Spyware / Malware / Virus Removal

Search gets redirected [Solved]

39 min read

Looking for the outcome? Ask AI

Melax Topic Starter

Post #1September 13, 2012, 11:29 PM UTC

Hello, I've noticed that recently my searches get redirected. Sometimes every other click of a link sends me somewhere else. I run windows 7 64 bits. Please find the OTL scan results. Thanks

OTL logfile created on: 9/13/2012 7:13:06 PM - Run 1
OTL by OldTimer - Version 3.2.61.3 Folder = C:\Users\XB70\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.88 Gb Available Physical Memory | 71.98% Memory free
8.00 Gb Paging File | 6.88 Gb Available in Paging File | 86.04% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1397.17 Gb Total Space | 1282.50 Gb Free Space | 91.79% Space Free | Partition Type: NTFS
Drive D: | 29.98 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: ASUS-DT | User Name: XB70 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\XB70\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (NisSrv) – c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (PnkBstrA) – C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (UMVPFSrv) – C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (McComponentHostService) – C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe (McAfee, Inc.)
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV:64bit: - (LVUVC64) – C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) – C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (VClone) – C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (ElbyCDIO) – C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (dmvsc) – C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (NVENETFD) – C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (SaiH0255) – C:\Windows\SysNative\drivers\SaiH0255.sys (Saitek)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 7A 22 3E 47 60 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {ED44AB0F-EA40-4FEF-B98D-FEA5B6F607F7}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{92739B98-EDA5-4EAD-B116-3F9F5C5AAAAC}: "URL" = http://en.wikipedia.org/w/index.php?title=…h={searchTerms}
IE - HKCU\..\SearchScopes\{ED44AB0F-EA40-4FEF-B98D-FEA5B6F607F7}: "URL" = http://www.google.com/search?q={searchTerm…utputEncoding?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "file:///C:/Users/XB70/Documents/bookmarks.html"
FF - prefs.js..extensions.enabledAddons: [removed]:2.6
FF - prefs.js..extensions.enabledAddons: [removed]:1.0

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\XB70\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\XB70\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\XB70\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\XB70\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\XB70\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/06 20:10:38 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/06 20:10:38 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2011/12/13 04:05:04 | 000,000,000 | —D | M] (No name found) – C:\Users\XB70\AppData\Roaming\Mozilla\Extensions
[2012/09/07 17:20:20 | 000,000,000 | —D | M] (No name found) – C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions
[2012/09/07 14:41:59 | 000,000,000 | —D | M] (Funmoods.com) – C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed]
[2012/09/07 14:41:59 | 000,000,000 | —D | M] (ASPCA App By We-Care.com) – C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\wecarereminder@bryan
[2012/06/02 19:42:49 | 000,009,189 | —- | M] () (No name found) – C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed]
[1832/11/29 00:22:58 | 000,004,819 | —- | M] () (No name found) – C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed]
[2012/07/14 16:43:21 | 000,057,702 | —- | M] () (No name found) – C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\{fe0258ab-4f74-43a1-8781-bcdf340f9ee9}.xpi
[2012/09/06 20:10:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/09/06 20:10:38 | 000,266,720 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/09/05 09:08:45 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/09/05 09:08:45 | 000,002,253 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Funmoods Helper Object) - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - C:\PROGRA~2\Funmoods\1.5.23.22\bh\escort.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Funmoods Toolbar) - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - C:\PROGRA~2\Funmoods\1.5.23.22\escorTlbr.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Facebook Update] C:\Users\XB70\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Users\XB70\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {7E866715-C9B6-4C64-AAB8-342E0D137213} http://192.168.1.23:8080/EDVR.CAB (DVR4204 Client Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DDBAFBE7-7C4E-4833-8053-ED759830477F}: NameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: vidc.i420 - lvcod64.dll (Logitech Inc.)
Drivers32: msacm.iac2 - C:\Windows\SysWOW64\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\SysWow64\lvcodec2.dll (Logitech Inc.)
Drivers32: VIDC.IV41 - C:\Windows\SysWow64\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\SysWow64\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/09/13 19:11:04 | 000,600,064 | —- | C] (OldTimer Tools) – C:\Users\XB70\Desktop\OTL.exe
[2012/09/13 18:57:50 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\XB70\Desktop\HiJackThis.exe
[2012/09/13 17:00:32 | 000,000,000 | —D | C] – C:\Users\XB70\Desktop\GooredFix Backups
[2012/09/13 03:00:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012/09/13 03:00:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2012/09/13 03:00:50 | 000,000,000 | R–D | C] – C:\Program Files (x86)\Skype
[2012/09/12 04:57:01 | 000,574,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10level9.dll
[2012/09/12 04:57:01 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\RNDISMP.sys
[2012/09/12 04:57:00 | 000,376,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\netio.sys
[2012/09/12 04:57:00 | 000,288,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2012/09/08 21:05:43 | 000,000,000 | —D | C] – C:\Users\XB70\AppData\Local\Facebook
[2012/09/07 14:42:19 | 000,000,000 | —D | C] – C:\Users\XB70\AppData\Roaming\vlc
[2012/09/07 14:41:56 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012/09/07 14:41:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\VideoLAN
[2012/09/07 14:41:08 | 000,000,000 | —D | C] – C:\ProgramData\WeCareReminder
[2012/09/07 14:40:54 | 000,000,000 | —D | C] – C:\ProgramData\Tarma Installer
[2012/09/06 20:10:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/09/03 23:28:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2012/09/03 23:28:41 | 000,246,760 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/09/03 23:28:35 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/09/03 23:28:35 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/09/03 23:28:35 | 000,095,208 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012/09/03 23:28:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2012/09/03 17:47:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2012/08/20 19:43:30 | 000,000,000 | —D | C] – C:\Call of Duty- Modern Warfare 3
[2012/08/19 03:02:34 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/08/19 03:02:34 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/08/19 03:02:33 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/08/19 03:02:33 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/08/19 03:02:32 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/08/19 03:02:32 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/08/19 03:02:32 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/08/19 03:02:32 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/08/19 03:02:31 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/08/19 03:02:31 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/08/19 03:02:31 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/08/19 03:02:30 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/08/19 03:02:30 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/08/18 20:04:13 | 000,503,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\srcore.dll
[2012/08/18 20:04:10 | 000,751,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\win32spl.dll
[2012/08/18 20:04:10 | 000,492,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\win32spl.dll
[2012/08/18 20:04:10 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\splwow64.exe
[2012/08/18 19:56:24 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\netapi32.dll
[2012/08/18 19:56:24 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\browcli.dll
[2012/08/18 19:56:24 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\browcli.dll
[2012/08/18 19:56:22 | 000,956,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\localspl.dll

========== Files - Modified Within 30 Days ==========

[2012/09/13 19:11:07 | 000,600,064 | —- | M] (OldTimer Tools) – C:\Users\XB70\Desktop\OTL.exe
[2012/09/13 18:57:50 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\XB70\Desktop\HiJackThis.exe
[2012/09/13 18:40:00 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2852863078-2948354453-2965589755-1001UA.job
[2012/09/13 18:10:02 | 000,000,924 | —- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2852863078-2948354453-2965589755-1001UA.job
[2012/09/13 17:09:50 | 000,020,320 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/13 17:09:50 | 000,020,320 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/13 17:09:37 | 000,729,944 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/09/13 17:09:37 | 000,626,290 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/09/13 17:09:37 | 000,107,566 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/09/13 17:02:33 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/09/13 17:02:32 | 3220,615,168 | -HS- | M] () – C:\hiberfil.sys
[2012/09/13 09:38:22 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\lvuvc.hs
[2012/09/13 03:00:53 | 000,002,515 | —- | M] () – C:\Users\Public\Desktop\Skype.lnk
[2012/09/13 00:40:00 | 000,000,852 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2852863078-2948354453-2965589755-1001Core.job
[2012/09/12 21:10:00 | 000,000,902 | —- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2852863078-2948354453-2965589755-1001Core.job
[2012/09/07 14:41:56 | 000,001,105 | —- | M] () – C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/07 14:41:10 | 000,033,958 | —- | M] () – C:\ProgramData\uninstaller.exe
[2012/09/07 14:40:46 | 000,031,465 | —- | M] () – C:\Users\XB70\AppData\Local\funmoods.crx
[2012/09/03 23:28:32 | 000,095,208 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012/09/03 23:28:30 | 000,246,760 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/09/03 23:28:30 | 000,174,056 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/09/03 23:28:30 | 000,174,056 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/09/03 23:28:29 | 000,821,736 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\npDeployJava1.dll
[2012/09/03 23:28:29 | 000,746,984 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2012/09/03 17:47:21 | 000,002,129 | —- | M] () – C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012/09/03 17:47:21 | 000,002,129 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/08/31 17:48:16 | 000,696,520 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/08/31 17:48:16 | 000,073,416 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/08/22 14:12:40 | 000,376,688 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\drivers\netio.sys
[2012/08/22 14:12:33 | 000,288,624 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2012/08/19 03:20:10 | 000,294,944 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2012/09/08 21:05:48 | 000,000,924 | —- | C] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2852863078-2948354453-2965589755-1001UA.job
[2012/09/08 21:05:46 | 000,000,902 | —- | C] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2852863078-2948354453-2965589755-1001Core.job
[2012/09/07 14:41:56 | 000,001,105 | —- | C] () – C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/07 14:41:10 | 000,033,958 | —- | C] () – C:\ProgramData\uninstaller.exe
[2012/09/07 14:40:47 | 000,031,465 | —- | C] () – C:\Users\XB70\AppData\Local\funmoods.crx
[2012/08/07 14:49:20 | 004,608,000 | —- | C] () – C:\ProgramData\ReadOnlyInstaller.msi
[2012/07/31 22:54:05 | 000,281,808 | —- | C] () – C:\Windows\SysWow64\PnkBstrB.exe
[2012/07/31 22:54:03 | 000,840,264 | —- | C] () – C:\Windows\SysWow64\pbsvc.exe
[2012/07/31 22:54:03 | 000,076,888 | —- | C] () – C:\Windows\SysWow64\PnkBstrA.exe
[2012/06/10 23:42:01 | 000,006,097 | —- | C] () – C:\Windows\SysWow64\vidmode.ini
[2012/01/09 01:13:21 | 000,024,576 | —- | C] () – C:\Windows\SysWow64\AsIO.dll
[2012/01/09 01:13:21 | 000,013,368 | —- | C] () – C:\Windows\SysWow64\drivers\AsIO.sys
[2012/01/09 01:13:13 | 000,011,832 | —- | C] () – C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2012/01/09 01:13:13 | 000,010,216 | —- | C] () – C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2012/01/09 01:12:06 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2011/12/13 06:43:36 | 000,007,671 | —- | C] () – C:\Users\XB70\AppData\Local\Resmon.ResmonCfg
[2011/12/13 03:29:50 | 000,743,538 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/09/28 18:44:14 | 000,179,271 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2011/08/19 10:26:20 | 010,898,456 | —- | C] () – C:\Windows\SysWow64\LogiDPP.dll
[2011/08/19 10:26:20 | 000,336,408 | —- | C] () – C:\Windows\SysWow64\DevManagerCore.dll
[2011/08/19 10:26:20 | 000,104,472 | —- | C] () – C:\Windows\SysWow64\LogiDPPApp.exe

========== LOP Check ==========

[2012/02/13 17:06:48 | 000,000,000 | —D | M] – C:\Users\XB70\AppData\Roaming\OpenOffice.org
[2012/07/12 01:02:46 | 000,000,000 | —D | M] – C:\Users\XB70\AppData\Roaming\Participatory Culture Foundation
[2012/09/12 21:10:00 | 000,000,902 | —- | M] () – C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2852863078-2948354453-2965589755-1001Core.job
[2012/09/13 18:10:02 | 000,000,924 | —- | M] () – C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2852863078-2948354453-2965589755-1001UA.job
[2012/04/14 10:01:38 | 000,032,588 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2011/04/12 03:33:59 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\PolicyDefinitions\en-US\Explorer.adml
[2011/04/12 03:33:59 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef5713984067904\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2009/06/10 16:53:55 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\PolicyDefinitions\Explorer.admx
[2009/06/10 16:53:55 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\winsxs\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_71af9b5b0a86e6b7\Explorer.admx

< MD5 for: EXPLORER.EXE >
[2011/02/26 01:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 02:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 23:24:46 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 23:24:35 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2011/04/12 03:33:47 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\en-US\explorer.exe.mui
[2011/04/12 03:33:47 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui
[2011/04/12 03:33:49 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2011/04/12 03:33:49 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui

< MD5 for: IEXPLORE.EXE >
[2012/06/02 07:47:54 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=004640AB259C1572EBD5FB0A32F63686 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_0dbfc836999db0ca\iexplore.exe
[2012/05/17 19:21:54 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=0129BB16161C2FD9A6B19111AB047198 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_1798a687b4d6030f\iexplore.exe
[2012/06/29 01:02:52 | 000,754,784 | —- | M] (Microsoft Corporation) MD5=1223ACBFC1093852DFF039E189599BBD – C:\Program Files\Internet Explorer\iexplore.exe
[2012/06/29 01:02:52 | 000,754,784 | —- | M] (Microsoft Corporation) MD5=1223ACBFC1093852DFF039E189599BBD – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_0d45fcc9807373c2\iexplore.exe
[2012/05/17 18:59:46 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=268982F1FD671A077C6A2AF41E351436 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_181271f4ce004017\iexplore.exe
[2012/06/02 05:08:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=34B01BBD8F00B6B9C9248DC4F1E3CD01 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_1799a6d1b4d51c66\iexplore.exe
[2012/05/17 22:51:05 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=4E99F42504A99D5024C2EFA015001937 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_0d43fc3580754114\iexplore.exe
[2012/06/28 22:45:31 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=5D03518409F37D1483C98869D86E23FF – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_0dc0c880999cca21\iexplore.exe
[2012/06/02 08:52:21 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=610F6596921C4BAA8834ADBB9BE272EE – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_0d44fc7f80745a6b\iexplore.exe
[2010/11/20 23:25:07 | 000,695,056 | —- | M] (Microsoft Corporation) MD5=86257731DDB311FBC283534CC0091634 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2011/12/16 15:04:32 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_17a944edb4ca4c7a\iexplore.exe
[2012/06/28 21:00:47 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=93569D46D79F9756ED077156496AFE23 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2012/06/28 21:00:47 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=93569D46D79F9756ED077156496AFE23 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_179aa71bb4d435bd\iexplore.exe
[2012/06/02 04:51:58 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=BE967C74B89577B78FB57C061E12B04C – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_18147288cdfe72c5\iexplore.exe
[2010/11/20 23:25:27 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C613E69C3B191BB02C7A191741A1D024 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\iexplore.exe
[2012/06/28 19:35:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=EB4105348272018D096FEB655CD1608C – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_181572d2cdfd8c1c\iexplore.exe
[2011/12/16 15:04:32 | 000,754,480 | —- | M] (Microsoft Corporation) MD5=F1424C1B9B1813BF825E45DF3790BC8A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_0d549a9b80698a7f\iexplore.exe
[2012/05/17 21:37:57 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=F8B2D47ED17C1D087D14EC747E5AC57A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_0dbdc7a2999f7e1c\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2011/12/16 15:04:32 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2011/12/16 15:04:32 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_07013012b816cb66\iexplore.exe.mui
[2011/12/16 15:04:32 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2011/12/16 15:04:32 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_1155da64ec778d61\iexplore.exe.mui
[2011/04/12 03:34:00 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_0b433e7773148b79\iexplore.exe.mui
[2011/04/12 03:34:00 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_1597e8c9a7754d74\iexplore.exe.mui

< MD5 for: SERVICES >
[2009/06/10 17:00:26 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6079f415110c0210\services

< MD5 for: SERVICES.CFG >
[2012/07/27 16:51:34 | 000,586,083 | —- | M] () MD5=6DE4EA437EC1FE6DB27CADB0A7EA8DC2 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Services\Services.cfg
[2011/06/06 13:55:30 | 000,584,045 | R— | M] () MD5=B82DD53FA8C260DDD7FDC42182DB816E – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\services.cfg

< MD5 for: SERVICES.EXE >
[2009/07/13 21:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\SysNative\services.exe
[2009/07/13 21:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2011/04/12 03:33:46 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 – C:\Windows\SysNative\en-US\services.exe.mui
[2011/04/12 03:33:46 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 – C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c5f238be3fa63468\services.exe.mui

< MD5 for: SERVICES.JSM >
[2012/04/12 13:24:36 | 000,006,317 | —- | M] () MD5=C698274FE1590498B56DEDB947AEFF16 – C:\Program Files (x86)\Participatory Culture Foundation\Miro\xulrunner\modules\Services.jsm

< MD5 for: SERVICES.LNK >
[2009/07/14 00:59:14 | 000,001,288 | —- | M] () MD5=C42118077122E0E466B73023B261C4BE – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/14 00:59:14 | 000,001,288 | —- | M] () MD5=C42118077122E0E466B73023B261C4BE – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOF >
[2009/06/10 16:44:06 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\SysNative\wbem\services.mof
[2009/06/10 16:44:06 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.mof

< MD5 for: SERVICES.MSC >
[2011/04/12 03:33:44 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\en-US\services.msc
[2009/06/10 16:38:36 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\services.msc
[2011/04/12 03:33:46 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\en-US\services.msc
[2009/06/10 17:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\services.msc
[2011/04/12 03:33:44 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_003408aa160fce5b\services.msc
[2009/06/10 16:38:36 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_2b58d44b5f6beb8a\services.msc
[2011/04/12 03:33:46 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc
[2009/06/10 17:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc

< MD5 for: SERVICES.PTXML >
[2009/07/13 16:16:17 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\SysNative\wdi\perftrack\Services.ptxml
[2009/07/13 16:16:17 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\Services.ptxml

< MD5 for: SERVICES.RDB >
[2011/01/17 19:52:22 | 000,237,568 | —- | M] () MD5=507957679AE4579C15D57FA741EA6FFA – C:\Program Files (x86)\OpenOffice.org 3\URE\misc\services.rdb
[2011/01/17 19:51:48 | 005,539,328 | —- | M] () MD5=F2B666905F7FDAA80C86A101A7DE62F9 – C:\Program Files (x86)\OpenOffice.org 3\Basis\program\services.rdb

< MD5 for: WINLOGON.ADML >
[2011/04/12 03:34:00 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\PolicyDefinitions\en-US\WinLogon.adml
[2011/04/12 03:34:00 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f0f9032ef6930070\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2009/06/10 17:04:41 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\PolicyDefinitions\WinLogon.admx
[2009/06/10 17:04:41 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_d7024e6992f3424d\WinLogon.admx

< MD5 for: WINLOGON.EXE >
[2010/11/20 23:24:50 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/20 23:24:50 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2011/04/12 03:33:44 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2011/04/12 03:33:44 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7601.17514_en-us_291e96fa1ab5fc7b\winlogon.exe.mui

< MD5 for: WINLOGON.MFL >
[2011/04/12 03:33:45 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\SysNative\wbem\en-US\winlogon.mfl
[2011/04/12 03:33:45 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_84afd4fd38ffd276\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2009/07/13 16:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\SysNative\wbem\winlogon.mof
[2009/07/13 16:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_dc2dbb778f98e40f\winlogon.mof

< %SYSTEMDRIVE%\*.* >
[2012/09/13 17:02:32 | 3220,615,168 | -HS- | M] () – C:\hiberfil.sys
[2012/09/13 17:02:36 | 4294,156,288 | -HS- | M] () – C:\pagefile.sys
[2012/09/07 17:10:46 | 000,125,362 | —- | M] () – C:\TDSSKiller.2.8.8.0_07.09.2012_17.10.20_log.txt
[2012/09/13 16:52:57 | 000,125,684 | —- | M] () – C:\TDSSKiller.2.8.8.0_13.09.2012_16.52.31_log.txt

< %systemroot%\Fonts\*.com >
[2009/07/14 01:38:09 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 01:38:09 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 01:38:09 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 01:38:09 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >
[2010/11/15 16:27:58 | 000,225,103 | —- | M] () – C:\Windows\system32\loginbkg.jpg

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:59:33 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/12/16 15:05:23 | 000,000,221 | -HS- | M] () – C:\Users\XB70\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/09/13 18:57:50 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\XB70\Desktop\HiJackThis.exe
[2012/04/13 22:29:22 | 504,843,514 | —- | M] ( ) – C:\Users\XB70\Desktop\Just Cause Setup.exe
[2012/09/13 19:11:07 | 000,600,064 | —- | M] (OldTimer Tools) – C:\Users\XB70\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

jeffce

Post #2September 14, 2012, 2:26 PM UTC

Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

The fixes are specific to your problem and should only be used for the issues on this machine.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Having said that….Let's get going!!

———-

Please download aswMBR to your desktop.

Double click the aswMBR icon to run it.
Click the Scan button to start scan.
If you are asked to update the Avast Virus database please allow it to do so.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan but do nothing else as we are just looking for what is there.
If Malicious objects are found, select Skip by changing the Cure dropdown in the upper right.
Attach the log in your next reply
A copy of the log will be saved automatically to the root of the drive (typically C:\)

———-

Melax

Post #3September 14, 2012, 3:45 PM UTC

hi Jeff, Thank you for your attention and fast response ! Please find below the 2 scans you've requested: aswMBR log: ****************************************** aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-09-14 11:05:55 —————————– 11:05:55.928 OS Version: Windows x64 6.1.7601 Service Pack 1 11:05:55.928 Number of processors: 4 586 0x403 11:05:55.928 ComputerName: ASUS-DT UserName: XB70 11:06:00.046 Initialize success 11:08:24.382 AVAST engine defs: 12091400 11:09:02.362 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005c 11:09:02.365 Disk 0 Vendor: Hitachi_ ML5O Size: 1430799MB BusType: 3 11:09:02.374 Disk 0 MBR read successfully 11:09:02.378 Disk 0 MBR scan 11:09:02.445 Disk 0 Windows 7 default MBR code 11:09:02.446 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048 11:09:02.475 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 1430697 MB offset 206848 11:09:02.516 Disk 0 scanning C:\Windows\system32\drivers 11:09:12.126 Service scanning 11:09:38.065 Modules scanning 11:09:38.078 Disk 0 trace - called modules: 11:09:38.098 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor.sys 11:09:38.105 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d1f060] 11:09:38.114 3 CLASSPNP.SYS[fffff880018fc43f] -> nt!IofCallDriver -> [0xfffffa8003dbe490] 11:09:38.122 5 ACPI.sys[fffff88000e957a1] -> nt!IofCallDriver -> \Device\0000005c[0xfffffa8003e19060] 11:09:41.555 AVAST engine scan C:\Windows 11:09:47.681 AVAST engine scan C:\Windows\system32 11:13:17.995 AVAST engine scan C:\Windows\system32\drivers 11:13:43.496 AVAST engine scan C:\Users\XB70 11:27:32.237 AVAST engine scan C:\ProgramData 11:27:49.910 Scan finished successfully 11:32:01.587 Disk 0 MBR has been saved successfully to "C:\Users\XB70\Desktop\MBR.dat" 11:32:01.597 The log file has been saved successfully to "C:\Users\XB70\Desktop\aswMBR.txt" ******************************** TDSS log: 11:34:34.0267 0696 TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48 11:34:34.0545 0696 ============================================================ 11:34:34.0545 0696 Current date / time: 2012/09/14 11:34:34.0545 11:34:34.0545 0696 SystemInfo: 11:34:34.0545 0696 11:34:34.0546 0696 OS Version: 6.1.7601 ServicePack: 1.0 11:34:34.0546 0696 Product type: Workstation 11:34:34.0546 0696 ComputerName: ASUS-DT 11:34:34.0546 0696 UserName: XB70 11:34:34.0546 0696 Windows directory: C:\Windows 11:34:34.0546 0696 System windows directory: C:\Windows 11:34:34.0546 0696 Running under WOW64 11:34:34.0546 0696 Processor architecture: Intel x64 11:34:34.0546 0696 Number of processors: 4 11:34:34.0546 0696 Page size: 0x1000 11:34:34.0546 0696 Boot type: Normal boot 11:34:34.0546 0696 ============================================================ 11:34:35.0688 0696 Drive \Device\Harddisk0\DR0 - Size: 0x15D50F66000 (1397.27 Gb), SectorSize: 0x200, Cylinders: 0xA8178, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000040 11:34:35.0691 0696 ============================================================ 11:34:35.0691 0696 \Device\Harddisk0\DR0: 11:34:35.0691 0696 MBR partitions: 11:34:35.0691 0696 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 11:34:35.0691 0696 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xAEA54800 11:34:35.0691 0696 ============================================================ 11:34:35.0733 0696 C: <-> \Device\Harddisk0\DR0\Partition2 11:34:35.0733 0696 ============================================================ 11:34:35.0733 0696 Initialize success 11:34:35.0733 0696 ============================================================ 11:34:46.0288 3504 ============================================================ 11:34:46.0288 3504 Scan started 11:34:46.0288 3504 Mode: Manual; 11:34:46.0288 3504 ============================================================ 11:34:46.0835 3504 ================ Scan system memory ======================== 11:34:46.0836 3504 System memory - ok 11:34:46.0836 3504 ================ Scan services ============================= 11:34:46.0954 3504 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys 11:34:46.0960 3504 1394ohci - ok 11:34:47.0027 3504 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys 11:34:47.0057 3504 ACPI - ok 11:34:47.0078 3504 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys 11:34:47.0079 3504 AcpiPmi - ok 11:34:47.0145 3504 [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 11:34:47.0148 3504 AdobeARMservice - ok 11:34:47.0181 3504 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys 11:34:47.0193 3504 adp94xx - ok 11:34:47.0216 3504 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\drivers\adpahci.sys 11:34:47.0224 3504 adpahci - ok 11:34:47.0256 3504 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\drivers\adpu320.sys 11:34:47.0261 3504 adpu320 - ok 11:34:47.0286 3504 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll 11:34:47.0289 3504 AeLookupSvc - ok 11:34:47.0329 3504 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys 11:34:47.0341 3504 AFD - ok 11:34:47.0376 3504 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys 11:34:47.0378 3504 agp440 - ok 11:34:47.0397 3504 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe 11:34:47.0400 3504 ALG - ok 11:34:47.0415 3504 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys 11:34:47.0416 3504 aliide - ok 11:34:47.0436 3504 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys 11:34:47.0436 3504 amdide - ok 11:34:47.0440 3504 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys 11:34:47.0441 3504 AmdK8 - ok 11:34:47.0455 3504 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys 11:34:47.0456 3504 AmdPPM - ok 11:34:47.0474 3504 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys 11:34:47.0476 3504 amdsata - ok 11:34:47.0489 3504 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\drivers\amdsbs.sys 11:34:47.0492 3504 amdsbs - ok 11:34:47.0504 3504 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys 11:34:47.0505 3504 amdxata - ok 11:34:47.0520 3504 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys 11:34:47.0521 3504 AppID - ok 11:34:47.0540 3504 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll 11:34:47.0541 3504 AppIDSvc - ok 11:34:47.0547 3504 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll 11:34:47.0548 3504 Appinfo - ok 11:34:47.0568 3504 [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt C:\Windows\System32\appmgmts.dll 11:34:47.0570 3504 AppMgmt - ok 11:34:47.0597 3504 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\drivers\arc.sys 11:34:47.0599 3504 arc - ok 11:34:47.0603 3504 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\drivers\arcsas.sys 11:34:47.0605 3504 arcsas - ok 11:34:47.0686 3504 [ 68726474C69B738EAC3A62E06B33ADDC ] AsIO C:\Windows\syswow64\drivers\AsIO.sys 11:34:47.0687 3504 AsIO - ok 11:34:47.0709 3504 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys 11:34:47.0710 3504 AsyncMac - ok 11:34:47.0729 3504 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys 11:34:47.0730 3504 atapi - ok 11:34:47.0775 3504 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll 11:34:47.0791 3504 AudioEndpointBuilder - ok 11:34:47.0812 3504 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll 11:34:47.0820 3504 AudioSrv - ok 11:34:47.0855 3504 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll 11:34:47.0859 3504 AxInstSV - ok 11:34:47.0903 3504 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys 11:34:47.0914 3504 b06bdrv - ok 11:34:47.0942 3504 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys 11:34:47.0949 3504 b57nd60a - ok 11:34:47.0983 3504 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll 11:34:47.0986 3504 BDESVC - ok 11:34:47.0996 3504 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys 11:34:47.0997 3504 Beep - ok 11:34:48.0039 3504 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll 11:34:48.0055 3504 BFE - ok 11:34:48.0085 3504 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll 11:34:48.0097 3504 BITS - ok 11:34:48.0110 3504 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys 11:34:48.0111 3504 blbdrive - ok 11:34:48.0142 3504 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys 11:34:48.0144 3504 bowser - ok 11:34:48.0164 3504 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys 11:34:48.0166 3504 BrFiltLo - ok 11:34:48.0183 3504 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys 11:34:48.0184 3504 BrFiltUp - ok 11:34:48.0216 3504 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll 11:34:48.0220 3504 Browser - ok 11:34:48.0246 3504 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys 11:34:48.0253 3504 Brserid - ok 11:34:48.0271 3504 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys 11:34:48.0273 3504 BrSerWdm - ok 11:34:48.0306 3504 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys 11:34:48.0308 3504 BrUsbMdm - ok 11:34:48.0323 3504 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys 11:34:48.0324 3504 BrUsbSer - ok 11:34:48.0347 3504 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys 11:34:48.0350 3504 BTHMODEM - ok 11:34:48.0390 3504 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll 11:34:48.0393 3504 bthserv - ok 11:34:48.0412 3504 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys 11:34:48.0415 3504 cdfs - ok 11:34:48.0442 3504 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys 11:34:48.0446 3504 cdrom - ok 11:34:48.0466 3504 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll 11:34:48.0469 3504 CertPropSvc - ok 11:34:48.0487 3504 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\drivers\circlass.sys 11:34:48.0488 3504 circlass - ok 11:34:48.0503 3504 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys 11:34:48.0508 3504 CLFS - ok 11:34:48.0559 3504 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 11:34:48.0561 3504 clr_optimization_v2.0.50727_32 - ok 11:34:48.0598 3504 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 11:34:48.0603 3504 clr_optimization_v2.0.50727_64 - ok 11:34:48.0652 3504 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 11:34:48.0655 3504 clr_optimization_v4.0.30319_32 - ok 11:34:48.0677 3504 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 11:34:48.0681 3504 clr_optimization_v4.0.30319_64 - ok 11:34:48.0702 3504 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\drivers\CmBatt.sys 11:34:48.0703 3504 CmBatt - ok 11:34:48.0722 3504 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys 11:34:48.0723 3504 cmdide - ok 11:34:48.0752 3504 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys 11:34:48.0763 3504 CNG - ok 11:34:48.0777 3504 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\drivers\compbatt.sys 11:34:48.0779 3504 Compbatt - ok 11:34:48.0796 3504 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys 11:34:48.0798 3504 CompositeBus - ok 11:34:48.0817 3504 COMSysApp - ok 11:34:48.0822 3504 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys 11:34:48.0823 3504 crcdisk - ok 11:34:48.0877 3504 [ 4F5414602E2544A4554D95517948B705 ] CryptSvc C:\Windows\system32\cryptsvc.dll 11:34:48.0882 3504 CryptSvc - ok 11:34:48.0919 3504 [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC C:\Windows\system32\drivers\csc.sys 11:34:48.0932 3504 CSC - ok 11:34:48.0964 3504 [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService C:\Windows\System32\cscsvc.dll 11:34:48.0980 3504 CscService - ok 11:34:49.0024 3504 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll 11:34:49.0039 3504 DcomLaunch - ok 11:34:49.0089 3504 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll 11:34:49.0097 3504 defragsvc - ok 11:34:49.0124 3504 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys 11:34:49.0128 3504 DfsC - ok 11:34:49.0150 3504 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll 11:34:49.0158 3504 Dhcp - ok 11:34:49.0168 3504 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys 11:34:49.0170 3504 discache - ok 11:34:49.0209 3504 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\drivers\disk.sys 11:34:49.0212 3504 Disk - ok 11:34:49.0234 3504 [ 5DB085A8A6600BE6401F2B24EECB5415 ] dmvsc C:\Windows\system32\drivers\dmvsc.sys 11:34:49.0237 3504 dmvsc - ok 11:34:49.0261 3504 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll 11:34:49.0267 3504 Dnscache - ok 11:34:49.0301 3504 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll 11:34:49.0308 3504 dot3svc - ok 11:34:49.0327 3504 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll 11:34:49.0332 3504 DPS - ok 11:34:49.0363 3504 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys 11:34:49.0364 3504 drmkaud - ok 11:34:49.0401 3504 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys 11:34:49.0423 3504 DXGKrnl - ok 11:34:49.0451 3504 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll 11:34:49.0456 3504 EapHost - ok 11:34:49.0533 3504 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\drivers\evbda.sys 11:34:49.0575 3504 ebdrv - ok 11:34:49.0598 3504 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe 11:34:49.0599 3504 EFS - ok 11:34:49.0657 3504 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe 11:34:49.0673 3504 ehRecvr - ok 11:34:49.0691 3504 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe 11:34:49.0693 3504 ehSched - ok 11:34:49.0739 3504 [ A05FC7ECA0966EBB70E4D17B855A853B ] ElbyCDIO C:\Windows\system32\Drivers\ElbyCDIO.sys 11:34:49.0740 3504 ElbyCDIO - ok 11:34:49.0781 3504 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\drivers\elxstor.sys 11:34:49.0793 3504 elxstor - ok 11:34:49.0801 3504 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys 11:34:49.0803 3504 ErrDev - ok 11:34:49.0854 3504 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll 11:34:49.0863 3504 EventSystem - ok 11:34:49.0881 3504 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys 11:34:49.0886 3504 exfat - ok 11:34:49.0904 3504 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys 11:34:49.0909 3504 fastfat - ok 11:34:49.0943 3504 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe 11:34:49.0960 3504 Fax - ok 11:34:49.0989 3504 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\drivers\fdc.sys 11:34:49.0991 3504 fdc - ok 11:34:50.0010 3504 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll 11:34:50.0013 3504 fdPHost - ok 11:34:50.0027 3504 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll 11:34:50.0030 3504 FDResPub - ok 11:34:50.0047 3504 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys 11:34:50.0049 3504 FileInfo - ok 11:34:50.0065 3504 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys 11:34:50.0067 3504 Filetrace - ok 11:34:50.0086 3504 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\drivers\flpydisk.sys 11:34:50.0087 3504 flpydisk - ok 11:34:50.0121 3504 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys 11:34:50.0129 3504 FltMgr - ok 11:34:50.0180 3504 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll 11:34:50.0207 3504 FontCache - ok 11:34:50.0234 3504 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 11:34:50.0235 3504 FontCache3.0.0.0 - ok 11:34:50.0243 3504 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys 11:34:50.0244 3504 FsDepends - ok 11:34:50.0274 3504 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys 11:34:50.0275 3504 Fs_Rec - ok 11:34:50.0306 3504 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys 11:34:50.0312 3504 fvevol - ok 11:34:50.0341 3504 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys 11:34:50.0344 3504 gagp30kx - ok 11:34:50.0376 3504 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll 11:34:50.0394 3504 gpsvc - ok 11:34:50.0405 3504 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys 11:34:50.0406 3504 hcw85cir - ok 11:34:50.0435 3504 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys 11:34:50.0440 3504 HdAudAddService - ok 11:34:50.0473 3504 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys 11:34:50.0477 3504 HDAudBus - ok 11:34:50.0485 3504 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\drivers\HidBatt.sys 11:34:50.0487 3504 HidBatt - ok 11:34:50.0502 3504 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\drivers\hidbth.sys 11:34:50.0512 3504 HidBth - ok 11:34:50.0521 3504 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\drivers\hidir.sys 11:34:50.0523 3504 HidIr - ok 11:34:50.0546 3504 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll 11:34:50.0549 3504 hidserv - ok 11:34:50.0565 3504 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys 11:34:50.0567 3504 HidUsb - ok 11:34:50.0590 3504 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll 11:34:50.0594 3504 hkmsvc - ok 11:34:50.0610 3504 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll 11:34:50.0617 3504 HomeGroupListener - ok 11:34:50.0635 3504 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll 11:34:50.0641 3504 HomeGroupProvider - ok 11:34:50.0657 3504 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys 11:34:50.0658 3504 HpSAMD - ok 11:34:50.0691 3504 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys 11:34:50.0706 3504 HTTP - ok 11:34:50.0715 3504 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys 11:34:50.0717 3504 hwpolicy - ok 11:34:50.0742 3504 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys 11:34:50.0744 3504 i8042prt - ok 11:34:50.0760 3504 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys 11:34:50.0766 3504 iaStorV - ok 11:34:50.0805 3504 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 11:34:50.0817 3504 idsvc - ok 11:34:50.0843 3504 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\drivers\iirsp.sys 11:34:50.0844 3504 iirsp - ok 11:34:50.0875 3504 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll 11:34:50.0886 3504 IKEEXT - ok 11:34:50.0892 3504 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys 11:34:50.0892 3504 intelide - ok 11:34:50.0908 3504 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\drivers\intelppm.sys 11:34:50.0909 3504 intelppm - ok 11:34:50.0915 3504 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll 11:34:50.0917 3504 IPBusEnum - ok 11:34:50.0924 3504 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys 11:34:50.0925 3504 IpFilterDriver - ok 11:34:50.0942 3504 [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll 11:34:50.0950 3504 iphlpsvc - ok 11:34:50.0959 3504 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys 11:34:50.0960 3504 IPMIDRV - ok 11:34:50.0973 3504 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys 11:34:50.0975 3504 IPNAT - ok 11:34:50.0996 3504 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys 11:34:50.0997 3504 IRENUM - ok 11:34:51.0009 3504 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys 11:34:51.0010 3504 isapnp - ok 11:34:51.0030 3504 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys 11:34:51.0037 3504 iScsiPrt - ok 11:34:51.0063 3504 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys 11:34:51.0065 3504 kbdclass - ok 11:34:51.0088 3504 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys 11:34:51.0090 3504 kbdhid - ok 11:34:51.0103 3504 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe 11:34:51.0106 3504 KeyIso - ok 11:34:51.0132 3504 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys 11:34:51.0134 3504 KSecDD - ok 11:34:51.0150 3504 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys 11:34:51.0154 3504 KSecPkg - ok 11:34:51.0178 3504 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys 11:34:51.0180 3504 ksthunk - ok 11:34:51.0207 3504 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll 11:34:51.0218 3504 KtmRm - ok 11:34:51.0250 3504 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll 11:34:51.0259 3504 LanmanServer - ok 11:34:51.0288 3504 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll 11:34:51.0296 3504 LanmanWorkstation - ok 11:34:51.0335 3504 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys 11:34:51.0337 3504 lltdio - ok 11:34:51.0371 3504 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll 11:34:51.0381 3504 lltdsvc - ok 11:34:51.0402 3504 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll 11:34:51.0405 3504 lmhosts - ok 11:34:51.0428 3504 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys 11:34:51.0431 3504 LSI_FC - ok 11:34:51.0446 3504 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys 11:34:51.0449 3504 LSI_SAS - ok 11:34:51.0461 3504 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys 11:34:51.0464 3504 LSI_SAS2 - ok 11:34:51.0477 3504 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys 11:34:51.0479 3504 LSI_SCSI - ok 11:34:51.0496 3504 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys 11:34:51.0498 3504 luafv - ok 11:34:51.0531 3504 [ EF2BE2F45D4F06410A3BD2A3467325B0 ] LVRS64 C:\Windows\system32\DRIVERS\lvrs64.sys 11:34:51.0535 3504 LVRS64 - ok 11:34:51.0666 3504 [ AC22F92C6078640FE8A70D662A2F3AD5 ] LVUVC64 C:\Windows\system32\DRIVERS\lvuvc64.sys 11:34:51.0728 3504 LVUVC64 - ok 11:34:51.0811 3504 [ 22A7776C5D8EB5930EDF9C8DD0884259 ] McComponentHostService C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe 11:34:51.0817 3504 McComponentHostService - ok 11:34:51.0853 3504 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll 11:34:51.0858 3504 Mcx2Svc - ok 11:34:51.0889 3504 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\drivers\megasas.sys 11:34:51.0891 3504 megasas - ok 11:34:51.0904 3504 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys 11:34:51.0911 3504 MegaSR - ok 11:34:51.0945 3504 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll 11:34:51.0949 3504 MMCSS - ok 11:34:51.0957 3504 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys 11:34:51.0959 3504 Modem - ok 11:34:51.0991 3504 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys 11:34:51.0993 3504 monitor - ok 11:34:52.0012 3504 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys 11:34:52.0014 3504 mouclass - ok 11:34:52.0047 3504 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\drivers\mouhid.sys 11:34:52.0049 3504 mouhid - ok 11:34:52.0066 3504 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys 11:34:52.0088 3504 mountmgr - ok 11:34:52.0170 3504 [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 11:34:52.0173 3504 MozillaMaintenance - ok 11:34:52.0210 3504 [ 94C66EDEDCDB6A126880472F9A704D8E ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys 11:34:52.0215 3504 MpFilter - ok 11:34:52.0229 3504 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys 11:34:52.0234 3504 mpio - ok 11:34:52.0252 3504 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys 11:34:52.0256 3504 mpsdrv - ok 11:34:52.0297 3504 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll 11:34:52.0318 3504 MpsSvc - ok 11:34:52.0326 3504 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys 11:34:52.0328 3504 MRxDAV - ok 11:34:52.0354 3504 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys 11:34:52.0356 3504 mrxsmb - ok 11:34:52.0364 3504 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys 11:34:52.0368 3504 mrxsmb10 - ok 11:34:52.0396 3504 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys 11:34:52.0398 3504 mrxsmb20 - ok 11:34:52.0423 3504 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys 11:34:52.0425 3504 msahci - ok 11:34:52.0436 3504 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys 11:34:52.0440 3504 msdsm - ok 11:34:52.0454 3504 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe 11:34:52.0460 3504 MSDTC - ok 11:34:52.0490 3504 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys 11:34:52.0492 3504 Msfs - ok 11:34:52.0512 3504 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys 11:34:52.0514 3504 mshidkmdf - ok 11:34:52.0525 3504 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys 11:34:52.0527 3504 msisadrv - ok 11:34:52.0561 3504 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll 11:34:52.0567 3504 MSiSCSI - ok 11:34:52.0575 3504 msiserver - ok 11:34:52.0607 3504 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys 11:34:52.0608 3504 MSKSSRV - ok 11:34:52.0666 3504 [ 59FAAF2C83C8169EA20F9E335E418907 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe 11:34:52.0667 3504 MsMpSvc - ok 11:34:52.0686 3504 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys 11:34:52.0687 3504 MSPCLOCK - ok 11:34:52.0704 3504 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys 11:34:52.0705 3504 MSPQM - ok 11:34:52.0729 3504 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys 11:34:52.0738 3504 MsRPC - ok 11:34:52.0764 3504 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys 11:34:52.0766 3504 mssmbios - ok 11:34:52.0786 3504 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys 11:34:52.0787 3504 MSTEE - ok 11:34:52.0801 3504 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\drivers\MTConfig.sys 11:34:52.0804 3504 MTConfig - ok 11:34:52.0848 3504 [ 2219A3D695405E7BA2186BA6B9EDE14A ] MTsensor C:\Windows\system32\DRIVERS\ASACPI.sys 11:34:52.0849 3504 MTsensor - ok 11:34:52.0864 3504 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys 11:34:52.0866 3504 Mup - ok 11:34:52.0897 3504 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll 11:34:52.0911 3504 napagent - ok 11:34:52.0955 3504 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys 11:34:52.0963 3504 NativeWifiP - ok 11:34:53.0027 3504 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys 11:34:53.0049 3504 NDIS - ok 11:34:53.0080 3504 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys 11:34:53.0082 3504 NdisCap - ok 11:34:53.0097 3504 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys 11:34:53.0099 3504 NdisTapi - ok 11:34:53.0107 3504 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys 11:34:53.0109 3504 Ndisuio - ok 11:34:53.0130 3504 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys 11:34:53.0132 3504 NdisWan - ok 11:34:53.0138 3504 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys 11:34:53.0139 3504 NDProxy - ok 11:34:53.0153 3504 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys 11:34:53.0154 3504 NetBIOS - ok 11:34:53.0161 3504 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys 11:34:53.0165 3504 NetBT - ok 11:34:53.0173 3504 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe 11:34:53.0175 3504 Netlogon - ok 11:34:53.0210 3504 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll 11:34:53.0215 3504 Netman - ok 11:34:53.0228 3504 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll 11:34:53.0234 3504 netprofm - ok 11:34:53.0253 3504 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 11:34:53.0255 3504 NetTcpPortSharing - ok 11:34:53.0282 3504 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys 11:34:53.0283 3504 nfrd960 - ok 11:34:53.0317 3504 [ 91B4E0273D2F6C24EF845F2B41311289 ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys 11:34:53.0320 3504 NisDrv - ok 11:34:53.0359 3504 [ 10A43829A9E606AF3EEF25A1C1665923 ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe 11:34:53.0366 3504 NisSrv - ok 11:34:53.0407 3504 [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc C:\Windows\System32\nlasvc.dll 11:34:53.0416 3504 NlaSvc - ok 11:34:53.0428 3504 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys 11:34:53.0430 3504 Npfs - ok 11:34:53.0449 3504 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll 11:34:53.0453 3504 nsi - ok 11:34:53.0469 3504 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys 11:34:53.0471 3504 nsiproxy - ok 11:34:53.0544 3504 [ A2F74975097F52A00745F9637451FDD8 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys 11:34:53.0567 3504 Ntfs - ok 11:34:53.0578 3504 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys 11:34:53.0579 3504 Null - ok 11:34:53.0603 3504 [ A85B4F2EF3A7304A5399EF0526423040 ] NVENETFD C:\Windows\system32\DRIVERS\nvm62x64.sys 11:34:53.0609 3504 NVENETFD - ok 11:34:53.0829 3504 [ B34E9BFBD9C61048EF6281C3E7EC210A ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys 11:34:54.0015 3504 nvlddmkm - ok 11:34:54.0036 3504 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys 11:34:54.0038 3504 nvraid - ok 11:34:54.0058 3504 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys 11:34:54.0059 3504 nvstor - ok 11:34:54.0105 3504 [ DFDA089BB2CD0FF7E789E2EF6BA1E4BA ] nvsvc C:\Windows\system32\nvvsvc.exe 11:34:54.0123 3504 nvsvc - ok 11:34:54.0160 3504 [ E7818CD4FB51284C948D68A7A85A69B8 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe 11:34:54.0189 3504 nvUpdatusService - ok 11:34:54.0212 3504 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys 11:34:54.0214 3504 nv_agp - ok 11:34:54.0227 3504 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys 11:34:54.0228 3504 ohci1394 - ok 11:34:54.0253 3504 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll 11:34:54.0259 3504 p2pimsvc - ok 11:34:54.0277 3504 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll 11:34:54.0284 3504 p2psvc - ok 11:34:54.0296 3504 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys 11:34:54.0298 3504 Parport - ok 11:34:54.0321 3504 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys 11:34:54.0322 3504 partmgr - ok 11:34:54.0332 3504 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll 11:34:54.0335 3504 PcaSvc - ok 11:34:54.0353 3504 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys 11:34:54.0356 3504 pci - ok 11:34:54.0364 3504 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys 11:34:54.0365 3504 pciide - ok 11:34:54.0371 3504 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\drivers\pcmcia.sys 11:34:54.0374 3504 pcmcia - ok 11:34:54.0386 3504 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys 11:34:54.0387 3504 pcw - ok 11:34:54.0405 3504 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys 11:34:54.0414 3504 PEAUTH - ok 11:34:54.0459 3504 [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll 11:34:54.0483 3504 PeerDistSvc - ok 11:34:54.0535 3504 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe 11:34:54.0536 3504 PerfHost - ok 11:34:54.0592 3504 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll 11:34:54.0611 3504 pla - ok 11:34:54.0649 3504 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll 11:34:54.0655 3504 PlugPlay - ok 11:34:54.0687 3504 PnkBstrA - ok 11:34:54.0713 3504 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll 11:34:54.0717 3504 PNRPAutoReg - ok 11:34:54.0740 3504 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll 11:34:54.0748 3504 PNRPsvc - ok 11:34:54.0780 3504 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll 11:34:54.0794 3504 PolicyAgent - ok 11:34:54.0839 3504 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll 11:34:54.0847 3504 Power - ok 11:34:54.0876 3504 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys 11:34:54.0879 3504 PptpMiniport - ok 11:34:54.0901 3504 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\drivers\processr.sys 11:34:54.0904 3504 Processor - ok 11:34:54.0951 3504 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll 11:34:54.0959 3504 ProfSvc - ok 11:34:54.0972 3504 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe 11:34:54.0975 3504 ProtectedStorage - ok 11:34:54.0995 3504 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys 11:34:54.0999 3504 Psched - ok 11:34:55.0055 3504 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\drivers\ql2300.sys 11:34:55.0082 3504 ql2300 - ok 11:34:55.0099 3504 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\drivers\ql40xx.sys 11:34:55.0101 3504 ql40xx - ok 11:34:55.0119 3504 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll 11:34:55.0123 3504 QWAVE - ok 11:34:55.0132 3504 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys 11:34:55.0133 3504 QWAVEdrv - ok 11:34:55.0143 3504 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys 11:34:55.0144 3504 RasAcd - ok 11:34:55.0168 3504 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys 11:34:55.0170 3504 RasAgileVpn - ok 11:34:55.0187 3504 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll 11:34:55.0193 3504 RasAuto - ok 11:34:55.0209 3504 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys 11:34:55.0213 3504 Rasl2tp - ok 11:34:55.0235 3504 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll 11:34:55.0246 3504 RasMan - ok 11:34:55.0262 3504 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys 11:34:55.0264 3504 RasPppoe - ok 11:34:55.0284 3504 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys 11:34:55.0286 3504 RasSstp - ok 11:34:55.0307 3504 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys 11:34:55.0311 3504 rdbss - ok 11:34:55.0325 3504 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys 11:34:55.0326 3504 rdpbus - ok 11:34:55.0332 3504 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys 11:34:55.0333 3504 RDPCDD - ok 11:34:55.0354 3504 [ 1B6163C503398B23FF8B939C67747683 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys 11:34:55.0357 3504 RDPDR - ok 11:34:55.0376 3504 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys 11:34:55.0376 3504 RDPENCDD - ok 11:34:55.0387 3504 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys 11:34:55.0389 3504 RDPREFMP - ok 11:34:55.0421 3504 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys 11:34:55.0424 3504 RDPWD - ok 11:34:55.0443 3504 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys 11:34:55.0449 3504 rdyboost - ok 11:34:55.0479 3504 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll 11:34:55.0485 3504 RemoteAccess - ok 11:34:55.0519 3504 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll 11:34:55.0527 3504 RemoteRegistry - ok 11:34:55.0550 3504 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll 11:34:55.0556 3504 RpcEptMapper - ok 11:34:55.0584 3504 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe 11:34:55.0587 3504 RpcLocator - ok 11:34:55.0609 3504 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll 11:34:55.0619 3504 RpcSs - ok 11:34:55.0649 3504 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys 11:34:55.0652 3504 rspndr - ok 11:34:55.0682 3504 [ E60C0A09F997826C7627B244195AB581 ] s3cap C:\Windows\system32\drivers\vms3cap.sys 11:34:55.0683 3504 s3cap - ok 11:34:55.0717 3504 [ 45C0B193065219189772A038E6C29D49 ] SaiH0255 C:\Windows\system32\DRIVERS\SaiH0255.sys 11:34:55.0722 3504 SaiH0255 - ok 11:34:55.0739 3504 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe 11:34:55.0742 3504 SamSs - ok 11:34:55.0763 3504 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys 11:34:55.0766 3504 sbp2port - ok 11:34:55.0787 3504 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll 11:34:55.0795 3504 SCardSvr - ok 11:34:55.0813 3504 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys 11:34:55.0814 3504 scfilter - ok 11:34:55.0851 3504 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll 11:34:55.0870 3504 Schedule - ok 11:34:55.0889 3504 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll 11:34:55.0890 3504 SCPolicySvc - ok 11:34:55.0910 3504 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll 11:34:55.0913 3504 SDRSVC - ok 11:34:55.0942 3504 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys 11:34:55.0943 3504 secdrv - ok 11:34:55.0955 3504 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll 11:34:55.0957 3504 seclogon - ok 11:34:55.0966 3504 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll 11:34:55.0968 3504 SENS - ok 11:34:55.0983 3504 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll 11:34:55.0985 3504 SensrSvc - ok 11:34:56.0004 3504 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys 11:34:56.0005 3504 Serenum - ok 11:34:56.0019 3504 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys 11:34:56.0020 3504 Serial - ok 11:34:56.0031 3504 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\drivers\sermouse.sys 11:34:56.0032 3504 sermouse - ok 11:34:56.0054 3504 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll 11:34:56.0057 3504 SessionEnv - ok 11:34:56.0065 3504 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys 11:34:56.0065 3504 sffdisk - ok 11:34:56.0075 3504 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys 11:34:56.0076 3504 sffp_mmc - ok 11:34:56.0079 3504 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys 11:34:56.0080 3504 sffp_sd - ok 11:34:56.0083 3504 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys 11:34:56.0084 3504 sfloppy - ok 11:34:56.0102 3504 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll 11:34:56.0107 3504 SharedAccess - ok 11:34:56.0140 3504 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll 11:34:56.0146 3504 ShellHWDetection - ok 11:34:56.0161 3504 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys 11:34:56.0162 3504 SiSRaid2 - ok 11:34:56.0177 3504 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys 11:34:56.0178 3504 SiSRaid4 - ok 11:34:56.0240 3504 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe 11:34:56.0244 3504 SkypeUpdate - ok 11:34:56.0272 3504 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys 11:34:56.0275 3504 Smb - ok 11:34:56.0305 3504 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe 11:34:56.0308 3504 SNMPTRAP - ok 11:34:56.0322 3504 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys 11:34:56.0323 3504 spldr - ok 11:34:56.0345 3504 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe 11:34:56.0353 3504 Spooler - ok 11:34:56.0435 3504 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe 11:34:56.0482 3504 sppsvc - ok 11:34:56.0492 3504 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll 11:34:56.0494 3504 sppuinotify - ok 11:34:56.0521 3504 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys 11:34:56.0533 3504 srv - ok 11:34:56.0548 3504 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys 11:34:56.0554 3504 srv2 - ok 11:34:56.0566 3504 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys 11:34:56.0569 3504 srvnet - ok 11:34:56.0601 3504 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll 11:34:56.0605 3504 SSDPSRV - ok 11:34:56.0619 3504 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll 11:34:56.0622 3504 SstpSvc - ok 11:34:56.0657 3504 Steam Client Service - ok 11:34:56.0688 3504 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\drivers\stexstor.sys 11:34:56.0690 3504 stexstor - ok 11:34:56.0735 3504 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll 11:34:56.0752 3504 stisvc - ok 11:34:56.0780 3504 [ 7785DC213270D2FC066538DAF94087E7 ] storflt C:\Windows\system32\drivers\vmstorfl.sys 11:34:56.0781 3504 storflt - ok 11:34:56.0802 3504 [ C40841817EF57D491F22EB103DA587CC ] StorSvc C:\Windows\system32\storsvc.dll 11:34:56.0804 3504 StorSvc - ok 11:34:56.0846 3504 [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc C:\Windows\system32\drivers\storvsc.sys 11:34:56.0850 3504 storvsc - ok 11:34:56.0877 3504 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\DRIVERS\swenum.sys 11:34:56.0879 3504 swenum - ok 11:34:56.0927 3504 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll 11:34:56.0943 3504 swprv - ok 11:34:56.0998 3504 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll 11:34:57.0022 3504 SysMain - ok 11:34:57.0032 3504 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll 11:34:57.0035 3504 TabletInputService - ok 11:34:57.0046 3504 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll 11:34:57.0051 3504 TapiSrv - ok 11:34:57.0055 3504 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll 11:34:57.0058 3504 TBS - ok 11:34:57.0126 3504 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] Tcpip C:\Windows\system32\drivers\tcpip.sys 11:34:57.0170 3504 Tcpip - ok 11:34:57.0211 3504 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys 11:34:57.0222 3504 TCPIP6 - ok 11:34:57.0264 3504 [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys 11:34:57.0279 3504 tcpipreg - ok 11:34:57.0304 3504 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys 11:34:57.0315 3504 TDPIPE - ok 11:34:57.0359 3504 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys 11:34:57.0369 3504 TDTCP - ok 11:34:57.0411 3504 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys 11:34:57.0425 3504 tdx - ok 11:34:57.0450 3504 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys 11:34:57.0467 3504 TermDD - ok 11:34:57.0580 3504 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll 11:34:57.0608 3504 TermService - ok 11:34:57.0637 3504 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll 11:34:57.0654 3504 Themes - ok 11:34:57.0682 3504 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll 11:34:57.0686 3504 THREADORDER - ok 11:34:57.0730 3504 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll 11:34:57.0747 3504 TrkWks - ok 11:34:57.0860 3504 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe 11:34:57.0891 3504 TrustedInstaller - ok 11:34:57.0920 3504 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys 11:34:57.0933 3504 tssecsrv - ok 11:34:57.0982 3504 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys 11:34:57.0997 3504 TsUsbFlt - ok 11:34:58.0029 3504 [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys 11:34:58.0031 3504 TsUsbGD - ok 11:34:58.0112 3504 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys 11:34:58.0120 3504 tunnel - ok 11:34:58.0148 3504 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\drivers\uagp35.sys 11:34:58.0178 3504 uagp35 - ok 11:34:58.0228 3504 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys 11:34:58.0243 3504 udfs - ok 11:34:58.0299 3504 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe 11:34:58.0311 3504 UI0Detect - ok 11:34:58.0355 3504 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys 11:34:58.0364 3504 uliagpkx - ok 11:34:58.0414 3504 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys 11:34:58.0430 3504 umbus - ok 11:34:58.0447 3504 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\drivers\umpass.sys 11:34:58.0464 3504 UmPass - ok 11:34:58.0521 3504 [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService C:\Windows\System32\umrdp.dll 11:34:58.0538 3504 UmRdpService - ok 11:34:58.0666 3504 [ 927754ABF077AEB5504BE4E0F2C60C1B ] UMVPFSrv C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe 11:34:58.0687 3504 UMVPFSrv - ok 11:34:58.0738 3504 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll 11:34:58.0751 3504 upnphost - ok 11:34:58.0822 3504 [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys 11:34:58.0827 3504 usbaudio - ok 11:34:58.0881 3504 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys 11:34:58.0903 3504 usbccgp - ok 11:34:58.0977 3504 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys 11:34:58.0994 3504 usbcir - ok 11:34:59.0029 3504 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys 11:34:59.0043 3504 usbehci - ok 11:34:59.0106 3504 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys 11:34:59.0115 3504 usbhub - ok 11:34:59.0138 3504 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys 11:34:59.0146 3504 usbohci - ok 11:34:59.0163 3504 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\drivers\usbprint.sys 11:34:59.0182 3504 usbprint - ok 11:34:59.0212 3504 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS 11:34:59.0224 3504 USBSTOR - ok 11:34:59.0290 3504 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys 11:34:59.0307 3504 usbuhci - ok 11:34:59.0432 3504 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys 11:34:59.0444 3504 usbvideo - ok 11:34:59.0508 3504 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll 11:34:59.0517 3504 UxSms - ok 11:34:59.0547 3504 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe 11:34:59.0550 3504 VaultSvc - ok 11:34:59.0636 3504 [ FD911873C0BB6945FA38C16E9A2B58F9 ] VClone C:\Windows\system32\DRIVERS\VClone.sys 11:34:59.0653 3504 VClone - ok 11:34:59.0733 3504 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys 11:34:59.0735 3504 vdrvroot - ok 11:34:59.0778 3504 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe 11:34:59.0786 3504 vds - ok 11:34:59.0792 3504 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys 11:34:59.0793 3504 vga - ok 11:34:59.0809 3504 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys 11:34:59.0810 3504 VgaSave - ok 11:34:59.0827 3504 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys 11:34:59.0837 3504 vhdmp - ok 11:34:59.0840 3504 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys 11:34:59.0841 3504 viaide - ok 11:34:59.0863 3504 [ 86EA3E79AE350FEA5331A1303054005F ] vmbus C:\Windows\system32\drivers\vmbus.sys 11:34:59.0865 3504 vmbus - ok 11:34:59.0872 3504 [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys 11:34:59.0873 3504 VMBusHID - ok 11:34:59.0886 3504 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys 11:34:59.0888 3504 volmgr - ok 11:34:59.0898 3504 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys 11:34:59.0902 3504 volmgrx - ok 11:34:59.0914 3504 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys 11:34:59.0917 3504 volsnap - ok 11:34:59.0944 3504 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys 11:34:59.0946 3504 vsmraid - ok 11:34:59.0982 3504 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe 11:35:00.0001 3504 VSS - ok 11:35:00.0015 3504 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys 11:35:00.0016 3504 vwifibus - ok 11:35:00.0034 3504 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll 11:35:00.0039 3504 W32Time - ok 11:35:00.0044 3504 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\drivers\wacompen.sys 11:35:00.0044 3504 WacomPen - ok 11:35:00.0065 3504 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys 11:35:00.0067 3504 WANARP - ok 11:35:00.0069 3504 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys 11:35:00.0070 3504 Wanarpv6 - ok 11:35:00.0115 3504 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe 11:35:00.0130 3504 WatAdminSvc - ok 11:35:00.0175 3504 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe 11:35:00.0193 3504 wbengine - ok 11:35:00.0204 3504 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll 11:35:00.0208 3504 WbioSrvc - ok 11:35:00.0223 3504 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll 11:35:00.0229 3504 wcncsvc - ok 11:35:00.0239 3504 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll 11:35:00.0241 3504 WcsPlugInService - ok 11:35:00.0260 3504 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\drivers\wd.sys 11:35:00.0261 3504 Wd - ok 11:35:00.0278 3504 [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys 11:35:00.0286 3504 Wdf01000 - ok 11:35:00.0307 3504 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll 11:35:00.0310 3504 WdiServiceHost - ok 11:35:00.0312 3504 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll 11:35:00.0314 3504 WdiSystemHost - ok 11:35:00.0328 3504 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll 11:35:00.0332 3504 WebClient - ok 11:35:00.0349 3504 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll 11:35:00.0353 3504 Wecsvc - ok 11:35:00.0363 3504 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll 11:35:00.0365 3504 wercplsupport - ok 11:35:00.0387 3504 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll 11:35:00.0389 3504 WerSvc - ok 11:35:00.0406 3504 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys 11:35:00.0407 3504 WfpLwf - ok 11:35:00.0418 3504 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys 11:35:00.0419 3504 WIMMount - ok 11:35:00.0430 3504 WinDefend - ok 11:35:00.0433 3504 WinHttpAutoProxySvc - ok 11:35:00.0463 3504 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll 11:35:00.0466 3504 Winmgmt - ok 11:35:00.0511 3504 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll 11:35:00.0536 3504 WinRM - ok 11:35:00.0581 3504 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys 11:35:00.0582 3504 WinUsb - ok 11:35:00.0611 3504 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll 11:35:00.0636 3504 Wlansvc - ok 11:35:00.0736 3504 [ 98F138897EF4246381D197CB81846D62 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 11:35:00.0769 3504 wlidsvc - ok 11:35:00.0782 3504 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys 11:35:00.0783 3504 WmiAcpi - ok 11:35:00.0807 3504 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe 11:35:00.0819 3504 wmiApSrv - ok 11:35:00.0837 3504 WMPNetworkSvc - ok 11:35:00.0890 3504 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll 11:35:00.0895 3504 WPCSvc - ok 11:35:01.0008 3504 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll 11:35:01.0015 3504 WPDBusEnum - ok 11:35:01.0037 3504 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys 11:35:01.0039 3504 ws2ifsl - ok 11:35:01.0069 3504 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll 11:35:01.0076 3504 wscsvc - ok 11:35:01.0083 3504 WSearch - ok 11:35:01.0162 3504 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll 11:35:01.0199 3504 wuauserv - ok 11:35:01.0209 3504 [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf C:\Windows\system32\drivers\WudfPf.sys 11:35:01.0211 3504 WudfPf - ok 11:35:01.0244 3504 [ CF8D590BE3373029D57AF80914190682 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys 11:35:01.0247 3504 WUDFRd - ok 11:35:01.0267 3504 [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc C:\Windows\System32\WUDFSvc.dll 11:35:01.0274 3504 wudfsvc - ok 11:35:01.0297 3504 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll 11:35:01.0307 3504 WwanSvc - ok 11:35:01.0317 3504 ================ Scan global =============================== 11:35:01.0340 3504 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll 11:35:01.0372 3504 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll 11:35:01.0391 3504 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll 11:35:01.0426 3504 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll 11:35:01.0442 3504 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe 11:35:01.0453 3504 [Global] - ok 11:35:01.0454 3504 ================ Scan MBR ================================== 11:35:01.0465 3504 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0 11:35:01.0673 3504 \Device\Harddisk0\DR0 - ok 11:35:01.0674 3504 ================ Scan VBR ================================== 11:35:01.0678 3504 [ 35565A7FDCEAAF08A3DF56A14B715F3D ] \Device\Harddisk0\DR0\Partition1 11:35:01.0679 3504 \Device\Harddisk0\DR0\Partition1 - ok 11:35:01.0688 3504 [ C33A6864F0851870BADE4401D774AD25 ] \Device\Harddisk0\DR0\Partition2 11:35:01.0689 3504 \Device\Harddisk0\DR0\Partition2 - ok 11:35:01.0689 3504 ============================================================ 11:35:01.0689 3504 Scan finished 11:35:01.0689 3504 ============================================================ 11:35:01.0696 3436 Detected object count: 0 11:35:01.0696 3436 Actual detected object count: 0 Thanks for your help.

jeffce

Post #4September 14, 2012, 5:04 PM UTC

Hi,

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 7A 22 3E 47 60 CD 01 [binary data]
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
FF - prefs.js..browser.startup.homepage: "file:///C:/Users/XB70/Documents/bookmarks.html"
FF - prefs.js..extensions.enabledAddons: [removed]:2.6
FF - prefs.js..extensions.enabledAddons: [removed]:1.0
[2012/09/07 14:41:59 | 000,000,000 | —D | M] (Funmoods.com) – C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed]
[2012/09/05 09:08:45 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
O2 - BHO: (Funmoods Helper Object) - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - C:\PROGRA~2\Funmoods\1.5.23.22\bh\escort.dll File not found
O3 - HKLM\..\Toolbar: (Funmoods Toolbar) - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - C:\PROGRA~2\Funmoods\1.5.23.22\escorTlbr.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O16 - DPF: {7E866715-C9B6-4C64-AAB8-342E0D137213} http://192.168.1.23:8080/EDVR.CAB (DVR4204 Client Control)
[2012/09/07 14:40:46 | 000,031,465 | —- | M] () – C:\Users\XB70\AppData\Local\funmoods.crx
[2012/09/07 14:40:47 | 000,031,465 | —- | C] () – C:\Users\XB70\AppData\Local\funmoods.crx

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Melax

Post #5September 14, 2012, 5:38 PM UTC

I ran OTL Fix, Please find the log below. Thanks

**********************

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Prefs.js: "file:///C:/Users/XB70/Documents/bookmarks.html" removed from browser.startup.homepage
Prefs.js: [removed]:2.6 removed from extensions.enabledAddons
Prefs.js: [removed]:1.0 removed from extensions.enabledAddons
C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed]\META-INF folder moved successfully.
C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed]\content\imgs\flgs folder moved successfully.
C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed]\content\imgs folder moved successfully.
C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed]\content\images folder moved successfully.
C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed]\content folder moved successfully.
C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed] folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\bing.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Starting removal of ActiveX control {7E866715-C9B6-4C64-AAB8-342E0D137213}
C:\Windows\Downloaded Program Files\ClientControl.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7E866715-C9B6-4C64-AAB8-342E0D137213}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E866715-C9B6-4C64-AAB8-342E0D137213}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7E866715-C9B6-4C64-AAB8-342E0D137213}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E866715-C9B6-4C64-AAB8-342E0D137213}\ not found.
File C:\Users\XB70\AppData\Local\funmoods.crx not found.
File C:\Users\XB70\AppData\Local\funmoods.crx not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\XB70\Desktop\cmd.bat deleted successfully.
C:\Users\XB70\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56475 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56475 bytes

User: XB70
->Temp folder emptied: 986592535 bytes
->Temporary Internet Files folder emptied: 196847047 bytes
->Java cache emptied: 117690 bytes
->FireFox cache emptied: 62258791 bytes
->Flash cache emptied: 77711 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 18866 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
RecycleBin emptied: 9727202 bytes

Total Files Cleaned = 1,198.00 mb

OTL by OldTimer - Version 3.2.61.3 log created on 09142012_132944

Files\Folders moved on Reboot…
C:\Users\XB70\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

jeffce

Post #6September 14, 2012, 6:01 PM UTC

How is your system behaving? When you ran OTL the first time there was a log named Extras.txt. Please post that.

Melax

Post #7September 14, 2012, 6:16 PM UTC last edited September 14, 2012, 6:21 PM UTC

I'm still getting redirected, this is the URL redirect hxxp://63.209.69.107/search/web/senegal+cr.../46938-97510/v5

Sorry that I didn't post the Extra.txt file, I can only find an extras.txt file generated yesterday (before your instructions) here it is.

OTL Extras logfile created on: 9/13/2012 7:13:06 PM - Run 1
OTL by OldTimer - Version 3.2.61.3 Folder = C:\Users\XB70\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.88 Gb Available Physical Memory | 71.98% Memory free
8.00 Gb Paging File | 6.88 Gb Available in Paging File | 86.04% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1397.17 Gb Total Space | 1282.50 Gb Free Space | 91.79% Space Free | Partition Type: NTFS
Drive D: | 29.98 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: ASUS-DT | User Name: XB70 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 61 01 DA 5A 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06387242-B459-4B3B-A449-CC4F62A966FD}" = rport=138 | protocol=17 | dir=out | app=system |
"{18BCC5F6-E13E-484F-BEAA-02F0E4ECE167}" = lport=445 | protocol=6 | dir=in | app=system |
"{1ADF9827-BE9A-43F4-AC12-0D7A21F9480F}" = lport=4000 | protocol=6 | dir=out | app=c:\program files (x86)\dll-files.com fixer\dllfixer.exe |
"{2A56A013-ED55-4998-BCAD-994F0F68E4D2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2F4EA3B0-B325-4015-8B9D-EA10A4620CF6}" = lport=139 | protocol=6 | dir=in | app=system |
"{2FF67243-876D-47E8-B4AB-AC49FEB01191}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{46FBBDD1-A0DC-4ED1-8E39-E090795FA5C6}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{5ACB17AE-6135-4895-9E1F-2CAAE94BA064}" = lport=137 | protocol=17 | dir=in | app=system |
"{6BF49821-9CEA-4A37-9F76-90222508120F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{70F56267-FCC5-450F-A124-915CDD682C24}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{80C2AA6D-CDC3-4D70-9403-1D69937FA595}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{93BA61B2-E025-404A-AF1A-30EB227319F4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9B609D66-31DF-4DD3-93A4-E5BBCE9E677A}" = rport=139 | protocol=6 | dir=out | app=system |
"{A9D07430-B5B2-4107-8EBE-0F1C79C2AB77}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{B999F0E7-05E3-4451-86DF-4FE2F8A5F2EE}" = lport=138 | protocol=17 | dir=in | app=system |
"{BB09AE17-B431-4404-8B00-2025753E1710}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{BEA3BE6E-20F0-4147-8890-07386495F921}" = lport=4000 | protocol=6 | dir=out | app=c:\program files (x86)\dll-files.com fixer\dllfixer.exe |
"{C0774F50-E49D-4378-869C-18DF5B3CEABC}" = rport=137 | protocol=17 | dir=out | app=system |
"{C7883CCD-7250-4D33-8E2A-7DEDB11EE2D8}" = lport=4000 | protocol=6 | dir=out | app=c:\program files (x86)\dll-files.com fixer\dllfixer.exe |
"{CA99A639-41B5-4A91-826F-6B20B532A91E}" = lport=4000 | protocol=6 | dir=out | app=c:\program files (x86)\dll-files.com fixer\dllfixer.exe |
"{D46FFA31-932C-4C4C-98D5-F84D3DDA53F9}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{D49AEF1C-57BF-4A43-9B6D-4F05025CBA35}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E54F427C-2EA2-4FFA-BD49-E88743816B46}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{EAE3D2FC-6AA1-437F-8BDD-D704A8B40F1E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{ED2179C5-8B13-4E29-8839-5E82CC54B571}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FA5C8C29-251C-44F7-ACBE-0A7E75C9CA4A}" = rport=445 | protocol=6 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0087FBB0-6183-49AD-807B-DE454A932E25}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\microsoft flight\flight.exe |
"{22D7408F-1008-4EC3-A5D7-29121BB9EEAA}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{35C5D973-DAD0-4F43-AB1B-F8C369BE322D}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{45B211CE-7C72-4B2B-8542-194D792326F8}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\microsoft flight\flight.exe |
"{5147A928-7BE8-40A7-A05F-9E8EE49F7592}" = protocol=17 | dir=in | app=c:\program files (x86)\tango\tango.exe |
"{7380D622-F054-4ACA-96C3-B963C1A31DC3}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{8513FF24-FD6F-460A-93C0-9F78A1D55529}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\battlefield 2142 deluxe edition\bf2142.exe |
"{85C41CBF-F2C4-40BC-A1AE-ABDD2AE7455A}" = dir=in | app=c:\users\xb70\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{9A4C5138-C8B5-450D-A82C-38B98B93EB3A}" = protocol=6 | dir=in | app=c:\program files (x86)\lucasarts\star wars battlefront\gamedata\battlefront.exe |
"{9F28128A-BB85-4573-BE0A-B72054CC9F20}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\battlefield 2142 deluxe edition\bf2142.exe |
"{AA982C1E-975E-4F3F-B38F-88709AC1DEE9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{AFBEA7C3-9800-4C83-A59D-32E0AE356978}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{B095388C-996E-4D5D-ADD5-33329D69C763}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{B27C1718-E278-404A-97C3-7FD00A1603C8}" = protocol=17 | dir=in | app=c:\program files (x86)\lucasarts\star wars battlefront\gamedata\battlefront.exe |
"{CB36175D-0A0F-41A4-A50C-2DA88F9E4A4C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{D15F4302-A51C-45CE-AA5C-C61B7A30E304}" = protocol=6 | dir=in | app=c:\program files (x86)\tango\tango.exe |
"{D5A30B0C-FC38-472E-99BC-19CDCE174878}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{E9A53FC6-1F64-4A69-B167-2CBE9B0BF360}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{FAB78AB6-7B90-4708-AD2A-21EB73E50157}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"TCP Query User{0475CBFB-5B6C-4AA6-AF97-B495A2808CDA}C:\call of duty- modern warfare 3\iw5mp_server.exe" = protocol=6 | dir=in | app=c:\call of duty- modern warfare 3\iw5mp_server.exe |
"TCP Query User{597DD5A7-722A-43E5-AB23-920AFFE2125B}C:\program files (x86)\participatory culture foundation\miro\miro_downloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\participatory culture foundation\miro\miro_downloader.exe |
"TCP Query User{B6E60698-97AC-4351-8A4E-36E32A9365FE}C:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=6 | dir=in | app=c:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe |
"TCP Query User{F2C82DD4-D75C-48BB-B0F8-B20ECDF9124E}C:\program files (x86)\ea games\mohaa\mohaa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\mohaa\mohaa.exe |
"UDP Query User{42FDA0BF-7FDE-42FE-8DEB-34F948DFD47C}C:\program files (x86)\participatory culture foundation\miro\miro_downloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\participatory culture foundation\miro\miro_downloader.exe |
"UDP Query User{5E0AE477-C2DB-473B-8B77-6C5CC543AF77}C:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=17 | dir=in | app=c:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe |
"UDP Query User{BF625D47-2153-4597-AA23-BFE278B97A0E}C:\call of duty- modern warfare 3\iw5mp_server.exe" = protocol=17 | dir=in | app=c:\call of duty- modern warfare 3\iw5mp_server.exe |
"UDP Query User{E615180A-E156-4328-AEA1-EE6577617CDD}C:\program files (x86)\ea games\mohaa\mohaa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\mohaa\mohaa.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}" = Microsoft Security Client
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 275.33
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 275.33
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.3.5
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"WinRAR archiver" = WinRAR 4.11 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0DEA94ED-915A-4834-A87E-388D012C8E02}" = Medal of Honor Allied Assault
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}" = Cool & Quiet
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{3D374523-CFDE-461A-827E-2A102E2AB365}" = Star Wars Battlefront II
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4D5308D2-DC8E-4658-A37C-351000008100}" = Microsoft Flight
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7391ABC8-0EA4-3798-ACE3-96B8C8D84EA8}" = Google Talk Plugin
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.4)
"{C79CB9C7-10A4-4814-8402-F574672C2192}" = Star Wars Battlefront
"{ED50ECE9-EC54-4C05-B5ED-EE4741A9F2EC}" = Battlefield 2142 Deluxe Edition
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Flight Simulator 7.0" = Microsoft Flight Simulator 2000
"Flight Simulator 8.0" = Microsoft Flight Simulator 2002
"GFWL_{4D5308D2-DC8E-4658-A37C-351000008100}" = Microsoft Flight
"JUST CAUSE *DVD RIP* *MULTI 4*_is1" = JUST CAUSE
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Miro" = Miro
"Mozilla Firefox 15.0 (x86 en-US)" = Mozilla Firefox 15.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PunkBusterSvc" = PunkBuster Services
"SystemRequirementsLab" = System Requirements Lab
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 2.0.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 15.0.1 (x86 en-US)" = Mozilla Firefox 15.0.1 (x86 en-US)
"Tango" = Tango

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 9/4/2012 2:05:50 PM | Computer Name = ASUS-DT | Source = WinMgmt | ID = 10
Description =

Error - 9/5/2012 9:07:56 AM | Computer Name = ASUS-DT | Source = WinMgmt | ID = 10
Description =

Error - 9/6/2012 4:03:36 PM | Computer Name = ASUS-DT | Source = WinMgmt | ID = 10
Description =

Error - 9/7/2012 10:50:18 AM | Computer Name = ASUS-DT | Source = WinMgmt | ID = 10
Description =

Error - 9/7/2012 5:14:11 PM | Computer Name = ASUS-DT | Source = WinMgmt | ID = 10
Description =

Error - 9/8/2012 9:06:37 PM | Computer Name = ASUS-DT | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 15.0.1.4631 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 424 Start
Time: 01cd8e1c883733c0 Termination Time: 157 Application Path: C:\Program Files (x86)\Mozilla
Firefox\firefox.exe Report Id: 94b61481-fa1a-11e1-b393-f46d04e71884

Error - 9/10/2012 3:05:02 PM | Computer Name = ASUS-DT | Source = WinMgmt | ID = 10
Description =

Error - 9/12/2012 8:26:01 PM | Computer Name = ASUS-DT | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 15.0.1.4631 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: ac Start
Time: 01cd91460d95cbcc Termination Time: 35 Application Path: C:\Program Files (x86)\Mozilla
Firefox\firefox.exe Report Id: 9313b6ed-fd39-11e1-83a2-f46d04e71884

Error - 9/13/2012 3:20:03 AM | Computer Name = ASUS-DT | Source = WinMgmt | ID = 10
Description =

Error - 9/13/2012 5:04:20 PM | Computer Name = ASUS-DT | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 7/20/2012 3:51:27 PM | Computer Name = ASUS-DT | Source = Service Control Manager | ID = 7023
Description = The Function Discovery Resource Publication service terminated with
the following error: %%-2147014847

Error - 7/23/2012 7:53:54 PM | Computer Name = ASUS-DT | Source = EventLog | ID = 6008
Description = The previous system shutdown at 12:53:24 AM on ?7/?23/?2012 was unexpected.

Error - 8/4/2012 1:40:00 PM | Computer Name = ASUS-DT | Source = EventLog | ID = 6008
Description = The previous system shutdown at 1:59:23 AM on ?8/?4/?2012 was unexpected.

Error - 8/20/2012 10:32:05 AM | Computer Name = ASUS-DT | Source = VDS Basic Provider | ID = 33554433
Description =

Error - 8/21/2012 12:49:19 PM | Computer Name = ASUS-DT | Source = EventLog | ID = 6008
Description = The previous system shutdown at 12:21:50 AM on ?8/?21/?2012 was unexpected.

Error - 8/23/2012 12:31:55 AM | Computer Name = ASUS-DT | Source = EventLog | ID = 6008
Description = The previous system shutdown at 12:29:15 AM on ?8/?22/?2012 was unexpected.

Error - 8/31/2012 5:41:56 PM | Computer Name = ASUS-DT | Source = EventLog | ID = 6008
Description = The previous system shutdown at 2:45:46 AM on ?8/?30/?2012 was unexpected.

Error - 9/3/2012 9:27:40 PM | Computer Name = ASUS-DT | Source = EventLog | ID = 6008
Description = The previous system shutdown at 9:23:34 PM on ?9/?3/?2012 was unexpected.

Error - 9/10/2012 3:03:20 PM | Computer Name = ASUS-DT | Source = EventLog | ID = 6008
Description = The previous system shutdown at 1:37:24 AM on ?9/?9/?2012 was unexpected.

Error - 9/13/2012 3:18:32 AM | Computer Name = ASUS-DT | Source = Microsoft-Windows-WHEA-Logger | ID = 20
Description = A fatal hardware error has occurred. Component: AMD Northbridge Error
Source: 3 Error Type: 2 Processor ID: 0 The details view of this entry contains further
information.

< End of report >

jeffce

Post #8September 14, 2012, 6:21 PM UTC

Hi,

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
[2012/06/02 19:42:49 | 000,009,189 | —- | M] () (No name found) – C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed]
[1832/11/29 00:22:58 | 000,004,819 | —- | M] () (No name found) – C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed]
[2012/07/14 16:43:21 | 000,057,702 | —- | M] () (No name found) – C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\{fe0258ab-4f74-43a1-8781-bcdf340f9ee9}.xpi

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

———-

Melax

Post #9September 14, 2012, 6:49 PM UTC

Here is the OTL fix log: All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed] moved successfully. C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed] moved successfully. C:\Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\{fe0258ab-4f74-43a1-8781-bcdf340f9ee9}.xpi moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public User: UpdatusUser ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: XB70 ->Temp folder emptied: 2976 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 84248671 bytes ->Flash cache emptied: 763 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 4670 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 80.00 mb OTL by OldTimer - Version 3.2.61.3 log created on 09142012_144634 Files\Folders moved on Reboot… C:\Users\XB70\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files… Registry entries deleted on Reboot…

jeffce

Post #10September 14, 2012, 6:50 PM UTC

How are the redirects?

Melax

Post #11September 14, 2012, 6:58 PM UTC

Hi jeff, I just tried about 20 search links and didn't get any redirect !! Super ( I hope)… The problem seems resolved for the time being. You guys are great !

Melax

Post #12September 14, 2012, 7:02 PM UTC

I'll be away from my computer for a couple of hours , upon returning, I'll click on more search links…

jeffce

Post #13September 14, 2012, 7:03 PM UTC

I just tried about 20 search links and didn't get any redirect !! Super ( I hope)… The problem seems resolved for the time being. You guys are great !

Good to hear….stick with me though.

Malwarebytes

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
Close the ESET online scan, and let me know how things are now.

———-

Please post the Malwarebytes and ESET logs when you get them.

Melax

Post #14September 14, 2012, 11:27 PM UTC

Hi Jeff, Here are the 2 logs, the eset took some time to complete. Malware bytes Log: ********************************************** Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Database version: v2012.09.14.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 XB70 :: ASUS-DT [administrator] 9/14/2012 4:57:07 PM mbam-log-2012-09-14 (16-57-07).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 213238 Time elapsed: 3 minute(s), 56 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) *************************************** ESET Log (Found 3 Threats) C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application C:\Users\All Users\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application C:\_OTL\MovedFiles\09142012_144634\C_Users\XB70\AppData\Roaming\Mozilla\Firefox\Profiles\wpdrp10g.default\extensions\[removed] JS/Redirector.NCA trojan Thanks

jeffce

Post #15September 15, 2012, 3:40 AM UTC

Hi,

Run OTL.exe

Copy/paste the following text written inside of the quote box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:Files
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll
C:\Users\All Users\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll
ipconfig /flushdns /c

:Commands
[emptytemp]
[resethosts]
[clearallrestorepoints]
[start explorer]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

———-

In your next reply please post the log made by OTL and let me know how your system is running.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Search gets redirected [Solved]

✨ Ask AI

Ask AI