Spyware / Malware / Virus Removal

live security platinum [Closed]

8 min read

Looking for the outcome? Ask AI

nonewbeertax Topic Starter

Post #1August 10, 2012, 3:23 AM UTC

Somewhere along the line I picked up live security platinum; it has slowed my computer down, it blocks parts of websites, Microsoft Security Essentials won't work.\ Thanks, Mikai

Satchfan

Post #2August 10, 2012, 4:58 PM UTC last edited August 10, 2012, 4:59 PM UTC

Hello nonewbeertax and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

Download RogueKiller to your desktop.

close all running programs
for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
when the prescan is finished, click on Scan
click on Report and copy/paste the content in your next post.[/list
If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe

Please post the contents of the RKreport.txt in your next reply.

Satchfan

nonewbeertax

Post #3August 10, 2012, 7:48 PM UTC

RogueKiller V7.6.6 [08/10/2012] by Tigzy
mail: tigzyRKgmailcom
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: mikaik [Admin rights]
Mode: Scan – Date: 08/10/2012 12:45:32

¤¤¤ Bad processes: 2 ¤¤¤
[SUSP PATH] MusicManager.exe – C:\Users\mikaik\AppData\Local\Programs\Google\MusicManager\MusicManager.exe -> KILLED [TermProc]
[SUSP PATH] 7531E8D003DE706E156BE7A4F875F002.exe – C:\ProgramData\7531E8D003DE706E156BE7A4F875F002\7531E8D003DE706E156BE7A4F875F002.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 11 ¤¤¤
[SUSP PATH] HKCU\[…]\Run : DW6 ("C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe") -> FOUND
[SUSP PATH] HKCU\[…]\Run : MusicManager ("C:\Users\mikaik\AppData\Local\Programs\Google\MusicManager\MusicManager.exe") -> FOUND
[SUSP PATH] HKCU\[…]\Run : CineForm (RUNDLL32.EXE C:\Users\mikaik\AppData\Local\CineForm\mcawoyzr.dll,CPPDebug) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-3377176785-3229694586-196458063-1000[…]\Run : DW6 ("C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe") -> FOUND
[SUSP PATH] HKUS\S-1-5-21-3377176785-3229694586-196458063-1000[…]\Run : MusicManager ("C:\Users\mikaik\AppData\Local\Programs\Google\MusicManager\MusicManager.exe") -> FOUND
[SUSP PATH] HKUS\S-1-5-21-3377176785-3229694586-196458063-1000[…]\Run : CineForm (RUNDLL32.EXE C:\Users\mikaik\AppData\Local\CineForm\mcawoyzr.dll,CPPDebug) -> FOUND
[SUSP PATH] HKCU\[…]\RunOnce : 7531E8D003DE706E156BE7A4F875F002 (C:\ProgramData\7531E8D003DE706E156BE7A4F875F002\7531E8D003DE706E156BE7A4F875F002.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-3377176785-3229694586-196458063-1000[…]\RunOnce : 7531E8D003DE706E156BE7A4F875F002 (C:\ProgramData\7531E8D003DE706E156BE7A4F875F002\7531E8D003DE706E156BE7A4F875F002.exe) -> FOUND
[ZeroAccess] HKCR\[…]\InprocServer32 : (C:\Users\mikaik\AppData\Local\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\n.) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FILE] @ : c:\windows\installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\@ –> FOUND
[ZeroAccess][FOLDER] U : c:\windows\installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\U –> FOUND
[ZeroAccess][FOLDER] L : c:\windows\installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\L –> FOUND
[ZeroAccess][FILE] @ : c:\users\mikaik\appdata\local\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\@ –> FOUND
[ZeroAccess][FOLDER] U : c:\users\mikaik\appdata\local\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\U –> FOUND
[ZeroAccess][FOLDER] L : c:\users\mikaik\appdata\local\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\L –> FOUND
[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_32\desktop.ini –> FOUND
[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_64\desktop.ini –> FOUND
[Susp.ASLR][ASLR WIPED-OFF] services.exe : c:\windows\system32\services.exe –> FOUND
[ZeroAccess][Sig found] services.exe : c:\windows\system32\services.exe –> FOUND

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 adobe.activate.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
[…]

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD1001FALS-41K1B0 ATA Device +++++
— User —
[MBR] fd056b57192e08dabd35c244b802c011
[BSP] e8c202d67ddc1011228c56056b07e574 : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 953766 Mo
User = LL1 … OK!
User = LL2 … OK!

+++++ PhysicalDrive1: ST3500418AS ATA Device +++++
— User —
[MBR] 846c721703767b7ce416bdf4cfb16449
[BSP] bb1531a0286da6b1b6fd01172cff8fe4 : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 476938 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[1].txt >>
RKreport[1].txt

Satchfan

Post #4August 10, 2012, 10:30 PM UTC

Hi again

You have a very severe infection that is difficult to totally remove but we'll do our best.

Please run these in the order requested.

Run TDSSKiller

Please download TDSSKiller.zip

extract it to your desktop
double click TDSSKiller.exe
press Start Scan
only if Malicious objects are found then ensure Cure is selected. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.
click Continue > Reboot now
copy and paste the log in your next reply
a copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

======================================================

Download and run ComboFix

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It MUST be saved directly to your desktop. Choose save as and then make sure you choose Desktop

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Double click on ComboFix.exe & follow the prompts.

when finished, it will produce a report for you.
please post the C:\ComboFix.txt for further review.

Logs to include with next post:

TDSSKiller log
ComboFix.txt

Thanks

Satchfan

nonewbeertax

Post #5August 10, 2012, 11:47 PM UTC

I can't figure out how to disable Microsoft security essentials

Satchfan

Post #6August 11, 2012, 7:05 AM UTC

click on Start, Programs, Microsoft Security Essentials
click on the “Settings” tab
on the left, click on Real-time protection
remove the check mark next to Turn on real-time protection (recommended)

nonewbeertax

Post #7August 11, 2012, 6:13 PM UTC

The virus took over Security essentials and it wont let me do anything except scan (which I have not done).

Satchfan

Post #8August 11, 2012, 7:30 PM UTC

The virus took over Security essentials and it wont let me do anything except scan

I don't understand what you mean. At what point did my instructions fail, and what was the message?

nonewbeertax

Post #9August 11, 2012, 7:56 PM UTC

When I'm in Security essentials, real time protection is off, but nothing works when Clicked. When I tried combo fix it restarted my computer and said that MSE was still on.

Satchfan

Post #10August 11, 2012, 9:40 PM UTC

Run both programs in the order I asked and ignore any warnings.

nonewbeertax

Post #11August 11, 2012, 10:56 PM UTC

14:58:10.0953 3828 TDSS rootkit removing tool [removed] Jul 24 2012 13:16:32 14:58:11.0335 3828 ============================================================ 14:58:11.0336 3828 Current date / time: 2012/08/11 14:58:11.0335 14:58:11.0336 3828 SystemInfo: 14:58:11.0336 3828 14:58:11.0336 3828 OS Version: 6.1.7601 ServicePack: 1.0 14:58:11.0336 3828 Product type: Workstation 14:58:11.0336 3828 ComputerName: TURSTYWIZARD 14:58:11.0336 3828 UserName: mikaik 14:58:11.0336 3828 Windows directory: C:\Windows 14:58:11.0336 3828 System windows directory: C:\Windows 14:58:11.0336 3828 Running under WOW64 14:58:11.0337 3828 Processor architecture: Intel x64 14:58:11.0337 3828 Number of processors: 4 14:58:11.0337 3828 Page size: 0x1000 14:58:11.0337 3828 Boot type: Normal boot 14:58:11.0337 3828 ============================================================ 14:58:12.0371 3828 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0CADE00 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 14:58:12.0371 3828 Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 14:58:12.0380 3828 ============================================================ 14:58:12.0380 3828 \Device\Harddisk0\DR0: 14:58:12.0380 3828 MBR partitions: 14:58:12.0380 3828 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 14:58:12.0380 3828 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3000 14:58:12.0380 3828 \Device\Harddisk1\DR1: 14:58:12.0381 3828 MBR partitions: 14:58:12.0381 3828 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x3A385000 14:58:12.0381 3828 ============================================================ 14:58:12.0396 3828 C: <-> \Device\Harddisk0\DR0\Partition1 14:58:12.0412 3828 D: <-> \Device\Harddisk1\DR1\Partition0 14:58:12.0412 3828 ============================================================ 14:58:12.0412 3828 Initialize success 14:58:12.0412 3828 ============================================================ 14:58:14.0137 5468 ============================================================ 14:58:14.0137 5468 Scan started 14:58:14.0137 5468 Mode: Manual; 14:58:14.0137 5468 ============================================================ 14:58:15.0396 5468 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 14:58:15.0399 5468 1394ohci - ok 14:58:15.0442 5468 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 14:58:15.0449 5468 ACPI - ok 14:58:15.0479 5468 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 14:58:15.0480 5468 AcpiPmi - ok 14:58:15.0592 5468 AdobeARMservice (11a52cf7b265631deeb24c6149309eff) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 14:58:15.0593 5468 AdobeARMservice - ok 14:58:15.0638 5468 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 14:58:15.0647 5468 adp94xx - ok 14:58:15.0680 5468 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 14:58:15.0684 5468 adpahci - ok 14:58:15.0703 5468 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 14:58:15.0705 5468 adpu320 - ok 14:58:15.0728 5468 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 14:58:15.0729 5468 AeLookupSvc - ok 14:58:15.0780 5468 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys 14:58:15.0788 5468 AFD - ok 14:58:15.0813 5468 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 14:58:15.0814 5468 agp440 - ok 14:58:15.0826 5468 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 14:58:15.0827 5468 ALG - ok 14:58:15.0850 5468 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 14:58:15.0851 5468 aliide - ok 14:58:15.0873 5468 AMD External Events Utility (a359974eaac83a435497c52f62a2e590) C:\Windows\system32\atiesrxx.exe 14:58:15.0875 5468 AMD External Events Utility - ok 14:58:15.0887 5468 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 14:58:15.0888 5468 amdide - ok 14:58:15.0904 5468 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 14:58:15.0905 5468 AmdK8 - ok 14:58:16.0332 5468 amdkmdag (60216b0e704584de6d5a9f59e9c34c47) C:\Windows\system32\DRIVERS\atikmdag.sys 14:58:16.0447 5468 amdkmdag - ok 14:58:16.0598 5468 amdkmdap (6b4e9261b613b047a9a145f328889968) C:\Windows\system32\DRIVERS\atikmpag.sys 14:58:16.0605 5468 amdkmdap - ok 14:58:16.0630 5468 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 14:58:16.0631 5468 AmdPPM - ok 14:58:16.0664 5468 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys 14:58:16.0666 5468 amdsata - ok 14:58:16.0689 5468 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 14:58:16.0692 5468 amdsbs - ok 14:58:16.0706 5468 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys 14:58:16.0707 5468 amdxata - ok 14:58:16.0736 5468 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 14:58:16.0738 5468 AppID - ok 14:58:16.0762 5468 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 14:58:16.0764 5468 AppIDSvc - ok 14:58:16.0874 5468 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll 14:58:16.0876 5468 Appinfo - ok 14:58:16.0982 5468 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 14:58:16.0985 5468 Apple Mobile Device - ok 14:58:17.0020 5468 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 14:58:17.0023 5468 arc - ok 14:58:17.0041 5468 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 14:58:17.0044 5468 arcsas - ok 14:58:17.0066 5468 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 14:58:17.0067 5468 AsyncMac - ok 14:58:17.0077 5468 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 14:58:17.0077 5468 atapi - ok 14:58:17.0140 5468 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 14:58:17.0157 5468 AudioEndpointBuilder - ok 14:58:17.0172 5468 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 14:58:17.0182 5468 AudioSrv - ok 14:58:17.0223 5468 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll 14:58:17.0226 5468 AxInstSV - ok 14:58:17.0269 5468 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 14:58:17.0283 5468 b06bdrv - ok 14:58:17.0338 5468 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 14:58:17.0344 5468 b57nd60a - ok 14:58:17.0375 5468 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 14:58:17.0379 5468 BDESVC - ok 14:58:17.0392 5468 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 14:58:17.0394 5468 Beep - ok 14:58:17.0464 5468 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll 14:58:17.0481 5468 BFE - ok 14:58:17.0507 5468 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 14:58:17.0509 5468 blbdrive - ok 14:58:17.0588 5468 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe 14:58:17.0603 5468 Bonjour Service - ok 14:58:17.0641 5468 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 14:58:17.0644 5468 bowser - ok 14:58:17.0656 5468 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 14:58:17.0657 5468 BrFiltLo - ok 14:58:17.0681 5468 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 14:58:17.0682 5468 BrFiltUp - ok 14:58:17.0700 5468 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys 14:58:17.0703 5468 BridgeMP - ok 14:58:17.0735 5468 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll 14:58:17.0738 5468 Browser - ok 14:58:17.0762 5468 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 14:58:17.0766 5468 Brserid - ok 14:58:17.0776 5468 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 14:58:17.0777 5468 BrSerWdm - ok 14:58:17.0790 5468 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 14:58:17.0791 5468 BrUsbMdm - ok 14:58:17.0804 5468 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 14:58:17.0805 5468 BrUsbSer - ok 14:58:17.0811 5468 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 14:58:17.0813 5468 BTHMODEM - ok 14:58:17.0843 5468 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 14:58:17.0845 5468 bthserv - ok 14:58:17.0857 5468 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 14:58:17.0859 5468 cdfs - ok 14:58:17.0892 5468 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 14:58:17.0896 5468 cdrom - ok 14:58:17.0933 5468 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 14:58:17.0935 5468 CertPropSvc - ok 14:58:17.0954 5468 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 14:58:17.0956 5468 circlass - ok 14:58:17.0991 5468 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 14:58:17.0996 5468 CLFS - ok 14:58:18.0065 5468 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 14:58:18.0068 5468 clr_optimization_v2.0.50727_32 - ok 14:58:18.0123 5468 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 14:58:18.0126 5468 clr_optimization_v2.0.50727_64 - ok 14:58:18.0207 5468 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 14:58:18.0210 5468 clr_optimization_v4.0.30319_32 - ok 14:58:18.0228 5468 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 14:58:18.0232 5468 clr_optimization_v4.0.30319_64 - ok 14:58:18.0248 5468 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 14:58:18.0250 5468 CmBatt - ok 14:58:18.0278 5468 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 14:58:18.0280 5468 cmdide - ok 14:58:18.0329 5468 CNG (9ac4f97c2d3e93367e2148ea940cd2cd) C:\Windows\system32\Drivers\cng.sys 14:58:18.0338 5468 CNG - ok 14:58:18.0357 5468 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 14:58:18.0358 5468 Compbatt - ok 14:58:18.0390 5468 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 14:58:18.0392 5468 CompositeBus - ok 14:58:18.0395 5468 COMSysApp - ok 14:58:18.0410 5468 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 14:58:18.0411 5468 crcdisk - ok 14:58:18.0446 5468 CryptSvc (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll 14:58:18.0449 5468 CryptSvc - ok 14:58:18.0524 5468 DAZContentManagementService (958ef96991abccfdac0953c4a24081dc) C:\Program Files\DAZ 3D\Content Management Service\ContentManagementServer.exe 14:58:18.0526 5468 DAZContentManagementService - ok 14:58:18.0559 5468 dc3d (843f2f44af050ddde89bece02b3ef119) C:\Windows\system32\DRIVERS\dc3d.sys 14:58:18.0562 5468 dc3d - ok 14:58:18.0614 5468 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 14:58:18.0622 5468 DcomLaunch - ok 14:58:18.0655 5468 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 14:58:18.0660 5468 defragsvc - ok 14:58:18.0687 5468 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 14:58:18.0688 5468 DfsC - ok 14:58:18.0737 5468 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll 14:58:18.0745 5468 Dhcp - ok 14:58:18.0759 5468 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 14:58:18.0760 5468 discache - ok 14:58:18.0774 5468 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 14:58:18.0777 5468 Disk - ok 14:58:18.0817 5468 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll 14:58:18.0822 5468 Dnscache - ok 14:58:18.0865 5468 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll 14:58:18.0872 5468 dot3svc - ok 14:58:18.0910 5468 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll 14:58:18.0915 5468 DPS - ok 14:58:18.0948 5468 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 14:58:18.0950 5468 drmkaud - ok 14:58:19.0004 5468 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 14:58:19.0016 5468 DXGKrnl - ok 14:58:19.0041 5468 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 14:58:19.0043 5468 EapHost - ok 14:58:19.0209 5468 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 14:58:19.0248 5468 ebdrv - ok 14:58:19.0353 5468 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe 14:58:19.0356 5468 EFS - ok 14:58:19.0445 5468 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe 14:58:19.0473 5468 ehRecvr - ok 14:58:19.0505 5468 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 14:58:19.0507 5468 ehSched - ok 14:58:19.0579 5468 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 14:58:19.0599 5468 elxstor - ok 14:58:19.0635 5468 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 14:58:19.0637 5468 ErrDev - ok 14:58:19.0707 5468 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 14:58:19.0740 5468 EventSystem - ok 14:58:19.0767 5468 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 14:58:19.0772 5468 exfat - ok 14:58:19.0799 5468 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 14:58:19.0804 5468 fastfat - ok 14:58:19.0878 5468 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe 14:58:19.0900 5468 Fax - ok 14:58:19.0910 5468 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 14:58:19.0911 5468 fdc - ok 14:58:19.0921 5468 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 14:58:19.0922 5468 fdPHost - ok 14:58:19.0936 5468 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 14:58:19.0937 5468 FDResPub - ok 14:58:19.0947 5468 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 14:58:19.0948 5468 FileInfo - ok 14:58:19.0952 5468 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 14:58:19.0953 5468 Filetrace - ok 14:58:19.0966 5468 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 14:58:19.0967 5468 flpydisk - ok 14:58:20.0003 5468 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 14:58:20.0006 5468 FltMgr - ok 14:58:20.0069 5468 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll 14:58:20.0085 5468 FontCache - ok 14:58:20.0177 5468 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 14:58:20.0180 5468 FontCache3.0.0.0 - ok 14:58:20.0192 5468 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 14:58:20.0195 5468 FsDepends - ok 14:58:20.0211 5468 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys 14:58:20.0212 5468 Fs_Rec - ok 14:58:20.0255 5468 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 14:58:20.0258 5468 fvevol - ok 14:58:20.0271 5468 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 14:58:20.0273 5468 gagp30kx - ok 14:58:20.0295 5468 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 14:58:20.0297 5468 GEARAspiWDM - ok 14:58:20.0357 5468 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll 14:58:20.0373 5468 gpsvc - ok 14:58:20.0447 5468 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 14:58:20.0451 5468 gupdate - ok 14:58:20.0471 5468 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 14:58:20.0474 5468 gupdatem - ok 14:58:20.0482 5468 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 14:58:20.0484 5468 hcw85cir - ok 14:58:20.0533 5468 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 14:58:20.0541 5468 HdAudAddService - ok 14:58:20.0585 5468 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys 14:58:20.0588 5468 HDAudBus - ok 14:58:20.0596 5468 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 14:58:20.0598 5468 HidBatt - ok 14:58:20.0618 5468 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 14:58:20.0622 5468 HidBth - ok 14:58:20.0635 5468 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 14:58:20.0637 5468 HidIr - ok 14:58:20.0666 5468 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\System32\hidserv.dll 14:58:20.0667 5468 hidserv - ok 14:58:20.0690 5468 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys 14:58:20.0691 5468 HidUsb - ok 14:58:20.0718 5468 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll 14:58:20.0721 5468 hkmsvc - ok 14:58:20.0760 5468 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll 14:58:20.0764 5468 HomeGroupListener - ok 14:58:20.0800 5468 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll 14:58:20.0805 5468 HomeGroupProvider - ok 14:58:20.0837 5468 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 14:58:20.0840 5468 HpSAMD - ok 14:58:20.0914 5468 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 14:58:20.0929 5468 HTTP - ok 14:58:20.0957 5468 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 14:58:20.0958 5468 hwpolicy - ok 14:58:20.0986 5468 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys 14:58:20.0989 5468 i8042prt - ok 14:58:21.0026 5468 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys 14:58:21.0042 5468 iaStorV - ok 14:58:21.0170 5468 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 14:58:21.0193 5468 idsvc - ok 14:58:21.0222 5468 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 14:58:21.0224 5468 iirsp - ok 14:58:21.0281 5468 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll 14:58:21.0303 5468 IKEEXT - ok 14:58:21.0318 5468 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 14:58:21.0319 5468 intelide - ok 14:58:21.0340 5468 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 14:58:21.0342 5468 intelppm - ok 14:58:21.0368 5468 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 14:58:21.0370 5468 IPBusEnum - ok 14:58:21.0410 5468 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 14:58:21.0412 5468 IpFilterDriver - ok 14:58:21.0496 5468 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll 14:58:21.0516 5468 iphlpsvc - ok 14:58:21.0541 5468 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 14:58:21.0544 5468 IPMIDRV - ok 14:58:21.0560 5468 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 14:58:21.0562 5468 IPNAT - ok 14:58:21.0654 5468 iPod Service (50d6ccc6ff5561f9f56946b3e6164fb8) C:\Program Files\iPod\bin\iPodService.exe 14:58:21.0685 5468 iPod Service - ok 14:58:21.0728 5468 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 14:58:21.0730 5468 IRENUM - ok 14:58:21.0745 5468 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 14:58:21.0747 5468 isapnp - ok 14:58:21.0782 5468 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 14:58:21.0786 5468 iScsiPrt - ok 14:58:21.0910 5468 jswpsapi (78d233d835a8876035ac559afe02b940) C:\Program Files (x86)\NETGEAR\WNDA3100\jswpsapi.exe 14:58:21.0941 5468 jswpsapi - ok 14:58:22.0019 5468 JSWPSLWF (5be640e88814b77a9e84b4549b5dcc2c) C:\Windows\system32\DRIVERS\jswpslwfx.sys 14:58:22.0021 5468 JSWPSLWF - ok 14:58:22.0044 5468 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys 14:58:22.0047 5468 kbdclass - ok 14:58:22.0061 5468 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys 14:58:22.0063 5468 kbdhid - ok 14:58:22.0086 5468 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 14:58:22.0089 5468 KeyIso - ok 14:58:22.0113 5468 KSecDD (97a7070aea4c058b6418519e869a63b4) C:\Windows\system32\Drivers\ksecdd.sys 14:58:22.0115 5468 KSecDD - ok 14:58:22.0141 5468 KSecPkg (26c43a7c2862447ec59deda188d1da07) C:\Windows\system32\Drivers\ksecpkg.sys 14:58:22.0145 5468 KSecPkg - ok 14:58:22.0159 5468 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 14:58:22.0160 5468 ksthunk - ok 14:58:22.0206 5468 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 14:58:22.0212 5468 KtmRm - ok 14:58:22.0245 5468 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\System32\srvsvc.dll 14:58:22.0250 5468 LanmanServer - ok 14:58:22.0285 5468 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll 14:58:22.0289 5468 LanmanWorkstation - ok 14:58:22.0319 5468 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 14:58:22.0321 5468 lltdio - ok 14:58:22.0357 5468 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 14:58:22.0363 5468 lltdsvc - ok 14:58:22.0375 5468 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 14:58:22.0377 5468 lmhosts - ok 14:58:22.0404 5468 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 14:58:22.0406 5468 LSI_FC - ok 14:58:22.0422 5468 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 14:58:22.0424 5468 LSI_SAS - ok 14:58:22.0442 5468 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 14:58:22.0443 5468 LSI_SAS2 - ok 14:58:22.0459 5468 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 14:58:22.0461 5468 LSI_SCSI - ok 14:58:22.0480 5468 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 14:58:22.0482 5468 luafv - ok 14:58:22.0508 5468 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll 14:58:22.0510 5468 Mcx2Svc - ok 14:58:22.0531 5468 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 14:58:22.0532 5468 megasas - ok 14:58:22.0560 5468 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 14:58:22.0564 5468 MegaSR - ok 14:58:22.0575 5468 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 14:58:22.0578 5468 MMCSS - ok 14:58:22.0594 5468 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 14:58:22.0595 5468 Modem - ok 14:58:22.0616 5468 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 14:58:22.0617 5468 monitor - ok 14:58:22.0643 5468 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys 14:58:22.0646 5468 mouclass - ok 14:58:22.0663 5468 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 14:58:22.0664 5468 mouhid - ok 14:58:22.0694 5468 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 14:58:22.0696 5468 mountmgr - ok 14:58:22.0744 5468 MpFilter (94c66ededcdb6a126880472f9a704d8e) C:\Windows\system32\DRIVERS\MpFilter.sys 14:58:22.0748 5468 MpFilter - ok 14:58:22.0783 5468 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 14:58:22.0787 5468 mpio - ok 14:58:22.0805 5468 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 14:58:22.0808 5468 mpsdrv - ok 14:58:22.0834 5468 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 14:58:22.0837 5468 MRxDAV - ok 14:58:22.0859 5468 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 14:58:22.0862 5468 mrxsmb - ok 14:58:22.0901 5468 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys 14:58:22.0905 5468 mrxsmb10 - ok 14:58:22.0921 5468 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 14:58:22.0923 5468 mrxsmb20 - ok 14:58:22.0942 5468 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 14:58:22.0943 5468 msahci - ok 14:58:22.0958 5468 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 14:58:22.0961 5468 msdsm - ok 14:58:22.0988 5468 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 14:58:22.0992 5468 MSDTC - ok 14:58:23.0005 5468 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 14:58:23.0005 5468 Msfs - ok 14:58:23.0013 5468 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 14:58:23.0015 5468 mshidkmdf - ok 14:58:23.0039 5468 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 14:58:23.0039 5468 msisadrv - ok 14:58:23.0075 5468 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 14:58:23.0081 5468 MSiSCSI - ok 14:58:23.0087 5468 msiserver - ok 14:58:23.0116 5468 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 14:58:23.0118 5468 MSKSSRV - ok 14:58:23.0134 5468 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 14:58:23.0136 5468 MSPCLOCK - ok 14:58:23.0146 5468 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 14:58:23.0147 5468 MSPQM - ok 14:58:23.0190 5468 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 14:58:23.0195 5468 MsRPC - ok 14:58:23.0212 5468 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 14:58:23.0213 5468 mssmbios - ok 14:58:23.0225 5468 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 14:58:23.0226 5468 MSTEE - ok 14:58:23.0239 5468 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 14:58:23.0240 5468 MTConfig - ok 14:58:23.0250 5468 MTsensor (03b7145c889603537e9ffeabb1ad1089) C:\Windows\system32\DRIVERS\ASACPI.sys 14:58:23.0251 5468 MTsensor - ok 14:58:23.0268 5468 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 14:58:23.0269 5468 Mup - ok 14:58:23.0321 5468 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll 14:58:23.0337 5468 napagent - ok 14:58:23.0388 5468 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 14:58:23.0396 5468 NativeWifiP - ok 14:58:23.0476 5468 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 14:58:23.0496 5468 NDIS - ok 14:58:23.0513 5468 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 14:58:23.0514 5468 NdisCap - ok 14:58:23.0536 5468 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 14:58:23.0537 5468 NdisTapi - ok 14:58:23.0563 5468 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 14:58:23.0565 5468 Ndisuio - ok 14:58:23.0593 5468 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 14:58:23.0595 5468 NdisWan - ok 14:58:23.0618 5468 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 14:58:23.0620 5468 NDProxy - ok 14:58:23.0632 5468 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 14:58:23.0633 5468 NetBIOS - ok 14:58:23.0673 5468 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 14:58:23.0676 5468 NetBT - ok 14:58:23.0702 5468 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 14:58:23.0703 5468 Netlogon - ok 14:58:23.0757 5468 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 14:58:23.0776 5468 Netman - ok 14:58:23.0825 5468 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 14:58:23.0856 5468 netprofm - ok 14:58:23.0960 5468 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 14:58:23.0963 5468 NetTcpPortSharing - ok 14:58:23.0991 5468 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 14:58:23.0993 5468 nfrd960 - ok 14:58:24.0036 5468 NisDrv (91b4e0273d2f6c24ef845f2b41311289) C:\Windows\system32\DRIVERS\NisDrvWFP.sys 14:58:24.0040 5468 NisDrv - ok 14:58:24.0110 5468 NisSrv (10a43829a9e606af3eef25a1c1665923) c:\Program Files\Microsoft Security Client\NisSrv.exe 14:58:24.0117 5468 NisSrv - ok 14:58:24.0163 5468 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll 14:58:24.0176 5468 NlaSvc - ok 14:58:24.0198 5468 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 14:58:24.0200 5468 Npfs - ok 14:58:24.0228 5468 npggsvc - ok 14:58:24.0242 5468 NPPTNT2 - ok 14:58:24.0262 5468 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 14:58:24.0264 5468 nsi - ok 14:58:24.0282 5468 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 14:58:24.0282 5468 nsiproxy - ok 14:58:24.0382 5468 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys 14:58:24.0402 5468 Ntfs - ok 14:58:24.0539 5468 NuidFltr (9924bdc1882f8c92335e26483bd1fb24) C:\Windows\system32\DRIVERS\NuidFltr.sys 14:58:24.0541 5468 NuidFltr - ok 14:58:24.0553 5468 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 14:58:24.0555 5468 Null - ok 14:58:24.0593 5468 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys 14:58:24.0596 5468 nvraid - ok 14:58:24.0622 5468 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys 14:58:24.0624 5468 nvstor - ok 14:58:24.0650 5468 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 14:58:24.0652 5468 nv_agp - ok 14:58:24.0675 5468 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 14:58:24.0677 5468 ohci1394 - ok 14:58:24.0704 5468 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 14:58:24.0709 5468 p2pimsvc - ok 14:58:24.0739 5468 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 14:58:24.0756 5468 p2psvc - ok 14:58:24.0783 5468 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 14:58:24.0785 5468 Parport - ok 14:58:24.0810 5468 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys 14:58:24.0812 5468 partmgr - ok 14:58:24.0840 5468 PCAMp50a64 (304e6ac43613a9c43896c4300009442b) C:\Windows\system32\Drivers\PCAMp50a64.sys 14:58:24.0841 5468 PCAMp50a64 - ok 14:58:24.0851 5468 PCASp50a64 (18b6869e23937175144e6f1d3cb85fc2) C:\Windows\system32\Drivers\PCASp50a64.sys 14:58:24.0852 5468 PCASp50a64 - ok 14:58:24.0870 5468 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 14:58:24.0874 5468 PcaSvc - ok 14:58:24.0896 5468 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 14:58:24.0898 5468 pci - ok 14:58:24.0908 5468 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 14:58:24.0909 5468 pciide - ok 14:58:24.0935 5468 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 14:58:24.0938 5468 pcmcia - ok 14:58:24.0953 5468 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 14:58:24.0954 5468 pcw - ok 14:58:24.0998 5468 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 14:58:25.0009 5468 PEAUTH - ok 14:58:25.0080 5468 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 14:58:25.0082 5468 PerfHost - ok 14:58:25.0171 5468 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll 14:58:25.0193 5468 pla - ok 14:58:25.0246 5468 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll 14:58:25.0267 5468 PlugPlay - ok 14:58:25.0300 5468 PnkBstrA - ok 14:58:25.0333 5468 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 14:58:25.0338 5468 PNRPAutoReg - ok 14:58:25.0374 5468 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 14:58:25.0382 5468 PNRPsvc - ok 14:58:25.0459 5468 Point64 (33328fa8a580885ab0065be6db266e9f) C:\Windows\system32\DRIVERS\point64.sys 14:58:25.0461 5468 Point64 - ok 14:58:25.0498 5468 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll 14:58:25.0512 5468 PolicyAgent - ok 14:58:25.0552 5468 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 14:58:25.0557 5468 Power - ok 14:58:25.0594 5468 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 14:58:25.0597 5468 PptpMiniport - ok 14:58:25.0621 5468 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 14:58:25.0623 5468 Processor - ok 14:58:25.0646 5468 ProfSvc (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll 14:58:25.0650 5468 ProfSvc - ok 14:58:25.0677 5468 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 14:58:25.0678 5468 ProtectedStorage - ok 14:58:25.0715 5468 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 14:58:25.0717 5468 Psched - ok 14:58:25.0748 5468 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys 14:58:25.0749 5468 PxHlpa64 - ok 14:58:25.0827 5468 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 14:58:25.0862 5468 ql2300 - ok 14:58:25.0976 5468 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 14:58:25.0980 5468 ql40xx - ok 14:58:26.0010 5468 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 14:58:26.0015 5468 QWAVE - ok 14:58:26.0029 5468 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 14:58:26.0031 5468 QWAVEdrv - ok 14:58:26.0040 5468 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 14:58:26.0042 5468 RasAcd - ok 14:58:26.0064 5468 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 14:58:26.0066 5468 RasAgileVpn - ok 14:58:26.0082 5468 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 14:58:26.0085 5468 RasAuto - ok 14:58:26.0108 5468 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 14:58:26.0110 5468 Rasl2tp - ok 14:58:26.0150 5468 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll 14:58:26.0156 5468 RasMan - ok 14:58:26.0175 5468 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 14:58:26.0176 5468 RasPppoe - ok 14:58:26.0191 5468 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 14:58:26.0193 5468 RasSstp - ok 14:58:26.0228 5468 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 14:58:26.0232 5468 rdbss - ok 14:58:26.0241 5468 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 14:58:26.0242 5468 rdpbus - ok 14:58:26.0255 5468 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 14:58:26.0255 5468 RDPCDD - ok 14:58:26.0271 5468 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 14:58:26.0272 5468 RDPENCDD - ok 14:58:26.0276 5468 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 14:58:26.0276 5468 RDPREFMP - ok 14:58:26.0298 5468 RDPWD (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys 14:58:26.0301 5468 RDPWD - ok 14:58:26.0339 5468 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 14:58:26.0344 5468 rdyboost - ok 14:58:26.0379 5468 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 14:58:26.0384 5468 RemoteAccess - ok 14:58:26.0409 5468 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 14:58:26.0416 5468 RemoteRegistry - ok 14:58:26.0516 5468 Roozz Updater (22766238da5ebc7bd3c8caae1bb3e394) C:\Program Files (x86)\Roozz\RoozzUpdater.exe 14:58:26.0522 5468 Roozz Updater - ok 14:58:26.0556 5468 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 14:58:26.0559 5468 RpcEptMapper - ok 14:58:26.0587 5468 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 14:58:26.0589 5468 RpcLocator - ok 14:58:26.0643 5468 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 14:58:26.0653 5468 RpcSs - ok 14:58:26.0694 5468 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 14:58:26.0697 5468 rspndr - ok 14:58:26.0735 5468 RTL8167 (baefee35d27a5440d35092ce10267bec) C:\Windows\system32\DRIVERS\Rt64win7.sys 14:58:26.0740 5468 RTL8167 - ok 14:58:26.0769 5468 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 14:58:26.0772 5468 SamSs - ok 14:58:26.0803 5468 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 14:58:26.0806 5468 sbp2port - ok 14:58:26.0834 5468 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 14:58:26.0842 5468 SCardSvr - ok 14:58:26.0866 5468 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 14:58:26.0868 5468 scfilter - ok 14:58:26.0951 5468 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll 14:58:26.0969 5468 Schedule - ok 14:58:26.0999 5468 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 14:58:27.0000 5468 SCPolicySvc - ok 14:58:27.0023 5468 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll 14:58:27.0028 5468 SDRSVC - ok 14:58:27.0046 5468 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 14:58:27.0047 5468 secdrv - ok 14:58:27.0070 5468 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll 14:58:27.0072 5468 seclogon - ok 14:58:27.0099 5468 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll 14:58:27.0102 5468 SENS - ok 14:58:27.0111 5468 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 14:58:27.0114 5468 SensrSvc - ok 14:58:27.0118 5468 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 14:58:27.0119 5468 Serenum - ok 14:58:27.0144 5468 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 14:58:27.0146 5468 Serial - ok 14:58:27.0158 5468 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 14:58:27.0159 5468 sermouse - ok 14:58:27.0195 5468 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll 14:58:27.0199 5468 SessionEnv - ok 14:58:27.0221 5468 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 14:58:27.0223 5468 sffdisk - ok 14:58:27.0232 5468 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 14:58:27.0233 5468 sffp_mmc - ok 14:58:27.0248 5468 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 14:58:27.0249 5468 sffp_sd - ok 14:58:27.0258 5468 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 14:58:27.0259 5468 sfloppy - ok 14:58:27.0297 5468 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll 14:58:27.0303 5468 ShellHWDetection - ok 14:58:27.0325 5468 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 14:58:27.0326 5468 SiSRaid2 - ok 14:58:27.0339 5468 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 14:58:27.0340 5468 SiSRaid4 - ok 14:58:27.0363 5468 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 14:58:27.0364 5468 Smb - ok 14:58:27.0388 5468 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 14:58:27.0391 5468 SNMPTRAP - ok 14:58:27.0398 5468 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 14:58:27.0398 5468 spldr - ok 14:58:27.0432 5468 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe 14:58:27.0463 5468 Spooler - ok 14:58:27.0704 5468 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe 14:58:27.0748 5468 sppsvc - ok 14:58:27.0838 5468 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 14:58:27.0843 5468 sppuinotify - ok 14:58:27.0924 5468 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 14:58:27.0933 5468 srv - ok 14:58:27.0965 5468 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 14:58:27.0971 5468 srv2 - ok 14:58:27.0991 5468 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 14:58:27.0993 5468 srvnet - ok 14:58:28.0026 5468 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 14:58:28.0031 5468 SSDPSRV - ok 14:58:28.0046 5468 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 14:58:28.0049 5468 SstpSvc - ok 14:58:28.0063 5468 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 14:58:28.0064 5468 stexstor - ok 14:58:28.0123 5468 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll 14:58:28.0135 5468 stisvc - ok 14:58:28.0163 5468 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 14:58:28.0164 5468 swenum - ok 14:58:28.0309 5468 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 14:58:28.0324 5468 SwitchBoard - ok 14:58:28.0370 5468 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 14:58:28.0394 5468 swprv - ok 14:58:28.0497 5468 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll 14:58:28.0526 5468 SysMain - ok 14:58:28.0636 5468 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll 14:58:28.0639 5468 TabletInputService - ok 14:58:28.0675 5468 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll 14:58:28.0682 5468 TapiSrv - ok 14:58:28.0694 5468 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 14:58:28.0696 5468 TBS - ok 14:58:28.0815 5468 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys 14:58:28.0838 5468 Tcpip - ok 14:58:28.0993 5468 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys 14:58:29.0007 5468 TCPIP6 - ok 14:58:29.0067 5468 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 14:58:29.0070 5468 tcpipreg - ok 14:58:29.0106 5468 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 14:58:29.0108 5468 TDPIPE - ok 14:58:29.0130 5468 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys 14:58:29.0132 5468 TDTCP - ok 14:58:29.0158 5468 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 14:58:29.0160 5468 tdx - ok 14:58:29.0191 5468 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 14:58:29.0192 5468 TermDD - ok 14:58:29.0232 5468 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll 14:58:29.0251 5468 TermService - ok 14:58:29.0265 5468 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 14:58:29.0267 5468 Themes - ok 14:58:29.0291 5468 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 14:58:29.0293 5468 THREADORDER - ok 14:58:29.0321 5468 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 14:58:29.0325 5468 TrkWks - ok 14:58:29.0373 5468 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe 14:58:29.0378 5468 TrustedInstaller - ok 14:58:29.0408 5468 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 14:58:29.0410 5468 tssecsrv - ok 14:58:29.0438 5468 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 14:58:29.0441 5468 TsUsbFlt - ok 14:58:29.0481 5468 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 14:58:29.0485 5468 tunnel - ok 14:58:29.0505 5468 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 14:58:29.0507 5468 uagp35 - ok 14:58:29.0533 5468 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 14:58:29.0538 5468 udfs - ok 14:58:29.0557 5468 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 14:58:29.0560 5468 UI0Detect - ok 14:58:29.0577 5468 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 14:58:29.0579 5468 uliagpkx - ok 14:58:29.0609 5468 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys 14:58:29.0611 5468 umbus - ok 14:58:29.0621 5468 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 14:58:29.0622 5468 UmPass - ok 14:58:29.0652 5468 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 14:58:29.0658 5468 upnphost - ok 14:58:29.0699 5468 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys 14:58:29.0702 5468 usbaudio - ok 14:58:29.0733 5468 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys 14:58:29.0735 5468 usbccgp - ok 14:58:29.0764 5468 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 14:58:29.0766 5468 usbcir - ok 14:58:29.0777 5468 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys 14:58:29.0778 5468 usbehci - ok 14:58:29.0804 5468 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys 14:58:29.0809 5468 usbhub - ok 14:58:29.0818 5468 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys 14:58:29.0819 5468 usbohci - ok 14:58:29.0835 5468 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 14:58:29.0836 5468 usbprint - ok 14:58:29.0854 5468 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS 14:58:29.0856 5468 USBSTOR - ok 14:58:29.0868 5468 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys 14:58:29.0869 5468 usbuhci - ok 14:58:29.0883 5468 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 14:58:29.0886 5468 UxSms - ok 14:58:29.0918 5468 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 14:58:29.0919 5468 VaultSvc - ok 14:58:29.0935 5468 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 14:58:29.0937 5468 vdrvroot - ok 14:58:29.0974 5468 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe 14:58:30.0005 5468 vds - ok 14:58:30.0050 5468 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 14:58:30.0052 5468 vga - ok 14:58:30.0067 5468 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 14:58:30.0069 5468 VgaSave - ok 14:58:30.0093 5468 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 14:58:30.0099 5468 vhdmp - ok 14:58:30.0115 5468 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 14:58:30.0117 5468 viaide - ok 14:58:30.0220 5468 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 14:58:30.0223 5468 volmgr - ok 14:58:30.0276 5468 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 14:58:30.0287 5468 volmgrx - ok 14:58:30.0334 5468 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 14:58:30.0339 5468 volsnap - ok 14:58:30.0371 5468 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 14:58:30.0374 5468 vsmraid - ok 14:58:30.0466 5468 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe 14:58:30.0506 5468 VSS - ok 14:58:30.0621 5468 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys 14:58:30.0623 5468 vwifibus - ok 14:58:30.0641 5468 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys 14:58:30.0644 5468 vwififlt - ok 14:58:30.0680 5468 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 14:58:30.0691 5468 W32Time - ok 14:58:30.0708 5468 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 14:58:30.0709 5468 WacomPen - ok 14:58:30.0748 5468 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 14:58:30.0750 5468 WANARP - ok 14:58:30.0753 5468 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 14:58:30.0755 5468 Wanarpv6 - ok 14:58:30.0867 5468 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe 14:58:30.0889 5468 WatAdminSvc - ok 14:58:30.0983 5468 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe 14:58:31.0010 5468 wbengine - ok 14:58:31.0065 5468 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 14:58:31.0070 5468 WbioSrvc - ok 14:58:31.0116 5468 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll 14:58:31.0124 5468 wcncsvc - ok 14:58:31.0133 5468 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 14:58:31.0137 5468 WcsPlugInService - ok 14:58:31.0149 5468 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 14:58:31.0150 5468 Wd - ok 14:58:31.0192 5468 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 14:58:31.0201 5468 Wdf01000 - ok 14:58:31.0214 5468 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 14:58:31.0217 5468 WdiServiceHost - ok 14:58:31.0221 5468 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 14:58:31.0223 5468 WdiSystemHost - ok 14:58:31.0260 5468 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll 14:58:31.0266 5468 WebClient - ok 14:58:31.0288 5468 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 14:58:31.0293 5468 Wecsvc - ok 14:58:31.0310 5468 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 14:58:31.0313 5468 wercplsupport - ok 14:58:31.0332 5468 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 14:58:31.0336 5468 WerSvc - ok 14:58:31.0356 5468 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 14:58:31.0357 5468 WfpLwf - ok 14:58:31.0361 5468 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 14:58:31.0362 5468 WIMMount - ok 14:58:31.0409 5468 WinDefend - ok 14:58:31.0423 5468 WinHttpAutoProxySvc - ok 14:58:31.0483 5468 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 14:58:31.0489 5468 Winmgmt - ok 14:58:31.0637 5468 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll 14:58:31.0685 5468 WinRM - ok 14:58:31.0821 5468 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys 14:58:31.0824 5468 WinUsb - ok 14:58:31.0886 5468 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 14:58:31.0919 5468 Wlansvc - ok 14:58:31.0939 5468 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 14:58:31.0940 5468 WmiAcpi - ok 14:58:31.0975 5468 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 14:58:31.0978 5468 wmiApSrv - ok 14:58:31.0989 5468 WMPNetworkSvc - ok 14:58:32.0063 5468 WNDA3100 (b972c12de88299e78f6656a31046dd99) C:\Windows\system32\DRIVERS\WNDA31w7x.sys 14:58:32.0092 5468 WNDA3100 - ok 14:58:32.0113 5468 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 14:58:32.0115 5468 WPCSvc - ok 14:58:32.0147 5468 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll 14:58:32.0154 5468 WPDBusEnum - ok 14:58:32.0188 5468 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 14:58:32.0189 5468 ws2ifsl - ok 14:58:32.0231 5468 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\system32\wscsvc.dll 14:58:32.0238 5468 wscsvc - ok 14:58:32.0244 5468 WSearch - ok 14:58:32.0382 5468 wuauserv (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll 14:58:32.0407 5468 wuauserv - ok 14:58:32.0541 5468 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 14:58:32.0545 5468 WudfPf - ok 14:58:32.0569 5468 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 14:58:32.0574 5468 WUDFRd - ok 14:58:32.0605 5468 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll 14:58:32.0612 5468 wudfsvc - ok 14:58:32.0652 5468 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 14:58:32.0662 5468 WwanSvc - ok 14:58:32.0696 5468 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 14:58:32.0896 5468 \Device\Harddisk0\DR0 - ok 14:58:32.0908 5468 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1 14:58:32.0913 5468 \Device\Harddisk1\DR1 - ok 14:58:32.0920 5468 Boot (0x1200) (e764744d71cd43325d82033ad7714f39) \Device\Harddisk0\DR0\Partition0 14:58:32.0923 5468 \Device\Harddisk0\DR0\Partition0 - ok 14:58:32.0936 5468 Boot (0x1200) (5bad91e254ef93c42f1f642a6e3a31b4) \Device\Harddisk0\DR0\Partition1 14:58:32.0938 5468 \Device\Harddisk0\DR0\Partition1 - ok 14:58:32.0941 5468 Boot (0x1200) (61d9970a139c38a937db5fa87bbc962d) \Device\Harddisk1\DR1\Partition0 14:58:32.0943 5468 \Device\Harddisk1\DR1\Partition0 - ok 14:58:32.0943 5468 ============================================================ 14:58:32.0943 5468 Scan finished 14:58:32.0943 5468 ============================================================ 14:58:32.0954 5520 Detected object count: 0 14:58:32.0954 5520 Actual detected object count: 0 14:59:10.0985 5852 Deinitialize success ComboFix 12-08-09.01 - mikaik 08/11/2012 15:01:38.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3838.2551 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\install.exe C:\prefs.js c:\program files (x86)\Complitly c:\program files (x86)\Complitly\chrome\ComplitlyChrome.crx c:\program files (x86)\Complitly\FireFoxExtension.exe c:\program files (x86)\Complitly\InstTracker.exe c:\program files (x86)\Complitly\[removed]\chrome.manifest c:\program files (x86)\Complitly\[removed]\chrome\content\appIcon.png c:\program files (x86)\Complitly\[removed]\chrome\content\browserOverlay.xul c:\program files (x86)\Complitly\[removed]\chrome\content\options.js c:\program files (x86)\Complitly\[removed]\chrome\content\options.xul c:\program files (x86)\Complitly\[removed]\chrome\content\utils.js c:\program files (x86)\Complitly\[removed]\defaults\preferences\predictad.js c:\program files (x86)\Complitly\[removed]\install.rdf c:\program files (x86)\Complitly\unins000.dat c:\program files (x86)\Complitly\unins000.exe c:\program files (x86)\DealPly c:\program files (x86)\DealPly\DealPly.crx c:\program files (x86)\DealPly\DealPlyIE.dll c:\program files (x86)\DealPly\icon.ico c:\program files (x86)\DealPly\uninst.exe c:\program files (x86)\facemoods.com c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.crx c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.png c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsApp.dll c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsEng.dll c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe c:\program files (x86)\facemoods.com\sqlite3.dll c:\program files (x86)\Search Toolbar c:\program files (x86)\Search Toolbar\icon.ico c:\program files (x86)\Search Toolbar\SearchToolbar.dll c:\program files (x86)\Search Toolbar\SearchToolbarUninstall.exe c:\program files (x86)\Search Toolbar\SearchToolbarUpdater.exe c:\programdata\4cb227b2-d361-4d61-a869-bb6da7e6bad3.ico c:\programdata\7531E8D003DE706E156BE7A4F875F002 c:\programdata\7531E8D003DE706E156BE7A4F875F002\7531E8D003DE706E156BE7A4F875F002 c:\programdata\7531E8D003DE706E156BE7A4F875F002\7531E8D003DE706E156BE7A4F875F002.exe c:\programdata\7531E8D003DE706E156BE7A4F875F002\7531E8D003DE706E156BE7A4F875F002.ico c:\users\mikaik\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antivirus Center.lnk c:\users\mikaik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum c:\users\mikaik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum\Live Security Platinum Support Site.url c:\users\mikaik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum\Live Security Platinum.lnk c:\users\mikaik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum\Uninstall.lnk c:\users\mikaik\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed] c:\users\mikaik\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\chrome.manifest c:\users\mikaik\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\chrome\gvtextlinks.jar c:\users\mikaik\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\gvtlf.xpt c:\users\mikaik\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\install.rdf c:\windows\assembly\GAC_32\Desktop.ini c:\windows\assembly\GAC_64\Desktop.ini c:\windows\Installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\@ c:\windows\Installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\L\00000004.@ c:\windows\Installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\L\201d3dde c:\windows\Installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\U\00000004.@ c:\windows\Installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\U\00000008.@ c:\windows\Installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\U\000000cb.@ c:\windows\Installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\U\80000000.@ c:\windows\Installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\U\80000032.@ c:\windows\Installer\{f8a1a43f-8393-093c-d0a8-2cc9c6ee48fb}\U\80000064.@ . Infected copy of c:\windows\system32\services.exe was found and disinfected Restored copy from - c:\32788r22fwjfw\HarddiskVolumeShadowCopy6_!Windows!System32!services.exe . . ((((((((((((((((((((((((( Files Created from 2012-07-11 to 2012-08-11 ))))))))))))))))))))))))))))))) . . 2012-08-11 22:07 . 2012-08-11 22:07 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-08-11 22:07 . 2012-08-11 22:07 ——– d—–w- c:\users\Pruette\AppData\Local\temp 2012-07-23 02:45 . 2012-07-23 02:45 ——– d-sh–w- c:\windows\SysWow64\%APPDATA% 2012-07-22 23:31 . 2012-07-22 23:31 69000 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C61282D3-766C-48E4-84A6-635D3000067D}\offreg.dll 2012-07-21 23:50 . 2012-06-29 10:04 9133488 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C61282D3-766C-48E4-84A6-635D3000067D}\mpengine.dll 2012-07-20 17:15 . 2012-06-29 10:04 9133488 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-11 10:00 . 2011-02-06 20:53 59701280 —-a-w- c:\windows\system32\MRT.exe 2012-06-12 03:08 . 2012-07-11 10:03 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-06-09 05:43 . 2012-07-10 18:51 14172672 —-a-w- c:\windows\system32\shell32.dll 2012-06-06 06:06 . 2012-07-10 18:51 2004480 —-a-w- c:\windows\system32\msxml6.dll 2012-06-06 06:06 . 2012-07-10 18:51 1881600 —-a-w- c:\windows\system32\msxml3.dll 2012-06-06 06:02 . 2012-07-10 18:51 1133568 —-a-w- c:\windows\system32\cdosys.dll 2012-06-06 05:05 . 2012-07-10 18:51 1390080 —-a-w- c:\windows\SysWow64\msxml6.dll 2012-06-06 05:05 . 2012-07-10 18:51 1236992 —-a-w- c:\windows\SysWow64\msxml3.dll 2012-06-06 05:03 . 2012-07-10 18:51 805376 —-a-w- c:\windows\SysWow64\cdosys.dll 2012-06-02 22:19 . 2012-06-30 17:55 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-30 17:55 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:19 . 2012-06-30 17:55 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-30 17:55 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-30 17:55 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 22:19 . 2012-06-30 17:55 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:15 . 2012-06-30 17:55 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:15 . 2012-06-30 17:55 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-02 22:15 . 2012-06-30 17:55 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 05:50 . 2012-07-10 18:51 458704 —-a-w- c:\windows\system32\drivers\cng.sys 2012-06-02 05:48 . 2012-07-10 18:51 95600 —-a-w- c:\windows\system32\drivers\ksecdd.sys 2012-06-02 05:48 . 2012-07-10 18:51 151920 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2012-06-02 05:45 . 2012-07-10 18:51 340992 —-a-w- c:\windows\system32\schannel.dll 2012-06-02 05:44 . 2012-07-10 18:51 307200 —-a-w- c:\windows\system32\ncrypt.dll 2012-06-02 04:40 . 2012-07-10 18:51 22016 —-a-w- c:\windows\SysWow64\secur32.dll 2012-06-02 04:40 . 2012-07-10 18:51 225280 —-a-w- c:\windows\SysWow64\schannel.dll 2012-06-02 04:39 . 2012-07-10 18:51 219136 —-a-w- c:\windows\SysWow64\ncrypt.dll 2012-06-02 04:34 . 2012-07-10 18:51 96768 —-a-w- c:\windows\SysWow64\sspicli.dll 2012-06-01 21:35 . 2012-06-01 21:35 1420800 —-a-w- c:\windows\system32\CFHD.dll 2012-06-01 21:32 . 2012-06-01 21:32 1454080 —-a-w- c:\windows\SysWow64\CFHD.dll 2012-05-20 03:20 . 2012-05-20 03:20 163048 —-a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin 2012-05-15 04:01 . 2012-06-13 03:32 1188864 —-a-w- c:\windows\system32\wininet.dll 2012-05-15 03:59 . 2012-06-13 03:32 64512 —-a-w- c:\windows\system32\jsproxy.dll 2012-05-15 03:03 . 2012-06-13 03:32 981504 —-a-w- c:\windows\SysWow64\wininet.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files (x86)\Freecorder\prxtbFree.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] 2011-05-09 08:49 176936 —-a-w- c:\program files (x86)\Freecorder\prxtbFree.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files (x86)\Freecorder\prxtbFree.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 —-a-w- c:\users\mikaik\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 —-a-w- c:\users\mikaik\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 —-a-w- c:\users\mikaik\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Spotify Web Helper"="c:\users\mikaik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-07-20 1193176] "chromium"="c:\users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe" [2012-08-07 1229848] "MusicManager"="c:\users\mikaik\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2012-06-01 13806592] "CineForm"="c:\users\mikaik\AppData\Local\CineForm\mcawoyzr.dll" [2012-07-20 738304] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936] "UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408] "UpdatePSTShortCut"="c:\program files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-01-06 210216] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-23 402432] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888] "Freecorder FLV Service"="c:\program files (x86)\Freecorder\FLVSrvc.exe" [2011-03-24 167936] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736] . c:\users\mikaik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\mikaik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ CineForm Status.lnk - c:\program files (x86)\CineForm\Tools\GoProCineFormStatusViewer.exe [2012-6-8 152064] NETGEAR WNDA3100 Smart Wizard.lnk - c:\program files (x86)\NETGEAR\WNDA3100\WNDA3100.exe [2009-9-21 1708032] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux3"=wdmaud.drv . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-16 136176] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-16 136176] R3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files (x86)\NETGEAR\WNDA3100\jswpsapi.exe [2008-02-29 942080] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-21 98688] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-27 291696] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x] R3 PCAMp50a64;PCAMp50a64 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50a64.sys [2006-11-29 43328] R3 PCASp50a64;PCASp50a64 NDIS Protocol Driver;c:\windows\system32\Drivers\PCASp50a64.sys [2006-11-29 41280] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-02-02 1255736] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280] S1 JSWPSLWF;JumpStart Wireless Filter Driver;c:\windows\system32\DRIVERS\jswpslwfx.sys [2008-10-02 26624] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-04-20 203776] S2 Roozz Updater;Roozz Updater;c:\program files (x86)\Roozz\RoozzUpdater.exe [2012-08-05 390656] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-04-20 9319936] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-04-20 306176] S3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [2011-04-13 52632] S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-04-13 45432] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392] S3 WNDA3100;NETGEAR WNDA3100 USB2.0 Wireless Card Service;c:\windows\system32\DRIVERS\WNDA31w7x.sys [2009-10-21 767488] . . Contents of the 'Scheduled Tasks' folder . 2012-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-16 04:13] . 2012-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-16 04:13] . 2012-08-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3377176785-3229694586-196458063-1000Core.job - c:\users\mikaik\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-31 22:37] . 2012-08-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3377176785-3229694586-196458063-1000UA.job - c:\users\mikaik\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-31 22:37] . 2012-08-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3377176785-3229694586-196458063-1003Core.job - c:\users\Pruette\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-25 16:21] . 2012-08-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3377176785-3229694586-196458063-1003UA.job - c:\users\Pruette\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-25 16:21] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 97792 —-a-w- c:\users\mikaik\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 97792 —-a-w- c:\users\mikaik\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 97792 —-a-w- c:\users\mikaik\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 97792 —-a-w- c:\users\mikaik\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208] "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-04-13 1860496] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-27 1271168] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1060933 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKCU-Run-AdobeBridge - (no file) Wow6432Node-HKCU-Run-DW6 - c:\program files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe Wow6432Node-HKLM-Run-jswtrayutil - c:\program files (x86)\NETGEAR\WNDA3100\jswtrayutil.exe Wow6432Node-HKLM-Run-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe SafeBoot-MsMpSvc WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{1392B8D2-5C05-419F-A8F6-B9F15A596612} - (no file) AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-DealPly - c:\program files (x86)\DealPly\uninst.exe AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe AddRemove-PunkBusterSvc - c:\program files (x86)\STEAM\STEAMAPPS\COMMON\APB RELOADED\Binaries\pbsvc_apb.exe AddRemove-Search Toolbar - c:\program files (x86)\Search Toolbar\SearchToolbarUninstall.exe AddRemove-{4FFBB818-B13C-11E0-931D-B2664824019B}_is1 - c:\program files (x86)\Complitly\unins000.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-3377176785-3229694586-196458063-1000\Software\SecuROM\License information*] "datasecu"=hex:e1,ab,37,f0,12,34,26,e3,66,56,24,15,6d,ef,b7,6b,8c,31,fb,36,49, 2f,39,e1,a8,5f,5e,d0,85,b1,3a,8d,1b,44,08,34,ee,90,89,5d,b9,e4,2c,a3,22,d2,\ "rkeysecu"=hex:b0,b6,41,3b,2a,b6,37,b5,e7,3f,9f,b4,8c,b0,6f,22 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Completion time: 2012-08-11 15:17:21 - machine was rebooted ComboFix-quarantined-files.txt 2012-08-11 22:17 . Pre-Run: 743,053,590,528 bytes free Post-Run: 745,048,100,864 bytes free . - - End Of File - - 93C21E56AD76767DFE864D5BEE760F67

Satchfan

Post #12August 12, 2012, 7:32 AM UTC

It looks like that cleared up a lot and dealt with the main infection.

Run DDS

Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif

disable any script blocking protection (How to Disable your Security Programs)
double click DDS icon to run the tool (may take up to 3 minutes to run)
when done, DDS.txt will open.
after a few moments, attach.txt will open in a second window.
save both reports to your desktop.
Post the contents of the DDS.txt and Attach.txt reports in your next reply

Can you tell me how the computer is running now.

Satchfan

nonewbeertax

Post #13August 13, 2012, 3:30 AM UTC

. DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 8.0.7601.17514 Run by [removed] at 20:24:05 on 2012-08-12 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3838.1956 [GMT -7:00] . SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\DAZ 3D\Content Management Service\ContentManagementServer.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\Roozz\RoozzUpdater.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Users\mikaik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe C:\Users\mikaik\AppData\Local\Programs\Google\MusicManager\MusicManager.exe C:\Windows\System32\rundll32.exe C:\Program Files (x86)\CineForm\Tools\GoProCineFormStatusViewer.exe C:\Program Files (x86)\NETGEAR\WNDA3100\WNDA3100.exe C:\Windows\SysWOW64\rundll32.exe C:\Users\mikaik\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Freecorder\FLVSrvc.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files (x86)\Internet Explorer\IELowutil.exe C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\mikaik\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe C:\Users\mikaik\AppData\Roaming\Spotify\spotify.exe C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1060933 uInternet Settings,ProxyOverride = *.local uURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll mURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll BHO: Complitly: {0fb6a909-6086-458f-bd92-1f8ee10042a0} - C:\Users\mikaik\AppData\Roaming\Complitly\Complitly.dll BHO: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [Spotify Web Helper] "C:\Users\mikaik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" uRun: [chromium] C:\Users\mikaik\AppData\Local\Google\Chrome\Application\chrome.exe –no-startup-window uRun: [MusicManager] "C:\Users\mikaik\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" uRun: [CineForm] RUNDLL32.EXE C:\Users\mikaik\AppData\Local\CineForm\mcawoyzr.dll,CPPDebug mRun: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" mRun: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" mRun: [UpdatePSTShortCut] "C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [Freecorder FLV Service] "C:\Program Files (x86)\Freecorder\FLVSrvc.exe" /run mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" StartupFolder: C:\Users\mikaik\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\mikaik\AppData\Roaming\Dropbox\bin\Dropbox.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\CINEFO~1.LNK - C:\Program Files (x86)\CineForm\Tools\GoProCineFormStatusViewer.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NETGEA~1.LNK - C:\Program Files (x86)\NETGEAR\WNDA3100\WNDA3100.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 TCP: Interfaces\{EFA7B04A-895D-4114-80D8-6BA8111547CF} : DhcpNameServer = 75.75.75.75 75.75.76.76 BHO-X64: Complitly: {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Users\mikaik\AppData\Roaming\Complitly\Complitly.dll BHO-X64: Complitly - No File BHO-X64: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll BHO-X64: Freecorder - No File BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB-X64: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File mRun-x64: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" mRun-x64: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" mRun-x64: [UpdatePSTShortCut] "C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" mRun-x64: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe mRun-x64: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun-x64: [Freecorder FLV Service] "C:\Program Files (x86)\Freecorder\FLVSrvc.exe" /run mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" . ============= SERVICES / DRIVERS =============== . R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys –> C:\Windows\system32\DRIVERS\MpFilter.sys [?] R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys –> C:\Windows\system32\Drivers\PxHlpa64.sys [?] R1 JSWPSLWF;JumpStart Wireless Filter Driver;C:\Windows\system32\DRIVERS\jswpslwfx.sys –> C:\Windows\system32\DRIVERS\jswpslwfx.sys [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe –> C:\Windows\system32\atiesrxx.exe [?] R2 DAZContentManagementService;DAZ Content Management Service;C:\Program Files\DAZ 3D\Content Management Service\ContentManagementServer.exe [2012-3-17 22528] R2 Roozz Updater;Roozz Updater;C:\Program Files (x86)\Roozz\RoozzUpdater.exe [2012-3-28 390656] R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys –> C:\Windows\system32\DRIVERS\atikmdag.sys [?] R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys –> C:\Windows\system32\DRIVERS\atikmpag.sys [?] R3 PCASp50a64;PCASp50a64 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50a64.sys –> C:\Windows\system32\Drivers\PCASp50a64.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 WNDA3100;NETGEAR WNDA3100 USB2.0 Wireless Card Service;C:\Windows\system32\DRIVERS\WNDA31w7x.sys –> C:\Windows\system32\DRIVERS\WNDA31w7x.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-15 136176] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-15 136176] S3 jswpsapi;Jumpstart Wifi Protected Setup;C:\Program Files (x86)\NETGEAR\WNDA3100\jswpsapi.exe [2008-2-29 942080] S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys –> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?] S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696] S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service –> C:\Windows\system32\GameMon.des -service [?] S3 PCAMp50a64;PCAMp50a64 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50a64.sys –> C:\Windows\system32\Drivers\PCAMp50a64.sys [?] S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] . =============== Created Last 30 ================ . 2012-08-11 22:52:38 ——– d-sh–w- C:\$RECYCLE.BIN 2012-08-11 06:46:08 98816 —-a-w- C:\Windows\sed.exe 2012-08-11 06:46:08 518144 —-a-w- C:\Windows\SWREG.exe 2012-08-11 06:46:08 256000 —-a-w- C:\Windows\PEV.exe 2012-08-11 06:46:08 208896 —-a-w- C:\Windows\MBR.exe 2012-07-23 02:45:08 ——– d-sh–w- C:\Windows\SysWow64\%APPDATA% 2012-07-22 23:31:22 69000 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C61282D3-766C-48E4-84A6-635D3000067D}\offreg.dll 2012-07-21 23:50:02 9133488 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C61282D3-766C-48E4-84A6-635D3000067D}\mpengine.dll 2012-07-20 17:15:35 9133488 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll . ==================== Find3M ==================== . 2012-06-12 03:08:36 3148800 —-a-w- C:\Windows\System32\win32k.sys 2012-06-06 06:06:16 2004480 —-a-w- C:\Windows\System32\msxml6.dll 2012-06-06 06:06:16 1881600 —-a-w- C:\Windows\System32\msxml3.dll 2012-06-06 06:02:54 1133568 —-a-w- C:\Windows\System32\cdosys.dll 2012-06-06 05:05:52 1390080 —-a-w- C:\Windows\SysWow64\msxml6.dll 2012-06-06 05:05:52 1236992 —-a-w- C:\Windows\SysWow64\msxml3.dll 2012-06-06 05:03:06 805376 —-a-w- C:\Windows\SysWow64\cdosys.dll 2012-06-02 22:19:42 186752 —-a-w- C:\Windows\System32\wuwebv.dll 2012-06-02 22:15:31 2622464 —-a-w- C:\Windows\System32\wucltux.dll 2012-06-02 22:15:12 36864 —-a-w- C:\Windows\System32\wuapp.exe 2012-06-02 22:15:08 99840 —-a-w- C:\Windows\System32\wudriver.dll 2012-06-02 05:50:10 458704 —-a-w- C:\Windows\System32\drivers\cng.sys 2012-06-02 05:48:16 95600 —-a-w- C:\Windows\System32\drivers\ksecdd.sys 2012-06-02 05:48:16 151920 —-a-w- C:\Windows\System32\drivers\ksecpkg.sys 2012-06-02 05:45:31 340992 —-a-w- C:\Windows\System32\schannel.dll 2012-06-02 05:44:21 307200 —-a-w- C:\Windows\System32\ncrypt.dll 2012-06-02 04:40:42 22016 —-a-w- C:\Windows\SysWow64\secur32.dll 2012-06-02 04:40:39 225280 —-a-w- C:\Windows\SysWow64\schannel.dll 2012-06-02 04:39:10 219136 —-a-w- C:\Windows\SysWow64\ncrypt.dll 2012-06-02 04:34:09 96768 —-a-w- C:\Windows\SysWow64\sspicli.dll 2012-06-01 21:35:28 1420800 —-a-w- C:\Windows\System32\CFHD.dll 2012-06-01 21:32:14 1454080 —-a-w- C:\Windows\SysWow64\CFHD.dll 2012-05-15 04:01:31 1188864 —-a-w- C:\Windows\System32\wininet.dll . ============= FINISH: 20:24:34.75 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 1/31/2011 2:18:52 PM System Uptime: 8/11/2012 3:21:20 PM (29 hours ago) . Motherboard: ASUSTeK Computer INC. | | M4A785TD-M EVO Processor: AMD Phenom™ II X4 925 Processor | AM3 | 2800/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 931 GiB total, 693.739 GiB free. D: is FIXED (NTFS) - 466 GiB total, 448.14 GiB free. . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP334: 7/11/2012 3:00:11 AM - Windows Update RP335: 7/14/2012 10:34:53 AM - Windows Update RP336: 7/17/2012 9:27:03 PM - Windows Update RP337: 7/21/2012 4:49:27 PM - Windows Update RP338: 8/10/2012 4:12:22 PM - Scheduled Checkpoint . ==== Installed Programs ====================== . Add or Remove Adobe Premiere Pro CS5 Adobe After Effects CS5 Adobe After Effects CS5 Third Party Content Adobe After Effects CS5 Third Party Royalty Content Adobe AIR Adobe Community Help Adobe Flash Player 11 Plugin Adobe Media Encoder CS5 Dolby X64 Adobe Media Encoder CS5 PCI X64 Adobe Media Player Adobe OnLocation CS5 Royalty Content Adobe Premiere Pro CS5 Third Party Royalty Content Adobe Reader X (10.1.0) Adobe Shockwave Player 11.6 Apple Application Support Apple Software Update Audacity 1.3.14 (Unicode) calibre Canon MovieEdit Task for ZoomBrowser EX Canon Utilities Digital Photo Professional 3.10 Canon Utilities EOS Sample Music Canon Utilities EOS Utility Canon Utilities Movie Uploader for YouTube Canon Utilities PhotoStitch Canon Utilities Picture Style Editor Canon Utilities ZoomBrowser EX Canon ZoomBrowser EX Memory Card Utility Celtx (2.9) Complitly Crayon Physics Deluxe version 55 CyberLink DVD Suite CyberLink Power2Go DAZ Content Management Service DealPly Dropbox DS4 Default Content Facemoods Toolbar FLV Blaster v5.9.0 FoxTab PDF Converter Freecorder 5 Freecorder Toolbar Google Chrome Google Earth Google Talk Plugin Google Update Helper GoPro CineForm Studio 1.2.1 Java Auto Updater Java™ 6 Update 22 Java™ 6 Update 29 Knoll 3D Flares Magic Bullet Colorista Free 64-bit Microsoft Games for Windows - LIVE Redistributable Microsoft Silverlight Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft_VC80_ATL_x86 Microsoft_VC80_CRT_x86 Microsoft_VC80_MFC_x86 Microsoft_VC80_MFCLOC_x86 Microsoft_VC90_ATL_x86 Microsoft_VC90_CRT_x86 Microsoft_VC90_MFC_x86 Music Manager NETGEAR RangeMax Duo Wireless-N USB Adapter WNDA3100 OpenAL PunkBuster Services PxMergeModule QuickTime Roozz plugin 2.8.14 Search Toolbar Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) SmoothDraw 3.2.11 Spotify swMSM Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) VLC media player 1.1.11 WNDA3100 Xvid Video Codec . ==== Event Viewer Messages From Past Week ======== . 8/9/2012 6:40:39 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed. 8/9/2012 6:40:39 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed. 8/5/2012 3:34:46 PM, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147024891 8/5/2012 3:34:46 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: %%-2147024891 8/11/2012 3:21:44 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: cdrom 8/11/2012 3:08:48 PM, Error: Service Control Manager [7023] - The Windows Defender service terminated with the following error: The specified module could not be found. 8/11/2012 3:07:50 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 8/11/2012 3:07:00 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. 8/10/2012 11:47:24 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service. . ==== End Of File ===========================

Satchfan

Post #14August 13, 2012, 7:27 AM UTC

Uninstall the following programs, if present:

Search Toolbar
Facemoods Toolbar
Java™ 6 Update 22
Java™ 6 Update 29 1. Click Start, Control Panel, Programs, and then Programs and Features.
2. A new dialog box appears, Adjust your computer's settings. Choose Programs. Click on it.
3. Click on Search Toolbar, and then Uninstall. Repeat this for Facemoods Toolbar
and all versions of Java or JRE runtime.
If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

====================================

Download Malwarebytes-Anti-Malware

Click here

double-click mbam-setup.exe and follow the prompts to install the program.
at the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
if an update is found, it will download and install the latest version.
once the program has loaded, select Perform quick scan, then click Scan.
when the scan is complete, click OK, then Show Results to view the results.
be sure that everything is checked, and click Remove Selected.
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Can you tell me if there are any outstanding problems.

Satchfan

nonewbeertax

Post #15August 13, 2012, 4:56 PM UTC

Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.13.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 mikaik :: TURSTYWIZARD [administrator] 8/13/2012 9:50:01 AM mbam-log-2012-08-13 (09-50-01).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 213694 Time elapsed: 2 minute(s), 22 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 1 C:\Users\mikaik\AppData\Local\CineForm\mcawoyzr.dll (Spyware.Password) -> Delete on reboot. Registry Keys Detected: 2 HKCR\AppID\GamevanceText.DLL (Adware.GameVance) -> Quarantined and deleted successfully. HKCU\Software\AppDataLow\gvtl (Adware.GameVance) -> Quarantined and deleted successfully. Registry Values Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|CineForm (Spyware.Password) -> Data: RUNDLL32.EXE C:\Users\mikaik\AppData\Local\CineForm\mcawoyzr.dll,CPPDebug -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Users\mikaik\AppData\Local\CineForm\mcawoyzr.dll (Spyware.Password) -> Delete on reboot. (end) My computer seems to be working very well.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

live security platinum [Closed]

✨ Ask AI

Ask AI