terms of Use
4. Click the
Start button.
5. Accept any security warnings from your browser.
6. Check
Scan archives
7. Push the
Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push
List of found threats
10. Push
Export to Text file and save the file to your desktop using a unique name, such as
ESETScan . Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the
back button.
12. Push
Finish
If a log has been produced post it in your next reply.
NOTE . If Eset doesn't find any threats, it won't produce a log.
Please let me know if there are any outstanding problems.
Thanks
Satchfan
Good Evening Satchfan:
Here is the ESET log….thank you again for all your help
C:\Qoobox\Quarantine\C\Windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\U\00000008.@.vir Win64/Agent.BA trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\U\80000000.@.vir Win64/Sirefef.AE trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\U\80000032.@.vir probably a variant of Win32/Sirefef.EU trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Windows\Installer\{57280367-6f8f-714c-95b8-5ae223dab86e}\U\80000064.@.vir Win64/Sirefef.AE trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Windows\System32\services.exe.vir Win64/Patched.A.Gen trojan deleted - quarantined
C:\Users\SPOONFAMILY\Downloads\SoftonicDownloader_for_unity-web-player.exe a variant of Win32/SoftonicDownloader.D application cleaned by deleting - quarantined
Well done, all now looks good.
Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:
You can delete the
DDS, TDSSKiller, SecurityCheck and
aswMBR logs and programs from your desktop.
Uninstall Combofix Follow these steps to uninstall Combofix click START then RUN now type Combofix /uninstall in the runbox and click OK . Note the space between the X and the / , it needs to be there .
🖼 Click to load external image (Posted Image)please follow the prompts to uninstall Combofix. once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.
===================================================
Update installed programs
You have old versions on your computer which are vulnerable to infections.
Java & Adobe Flash from the Start menu, select Control Panel . in Large or Small icon view, click Programs and Features . If you're using Category view, under "Programs" , click Uninstall a program . select any versions of Java, and Adobe Flash then click Uninstall .
Install the latest versions:
Java Flash go to the bottom of the page and under Downloads , choose Adobe Flash Player / you will then be able to choose the right one for your operating system.
===================================================
Recommended programs SpywareBlaster . SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.
===================================================
Update and run
Malwarebytes . This really is an excellent program that you should also update and run on a regular basis, probably weekly.
===================================================
It’s important to keep programs up to date so that malware doesn't exploit any old security flaws. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.
===================================================
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
===================================================
I also recommend that you read the following: How to prevent malware by miekiemoes
Safe computing
Satchfan
Thank you Satchfan….seems to be running well. I have updated the programs and downloaded your suggestions.
Thank you again !!!
