Spyware / Malware / Virus Removal

SEARCHQU [Solved]

17 min read

Looking for the outcome? Ask AI

SuperQvas Topic Starter

Post #1June 26, 2012, 11:16 AM UTC

Hi guys, I am a newbie. I have this problem , I got this ilivid software that setted my homepage to searchqu in every single browser in my laptop. I uninstalled the ilivid sofware, and resetted my homepage to google again but now, everytime I start my windows 7, i get this error message: AppData\Local\Temp\INSTAL~1.DLL I need halp!

jeffce

Post #2June 26, 2012, 11:30 AM UTC

Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

First we need to make all files and folders VISIBLE:

Go to start>control panel>folder options>view
Choose to "show hidden files and folders,"
Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
Close the window with OK

———

OTL

Download OTL to your desktop.
Right-click and Run as Administrator on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Select All Users
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under the Custom Scan box paste this in

netsvcs
%systemroot%\*. /rp /s
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

———-

Please download aswMBR to your desktop.

Right click and Run as Administrator the aswMBR icon to run it.
Click the Scan button to start scan.
If asked whether you would like to update the Avast virus database please do.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post the logs made by OTL and aswMBR.

SuperQvas

Post #3June 26, 2012, 1:16 PM UTC

I have the following problems: 1 - OTL will not save an EXTRAS.txt file 2 - aswMBR.exe will not finish the scan but at a certain time an error message from windows comes telling me that an error had occurred while scanning and that windows is searching for a solution to the problem… after some seconds, the aswMBR kicks me out.

SuperQvas

Post #4June 26, 2012, 1:17 PM UTC

btw, thanks for helping me!

jeffce

Post #5June 26, 2012, 1:23 PM UTC

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Right-click and Run as Administrator dds to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
when the window opens, click on Change Parameters
under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
click OK
Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
- Then click Continue > Reboot now
Attach the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

———-

You are more than welcome.

In your next reply please post the logs made by DDS and TDSSKiller.

SuperQvas

Post #6June 26, 2012, 1:57 PM UTC

DDS.txt:

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29
Run by [removed] at 15:26:57 on 2012-06-26
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.39.1040.18.3758.1755 [GMT 2:00]
.
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Windows\SysWOW64\NLSSRV32.EXE
C:\Program Files\OO Software\Defrag\oodag.exe
C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe
C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe
C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe
C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\OO Software\Defrag\oodtray.exe
C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\Program Files\Sony\VAIO Update Common\VUAgent.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Program Files\Sony\VAIO Power Management\SPMService.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Sony\VAIO Care\VCsystray.exe
C:\Program Files\Sony\VAIO Care\VCService.exe
C:\Program Files\Sony\VAIO Care\VCAgent.exe
C:\Windows\System32\vds.exe
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page =
uStart Page = hxxp://www.google.com.do/
uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
uSearch Bar =
mStart Page = hxxp://mystart.incredimail.com/mb50?u=891929752390932140
uInternet Settings,ProxyOverride =
uInternet Settings,ProxyServer = http=127.0.0.1:80
mSearchAssistant =
uURLSearchHooks: H - No File
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
uRun: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s
uRun: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
uRunOnce: [!SearchquFFHP] C:\Windows\system32\RUNDLL32.EXE C:\Users\vaio\AppData\Local\Temp\INSTAL~1.DLL,_SetFirefoxHP http://www.searchnu.com/406,
mRun: [SHTtray.exe] C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\GOOGLE~1.LNK - C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&sporta in Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Extract e-mail addresses
IE: Google Sidewiki…
IE: I&nvia a OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
IE: {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{423D4F55-13A2-4D2E-BBDA-A1774A136043} : DhcpNameServer = 10.100.6.1
TCP: Interfaces\{A56D231E-447F-43BC-B413-876EA6E69004} : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{A56D231E-447F-43BC-B413-876EA6E69004}\83155756374716E4F6E63596353627F6363616A616A616A616A616A616A616A6 : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{A56D231E-447F-43BC-B413-876EA6E69004}\83155756374716E6F6E63796373627F6363616 : DhcpNameServer = [removed] [removed]
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{53707962-6F74-2D53-2644-206D7942484F}
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
{B4F3A835-0E21-4959-BA22-42B3008E02FF}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
mRun-x64: [SHTtray.exe] C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe
mRun-x64: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun-x64: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
IE-X64: {491A6C2B-1046-486b-8A8F-7D26BCB79A9B}
SEH-X64: {B5A7F190-DDA6-4420-B3BA-52453494E6CD}: Groove GFS Stub Execution Hook
.
============= SERVICES / DRIVERS ===============
.
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 eamonm;eamonm;C:\Windows\system32\DRIVERS\eamonm.sys –> C:\Windows\system32\DRIVERS\eamonm.sys [?]
R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-1-14 810144]
R2 epfwwfpr;epfwwfpr;C:\Windows\system32\DRIVERS\epfwwfpr.sys –> C:\Windows\system32\DRIVERS\epfwwfpr.sys [?]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-10-12 13336]
R2 nlsX86cc;NLS Service;C:\Windows\SysWOW64\NLSSRV32.EXE [2011-1-12 68928]
R2 OODefragAgent;O&O Defrag;C:\Program Files\OO Software\Defrag\oodag.exe [2011-9-18 3271496]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-11-4 632792]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-27 398176]
R2 rimspci;rimspci;C:\Windows\system32\drivers\rimssne64.sys –> C:\Windows\system32\drivers\rimssne64.sys [?]
R2 risdsnpe;risdsnpe;C:\Windows\system32\drivers\risdsne64.sys –> C:\Windows\system32\drivers\risdsne64.sys [?]
R2 SOHCImp;VAIO Media plus Content Importer;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-6-20 108400]
R2 SOHDms;VAIO Media plus Digital Media Server;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-6-18 423280]
R2 SOHDs;VAIO Media plus Device Searcher;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-6-20 67952]
R2 uCamMonitor;CamMonitor;C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2011-2-6 104960]
R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-2-6 2320920]
R2 VAIO Power Management;VAIO Power Management;C:\Program Files\Sony\VAIO Power Management\SPMService.exe [2011-2-6 575856]
R2 VCFw;VAIO Content Folder Watcher;C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-1-20 887000]
R2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-5-19 549616]
R2 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-6-9 384880]
R2 VSNService;VSNService;C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [2011-2-6 836608]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys –> C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys [?]
R3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\system32\drivers\btwampfl.sys –> C:\Windows\system32\drivers\btwampfl.sys [?]
R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys –> C:\Windows\system32\DRIVERS\btwl2cap.sys [?]
R3 HECIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys –> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 Impcd;Impcd;C:\Windows\system32\drivers\Impcd.sys –> C:\Windows\system32\drivers\Impcd.sys [?]
R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys –> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
R3 NETw5s64;Driver scheda Intel® Wireless WiFi Link 5000 Series per Windows 7 64 Bit;C:\Windows\system32\DRIVERS\NETw5s64.sys –> C:\Windows\system32\DRIVERS\NETw5s64.sys [?]
R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
R3 SFEP;Sony Firmware Extension Parser;C:\Windows\system32\DRIVERS\SFEP.sys –> C:\Windows\system32\DRIVERS\SFEP.sys [?]
R3 SpfService;VAIO Entertainment Common Service;C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-1-20 286936]
R3 VCService;VCService;C:\Program Files\Sony\VAIO Care\VCService.exe [2011-12-3 44736]
R3 VUAgent;VUAgent;C:\Program Files\Sony\VAIO Update Common\VUAgent.exe [2012-1-13 1256040]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys –> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 KMService;KMService;C:\Windows\System32\srvany.exe [2011-4-13 8192]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-13 250056]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\system32\DRIVERS\ssudbus.sys –> C:\Windows\system32\DRIVERS\ssudbus.sys [?]
S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys –> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
S3 GRemoteBus;GRemote virtual joystick Bus Enumerator;C:\Windows\system32\DRIVERS\GRemoteBus64.sys –> C:\Windows\system32\DRIVERS\GRemoteBus64.sys [?]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 31125880]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\system32\DRIVERS\ssudmdm.sys –> C:\Windows\system32\DRIVERS\ssudmdm.sys [?]
S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TFsExDisk;TFsExDisk;\??\C:\Windows\System32\Drivers\TFsExDisk.sys –> C:\Windows\System32\Drivers\TFsExDisk.sys [?]
S3 VBTUSB;VBTUSB.Sys VAIO Bluetooth Driver over USB device;C:\Windows\system32\Drivers\VBTUSB.sys –> C:\Windows\system32\Drivers\VBTUSB.sys [?]
S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-2-18 99104]
S3 WatAdminSvc;Servizio Windows Activation Technologies;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;C:\Program Files\Zune\WMZuneComm.exe [2011-8-5 306400]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqladhlp.exe [2008-7-10 47128]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-06-26 10:16:39 ——– d—–w- C:\Users\vaio\AppData\Roaming\PC Cleaners
2012-06-26 10:16:35 4446520 —-a-w- C:\Windows\uninst.exe
2012-06-26 10:16:35 ——– d—–w- C:\Users\vaio\AppData\Roaming\PCPro
2012-06-26 10:16:33 ——– d—–w- C:\ProgramData\PC1Data
2012-06-26 09:38:53 9013136 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BCD702F2-1ED6-4347-B583-1F66521B0D09}\mpengine.dll
2012-06-25 21:24:27 ——– d—–w- C:\Users\vaio\AppData\Roaming\Malwarebytes
2012-06-25 21:23:46 ——– d—–w- C:\ProgramData\Malwarebytes
2012-06-25 21:02:12 ——– d—–w- C:\ZHP
2012-06-25 21:02:12 ——– d—–w- C:\Program Files (x86)\ZHPDiag
2012-06-21 18:04:26 2622464 —-a-w- C:\Windows\System32\wucltux.dll
2012-06-21 18:03:59 99840 —-a-w- C:\Windows\System32\wudriver.dll
2012-06-21 18:03:23 36864 —-a-w- C:\Windows\System32\wuapp.exe
2012-06-21 18:03:23 186752 —-a-w- C:\Windows\System32\wuwebv.dll
2012-06-19 09:53:08 ——– d—–w- C:\Nuova cartella
2012-06-15 06:32:23 ——– d—–w- C:\Users\vaio\AppData\Local\Macromedia
2012-06-14 14:39:12 9216 —-a-w- C:\Windows\System32\rdrmemptylst.exe
2012-06-14 14:39:12 76288 —-a-w- C:\Windows\System32\rdpwsx.dll
2012-06-14 14:39:12 149504 —-a-w- C:\Windows\System32\rdpcorekmts.dll
2012-06-14 14:39:11 208896 —-a-w- C:\Windows\System32\profsvc.dll
2012-06-14 14:39:10 5505392 —-a-w- C:\Windows\System32\ntoskrnl.exe
2012-06-14 14:39:08 3902320 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-06-14 14:39:07 3958128 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-06-14 14:39:00 3213824 —-a-w- C:\Windows\System32\msi.dll
2012-06-14 14:38:59 2342400 —-a-w- C:\Windows\SysWow64\msi.dll
2012-06-14 14:38:57 204800 —-a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-06-14 14:38:56 3144192 —-a-w- C:\Windows\System32\win32k.sys
2012-06-14 14:38:49 182272 —-a-w- C:\Windows\System32\cryptsvc.dll
2012-06-14 14:38:49 1460224 —-a-w- C:\Windows\System32\crypt32.dll
2012-06-14 14:38:49 140288 —-a-w- C:\Windows\System32\cryptnet.dll
2012-06-14 14:38:49 139264 —-a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-06-14 14:38:49 1156608 —-a-w- C:\Windows\SysWow64\crypt32.dll
2012-06-14 14:38:48 103936 —-a-w- C:\Windows\SysWow64\cryptnet.dll
2012-06-13 20:28:09 ——– d—–w- C:\ExchangeSetupLogs
2012-06-05 17:48:49 ——– d—–w- C:\Program Files (x86)\Monster Of The Deep
2012-06-05 08:29:44 ——– d—–w- C:\Users\vaio\AppData\Roaming\deluge
2012-06-05 08:28:57 ——– d—–w- C:\Program Files (x86)\Deluge
2012-05-28 15:04:31 472576 —-a-w- C:\Windows\AutoKMS.exe
.
==================== Find3M ====================
.
2012-06-23 15:21:35 70344 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-23 15:21:35 426184 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-05-18 02:06:48 2311680 —-a-w- C:\Windows\System32\jscript9.dll
2012-05-18 01:59:14 1392128 —-a-w- C:\Windows\System32\wininet.dll
2012-05-18 01:58:39 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl
2012-05-18 01:55:22 173056 —-a-w- C:\Windows\System32\ieUnatt.exe
2012-05-18 01:51:30 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2012-05-17 22:45:37 1800192 —-a-w- C:\Windows\SysWow64\jscript9.dll
2012-05-17 22:35:47 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll
2012-05-17 22:35:39 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-05-17 22:29:45 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-05-17 22:24:45 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2012-03-30 11:09:53 1895280 —-a-w- C:\Windows\System32\drivers\tcpip.sys
.
============= FINISH: 15:27:16,55 ===============

attach.txt:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 19/03/2011 10:28:49
System Uptime: 26/06/2012 14:52:35 (1 hours ago)
.
Motherboard: Sony Corporation | | VAIO
Processor: Intel® Core™ i5 CPU M 480 @ 2.67GHz | N/A | 2240/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 288 GiB total, 214,716 GiB free.
D: is CDROM ()
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP358: 21/06/2012 20:02:56 - Windows Update
RP359: 23/06/2012 17:13:41 - Windows Update
RP360: 25/06/2012 19:43:04 - OTL Restore Point - 25/06/2012 19:43:03
RP361: 25/06/2012 19:55:56 - Installed HiJackThis
RP362: 25/06/2012 23:33:43 - Removed HiJackThis
RP363: 26/06/2012 12:34:44 - OTL Restore Point - 26/06/2012 12:34:43
RP364: 26/06/2012 12:45:34 - OTL Restore Point - 26/06/2012 12:45:34
RP365: 26/06/2012 13:39:13 - OTL Restore Point - 26/06/2012 13:39:12
RP366: 26/06/2012 13:51:01 - OTL Restore Point - 26/06/2012 13:51:01
RP367: 26/06/2012 14:58:30 - OTL Restore Point - 26/06/2012 14:58:30
.
==== Installed Programs ======================
.
.
1200 Contratti e Lettere commerciali
7-Zip 9.20
abgx360 v1.0.5
Adobe AIR
Adobe Community Help
Adobe Download Assistant
Adobe Dreamweaver CS5.5
Adobe Fireworks CS5
Adobe Flash Player 11 Plugin
Adobe Media Player
Adobe Photoshop CS5.1
Adobe Reader 9.5.1 - Italiano
Adobe Shockwave Player 11.6
Adobe Widget Browser
AdunanzA
ArcSoft Magic-i Visual Effects 2
ArcSoft WebCam Companion 3
Atomic Email Hunter
AVS Screen Capture version 2.0.1
AVS Update Manager 1.0
AVS Video Converter 8
AVS Video Editor 6
AVS Video Recorder 2.4
AVS4YOU Software Navigator 1.4
D3DX10
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Deluge 1.3.5
DivX 4.11 Codec
DVDFab 8.0.5.0 (18/11/2010)
Evernote
Google Calendar Sync
Google Chrome
GPL Ghostscript 8.63
Hotfix for Microsoft .NET Framework 4 Client Profile (KB2461678)
ImgBurn
Intel® Control Center
Intel® Graphics Media Accelerator Driver
Intel® Management Engine Components
Intel® Rapid Storage Technology
Intel® Turbo Boost Technology Driver
Java Auto Updater
Java™ 6 Update 29
JDownloader 0.9
Junk Mail filter update
MagicDisc 2.7.106
Manuale VAIO
Media Gallery
Mesh Runtime
Messenger Companion
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access MUI (Italian) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Excel MUI (Italian) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office Home and Business 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office Live Meeting 2007
Microsoft Office OneNote MUI (English) 2010
Microsoft Office OneNote MUI (Italian) 2010
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2010
Microsoft Office Outlook MUI (Italian) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office PowerPoint MUI (Italian) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (German) 2010
Microsoft Office Proof (Italian) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Proofing (Italian) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Publisher MUI (Italian) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared MUI (Italian) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Word MUI (English) 2010
Microsoft Office Word MUI (Italian) 2010
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit
Microsoft SQL Server 2008 Common Files
Microsoft SQL Server 2008 Database Engine Shared
Microsoft SQL Server 2008 RsFx Driver
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Microsoft_VC90_MFCLOC_x86
Monster Of The Deep
Mp3tag v2.49
MSVC80_x86
MSVC80_x86_v2
MSVC90_x86
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 Parser and SDK
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB973685)
NexDef Plug-in
PDF Settings CS5
PMB
PMB VAIO Edition Guide
PMB VAIO Edition Plug-in
Quick Web Access
R-Wipe&Clean 9.5
Raccolta foto di Windows Live
Realtek High Definition Audio Driver
Registry Mechanic 10.0
Remote Play with PlayStation 3
Riproduzione remota con PlayStation®3
Samsung Kies
Security Update for Microsoft .NET Framework 4 Client Profile - Language Pack (ITA) (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile - Language Pack (ITA) (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)
Security Update for Microsoft Visio Viewer 2010 (KB2597981) 32-Bit Edition
SopCast 3.4.8
Spybot - Search & Destroy
Sql Server Customer Experience Improvement Program
StreamTorrent 1.0
Supporto trasferimento VAIO
Tastiera remota con PlayStation 3
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
VAIO - Media Gallery
VAIO - PMB VAIO Edition Guide
VAIO - PMB VAIO Edition Plug-in
VAIO Care
VAIO Control Center
VAIO Data Restore Tool
VAIO DVD Menu Data
VAIO Gate
VAIO Gate Default
VAIO Hardware Diagnostics
VAIO Media plus
VAIO Media plus Opening Movie
VAIO Movie Story Template Data
VAIO Sample Contents
VAIO screensaver
VAIO Smart Network
VAIO Update
Veetle TV
VideoLAN VLC media player 0.8.5
Visual Studio 2008 x64 Redistributables
VobSub v2.05 (Remove Only)
VU5x86
WebCallDirect
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
.
==== End Of File ===========================

DTSkiller:

15:30:40.0064 3012 TDSS rootkit removing tool [removed] Jun 25 2012 21:18:44
15:30:40.0438 3012 ============================================================
15:30:40.0438 3012 Current date / time: 2012/06/26 15:30:40.0438
15:30:40.0438 3012 SystemInfo:
15:30:40.0438 3012
15:30:40.0438 3012 OS Version: 6.1.7600 ServicePack: 0.0
15:30:40.0438 3012 Product type: Workstation
15:30:40.0438 3012 ComputerName: NB_EB4B4E
15:30:40.0438 3012 UserName: vaio
15:30:40.0438 3012 Windows directory: C:\Windows
15:30:40.0438 3012 System windows directory: C:\Windows
15:30:40.0438 3012 Running under WOW64
15:30:40.0438 3012 Processor architecture: Intel x64
15:30:40.0438 3012 Number of processors: 4
15:30:40.0438 3012 Page size: 0x1000
15:30:40.0438 3012 Boot type: Normal boot
15:30:40.0438 3012 ============================================================
15:30:41.0000 3012 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
15:30:41.0016 3012 ============================================================
15:30:41.0016 3012 \Device\Harddisk0\DR0:
15:30:41.0016 3012 MBR partitions:
15:30:41.0016 3012 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x14CF800, BlocksNum 0x32000
15:30:41.0016 3012 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1501800, BlocksNum 0x23F2CAB0
15:30:41.0016 3012 ============================================================
15:30:41.0062 3012 C: <-> \Device\Harddisk0\DR0\Partition1
15:30:41.0062 3012 ============================================================
15:30:41.0062 3012 Initialize success
15:30:41.0062 3012 ============================================================
15:31:07.0879 6076 ============================================================
15:31:07.0879 6076 Scan started
15:31:07.0879 6076 Mode: Manual; TDLFS;
15:31:07.0879 6076 ============================================================
15:31:09.0127 6076 1394ohci (969c91060cbb5d17cb8440b5f78b4c51) C:\Windows\system32\drivers\1394ohci.sys
15:31:09.0142 6076 1394ohci - ok
15:31:09.0236 6076 ACDaemon (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
15:31:09.0236 6076 ACDaemon - ok
15:31:09.0283 6076 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\drivers\ACPI.sys
15:31:09.0298 6076 ACPI - ok
15:31:09.0314 6076 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\drivers\acpipmi.sys
15:31:09.0330 6076 AcpiPmi - ok
15:31:09.0720 6076 AdobeFlashPlayerUpdateSvc (990dc6edc9f933194d7cd4e65146bc94) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
15:31:09.0720 6076 AdobeFlashPlayerUpdateSvc - ok
15:31:09.0922 6076 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\drivers\adp94xx.sys
15:31:09.0938 6076 adp94xx - ok
15:31:09.0985 6076 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\drivers\adpahci.sys
15:31:10.0000 6076 adpahci - ok
15:31:10.0047 6076 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\drivers\adpu320.sys
15:31:10.0047 6076 adpu320 - ok
15:31:10.0078 6076 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
15:31:10.0078 6076 AeLookupSvc - ok
15:31:10.0141 6076 AFD (db9d6c6b2cd95a9ca414d045b627422e) C:\Windows\system32\drivers\afd.sys
15:31:10.0156 6076 AFD - ok
15:31:10.0172 6076 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
15:31:10.0172 6076 agp440 - ok
15:31:10.0188 6076 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
15:31:10.0188 6076 ALG - ok
15:31:10.0203 6076 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
15:31:10.0203 6076 aliide - ok
15:31:10.0203 6076 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
15:31:10.0203 6076 amdide - ok
15:31:10.0219 6076 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\drivers\amdk8.sys
15:31:10.0219 6076 AmdK8 - ok
15:31:10.0219 6076 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\drivers\amdppm.sys
15:31:10.0219 6076 AmdPPM - ok
15:31:10.0266 6076 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys
15:31:10.0266 6076 amdsata - ok
15:31:10.0281 6076 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\drivers\amdsbs.sys
15:31:10.0281 6076 amdsbs - ok
15:31:10.0312 6076 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys
15:31:10.0312 6076 amdxata - ok
15:31:10.0359 6076 ApfiltrService (2d45f2dfbc3d8f53df7ebeffa8c9bc38) C:\Windows\system32\DRIVERS\Apfiltr.sys
15:31:10.0359 6076 ApfiltrService - ok
15:31:10.0359 6076 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
15:31:10.0359 6076 AppID - ok
15:31:10.0390 6076 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
15:31:10.0390 6076 AppIDSvc - ok
15:31:10.0422 6076 Appinfo (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll
15:31:10.0422 6076 Appinfo - ok
15:31:10.0437 6076 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\drivers\arc.sys
15:31:10.0437 6076 arc - ok
15:31:10.0453 6076 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\drivers\arcsas.sys
15:31:10.0453 6076 arcsas - ok
15:31:10.0484 6076 ArcSoftKsUFilter (c130bc4a51b1382b2be8e44579ec4c0a) C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys
15:31:10.0484 6076 ArcSoftKsUFilter - ok
15:31:10.0500 6076 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
15:31:10.0500 6076 AsyncMac - ok
15:31:10.0515 6076 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
15:31:10.0515 6076 atapi - ok
15:31:10.0624 6076 athr (cca705cdf038d5bc243203ce4416b345) C:\Windows\system32\DRIVERS\athrx.sys
15:31:10.0656 6076 athr - ok
15:31:11.0124 6076 atikmdag (eaea2ce49de0cca80beb9134107e5dd7) C:\Windows\system32\DRIVERS\atikmdag.sys
15:31:11.0248 6076 atikmdag - ok
15:31:11.0389 6076 AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll
15:31:11.0404 6076 AudioEndpointBuilder - ok
15:31:11.0420 6076 AudioSrv (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll
15:31:11.0420 6076 AudioSrv - ok
15:31:11.0436 6076 AxInstSV (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll
15:31:11.0436 6076 AxInstSV - ok
15:31:11.0514 6076 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\drivers\bxvbda.sys
15:31:11.0514 6076 b06bdrv - ok
15:31:11.0545 6076 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
15:31:11.0560 6076 b57nd60a - ok
15:31:11.0592 6076 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
15:31:11.0592 6076 BDESVC - ok
15:31:11.0607 6076 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
15:31:11.0607 6076 Beep - ok
15:31:11.0670 6076 BFE (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll
15:31:11.0670 6076 BFE - ok
15:31:11.0779 6076 BITS (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\System32\qmgr.dll
15:31:11.0794 6076 BITS - ok
15:31:11.0841 6076 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\drivers\blbdrive.sys
15:31:11.0841 6076 blbdrive - ok
15:31:11.0872 6076 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys
15:31:11.0872 6076 bowser - ok
15:31:11.0888 6076 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\BrFiltLo.sys
15:31:11.0888 6076 BrFiltLo - ok
15:31:11.0919 6076 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\BrFiltUp.sys
15:31:11.0919 6076 BrFiltUp - ok
15:31:11.0950 6076 Browser (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll
15:31:11.0950 6076 Browser - ok
15:31:11.0982 6076 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
15:31:11.0997 6076 Brserid - ok
15:31:12.0013 6076 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
15:31:12.0013 6076 BrSerWdm - ok
15:31:12.0044 6076 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
15:31:12.0044 6076 BrUsbMdm - ok
15:31:12.0060 6076 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
15:31:12.0060 6076 BrUsbSer - ok
15:31:12.0091 6076 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys
15:31:12.0091 6076 BthEnum - ok
15:31:12.0091 6076 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
15:31:12.0091 6076 BTHMODEM - ok
15:31:12.0106 6076 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
15:31:12.0106 6076 BthPan - ok
15:31:12.0153 6076 BTHPORT (21084ceb85280468c9aca3c805c0f8cf) C:\Windows\system32\Drivers\BTHport.sys
15:31:12.0169 6076 BTHPORT - ok
15:31:12.0200 6076 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
15:31:12.0200 6076 bthserv - ok
15:31:12.0216 6076 BTHUSB (8504842634dd144c075b6b0c982ccec4) C:\Windows\system32\Drivers\BTHUSB.sys
15:31:12.0216 6076 BTHUSB - ok
15:31:12.0262 6076 btwampfl (59e3510784548c6939c1b3b985c232e3) C:\Windows\system32\drivers\btwampfl.sys
15:31:12.0262 6076 btwampfl - ok
15:31:12.0278 6076 btwaudio (1872074ed0a3fb22e3f1e3197b984bfa) C:\Windows\system32\drivers\btwaudio.sys
15:31:12.0278 6076 btwaudio - ok
15:31:12.0294 6076 btwavdt (691cf076c33ab1c3a5b2fd5450300733) C:\Windows\system32\DRIVERS\btwavdt.sys
15:31:12.0294 6076 btwavdt - ok
15:31:12.0418 6076 btwdins (8ba6e93a182126781952a7895ec1e4b2) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
15:31:12.0434 6076 btwdins - ok
15:31:12.0465 6076 btwl2cap (07096d2bc22ccb6cea5a532df0be8a75) C:\Windows\system32\DRIVERS\btwl2cap.sys
15:31:12.0465 6076 btwl2cap - ok
15:31:12.0465 6076 btwrchid (c9273b20dec8ce38dbce5d29de63c907) C:\Windows\system32\DRIVERS\btwrchid.sys
15:31:12.0465 6076 btwrchid - ok
15:31:12.0481 6076 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
15:31:12.0496 6076 cdfs - ok
15:31:12.0512 6076 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
15:31:12.0512 6076 cdrom - ok
15:31:12.0543 6076 CertPropSvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll
15:31:12.0543 6076 CertPropSvc - ok
15:31:12.0574 6076 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\drivers\circlass.sys
15:31:12.0574 6076 circlass - ok
15:31:12.0621 6076 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
15:31:12.0621 6076 CLFS - ok
15:31:12.0684 6076 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
15:31:12.0684 6076 clr_optimization_v2.0.50727_32 - ok
15:31:12.0699 6076 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
15:31:12.0699 6076 clr_optimization_v2.0.50727_64 - ok
15:31:12.0762 6076 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
15:31:12.0762 6076 clr_optimization_v4.0.30319_32 - ok
15:31:12.0808 6076 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
15:31:12.0808 6076 clr_optimization_v4.0.30319_64 - ok
15:31:12.0840 6076 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\drivers\CmBatt.sys
15:31:12.0840 6076 CmBatt - ok
15:31:12.0855 6076 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
15:31:12.0855 6076 cmdide - ok
15:31:12.0918 6076 CNG (937beb186a735aca91d717044a49d17e) C:\Windows\system32\Drivers\cng.sys
15:31:12.0918 6076 CNG - ok
15:31:12.0933 6076 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\drivers\compbatt.sys
15:31:12.0933 6076 Compbatt - ok
15:31:12.0933 6076 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\drivers\CompositeBus.sys
15:31:12.0933 6076 CompositeBus - ok
15:31:12.0949 6076 COMSysApp - ok
15:31:12.0996 6076 cpuz132 - ok
15:31:13.0011 6076 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\drivers\crcdisk.sys
15:31:13.0027 6076 crcdisk - ok
15:31:13.0058 6076 CryptSvc (f02786b66375292e58c8777082d4396d) C:\Windows\system32\cryptsvc.dll
15:31:13.0074 6076 CryptSvc - ok
15:31:13.0120 6076 DcomLaunch (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll
15:31:13.0136 6076 DcomLaunch - ok
15:31:13.0183 6076 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
15:31:13.0183 6076 defragsvc - ok
15:31:13.0214 6076 DfsC (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys
15:31:13.0230 6076 DfsC - ok
15:31:13.0245 6076 dg_ssudbus (113212d25d0c9bb8901a9833774da97f) C:\Windows\system32\DRIVERS\ssudbus.sys
15:31:13.0261 6076 dg_ssudbus - ok
15:31:13.0292 6076 Dhcp (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll
15:31:13.0308 6076 Dhcp - ok
15:31:13.0339 6076 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
15:31:13.0339 6076 discache - ok
15:31:13.0354 6076 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\drivers\disk.sys
15:31:13.0354 6076 Disk - ok
15:31:13.0386 6076 Dnscache (85cf424c74a1d5ec33533e1dbff9920a) C:\Windows\System32\dnsrslvr.dll
15:31:13.0386 6076 Dnscache - ok
15:31:13.0417 6076 dot3svc (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll
15:31:13.0417 6076 dot3svc - ok
15:31:13.0448 6076 DPS (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll
15:31:13.0448 6076 DPS - ok
15:31:13.0464 6076 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
15:31:13.0464 6076 drmkaud - ok
15:31:13.0588 6076 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys
15:31:13.0604 6076 DXGKrnl - ok
15:31:13.0635 6076 eamonm (aca3fe4f18a945b7bf2618a79f6f670b) C:\Windows\system32\DRIVERS\eamonm.sys
15:31:13.0635 6076 eamonm - ok
15:31:13.0666 6076 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
15:31:13.0666 6076 EapHost - ok
15:31:13.0900 6076 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\drivers\evbda.sys
15:31:13.0947 6076 ebdrv - ok
15:31:14.0041 6076 EFS (156f6159457d0aa7e59b62681b56eb90) C:\Windows\System32\lsass.exe
15:31:14.0041 6076 EFS - ok
15:31:14.0072 6076 ehdrv (6672438bdcbfd87250d22112d458294d) C:\Windows\system32\DRIVERS\ehdrv.sys
15:31:14.0088 6076 ehdrv - ok
15:31:14.0166 6076 ehRecvr (47c071994c3f649f23d9cd075ac9304a) C:\Windows\ehome\ehRecvr.exe
15:31:14.0166 6076 ehRecvr - ok
15:31:14.0197 6076 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
15:31:14.0197 6076 ehSched - ok
15:31:14.0244 6076 EhttpSrv (8af4f3c4c2110cc4b8b59d625788230d) C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
15:31:14.0244 6076 EhttpSrv - ok
15:31:14.0322 6076 ekrn (791c18d5c16ada0d8188bf39aff8ef24) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
15:31:14.0322 6076 ekrn - ok
15:31:14.0431 6076 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\drivers\elxstor.sys
15:31:14.0446 6076 elxstor - ok
15:31:14.0478 6076 epfwwfpr (954fade8e59f159b0a71d0cfcc99a76e) C:\Windows\system32\DRIVERS\epfwwfpr.sys
15:31:14.0478 6076 epfwwfpr - ok
15:31:14.0493 6076 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
15:31:14.0493 6076 ErrDev - ok
15:31:14.0571 6076 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
15:31:14.0571 6076 EventSystem - ok
15:31:14.0712 6076 EvtEng (b56d9602db5fe1c116b1ca5efd8e2e50) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
15:31:14.0743 6076 EvtEng - ok
15:31:14.0852 6076 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
15:31:14.0852 6076 exfat - ok
15:31:14.0883 6076 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
15:31:14.0883 6076 fastfat - ok
15:31:14.0946 6076 Fax (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe
15:31:14.0961 6076 Fax - ok
15:31:14.0977 6076 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\drivers\fdc.sys
15:31:14.0977 6076 fdc - ok
15:31:14.0992 6076 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
15:31:14.0992 6076 fdPHost - ok
15:31:15.0008 6076 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
15:31:15.0008 6076 FDResPub - ok
15:31:15.0024 6076 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
15:31:15.0024 6076 FileInfo - ok
15:31:15.0039 6076 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
15:31:15.0039 6076 Filetrace - ok
15:31:15.0055 6076 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\drivers\flpydisk.sys
15:31:15.0070 6076 flpydisk - ok
15:31:15.0102 6076 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
15:31:15.0102 6076 FltMgr - ok
15:31:15.0211 6076 FontCache (bc00505cfda789ed3be95d2ff38c4875) C:\Windows\system32\FntCache.dll
15:31:15.0226 6076 FontCache - ok
15:31:15.0289 6076 FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
15:31:15.0289 6076 FontCache3.0.0.0 - ok
15:31:15.0336 6076 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
15:31:15.0336 6076 FsDepends - ok
15:31:15.0367 6076 fssfltr (6c06701bf1db05405804d7eb610991ce) C:\Windows\system32\DRIVERS\fssfltr.sys
15:31:15.0367 6076 fssfltr - ok
15:31:15.0538 6076 fsssvc (4ce9dac1518ff7e77bd213e6394b9d77) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
15:31:15.0570 6076 fsssvc - ok
15:31:15.0663 6076 Fs_Rec (d3e3f93d67821a2db2b3d9fac2dc2064) C:\Windows\system32\drivers\Fs_Rec.sys
15:31:15.0663 6076 Fs_Rec - ok
15:31:15.0694 6076 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
15:31:15.0694 6076 fvevol - ok
15:31:15.0741 6076 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\drivers\gagp30kx.sys
15:31:15.0741 6076 gagp30kx - ok
15:31:15.0850 6076 gpsvc (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll
15:31:15.0866 6076 gpsvc - ok
15:31:15.0897 6076 GRemoteBus (5bd454f0e896150e92dba95b4e23289a) C:\Windows\system32\DRIVERS\GRemoteBus64.sys
15:31:15.0897 6076 GRemoteBus - ok
15:31:15.0944 6076 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
15:31:15.0944 6076 hcw85cir - ok
15:31:15.0975 6076 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
15:31:15.0975 6076 HdAudAddService - ok
15:31:16.0006 6076 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\drivers\HDAudBus.sys
15:31:16.0022 6076 HDAudBus - ok
15:31:16.0038 6076 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys
15:31:16.0038 6076 HECIx64 - ok
15:31:16.0053 6076 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\drivers\HidBatt.sys
15:31:16.0053 6076 HidBatt - ok
15:31:16.0084 6076 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\drivers\hidbth.sys
15:31:16.0084 6076 HidBth - ok
15:31:16.0100 6076 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\drivers\hidir.sys
15:31:16.0116 6076 HidIr - ok
15:31:16.0131 6076 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
15:31:16.0131 6076 hidserv - ok
15:31:16.0162 6076 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
15:31:16.0162 6076 HidUsb - ok
15:31:16.0209 6076 hkmsvc (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll
15:31:16.0209 6076 hkmsvc - ok
15:31:16.0240 6076 HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll
15:31:16.0240 6076 HomeGroupListener - ok
15:31:16.0272 6076 HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll
15:31:16.0272 6076 HomeGroupProvider - ok
15:31:16.0303 6076 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\drivers\HpSAMD.sys
15:31:16.0303 6076 HpSAMD - ok
15:31:16.0365 6076 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
15:31:16.0381 6076 HTTP - ok
15:31:16.0412 6076 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
15:31:16.0412 6076 hwpolicy - ok
15:31:16.0428 6076 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
15:31:16.0428 6076 i8042prt - ok
15:31:16.0474 6076 iaStor (abbf174cb394f5c437410a788b7e404a) C:\Windows\system32\drivers\iaStor.sys
15:31:16.0474 6076 iaStor - ok
15:31:16.0537 6076 IAStorDataMgrSvc (31a0e93cdf29007d6c6fffb632f375ed) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
15:31:16.0537 6076 IAStorDataMgrSvc - ok
15:31:16.0584 6076 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys
15:31:16.0599 6076 iaStorV - ok
15:31:16.0708 6076 idsvc (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
15:31:16.0724 6076 idsvc - ok
15:31:17.0379 6076 igfx (2a22ab054f4630d2ef4bab2853f6d5f6) C:\Windows\system32\DRIVERS\igdkmd64.sys
15:31:17.0582 6076 igfx - ok
15:31:17.0691 6076 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\drivers\iirsp.sys
15:31:17.0691 6076 iirsp - ok
15:31:17.0769 6076 IKEEXT (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll
15:31:17.0785 6076 IKEEXT - ok
15:31:17.0832 6076 Impcd (dd587a55390ed2295bce6d36ad567da9) C:\Windows\system32\drivers\Impcd.sys
15:31:17.0832 6076 Impcd - ok
15:31:18.0019 6076 IntcAzAudAddService (526e482afb586cb1cdd687869decf686) C:\Windows\system32\drivers\RTKVHD64.sys
15:31:18.0034 6076 IntcAzAudAddService - ok
15:31:18.0144 6076 IntcDAud (58cf58dee26c909bd6f977b61d246295) C:\Windows\system32\DRIVERS\IntcDAud.sys
15:31:18.0144 6076 IntcDAud - ok
15:31:18.0175 6076 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
15:31:18.0190 6076 intelide - ok
15:31:18.0206 6076 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
15:31:18.0206 6076 intelppm - ok
15:31:18.0237 6076 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
15:31:18.0237 6076 IPBusEnum - ok
15:31:18.0253 6076 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
15:31:18.0253 6076 IpFilterDriver - ok
15:31:18.0284 6076 iphlpsvc (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll
15:31:18.0300 6076 iphlpsvc - ok
15:31:18.0331 6076 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\drivers\IPMIDrv.sys
15:31:18.0331 6076 IPMIDRV - ok
15:31:18.0346 6076 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
15:31:18.0346 6076 IPNAT - ok
15:31:18.0346 6076 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
15:31:18.0362 6076 IRENUM - ok
15:31:18.0378 6076 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
15:31:18.0378 6076 isapnp - ok
15:31:18.0393 6076 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\drivers\msiscsi.sys
15:31:18.0393 6076 iScsiPrt - ok
15:31:18.0409 6076 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
15:31:18.0409 6076 kbdclass - ok
15:31:18.0424 6076 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\drivers\kbdhid.sys
15:31:18.0424 6076 kbdhid - ok
15:31:18.0456 6076 KeyIso (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe
15:31:18.0456 6076 KeyIso - ok
15:31:18.0456 6076 KMService - ok
15:31:18.0471 6076 KSecDD (16c1b906fc5ead84769f90b736b6bf0e) C:\Windows\system32\Drivers\ksecdd.sys
15:31:18.0471 6076 KSecDD - ok
15:31:18.0487 6076 KSecPkg (0b711550c56444879d71c7daabda6c83) C:\Windows\system32\Drivers\ksecpkg.sys
15:31:18.0487 6076 KSecPkg - ok
15:31:18.0534 6076 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
15:31:18.0534 6076 ksthunk - ok
15:31:18.0565 6076 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
15:31:18.0580 6076 KtmRm - ok
15:31:18.0612 6076 LanmanServer (81f1d04d4d0e433099365127375fd501) C:\Windows\system32\srvsvc.dll
15:31:18.0612 6076 LanmanServer - ok
15:31:18.0658 6076 LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll
15:31:18.0658 6076 LanmanWorkstation - ok
15:31:18.0674 6076 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
15:31:18.0690 6076 lltdio - ok
15:31:18.0736 6076 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
15:31:18.0736 6076 lltdsvc - ok
15:31:18.0768 6076 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
15:31:18.0768 6076 lmhosts - ok
15:31:18.0814 6076 LMS (3d23191672d83e90d1cf63927ee98136) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
15:31:18.0814 6076 LMS - ok
15:31:18.0861 6076 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\drivers\lsi_fc.sys
15:31:18.0861 6076 LSI_FC - ok
15:31:18.0877 6076 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\drivers\lsi_sas.sys
15:31:18.0877 6076 LSI_SAS - ok
15:31:18.0877 6076 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\drivers\lsi_sas2.sys
15:31:18.0892 6076 LSI_SAS2 - ok
15:31:18.0892 6076 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\drivers\lsi_scsi.sys
15:31:18.0892 6076 LSI_SCSI - ok
15:31:18.0924 6076 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
15:31:18.0924 6076 luafv - ok
15:31:18.0970 6076 mcdbus (79d51e7f5926e8ce1b3ebecebae28cff) C:\Windows\system32\DRIVERS\mcdbus.sys
15:31:18.0970 6076 mcdbus - ok
15:31:18.0986 6076 Mcx2Svc (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll
15:31:19.0002 6076 Mcx2Svc - ok
15:31:19.0017 6076 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\drivers\megasas.sys
15:31:19.0017 6076 megasas - ok
15:31:19.0048 6076 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\drivers\MegaSR.sys
15:31:19.0064 6076 MegaSR - ok
15:31:19.0142 6076 Microsoft SharePoint Workspace Audit Service - ok
15:31:19.0158 6076 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
15:31:19.0158 6076 MMCSS - ok
15:31:19.0173 6076 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
15:31:19.0173 6076 Modem - ok
15:31:19.0204 6076 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
15:31:19.0204 6076 monitor - ok
15:31:19.0220 6076 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
15:31:19.0220 6076 mouclass - ok
15:31:19.0251 6076 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
15:31:19.0251 6076 mouhid - ok
15:31:19.0282 6076 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
15:31:19.0282 6076 mountmgr - ok
15:31:19.0298 6076 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\drivers\mpio.sys
15:31:19.0298 6076 mpio - ok
15:31:19.0329 6076 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
15:31:19.0329 6076 mpsdrv - ok
15:31:19.0407 6076 MpsSvc (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll
15:31:19.0423 6076 MpsSvc - ok
15:31:19.0470 6076 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
15:31:19.0470 6076 MRxDAV - ok
15:31:19.0516 6076 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys
15:31:19.0516 6076 mrxsmb - ok
15:31:19.0594 6076 mrxsmb10 (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys
15:31:19.0594 6076 mrxsmb10 - ok
15:31:19.0610 6076 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys
15:31:19.0610 6076 mrxsmb20 - ok
15:31:19.0626 6076 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\drivers\msahci.sys
15:31:19.0626 6076 msahci - ok
15:31:19.0641 6076 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\drivers\msdsm.sys
15:31:19.0657 6076 msdsm - ok
15:31:19.0688 6076 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
15:31:19.0704 6076 MSDTC - ok
15:31:19.0704 6076 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
15:31:19.0719 6076 Msfs - ok
15:31:19.0750 6076 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
15:31:19.0750 6076 mshidkmdf - ok
15:31:19.0750 6076 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
15:31:19.0750 6076 msisadrv - ok
15:31:19.0797 6076 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
15:31:19.0797 6076 MSiSCSI - ok
15:31:19.0797 6076 msiserver - ok
15:31:19.0813 6076 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
15:31:19.0828 6076 MSKSSRV - ok
15:31:19.0844 6076 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
15:31:19.0844 6076 MSPCLOCK - ok
15:31:19.0860 6076 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
15:31:19.0860 6076 MSPQM - ok
15:31:19.0891 6076 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
15:31:19.0906 6076 MsRPC - ok
15:31:19.0922 6076 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
15:31:19.0922 6076 mssmbios - ok
15:31:20.0000 6076 MSSQLServerADHelper100 (f1761c8fb2b25a32c6d63e36bb88c3ae) c:\Program Files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE
15:31:20.0000 6076 MSSQLServerADHelper100 - ok
15:31:20.0031 6076 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
15:31:20.0031 6076 MSTEE - ok
15:31:20.0047 6076 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\drivers\MTConfig.sys
15:31:20.0047 6076 MTConfig - ok
15:31:20.0078 6076 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
15:31:20.0078 6076 Mup - ok
15:31:20.0125 6076 napagent (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll
15:31:20.0140 6076 napagent - ok
15:31:20.0187 6076 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
15:31:20.0187 6076 NativeWifiP - ok
15:31:20.0265 6076 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
15:31:20.0281 6076 NDIS - ok
15:31:20.0296 6076 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
15:31:20.0296 6076 NdisCap - ok
15:31:20.0328 6076 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
15:31:20.0328 6076 NdisTapi - ok
15:31:20.0343 6076 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
15:31:20.0343 6076 Ndisuio - ok
15:31:20.0359 6076 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
15:31:20.0359 6076 NdisWan - ok
15:31:20.0374 6076 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
15:31:20.0374 6076 NDProxy - ok
15:31:20.0390 6076 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
15:31:20.0390 6076 NetBIOS - ok
15:31:20.0421 6076 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
15:31:20.0421 6076 NetBT - ok
15:31:20.0452 6076 Netlogon (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe
15:31:20.0452 6076 Netlogon - ok
15:31:20.0499 6076 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
15:31:20.0515 6076 Netman - ok
15:31:20.0562 6076 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
15:31:20.0562 6076 netprofm - ok
15:31:20.0640 6076 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
15:31:20.0640 6076 NetTcpPortSharing - ok
15:31:21.0170 6076 NETw5s64 (18555f48844c2861d9dce8f2b7223ae5) C:\Windows\system32\DRIVERS\NETw5s64.sys
15:31:21.0342 6076 NETw5s64 - ok
15:31:21.0435 6076 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\drivers\nfrd960.sys
15:31:21.0435 6076 nfrd960 - ok
15:31:21.0482 6076 NlaSvc (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll
15:31:21.0482 6076 NlaSvc - ok
15:31:21.0747 6076 nlsX86cc (1e38790bdea07472c4b16add469e9912) C:\Windows\SysWOW64\NLSSRV32.EXE
15:31:21.0747 6076 nlsX86cc - ok
15:31:21.0856 6076 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
15:31:21.0856 6076 Npfs - ok
15:31:21.0888 6076 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
15:31:21.0888 6076 nsi - ok
15:31:21.0903 6076 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
15:31:21.0903 6076 nsiproxy - ok
15:31:22.0044 6076 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys
15:31:22.0075 6076 Ntfs - ok
15:31:22.0184 6076 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
15:31:22.0184 6076 Null - ok
15:31:22.0215 6076 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys
15:31:22.0215 6076 nvraid - ok
15:31:22.0246 6076 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys
15:31:22.0246 6076 nvstor - ok
15:31:22.0278 6076 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
15:31:22.0278 6076 nv_agp - ok
15:31:22.0293 6076 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
15:31:22.0309 6076 ohci1394 - ok
15:31:22.0574 6076 OODefragAgent (6aaf515829c68c2cc52994fbd32d3f6c) C:\Program Files\OO Software\Defrag\oodag.exe
15:31:22.0621 6076 OODefragAgent - ok
15:31:22.0683 6076 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
15:31:22.0683 6076 ose - ok
15:31:23.0073 6076 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
15:31:23.0151 6076 osppsvc - ok
15:31:23.0276 6076 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
15:31:23.0292 6076 p2pimsvc - ok
15:31:23.0323 6076 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
15:31:23.0338 6076 p2psvc - ok
15:31:23.0370 6076 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\drivers\parport.sys
15:31:23.0370 6076 Parport - ok
15:31:23.0401 6076 partmgr (90061b1acfe8ccaa5345750ffe08d8b8) C:\Windows\system32\drivers\partmgr.sys
15:31:23.0401 6076 partmgr - ok
15:31:23.0432 6076 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
15:31:23.0432 6076 PcaSvc - ok
15:31:23.0448 6076 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\drivers\pci.sys
15:31:23.0448 6076 pci - ok
15:31:23.0463 6076 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
15:31:23.0463 6076 pciide - ok
15:31:23.0494 6076 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\drivers\pcmcia.sys
15:31:23.0494 6076 pcmcia - ok
15:31:23.0541 6076 pcouffin (af7ce12c4f3dc8cb2b07685c916bbcfe) C:\Windows\system32\Drivers\pcouffin.sys
15:31:23.0541 6076 pcouffin - ok
15:31:23.0650 6076 PCToolsSSDMonitorSvc (a0e7d752514a7d99341d5f2a834224a9) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
15:31:23.0650 6076 PCToolsSSDMonitorSvc - ok
15:31:23.0666 6076 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
15:31:23.0666 6076 pcw - ok
15:31:23.0744 6076 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
15:31:23.0744 6076 PEAUTH - ok
15:31:23.0994 6076 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
15:31:23.0994 6076 PerfHost - ok
15:31:24.0212 6076 pla (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll
15:31:24.0243 6076 pla - ok
15:31:24.0290 6076 PlugPlay (98b1721b8718164293b9701b98c52d77) C:\Windows\system32\umpnpmgr.dll
15:31:24.0306 6076 PlugPlay - ok
15:31:24.0415 6076 PMBDeviceInfoProvider (63694c307273062a2167ae4ce80730ef) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
15:31:24.0430 6076 PMBDeviceInfoProvider - ok
15:31:24.0446 6076 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
15:31:24.0462 6076 PNRPAutoReg - ok
15:31:24.0493 6076 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
15:31:24.0508 6076 PNRPsvc - ok
15:31:24.0571 6076 PolicyAgent (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll
15:31:24.0571 6076 PolicyAgent - ok
15:31:24.0618 6076 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
15:31:24.0618 6076 Power - ok
15:31:24.0680 6076 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
15:31:24.0680 6076 PptpMiniport - ok
15:31:24.0711 6076 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\drivers\processr.sys
15:31:24.0711 6076 Processor - ok
15:31:24.0758 6076 ProfSvc (97293447431311c06703368ad0f6c4be) C:\Windows\system32\profsvc.dll
15:31:24.0758 6076 ProfSvc - ok
15:31:24.0805 6076 ProtectedStorage (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe
15:31:24.0805 6076 ProtectedStorage - ok
15:31:24.0836 6076 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
15:31:24.0836 6076 Psched - ok
15:31:24.0945 6076 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\drivers\ql2300.sys
15:31:24.0976 6076 ql2300 - ok
15:31:25.0070 6076 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\drivers\ql40xx.sys
15:31:25.0070 6076 ql40xx - ok
15:31:25.0117 6076 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
15:31:25.0117 6076 QWAVE - ok
15:31:25.0148 6076 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
15:31:25.0148 6076 QWAVEdrv - ok
15:31:25.0164 6076 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
15:31:25.0164 6076 RasAcd - ok
15:31:25.0179 6076 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
15:31:25.0179 6076 RasAgileVpn - ok
15:31:25.0210 6076 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
15:31:25.0210 6076 RasAuto - ok
15:31:25.0226 6076 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
15:31:25.0226 6076 Rasl2tp - ok
15:31:25.0257 6076 RasMan (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll
15:31:25.0273 6076 RasMan - ok
15:31:25.0288 6076 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
15:31:25.0288 6076 RasPppoe - ok
15:31:25.0320 6076 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
15:31:25.0320 6076 RasSstp - ok
15:31:25.0351 6076 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
15:31:25.0351 6076 rdbss - ok
15:31:25.0382 6076 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\drivers\rdpbus.sys
15:31:25.0382 6076 rdpbus - ok
15:31:25.0382 6076 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
15:31:25.0382 6076 RDPCDD - ok
15:31:25.0398 6076 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
15:31:25.0398 6076 RDPENCDD - ok
15:31:25.0398 6076 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
15:31:25.0398 6076 RDPREFMP - ok
15:31:25.0444 6076 RDPWD (447de7e3dea39d422c1504f245b668b1) C:\Windows\system32\drivers\RDPWD.sys
15:31:25.0444 6076 RDPWD - ok
15:31:25.0491 6076 rdyboost (e5dc9ba9e439d6dbdd79f8caacb5bf01) C:\Windows\system32\drivers\rdyboost.sys
15:31:25.0491 6076 rdyboost - ok
15:31:25.0647 6076 RegSrvc (0aa473966357c4a41b5eb19649eb6e5e) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
15:31:25.0647 6076 RegSrvc - ok
15:31:25.0694 6076 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
15:31:25.0694 6076 RemoteAccess - ok
15:31:25.0725 6076 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
15:31:25.0725 6076 RemoteRegistry - ok
15:31:25.0788 6076 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
15:31:25.0803 6076 RFCOMM - ok
15:31:25.0819 6076 rimspci (fa6abc06b629da29634d31f1fe0347bd) C:\Windows\system32\drivers\rimssne64.sys
15:31:25.0819 6076 rimspci - ok
15:31:25.0834 6076 risdsnpe (8f8539a7f5c117d4407b2985995671f2) C:\Windows\system32\drivers\risdsne64.sys
15:31:25.0834 6076 risdsnpe - ok
15:31:25.0866 6076 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
15:31:25.0866 6076 RpcEptMapper - ok
15:31:25.0897 6076 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
15:31:25.0897 6076 RpcLocator - ok
15:31:25.0959 6076 RpcSs (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll
15:31:25.0959 6076 RpcSs - ok
15:31:25.0975 6076 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
15:31:25.0975 6076 rspndr - ok
15:31:26.0006 6076 SamSs (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe
15:31:26.0022 6076 SamSs - ok
15:31:26.0053 6076 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\drivers\sbp2port.sys
15:31:26.0053 6076 sbp2port - ok
15:31:26.0084 6076 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
15:31:26.0084 6076 SCardSvr - ok
15:31:26.0115 6076 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
15:31:26.0115 6076 scfilter - ok
15:31:26.0209 6076 Schedule (624d0f5ff99428bb90a5b8a4123e918e) C:\Windows\system32\schedsvc.dll
15:31:26.0224 6076 Schedule - ok
15:31:26.0256 6076 SCPolicySvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll
15:31:26.0256 6076 SCPolicySvc - ok
15:31:26.0287 6076 sdbus (2c8d162efaf73abd36d8bcbb6340cae7) C:\Windows\system32\DRIVERS\sdbus.sys
15:31:26.0287 6076 sdbus - ok
15:31:26.0334 6076 SDRSVC (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll
15:31:26.0349 6076 SDRSVC - ok
15:31:26.0349 6076 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
15:31:26.0365 6076 secdrv - ok
15:31:26.0380 6076 seclogon (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll
15:31:26.0380 6076 seclogon - ok
15:31:26.0412 6076 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
15:31:26.0412 6076 SENS - ok
15:31:26.0427 6076 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
15:31:26.0427 6076 SensrSvc - ok
15:31:26.0443 6076 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\drivers\serenum.sys
15:31:26.0443 6076 Serenum - ok
15:31:26.0474 6076 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\drivers\serial.sys
15:31:26.0474 6076 Serial - ok
15:31:26.0490 6076 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\drivers\sermouse.sys
15:31:26.0490 6076 sermouse - ok
15:31:26.0536 6076 SessionEnv (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll
15:31:26.0552 6076 SessionEnv - ok
15:31:26.0568 6076 SFEP (286d3889e6ab5589646ff8a63cb928ae) C:\Windows\system32\DRIVERS\SFEP.sys
15:31:26.0568 6076 SFEP - ok
15:31:26.0583 6076 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
15:31:26.0583 6076 sffdisk - ok
15:31:26.0599 6076 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
15:31:26.0599 6076 sffp_mmc - ok
15:31:26.0614 6076 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\drivers\sffp_sd.sys
15:31:26.0614 6076 sffp_sd - ok
15:31:26.0630 6076 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\drivers\sfloppy.sys
15:31:26.0630 6076 sfloppy - ok
15:31:26.0677 6076 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
15:31:26.0677 6076 SharedAccess - ok
15:31:26.0739 6076 ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll
15:31:26.0755 6076 ShellHWDetection - ok
15:31:26.0770 6076 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\drivers\SiSRaid2.sys
15:31:26.0770 6076 SiSRaid2 - ok
15:31:26.0786 6076 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\drivers\sisraid4.sys
15:31:26.0786 6076 SiSRaid4 - ok
15:31:26.0802 6076 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
15:31:26.0802 6076 Smb - ok
15:31:26.0833 6076 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
15:31:26.0848 6076 SNMPTRAP - ok
15:31:26.0895 6076 SOHCImp (c3e69db0a4e59564230e053232f39ac7) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe
15:31:26.0895 6076 SOHCImp - ok
15:31:26.0942 6076 SOHDms (65cc4779a29c3e82b987bd4961790dff) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe
15:31:26.0958 6076 SOHDms - ok
15:31:26.0958 6076 SOHDs (f47d75cee1844eef4a9ea6ee768828fb) C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe
15:31:26.0973 6076 SOHDs - ok
15:31:27.0051 6076 SpfService (65e5659e9c2a0762d05657c0e22a7ca2) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe
15:31:27.0067 6076 SpfService - ok
15:31:27.0098 6076 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
15:31:27.0098 6076 spldr - ok
15:31:27.0160 6076 Spooler (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\Windows\System32\spoolsv.exe
15:31:27.0176 6076 Spooler - ok
15:31:27.0426 6076 sppsvc (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe
15:31:27.0488 6076 sppsvc - ok
15:31:27.0628 6076 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
15:31:27.0628 6076 sppuinotify - ok
15:31:27.0706 6076 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys
15:31:27.0706 6076 srv - ok
15:31:27.0738 6076 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys
15:31:27.0753 6076 srv2 - ok
15:31:27.0769 6076 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys
15:31:27.0769 6076 srvnet - ok
15:31:27.0800 6076 sscdbus (ed161b91fdf7eaa39469d72d463d5f4e) C:\Windows\system32\DRIVERS\sscdbus.sys
15:31:27.0816 6076 sscdbus - ok
15:31:27.0847 6076 sscdmdfl (4cb09e77593dbd8d7af33b37375ca715) C:\Windows\system32\DRIVERS\sscdmdfl.sys
15:31:27.0847 6076 sscdmdfl - ok
15:31:27.0878 6076 sscdmdm (c7b4cf53497a6e5363f3439427663882) C:\Windows\system32\DRIVERS\sscdmdm.sys
15:31:27.0878 6076 sscdmdm - ok
15:31:27.0940 6076 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
15:31:27.0940 6076 SSDPSRV - ok
15:31:27.0972 6076 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
15:31:27.0972 6076 SstpSvc - ok
15:31:28.0018 6076 ssudmdm (78cd64791f8634cf7b582fd085e57c4b) C:\Windows\system32\DRIVERS\ssudmdm.sys
15:31:28.0018 6076 ssudmdm - ok
15:31:28.0050 6076 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\drivers\stexstor.sys
15:31:28.0050 6076 stexstor - ok
15:31:28.0112 6076 stisvc (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll
15:31:28.0128 6076 stisvc - ok
15:31:28.0143 6076 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
15:31:28.0143 6076 swenum - ok
15:31:28.0237 6076 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
15:31:28.0252 6076 SwitchBoard - ok
15:31:28.0299 6076 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
15:31:28.0299 6076 swprv - ok
15:31:28.0440 6076 SysMain (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll
15:31:28.0471 6076 SysMain - ok
15:31:28.0580 6076 TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll
15:31:28.0596 6076 TabletInputService - ok
15:31:28.0627 6076 TapiSrv (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll
15:31:28.0627 6076 TapiSrv - ok
15:31:28.0658 6076 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
15:31:28.0658 6076 TBS - ok
15:31:28.0798 6076 Tcpip (624c5b3aa4c99b3184bb922d9ece3ff0) C:\Windows\system32\drivers\tcpip.sys
15:31:28.0845 6076 Tcpip - ok
15:31:29.0079 6076 TCPIP6 (624c5b3aa4c99b3184bb922d9ece3ff0) C:\Windows\system32\DRIVERS\tcpip.sys
15:31:29.0095 6076 TCPIP6 - ok
15:31:29.0204 6076 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
15:31:29.0204 6076 tcpipreg - ok
15:31:29.0235 6076 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
15:31:29.0235 6076 TDPIPE - ok
15:31:29.0266 6076 TDTCP (7518f7bcfd4b308abc9192bacaf6c970) C:\Windows\system32\drivers\tdtcp.sys
15:31:29.0266 6076 TDTCP - ok
15:31:29.0298 6076 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
15:31:29.0298 6076 tdx - ok
15:31:29.0313 6076 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\drivers\termdd.sys
15:31:29.0313 6076 TermDD - ok
15:31:29.0391 6076 TermService (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll
15:31:29.0391 6076 TermService - ok
15:31:29.0422 6076 TFsExDisk (ce4b6956e4e12492715a53076e58761f) C:\Windows\System32\Drivers\TFsExDisk.sys
15:31:29.0422 6076 TFsExDisk - ok
15:31:29.0438 6076 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
15:31:29.0438 6076 Themes - ok
15:31:29.0485 6076 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
15:31:29.0485 6076 THREADORDER - ok
15:31:29.0516 6076 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
15:31:29.0516 6076 TrkWks - ok
15:31:29.0593 6076 TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe
15:31:29.0593 6076 TrustedInstaller - ok
15:31:29.0623 6076 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
15:31:29.0623 6076 tssecsrv - ok
15:31:29.0653 6076 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
15:31:29.0653 6076 tunnel - ok
15:31:29.0683 6076 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\drivers\uagp35.sys
15:31:29.0683 6076 uagp35 - ok
15:31:29.0743 6076 uCamMonitor (63f6d08c54d5b3c1b12a6172032055c7) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
15:31:29.0743 6076 uCamMonitor - ok
15:31:29.0783 6076 udfs (0e5e962b5649d544be54e8c90761ea2b) C:\Windows\system32\DRIVERS\udfs.sys
15:31:29.0783 6076 udfs - ok
15:31:29.0823 6076 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
15:31:29.0833 6076 UI0Detect - ok
15:31:29.0853 6076 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
15:31:29.0853 6076 uliagpkx - ok
15:31:29.0863 6076 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
15:31:29.0863 6076 umbus - ok
15:31:29.0893 6076 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\drivers\umpass.sys
15:31:29.0893 6076 UmPass - ok
15:31:30.0093 6076 UNS (11a559e0f10cc5e788984023df400a6f) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
15:31:30.0133 6076 UNS - ok
15:31:30.0243 6076 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
15:31:30.0243 6076 upnphost - ok
15:31:30.0283 6076 usbccgp (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys
15:31:30.0283 6076 usbccgp - ok
15:31:30.0323 6076 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
15:31:30.0323 6076 usbcir - ok
15:31:30.0353 6076 usbehci (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\drivers\usbehci.sys
15:31:30.0353 6076 usbehci - ok
15:31:30.0383 6076 usbhub (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys
15:31:30.0393 6076 usbhub - ok
15:31:30.0413 6076 usbohci (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\drivers\usbohci.sys
15:31:30.0413 6076 usbohci - ok
15:31:30.0423 6076 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
15:31:30.0423 6076 usbprint - ok
15:31:30.0463 6076 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
15:31:30.0463 6076 usbscan - ok
15:31:30.0503 6076 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS
15:31:30.0503 6076 USBSTOR - ok
15:31:30.0543 6076 usbuhci (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\drivers\usbuhci.sys
15:31:30.0543 6076 usbuhci - ok
15:31:30.0583 6076 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\System32\Drivers\usbvideo.sys
15:31:30.0583 6076 usbvideo - ok
15:31:30.0613 6076 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
15:31:30.0613 6076 UxSms - ok
15:31:30.0703 6076 VAIO Event Service (a60605fc66552b421ee1f3d4ebb9a4e0) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
15:31:30.0703 6076 VAIO Event Service - ok
15:31:30.0783 6076 VAIO Power Management (d469be2723f79cf4b384680b1fdc577d) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
15:31:30.0793 6076 VAIO Power Management - ok
15:31:30.0823 6076 VaultSvc (156f6159457d0aa7e59b62681b56eb90) C:\Windows\system32\lsass.exe
15:31:30.0833 6076 VaultSvc - ok
15:31:30.0863 6076 VBTUSB (70a90412f0ae18021794a0754c2d6299) C:\Windows\system32\Drivers\VBTUSB.sys
15:31:30.0863 6076 VBTUSB - ok
15:31:30.0973 6076 VCFw (d00058c1fff3f3de990444a5734e9639) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
15:31:30.0983 6076 VCFw - ok
15:31:31.0093 6076 VcmIAlzMgr (f19275655b42086c884abcdae2c659ae) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
15:31:31.0103 6076 VcmIAlzMgr - ok
15:31:31.0163 6076 VcmINSMgr (e005b04dfca99f5880c5111933194ca9) C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
15:31:31.0173 6076 VcmINSMgr - ok
15:31:31.0263 6076 VcmXmlIfHelper (32a3735f6874b7783c6209ed5ca36d9d) C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe
15:31:31.0263 6076 VcmXmlIfHelper - ok
15:31:31.0313 6076 VCService (d347d3abe070aa09c22fc37121555d52) C:\Program Files\Sony\VAIO Care\VCService.exe
15:31:31.0313 6076 VCService - ok
15:31:31.0413 6076 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
15:31:31.0413 6076 vdrvroot - ok
15:31:31.0483 6076 vds (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe
15:31:31.0493 6076 vds - ok
15:31:31.0513 6076 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
15:31:31.0513 6076 vga - ok
15:31:31.0553 6076 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
15:31:31.0563 6076 VgaSave - ok
15:31:31.0593 6076 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\drivers\vhdmp.sys
15:31:31.0593 6076 vhdmp - ok
15:31:31.0608 6076 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
15:31:31.0624 6076 viaide - ok
15:31:31.0640 6076 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\drivers\volmgr.sys
15:31:31.0640 6076 volmgr - ok
15:31:31.0671 6076 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
15:31:31.0686 6076 volmgrx - ok
15:31:31.0702 6076 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\drivers\volsnap.sys
15:31:31.0718 6076 volsnap - ok
15:31:31.0749 6076 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\drivers\vsmraid.sys
15:31:31.0749 6076 vsmraid - ok
15:31:31.0874 6076 VSNService (a7eb62c664a03901165290a714bd48d0) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
15:31:31.0889 6076 VSNService - ok
15:31:32.0014 6076 VSS (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe
15:31:32.0045 6076 VSS - ok
15:31:32.0217 6076 VUAgent (fb4a1695d2d74f9c92ca5e84795cdbe1) C:\Program Files\Sony\VAIO Update Common\VUAgent.exe
15:31:32.0248 6076 VUAgent - ok
15:31:32.0373 6076 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
15:31:32.0373 6076 vwifibus - ok
15:31:32.0404 6076 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
15:31:32.0404 6076 vwififlt - ok
15:31:32.0451 6076 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
15:31:32.0467 6076 W32Time - ok
15:31:32.0482 6076 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\drivers\wacompen.sys
15:31:32.0482 6076 WacomPen - ok
15:31:32.0498 6076 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
15:31:32.0498 6076 WANARP - ok
15:31:32.0513 6076 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
15:31:32.0513 6076 Wanarpv6 - ok
15:31:32.0638 6076 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
15:31:32.0669 6076 WatAdminSvc - ok
15:31:32.0779 6076 wbengine (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe
15:31:32.0810 6076 wbengine - ok
15:31:32.0919 6076 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
15:31:32.0919 6076 WbioSrvc - ok
15:31:32.0966 6076 wcncsvc (dd1bae8ebfc653824d29ccf8c9054d68) C:\Windows\System32\wcncsvc.dll
15:31:32.0981 6076 wcncsvc - ok
15:31:33.0013 6076 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
15:31:33.0013 6076 WcsPlugInService - ok
15:31:33.0044 6076 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\drivers\wd.sys
15:31:33.0044 6076 Wd - ok
15:31:33.0106 6076 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
15:31:33.0122 6076 Wdf01000 - ok
15:31:33.0153 6076 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
15:31:33.0153 6076 WdiServiceHost - ok
15:31:33.0153 6076 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
15:31:33.0153 6076 WdiSystemHost - ok
15:31:33.0200 6076 WebClient (733006127f235be7c35354ebee7b9a7b) C:\Windows\System32\webclnt.dll
15:31:33.0200 6076 WebClient - ok
15:31:33.0247 6076 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
15:31:33.0247 6076 Wecsvc - ok
15:31:33.0278 6076 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
15:31:33.0278 6076 wercplsupport - ok
15:31:33.0309 6076 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
15:31:33.0309 6076 WerSvc - ok
15:31:33.0356 6076 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
15:31:33.0356 6076 WfpLwf - ok
15:31:33.0387 6076 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
15:31:33.0387 6076 WIMMount - ok
15:31:33.0418 6076 WinDefend - ok
15:31:33.0434 6076 WinHttpAutoProxySvc - ok
15:31:33.0496 6076 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
15:31:33.0496 6076 Winmgmt - ok
15:31:33.0668 6076 WinRM (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll
15:31:33.0683 6076 WinRM - ok
15:31:33.0808 6076 WinUSB (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUSB.sys
15:31:33.0808 6076 WinUSB - ok
15:31:33.0886 6076 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
15:31:33.0902 6076 Wlansvc - ok
15:31:33.0980 6076 wlcrasvc (06c8fa1cf39de6a735b54d906ba791c6) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
15:31:33.0980 6076 wlcrasvc - ok
15:31:34.0167 6076 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
15:31:34.0214 6076 wlidsvc - ok
15:31:34.0307 6076 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
15:31:34.0307 6076 WmiAcpi - ok
15:31:34.0385 6076 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
15:31:34.0385 6076 wmiApSrv - ok
15:31:34.0432 6076 WMPNetworkSvc - ok
15:31:34.0526 6076 WMZuneComm (83b6ca03c846fcd47f9883d77d1eb27b) c:\Program Files\Zune\WMZuneComm.exe
15:31:34.0541 6076 WMZuneComm - ok
15:31:34.0573 6076 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
15:31:34.0573 6076 WPCSvc - ok
15:31:34.0604 6076 WPDBusEnum (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll
15:31:34.0604 6076 WPDBusEnum - ok
15:31:34.0619 6076 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
15:31:34.0619 6076 ws2ifsl - ok
15:31:34.0651 6076 wscsvc (8f9f3969933c02da96eb0f84576db43e) C:\Windows\System32\wscsvc.dll
15:31:34.0651 6076 wscsvc - ok
15:31:34.0666 6076 WSearch - ok
15:31:34.0853 6076 wuauserv (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll
15:31:34.0885 6076 wuauserv - ok
15:31:35.0009 6076 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
15:31:35.0009 6076 WudfPf - ok
15:31:35.0041 6076 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
15:31:35.0041 6076 WUDFRd - ok
15:31:35.0072 6076 wudfsvc (b551d6637aa0e132c18ac6e504f7b79b) C:\Windows\System32\WUDFSvc.dll
15:31:35.0072 6076 wudfsvc - ok
15:31:35.0103 6076 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
15:31:35.0103 6076 WwanSvc - ok
15:31:35.0150 6076 yukonw7 (5250193ef8e173aa7491250f00eb367f) C:\Windows\system32\DRIVERS\yk62x64.sys
15:31:35.0165 6076 yukonw7 - ok
15:31:35.0789 6076 ZuneNetworkSvc (67b787c34fb2888d01b130ae007042d8) c:\Program Files\Zune\ZuneNss.exe
15:31:35.0961 6076 ZuneNetworkSvc - ok
15:31:36.0086 6076 ZuneWlanCfgSvc (4d89fc1c20cf655739efac5da81a67bc) c:\Program Files\Zune\ZuneWlanCfgSvc.exe
15:31:36.0086 6076 ZuneWlanCfgSvc - ok
15:31:36.0133 6076 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
15:31:36.0476 6076 \Device\Harddisk0\DR0 - ok
15:31:36.0476 6076 Boot (0x1200) (b76f16cce8104a5416fc3e15a018410f) \Device\Harddisk0\DR0\Partition0
15:31:36.0476 6076 \Device\Harddisk0\DR0\Partition0 - ok
15:31:36.0507 6076 Boot (0x1200) (2455e3afa0399bab7ede9bb4427b6836) \Device\Harddisk0\DR0\Partition1
15:31:36.0507 6076 \Device\Harddisk0\DR0\Partition1 - ok
15:31:36.0507 6076 ============================================================
15:31:36.0507 6076 Scan finished
15:31:36.0507 6076 ============================================================
15:31:36.0507 5552 Detected object count: 0
15:31:36.0507 5552 Actual detected object count: 0
15:36:29.0612 5224 Deinitialize success

SuperQvas

Post #7June 26, 2012, 1:59 PM UTC last edited June 26, 2012, 2:04 PM UTC

cancelled

jeffce

Post #8June 26, 2012, 2:39 PM UTC

cancelled

What do you mean by this?

SuperQvas

Post #9June 26, 2012, 2:42 PM UTC

I posted the Logs twice so I cancelled one of them. That post"cancelled" is to be ignored, sorry!

jeffce

Post #10June 26, 2012, 2:44 PM UTC

Oh ok.

If you do something like that again just go ahead and leave it….it's fine.

Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

SuperQvas

Post #11June 26, 2012, 3:50 PM UTC

ComboFix 12-06-26.01 - vaio 26/06/2012 16:56:29.2.4 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.39.1040.18.3758.1988 [GMT 2:00] Eseguito da: c:\users\vaio\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Mozilla Firefox\searchplugins\SearchquWebSearch.xml c:\users\vaio\AppData\Local\Temp\{A26E1405-D955-44C6-975D-504C45D49672}\fpb.tmp c:\users\vaio\AppData\Local\Temp\c25e8b3d-33a7-42bf-85e6-6880c6753136\CliSecureRT.dll c:\users\vaio\AppData\Roaming\.# c:\users\vaio\AppData\Roaming\inst.exe c:\users\vaio\AppData\Roaming\OfferBox c:\users\vaio\AppData\Roaming\OfferBox\config.xml c:\windows\IsUn0410.exe c:\windows\SysWow64\ijl11.dll c:\windows\SysWow64\muzapp.exe c:\windows\SysWow64\system32.dll . . ((((((((((((((((((((((((( Files Creati Da 2012-05-26 al 2012-06-26 ))))))))))))))))))))))))))))))))))) . . 2012-06-26 15:02 . 2012-06-26 15:02 77824 —-a-w- c:\windows\Keygen.exe 2012-06-26 15:01 . 2012-06-26 15:01 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\users\vaio\AppData\Roaming\PC Cleaners 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\users\vaio\AppData\Roaming\PCPro 2012-06-26 10:16 . 2012-06-26 10:16 4446520 —-a-w- c:\windows\uninst.exe 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\programdata\PC1Data 2012-06-25 21:24 . 2012-06-25 21:24 ——– d—–w- c:\users\vaio\AppData\Roaming\Malwarebytes 2012-06-25 21:23 . 2012-06-25 21:23 ——– d—–w- c:\programdata\Malwarebytes 2012-06-25 21:02 . 2012-06-25 21:32 ——– d—–w- c:\program files (x86)\ZHPDiag 2012-06-25 21:02 . 2012-06-25 21:06 ——– d—–w- C:\ZHP 2012-06-21 18:04 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-21 18:04 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-21 18:04 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-21 18:04 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-21 18:03 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-21 18:03 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-21 18:03 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-21 18:03 . 2012-06-02 13:19 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-21 18:03 . 2012-06-02 13:15 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-19 09:53 . 2012-06-19 09:53 ——– d—–w- C:\Nuova cartella 2012-06-15 06:32 . 2012-06-15 06:32 ——– d—–w- c:\users\vaio\AppData\Local\Macromedia 2012-06-14 14:39 . 2012-04-26 05:34 76288 —-a-w- c:\windows\system32\rdpwsx.dll 2012-06-14 14:39 . 2012-04-26 05:34 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-14 14:39 . 2012-04-26 05:28 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-14 14:39 . 2012-05-02 05:32 208896 —-a-w- c:\windows\system32\profsvc.dll 2012-06-14 14:39 . 2012-05-04 10:52 5505392 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-06-14 14:39 . 2012-05-04 10:08 3902320 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-06-14 14:39 . 2012-05-04 10:08 3958128 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-06-14 14:39 . 2012-04-07 12:18 3213824 —-a-w- c:\windows\system32\msi.dll 2012-06-14 14:38 . 2012-04-07 11:34 2342400 —-a-w- c:\windows\SysWow64\msi.dll 2012-06-14 14:38 . 2012-04-28 03:50 204800 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-14 14:38 . 2012-05-15 01:32 3144192 —-a-w- c:\windows\system32\win32k.sys 2012-06-14 14:38 . 2012-04-24 05:59 182272 —-a-w- c:\windows\system32\cryptsvc.dll 2012-06-14 14:38 . 2012-04-24 05:59 1460224 —-a-w- c:\windows\system32\crypt32.dll 2012-06-14 14:38 . 2012-04-24 05:59 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-06-14 14:38 . 2012-04-24 04:47 139264 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-06-14 14:38 . 2012-04-24 04:47 1156608 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-06-14 14:38 . 2012-04-24 04:47 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll 2012-06-13 20:28 . 2012-06-13 21:05 ——– d—–w- C:\ExchangeSetupLogs 2012-06-05 17:48 . 2012-06-05 17:49 ——– d—–w- c:\program files (x86)\Monster Of The Deep 2012-06-05 08:29 . 2012-06-19 08:51 ——– d—–w- c:\users\vaio\AppData\Roaming\deluge 2012-06-05 08:28 . 2012-06-05 08:29 ——– d—–w- c:\program files (x86)\Deluge 2012-05-28 15:04 . 2012-05-28 15:04 472576 —-a-w- c:\windows\AutoKMS.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-23 15:21 . 2012-04-13 06:48 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-23 15:21 . 2011-06-01 16:52 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-05-31 04:04 . 2012-06-26 09:38 9013136 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BCD702F2-1ED6-4347-B583-1F66521B0D09}\mpengine.dll 2012-03-30 11:09 . 2012-05-08 20:46 1895280 —-a-w- c:\windows\system32\drivers\tcpip.sys . . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] "KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2012-05-04 955792] "KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-05-04 21392] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "!SearchquFFHP"="c:\windows\system32\RUNDLL32.EXE" [2009-07-14 44544] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SHTtray.exe"="c:\program files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe" [2010-06-20 99696] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-05-04 3521424] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-6-9 1128224] Google Calendar Sync.lnk - c:\program files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe [2011-4-8 542264] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer2"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG10\avgchsva.exe /sync\0c:\progra~2\AVG\AVG10\avgrsa.exe /sync /restart\0OODBS . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x] R3 GRemoteBus;GRemote virtual joystick Bus Enumerator;c:\windows\system32\DRIVERS\GRemoteBus64.sys [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x] R3 VBTUSB;VBTUSB.Sys VAIO Bluetooth Driver over USB device;c:\windows\system32\Drivers\VBTUSB.sys [x] R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-02-18 99104] R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 306400] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x] S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-01-14 810144] S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336] S2 nlsX86cc;NLS Service;c:\windows\SysWOW64\NLSSRV32.EXE [2011-01-12 68928] S2 OODefragAgent;O&O; Defrag;c:\program files\OO Software\Defrag\oodag.exe [2011-09-18 3271496] S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-10-01 632792] S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-26 398176] S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [x] S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [x] S2 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-06-20 108400] S2 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-06-18 423280] S2 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-06-20 67952] S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-05-28 2320920] S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-06-21 575856] S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-01-20 887000] S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-05-19 549616] S2 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-06-09 384880] S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2010-06-08 836608] S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x] S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [x] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x] S3 NETw5s64;Driver scheda Intel® Wireless WiFi Link 5000 Series per Windows 7 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x] S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x] S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x] S3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-01-20 286936] S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2011-02-14 44736] S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2012-01-13 1256040] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] . . Contenuto della cartella 'Scheduled Tasks' . 2012-06-26 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 15:21] . 2012-06-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000Core.job - c:\users\vaio\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-18 13:33] . 2012-06-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000UA.job - c:\users\vaio\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-18 13:33] . 2012-06-25 c:\windows\Tasks\RMSchedule.job - c:\program files (x86)\Registry Mechanic\RegMech.exe [2011-11-04 16:05] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-06-24 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-06-24 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-06-24 413208] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-31 10775584] "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-05-31 2040352] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-12-23 2918656] "OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2011-09-18 3993416] "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-05-04 3521424] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x1 . ——- Scansione supplementare ——- . uStart Page = hxxp://www.google.com.do/ mStart Page = hxxp://mystart.incredimail.com/mb50?u=891929752390932140 uInternet Settings,ProxyOverride = uInternet Settings,ProxyServer = http=127.0.0.1:80 IE: E&sporta; in Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Extract e-mail addresses IE: Google Sidewiki… IE: I&nvia; a OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = [removed] [removed] . - - - - CHIAVI ORFANE RIMOSSE - - - - . URLSearchHooks-{c91fec63-9f25-400d-95e5-6cd334dd3cc1} - (no file) AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe . . . ——————— CHIAVI DI REGISTRO BLOCCATE ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info] @Denied: (2) (LocalSystem) "AppDataDir"="c:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\" "DataDir"="ESET\\ESET NOD32 Antivirus\\" "EditionName"=" " "InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\" "LanguageId"=dword:00000410 "PackageTag"=dword:00000000 "ProductBase"=dword:00000000 "ProductCode"="{E6AF0EB3-0945-431F-919E-6826C969AA84}" "ProductName"="ESET NOD32 Antivirus" "ProductType"="eav" "ProductVersion"="4.2.71.3" "UniqueId"="00592B264EF5040F" "ScannerBuild"=dword:00001dd3 "ScannerVersionId"=dword:000015fe "ScannerVersion"="ready" "ei2"=hex(

:58,cf,fc,46,b5,b2,38,70 "ei1"=hex(

:78,84,3c,cc,61,35,00,00 "ei3"=hex(

:7d,04,f5,4e,00,00,00,00 "ei4"=dword:00000000 "FixId"=dword:00000009 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG15.00.00.01PROFESSIONAL"="AEAF1ADEE5DE6C3445EDEA2460BB66387BB72696E7CE70F9FA27B15974733E247A07F66420E 75DA07C834742FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC 9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98085D575E7D6A3B98088EDD5E5BE2F6E6675D575 E7D6A3B9808D259E42D773D84900C1FDB7C2D56980ED62A73B0BF4B8C9C258D205821E1CA5EFB7EFB EE9435C2AE48C60217F5EB56628FB421694CFA1125EC2B9BD32EF4B05DD73EB589F76E7AA0485ABB7 E4EF1E93D1FFDCBF7737F254F6288FCAA6D20C368498DCAE9778A6CC19DC85562C751B90BE011786E 252B7338CF65A170CABF17EB28080C421C8BAF71CB273735A857013AA71ABE9F04B37CFE732A76F66 68F8DDB3EEB5C0923592C90C9AC582FEBB2CD40B6E9CD23E7B194C87F5E7DDA95B3E02D4C9CB1F87E 3FA1088534434B40F80392C6F46656DCA3633F9A32CC76DFB11DD804A01A8F546C2041DD3F1AC708A 157AE06D45D5822E8640EDCF511EC82F4A45D0C23320F7D748EA9A67111A85A0B561416C59B0E2A49 6666D52084226E4BAA3B7FF2AEFC08CFA636A712EFB401F25E450A2920209E6D8E7C074AFC3F47E53 979EE83D62534D7F5DC1E8D12F67AFE21CA6D057A795962540967B25F3265DD2CA1DB6A849478CC5D 17B9736ABEF8B7A7AF3B7F50CA6A180449DF3B252CD6AB3340BEE4A99D7F5393649EF77A9F648ACA0 4E4675C0895E6BCFC4E695DA1D9ADD5E6804FC6562470A2C8E372DB70D5453A5BCE2E69E9D0867169 05672BCBE5276A2D812E74987A1268C7965FBACB1C1F78CD5466DAEC4A16EBD7CA04C328203E202A9 5275E024785166F35DED6113BAE5CF6404B25CF60144613D82FF0F7E7FC757E0207C377827FB1CB36 3406E4E7EF1075D338D0172667F0ED5D0012C04CD14048823AF51C5B9714707FC62E2C0D4593ECC4A FFC8BE259AF3BFAB01ACA1290A8B0C7D55F5B33476C74EDA44D14C8F1B9873C555939929799D4C61E 8DA2326DAC5F7110F8639FEFBBF2D1FAF3096F9E276DD772ABEF65341B16CACB861CD8839B8119435 2A6E9D45809EE2045C106D5D851A6F24DC43EA27561865DB5C8E5D21BCAC8EE8F5A0F9CEA5A7C0B79 33480B1DE42F692C0F34BEB99AEA1FDA056F3B24EE80B5E678C1D2730D28565D18A3121660E90AC76 A1443502A5DFD4E6B3D058328B25E2541E5E6414C11C352F13AA1BA7FC4ADB7375CD3F6FC398BF85F CA5A59B4C5D3283496AC7BC5CAB6C980635756029E52239AC0F43C83CA7D5805CAC79AD694A5E31A2 1DB9BAD5DB6CECE2AB287ABCF96C87C298F82B2D62E014420428F51EF065FFA860E6E3A46EFFC244C 1941C21E40F808B0F18302109B984C639F567199CB36A5FB44182574B18313BC534995C83919AE27C C4AEFA367D70EE1195F0248F2962C" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Altri processi in esecuzione ———————— . c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe c:\program files (x86)\Sony\VAIO Event Service\VESMgr.exe c:\windows\SysWOW64\DllHost.exe c:\program files (x86)\Sony\VAIO Event Service\VESMgrSub.exe c:\windows\SysWOW64\RunDll32.exe c:\program files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe . ************************************************************************** . Ora fine scansione: 2012-06-26 17:09:00 - Il pc è stato riavviato ComboFix-quarantined-files.txt 2012-06-26 15:08 . Pre-Run: 229.961.838.592 byte disponibili Post-Run: 229.660.139.520 byte disponibili . - - End Of File - - 618472D3E338A16F08975CA3D99E01E2

jeffce

Post #12June 26, 2012, 5:23 PM UTC

Hi,

Disable Spybot S-D Tea Timer

TeaTimer needs to be disabled so that its protection does not interfere with fixes.

TeaTimer can be re-enabled once the computer is clean.

1. Open Spybot-S&D in Advanced Mode.
2. If it is not already set to do this go to the "Mode" menu and select "Advanced Mode".
3. On the left hand side, click on "Tools".
4. Then click on the Resident Icon in the List.
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.
———-

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

ClearJavaCache::

DDS::
mStart Page = hxxp://mystart.incredimail.com/mb50?u=891929752390932140
uInternet Settings,ProxyOverride = 
uInternet Settings,ProxyServer = http=127.0.0.1:80
mSearchAssistant = 
uURLSearchHooks: H - No File
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{53707962-6F74-2D53-2644-206D7942484F}
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
{B4F3A835-0E21-4959-BA22-42B3008E02FF}
{DBC80044-A445-435b-BC74-9C25C1C588A9}

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

SuperQvas

Post #13June 26, 2012, 6:52 PM UTC

ComboFix 12-06-26.01 - vaio 26/06/2012 20:02:23.3.4 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.39.1040.18.3758.2108 [GMT 2:00] Eseguito da: c:\users\vaio\Desktop\ComboFix.exe Opzioni usate :: c:\users\vaio\Desktop\CFScript.txt AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\vaio\AppData\Local\Temp\c25e8b3d-33a7-42bf-85e6-6880c6753136\CliSecureRT.dll . . ((((((((((((((((((((((((( Files Creati Da 2012-05-26 al 2012-06-26 ))))))))))))))))))))))))))))))))))) . . 2012-06-26 18:08 . 2012-06-26 18:08 77824 —-a-w- c:\windows\Keygen.exe 2012-06-26 18:07 . 2012-06-26 18:07 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\users\vaio\AppData\Roaming\PC Cleaners 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\users\vaio\AppData\Roaming\PCPro 2012-06-26 10:16 . 2012-06-26 10:16 4446520 —-a-w- c:\windows\uninst.exe 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\programdata\PC1Data 2012-06-26 09:38 . 2012-05-31 04:04 9013136 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BCD702F2-1ED6-4347-B583-1F66521B0D09}\mpengine.dll 2012-06-25 21:24 . 2012-06-25 21:24 ——– d—–w- c:\users\vaio\AppData\Roaming\Malwarebytes 2012-06-25 21:23 . 2012-06-25 21:23 ——– d—–w- c:\programdata\Malwarebytes 2012-06-25 21:02 . 2012-06-25 21:32 ——– d—–w- c:\program files (x86)\ZHPDiag 2012-06-25 21:02 . 2012-06-25 21:06 ——– d—–w- C:\ZHP 2012-06-21 18:04 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-21 18:04 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-21 18:04 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-21 18:04 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-21 18:03 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-21 18:03 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-21 18:03 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-21 18:03 . 2012-06-02 13:19 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-21 18:03 . 2012-06-02 13:15 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-19 09:53 . 2012-06-19 09:53 ——– d—–w- C:\Nuova cartella 2012-06-15 06:32 . 2012-06-15 06:32 ——– d—–w- c:\users\vaio\AppData\Local\Macromedia 2012-06-14 14:39 . 2012-04-26 05:34 76288 —-a-w- c:\windows\system32\rdpwsx.dll 2012-06-14 14:39 . 2012-04-26 05:34 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-14 14:39 . 2012-04-26 05:28 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-14 14:39 . 2012-05-02 05:32 208896 —-a-w- c:\windows\system32\profsvc.dll 2012-06-14 14:39 . 2012-05-04 10:52 5505392 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-06-14 14:39 . 2012-05-04 10:08 3902320 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-06-14 14:39 . 2012-05-04 10:08 3958128 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-06-14 14:39 . 2012-04-07 12:18 3213824 —-a-w- c:\windows\system32\msi.dll 2012-06-14 14:38 . 2012-04-07 11:34 2342400 —-a-w- c:\windows\SysWow64\msi.dll 2012-06-14 14:38 . 2012-04-28 03:50 204800 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-14 14:38 . 2012-05-15 01:32 3144192 —-a-w- c:\windows\system32\win32k.sys 2012-06-14 14:38 . 2012-04-24 05:59 182272 —-a-w- c:\windows\system32\cryptsvc.dll 2012-06-14 14:38 . 2012-04-24 05:59 1460224 —-a-w- c:\windows\system32\crypt32.dll 2012-06-14 14:38 . 2012-04-24 05:59 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-06-14 14:38 . 2012-04-24 04:47 139264 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-06-14 14:38 . 2012-04-24 04:47 1156608 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-06-14 14:38 . 2012-04-24 04:47 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll 2012-06-13 20:28 . 2012-06-13 21:05 ——– d—–w- C:\ExchangeSetupLogs 2012-06-05 17:48 . 2012-06-05 17:49 ——– d—–w- c:\program files (x86)\Monster Of The Deep 2012-06-05 08:29 . 2012-06-19 08:51 ——– d—–w- c:\users\vaio\AppData\Roaming\deluge 2012-06-05 08:28 . 2012-06-05 08:29 ——– d—–w- c:\program files (x86)\Deluge 2012-05-28 15:04 . 2012-05-28 15:04 472576 —-a-w- c:\windows\AutoKMS.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-23 15:21 . 2012-04-13 06:48 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-23 15:21 . 2011-06-01 16:52 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-03-30 11:09 . 2012-05-08 20:46 1895280 —-a-w- c:\windows\system32\drivers\tcpip.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-06-26_15.02.42 ))))))))))))))))))))))))))))))))))))))))) . - 2009-07-14 04:54 . 2012-06-26 15:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-06-26 18:07 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2012-06-26 10:46 . 2012-06-26 15:01 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2012-06-26 10:46 . 2012-06-26 18:07 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-06-26 18:07 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-06-26 15:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-02-06 14:56 . 2012-06-26 14:46 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-02-06 14:56 . 2012-06-26 17:54 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-06-26 17:54 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-06-26 14:46 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-10-12 16:34 . 2012-06-26 15:01 1956 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat + 2010-10-12 16:34 . 2012-06-26 18:07 1956 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat + 2012-06-26 18:08 . 2012-06-26 18:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-06-26 15:01 . 2012-06-26 15:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-06-26 15:01 . 2012-06-26 15:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-06-26 18:08 . 2012-06-26 18:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-02-06 23:50 . 2012-06-26 17:56 698804 c:\windows\system32\perfh010.dat - 2011-02-06 23:50 . 2012-06-26 14:48 698804 c:\windows\system32\perfh010.dat + 2009-07-14 02:36 . 2012-06-26 17:56 616242 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-06-26 14:48 616242 c:\windows\system32\perfh009.dat - 2011-02-06 23:50 . 2012-06-26 14:48 127998 c:\windows\system32\perfc010.dat + 2011-02-06 23:50 . 2012-06-26 17:56 127998 c:\windows\system32\perfc010.dat - 2009-07-14 02:36 . 2012-06-26 14:48 106622 c:\windows\system32\perfc009.dat + 2009-07-14 02:36 . 2012-06-26 17:56 106622 c:\windows\system32\perfc009.dat - 2011-02-06 14:56 . 2012-06-26 14:46 163840 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-02-06 14:56 . 2012-06-26 17:54 163840 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2012-06-20 18:05 . 2012-06-26 15:01 503144 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-06-20 18:05 . 2012-06-26 18:07 503144 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-06-20 18:05 . 2012-06-26 18:07 8768692 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3564337256-1403246104-864991456-1000-8192.dat + 2009-07-14 02:34 . 2012-06-26 15:57 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT - 2009-07-14 02:34 . 2012-06-26 14:57 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] "KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2012-05-04 955792] "KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-05-04 21392] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "!SearchquFFHP"="c:\windows\system32\RUNDLL32.EXE" [2009-07-14 44544] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SHTtray.exe"="c:\program files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe" [2010-06-20 99696] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-05-04 3521424] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-6-9 1128224] Google Calendar Sync.lnk - c:\program files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe [2011-4-8 542264] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer2"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG10\avgchsva.exe /sync\0c:\progra~2\AVG\AVG10\avgrsa.exe /sync /restart\0OODBS . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x] R3 GRemoteBus;GRemote virtual joystick Bus Enumerator;c:\windows\system32\DRIVERS\GRemoteBus64.sys [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x] R3 VBTUSB;VBTUSB.Sys VAIO Bluetooth Driver over USB device;c:\windows\system32\Drivers\VBTUSB.sys [x] R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-02-18 99104] R3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2011-02-14 44736] R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 306400] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x] S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-01-14 810144] S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336] S2 nlsX86cc;NLS Service;c:\windows\SysWOW64\NLSSRV32.EXE [2011-01-12 68928] S2 OODefragAgent;O&O; Defrag;c:\program files\OO Software\Defrag\oodag.exe [2011-09-18 3271496] S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-10-01 632792] S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-26 398176] S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [x] S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [x] S2 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-06-20 108400] S2 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-06-18 423280] S2 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-06-20 67952] S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-05-28 2320920] S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-06-21 575856] S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-01-20 887000] S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-05-19 549616] S2 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-06-09 384880] S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2010-06-08 836608] S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x] S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [x] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x] S3 NETw5s64;Driver scheda Intel® Wireless WiFi Link 5000 Series per Windows 7 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x] S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x] S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x] S3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-01-20 286936] S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2012-01-13 1256040] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] . . Contenuto della cartella 'Scheduled Tasks' . 2012-06-26 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 15:21] . 2012-06-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000Core.job - c:\users\vaio\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-18 13:33] . 2012-06-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000UA.job - c:\users\vaio\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-18 13:33] . 2012-06-26 c:\windows\Tasks\RMSchedule.job - c:\program files (x86)\Registry Mechanic\RegMech.exe [2011-11-04 16:05] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-06-24 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-06-24 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-06-24 413208] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-31 10775584] "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-05-31 2040352] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-12-23 2918656] "OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2011-09-18 3993416] "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-05-04 3521424] . ——- Scansione supplementare ——- . uStart Page = hxxp://www.google.com.do/ IE: E&sporta; in Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Extract e-mail addresses IE: Google Sidewiki… IE: I&nvia; a OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = [removed] [removed] . . ——————— CHIAVI DI REGISTRO BLOCCATE ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" .[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info] @Denied: (2) (LocalSystem) "AppDataDir"="c:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\" "DataDir"="ESET\\ESET NOD32 Antivirus\\" "EditionName"=" " "InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\" "LanguageId"=dword:00000410 "PackageTag"=dword:00000000 "ProductBase"=dword:00000000 "ProductCode"="{E6AF0EB3-0945-431F-919E-6826C969AA84}" "ProductName"="ESET NOD32 Antivirus" "ProductType"="eav" "ProductVersion"="4.2.71.3" "UniqueId"="00592B264EF5040F" "ScannerBuild"=dword:00001dd3 "ScannerVersionId"=dword:000015fe "ScannerVersion"="ready" "ei2"=hex(

:58,cf,fc,46,b5,b2,38,70 "ei1"=hex(

:78,84,3c,cc,61,35,00,00 "ei3"=hex(

jeffce

Post #14June 26, 2012, 6:57 PM UTC

Hi,

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"!SearchquFFHP"=-
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

SuperQvas

Post #15June 26, 2012, 7:26 PM UTC

ComboFix 12-06-26.01 - vaio 26/06/2012 21:18:24.4.4 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.39.1040.18.3758.2159 [GMT 2:00] Eseguito da: c:\users\vaio\Desktop\ComboFix.exe Opzioni usate :: c:\users\vaio\Desktop\CFScript.txt AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Creati Da 2012-05-26 al 2012-06-26 ))))))))))))))))))))))))))))))))))) . . 2012-06-26 19:22 . 2012-06-26 19:22 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\users\vaio\AppData\Roaming\PC Cleaners 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\users\vaio\AppData\Roaming\PCPro 2012-06-26 10:16 . 2012-06-26 10:16 4446520 —-a-w- c:\windows\uninst.exe 2012-06-26 10:16 . 2012-06-26 10:16 ——– d—–w- c:\programdata\PC1Data 2012-06-26 09:38 . 2012-05-31 04:04 9013136 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BCD702F2-1ED6-4347-B583-1F66521B0D09}\mpengine.dll 2012-06-25 21:24 . 2012-06-25 21:24 ——– d—–w- c:\users\vaio\AppData\Roaming\Malwarebytes 2012-06-25 21:23 . 2012-06-25 21:23 ——– d—–w- c:\programdata\Malwarebytes 2012-06-25 21:02 . 2012-06-25 21:32 ——– d—–w- c:\program files (x86)\ZHPDiag 2012-06-25 21:02 . 2012-06-25 21:06 ——– d—–w- C:\ZHP 2012-06-21 18:04 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-21 18:04 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-21 18:04 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-21 18:04 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-21 18:03 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-21 18:03 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-21 18:03 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-21 18:03 . 2012-06-02 13:19 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-21 18:03 . 2012-06-02 13:15 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-19 09:53 . 2012-06-19 09:53 ——– d—–w- C:\Nuova cartella 2012-06-15 06:32 . 2012-06-15 06:32 ——– d—–w- c:\users\vaio\AppData\Local\Macromedia 2012-06-14 14:39 . 2012-04-26 05:34 76288 —-a-w- c:\windows\system32\rdpwsx.dll 2012-06-14 14:39 . 2012-04-26 05:34 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-14 14:39 . 2012-04-26 05:28 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-14 14:39 . 2012-05-02 05:32 208896 —-a-w- c:\windows\system32\profsvc.dll 2012-06-14 14:39 . 2012-05-04 10:52 5505392 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-06-14 14:39 . 2012-05-04 10:08 3902320 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-06-14 14:39 . 2012-05-04 10:08 3958128 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-06-14 14:39 . 2012-04-07 12:18 3213824 —-a-w- c:\windows\system32\msi.dll 2012-06-14 14:38 . 2012-04-07 11:34 2342400 —-a-w- c:\windows\SysWow64\msi.dll 2012-06-14 14:38 . 2012-04-28 03:50 204800 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-14 14:38 . 2012-05-15 01:32 3144192 —-a-w- c:\windows\system32\win32k.sys 2012-06-14 14:38 . 2012-04-24 05:59 182272 —-a-w- c:\windows\system32\cryptsvc.dll 2012-06-14 14:38 . 2012-04-24 05:59 1460224 —-a-w- c:\windows\system32\crypt32.dll 2012-06-14 14:38 . 2012-04-24 05:59 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-06-14 14:38 . 2012-04-24 04:47 139264 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-06-14 14:38 . 2012-04-24 04:47 1156608 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-06-14 14:38 . 2012-04-24 04:47 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll 2012-06-13 20:28 . 2012-06-13 21:05 ——– d—–w- C:\ExchangeSetupLogs 2012-06-05 17:48 . 2012-06-05 17:49 ——– d—–w- c:\program files (x86)\Monster Of The Deep 2012-06-05 08:29 . 2012-06-19 08:51 ——– d—–w- c:\users\vaio\AppData\Roaming\deluge 2012-06-05 08:28 . 2012-06-05 08:29 ——– d—–w- c:\program files (x86)\Deluge 2012-05-28 15:04 . 2012-05-28 15:04 472576 —-a-w- c:\windows\AutoKMS.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-23 15:21 . 2012-04-13 06:48 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-23 15:21 . 2011-06-01 16:52 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-03-30 11:09 . 2012-05-08 20:46 1895280 —-a-w- c:\windows\system32\drivers\tcpip.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-06-26_15.02.42 ))))))))))))))))))))))))))))))))))))))))) . - 2009-07-14 04:54 . 2012-06-26 15:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-06-26 18:07 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2012-06-26 10:46 . 2012-06-26 15:01 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2012-06-26 10:46 . 2012-06-26 18:07 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-06-26 18:07 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-06-26 15:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-02-06 14:56 . 2012-06-26 14:46 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-02-06 14:56 . 2012-06-26 18:11 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-06-26 18:11 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-06-26 14:46 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-10-12 16:34 . 2012-06-26 15:01 1956 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat + 2010-10-12 16:34 . 2012-06-26 18:07 1956 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat + 2012-06-26 18:08 . 2012-06-26 18:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-06-26 15:01 . 2012-06-26 15:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-06-26 15:01 . 2012-06-26 15:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-06-26 18:08 . 2012-06-26 18:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-02-06 23:50 . 2012-06-26 18:13 698804 c:\windows\system32\perfh010.dat - 2011-02-06 23:50 . 2012-06-26 14:48 698804 c:\windows\system32\perfh010.dat + 2009-07-14 02:36 . 2012-06-26 18:13 616242 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-06-26 14:48 616242 c:\windows\system32\perfh009.dat - 2011-02-06 23:50 . 2012-06-26 14:48 127998 c:\windows\system32\perfc010.dat + 2011-02-06 23:50 . 2012-06-26 18:13 127998 c:\windows\system32\perfc010.dat - 2009-07-14 02:36 . 2012-06-26 14:48 106622 c:\windows\system32\perfc009.dat + 2009-07-14 02:36 . 2012-06-26 18:13 106622 c:\windows\system32\perfc009.dat - 2011-02-06 14:56 . 2012-06-26 14:46 163840 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-02-06 14:56 . 2012-06-26 18:11 163840 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2012-06-20 18:05 . 2012-06-26 15:01 503144 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-06-20 18:05 . 2012-06-26 18:07 503144 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-06-20 18:05 . 2012-06-26 18:07 8768692 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3564337256-1403246104-864991456-1000-8192.dat + 2009-07-14 02:34 . 2012-06-26 18:57 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT - 2009-07-14 02:34 . 2012-06-26 14:57 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] "KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2012-05-04 955792] "KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-05-04 21392] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SHTtray.exe"="c:\program files (x86)\Common Files\Sony Shared\SOHLib\SHTtray.exe" [2010-06-20 99696] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-05-04 3521424] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-6-9 1128224] Google Calendar Sync.lnk - c:\program files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe [2011-4-8 542264] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer2"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG10\avgchsva.exe /sync\0c:\progra~2\AVG\AVG10\avgrsa.exe /sync /restart\0OODBS . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x] R3 GRemoteBus;GRemote virtual joystick Bus Enumerator;c:\windows\system32\DRIVERS\GRemoteBus64.sys [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x] R3 VBTUSB;VBTUSB.Sys VAIO Bluetooth Driver over USB device;c:\windows\system32\Drivers\VBTUSB.sys [x] R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-02-18 99104] R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 306400] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x] S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-01-14 810144] S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336] S2 nlsX86cc;NLS Service;c:\windows\SysWOW64\NLSSRV32.EXE [2011-01-12 68928] S2 OODefragAgent;O&O; Defrag;c:\program files\OO Software\Defrag\oodag.exe [2011-09-18 3271496] S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-10-01 632792] S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-26 398176] S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [x] S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [x] S2 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-06-20 108400] S2 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-06-18 423280] S2 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-06-20 67952] S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-05-28 2320920] S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-06-21 575856] S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-01-20 887000] S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-05-19 549616] S2 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-06-09 384880] S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2010-06-08 836608] S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x] S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [x] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x] S3 NETw5s64;Driver scheda Intel® Wireless WiFi Link 5000 Series per Windows 7 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x] S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x] S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x] S3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-01-20 286936] S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2011-02-14 44736] S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2012-01-13 1256040] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] . . Contenuto della cartella 'Scheduled Tasks' . 2012-06-26 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 15:21] . 2012-06-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000Core.job - c:\users\vaio\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-18 13:33] . 2012-06-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3564337256-1403246104-864991456-1000UA.job - c:\users\vaio\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-18 13:33] . 2012-06-26 c:\windows\Tasks\RMSchedule.job - c:\program files (x86)\Registry Mechanic\RegMech.exe [2011-11-04 16:05] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-06-24 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-06-24 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-06-24 413208] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-31 10775584] "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-05-31 2040352] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-12-23 2918656] "OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2011-09-18 3993416] "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-05-04 3521424] . ——- Scansione supplementare ——- . uStart Page = hxxp://www.google.com.do/ IE: E&sporta; in Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Extract e-mail addresses IE: Google Sidewiki… IE: I&nvia; a OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = [removed] [removed] . . ——————— CHIAVI DI REGISTRO BLOCCATE ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info] @Denied: (2) (LocalSystem) "AppDataDir"="c:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\" "DataDir"="ESET\\ESET NOD32 Antivirus\\" "EditionName"=" " "InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\" "LanguageId"=dword:00000410 "PackageTag"=dword:00000000 "ProductBase"=dword:00000000 "ProductCode"="{E6AF0EB3-0945-431F-919E-6826C969AA84}" "ProductName"="ESET NOD32 Antivirus" "ProductType"="eav" "ProductVersion"="4.2.71.3" "UniqueId"="00592B264EF5040F" "ScannerBuild"=dword:00001dd3 "ScannerVersionId"=dword:000015fe "ScannerVersion"="ready" "ei2"=hex(

:58,cf,fc,46,b5,b2,38,70 "ei1"=hex(

:78,84,3c,cc,61,35,00,00 "ei3"=hex(

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

SEARCHQU [Solved]

✨ Ask AI

Ask AI