Spyware / Malware / Virus Removal

Beesq.net redirect [Solved]

9 min read

Looking for the outcome? Ask AI

David714 Topic Starter

Post #1October 2, 2012, 4:07 PM UTC

Every time I search a website the first time I click the link I get redirected. Most often to Beesq.net but sometimes it will say click.livesearchnow.com or click.searchwebresults.com. Last week I scanned my system with Malwarebytes and found and cleaned the Happili trojan. I never thought about that not fixing the problem until yesterday I noticed it was still doing the same redirect. I ran Kaspersky full scan yesterday and found Exploit.Java.CVE-2009-3867.s and a Malicious URL (askzilly). Even after removing those I am still having problems. I ran Anvisoft this morning and found Backdoor.Frauder.65426 and Hijack.StartMenu.247136. Even after that I still get redirected. Can you help? DDS log included below: . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 10:33:12.42 on Tue 10/02/2012 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12279.10205 [GMT -5:00] . AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984} SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\atieclxx.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\PrintIsolationHost.exe C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation c:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe C:\Windows\System32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDTray.exe C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\wmi64.exe C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\WUDFHost.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\rundll32.exe C:\Users\Krystal\Downloads\dds.scr C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uWindow Title = Windows Internet Explorer provided by Yahoo! uStart Page = hxxp://www.yahoo.com/?fr=fp-yie9 uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie9 mStart Page = hxxp://www.yahoo.com/?fr=fp-yie9 mDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie9 uInternet Settings,ProxyOverride = *.local mSearchAssistant = about:blank mWinlogon: Userinit=userinit.exe, BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll uRun: [Google Update] "C:\Users\Krystal\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRun: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe uRun: [Deployment] rundll32.exe "C:\Users\Krystal\AppData\Local\Diagnostics\Deployment\kvokl.dll",DllRegisterServerW mRun: [VolPanel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" mRun: [] mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml mRun: [Anvi Smart Defender] C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDTray.exe dRun: [Deployment] rundll32.exe "C:\Users\Krystal\AppData\Local\Diagnostics\Deployment\kvokl.dll",DllRegisterServerW mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll Trusted Zone: facebook.com\apps DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} - hxxp://i.dell.com/images/global/js/scanner/SysProExe.cab DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.6.2.cab DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxp://support.dell.com/systemprofiler/SysProExe.CAB DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} - hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - C:\Program Files (x86)\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files (x86)\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - C:\Program Files (x86)\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\System32\mscoree.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll BHO-X64: IEVkbdBHO - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll BHO-X64: FilterBHO Class: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll BHO-X64: link filter bho - No File TB-X64: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Krystal\AppData\Roaming\Mozilla\Firefox\Profiles\ujdhaxyv.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2559647&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Search FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2559647&SearchSource=2&q= FF - component: C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]\components\abhelperxpcom.dll FF - component: C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]\components\kavlinkfilter.dll FF - component: C:\Users\Krystal\AppData\Roaming\Mozilla\Firefox\Profiles\ujdhaxyv.default\extensions\{37153479-1976-43c3-a1ee-557513977b64}\components\RadioWMPCoreGecko19.dll FF - plugin: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10516.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\NOS\bin\np_gp.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\Krystal\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\Users\Krystal\AppData\Roaming\Mozilla\Firefox\Profiles\ujdhaxyv.default\extensions\{37153479-1976-43c3-a1ee-557513977b64}\plugins\np-mswmp.dll FF - plugin: C:\Users\Krystal\AppData\Roaming\Mozilla\Firefox\Profiles\ujdhaxyv.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\plugins\np-mswmp.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2011-7-1 55280] R1 asdrm;asdrm;C:\Windows\System32\drivers\asdrm.sys [2012-10-2 18768] R1 kl2;kl2;C:\Windows\System32\drivers\kl2.sys [2011-3-4 11864] R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2011-3-10 29488] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-4-8 202752] R2 asdrs;AntiMalware Host-based Intrusion Prevention System;C:\Windows\System32\drivers\asdrs.sys [2012-10-2 23376] R2 asdsrv;Anvi Smart Defender Realtime Guard Service;C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe [2012-8-23 686896] R2 asdws;AnviSmartDefender Web Guard;C:\Windows\System32\drivers\asdws.sys [2012-10-2 17232] R2 AVP;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [2011-4-25 202296] R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-5-14 96896] R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2009-11-2 22544] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-3-2 187392] R3 t3;Sound Blaster X-Fi Xtreme Audio;C:\Windows\System32\drivers\t3.sys [2009-5-6 639512] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920] R3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 SessionLauncher;SessionLauncher;C:\Users\Krystal\AppData\Local\Temp\DX9\SessionLauncher.exe –> C:\Users\Krystal\AppData\Local\Temp\DX9\SessionLauncher.exe [?] S3 atillk64;atillk64;C:\dell\drivers\R267410\atillk64.sys [2010-6-16 14608] S3 ivusb;Initio Driver for USB Default Controller;C:\Windows\System32\drivers\ivusb.sys [2010-7-29 29720] S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-11 114144] S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2012-4-10 25072] S3 QuickBooksDB20;QuickBooksDB20;C:\PROGRA~2\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB20 –> C:\PROGRA~2\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB20 [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-5-23 59392] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-2-15 52736] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-2-17 1255736] S4 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-2-17 79360] S4 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-2-17 79360] S4 Creative Media Toolbox 6 Licensing Service;Creative Media Toolbox 6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [2011-2-17 79360] S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files\Microsoft SQL Server\100\Shared\sqladhlp.exe [2010-4-3 59744] S4 RoxLiveShare10;LiveShare P2P Server 10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [2009-6-10 309744] S4 RoxMediaDB10;RoxMediaDB10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-6-10 1124848] S4 RoxWatch10;Roxio Hard Drive Watcher 10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [2009-6-10 166384] S4 RsFx0150;RsFx0150 Driver;C:\Windows\System32\drivers\RsFx0150.sys [2010-4-3 313696] . =============== Created Last 30 ================ . 2012-10-02 15:18:17 ——– d—–w- C:\Users\Krystal\AppData\Local\ElevatedDiagnostics 2012-10-02 15:12:29 ——– d—–w- C:\Users\Krystal\AppData\Roaming\Anvisoft 2012-10-02 15:12:17 23376 —-a-w- C:\Windows\System32\drivers\asdrs.sys 2012-10-02 15:12:17 18768 —-a-w- C:\Windows\System32\drivers\asdrm.sys 2012-10-02 15:12:17 17232 —-a-w- C:\Windows\System32\drivers\asdws.sys 2012-10-02 15:12:17 ——– d—–w- C:\PROGRA~3\Anvisoft 2012-10-02 15:12:16 ——– d—–w- C:\Program Files (x86)\Anvisoft 2012-10-02 08:13:37 9308616 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{94B08181-7EAF-4FDE-8246-0CA28E6B66CC}\mpengine.dll 2012-10-01 17:02:44 ——– d—–w- C:\Users\Krystal\AppData\Roaming\SUPERAntiSpyware.com 2012-09-28 16:50:44 ——– d—–w- C:\Users\Krystal\AppData\Local\{59B921CD-3AAF-4BBD-AD22-CF52265C1482} 2012-09-27 17:03:51 ——– d—–w- C:\Users\Krystal\AppData\Local\Creative Solutions 2012-09-27 16:30:11 ——– d—–w- C:\Program Files (x86)\Microsoft Synchronization Services 2012-09-27 15:20:27 77152 —-a-w- C:\Windows\System32\perf-MSSQL10_50.MSSQLSERVER-sqlagtctr.dll 2012-09-27 15:20:27 47456 —-a-w- C:\Windows\SysWow64\perf-MSSQL10_50.MSSQLSERVER-sqlagtctr.dll 2012-09-27 15:20:11 79200 —-a-w- C:\Windows\System32\perf-MSSQLSERVER-sqlctr10.50.1600.1.dll 2012-09-27 15:19:35 ——– d—–w- C:\Windows\System32\RsFx 2012-09-27 15:17:37 ——– d—–w- C:\Windows\SysWow64\1033 2012-09-27 15:17:37 ——– d—–w- C:\Windows\System32\1033 2012-09-27 14:43:12 ——– d—–w- C:\Users\Krystal\AppData\Local\{13E6E84B-CCA5-4E3B-B83D-794F6A4E4A78} 2012-09-26 14:17:06 ——– d—–w- C:\Users\Krystal\AppData\Local\{F4F73A1D-24E5-4973-AC0E-1C02FA80283B} 2012-09-26 02:16:45 ——– d—–w- C:\Users\Krystal\AppData\Local\{AE76BE8B-371D-425E-B620-2ED8517305CE} 2012-09-26 01:18:17 245760 —-a-w- C:\Windows\System32\OxpsConverter.exe 2012-09-25 14:16:10 ——– d—–w- C:\Users\Krystal\AppData\Local\{368C6D42-35AE-4091-8C21-CEB9522584C7} 2012-09-25 02:15:35 ——– d—–w- C:\Users\Krystal\AppData\Local\{D6169043-ACB8-454E-B17A-F511FC3399F3} 2012-09-24 14:15:10 ——– d—–w- C:\Users\Krystal\AppData\Local\{1239BB8E-DB8F-429C-B110-AFEA3D581B61} 2012-09-21 16:02:24 ——– d—–w- C:\Accounting CS 2012.1.0 Download 2012-09-21 15:00:12 ——– d—–w- C:\Users\Krystal\AppData\Local\{AF24291A-6DE4-40FB-9725-7675C0F08662} 2012-09-20 14:18:33 ——– d—–w- C:\Users\Krystal\AppData\Local\{2FA995EB-2073-41B5-96D8-3B4D1579BD23} 2012-09-18 19:40:37 ——– d—–w- C:\Users\Krystal\AppData\Local\{9C3C38DC-79EB-46C2-9239-AC4DF1F916EF} 2012-09-17 19:34:06 ——– d—–w- C:\Users\Krystal\AppData\Local\{B225949F-590C-41AF-9901-530F583FDBAF} 2012-09-13 13:45:42 ——– d—–w- C:\Users\Krystal\AppData\Local\{CA5806E7-135C-4A34-8631-13802A23255C} 2012-09-12 00:04:01 950128 —-a-w- C:\Windows\System32\drivers\ndis.sys 2012-09-12 00:04:01 41472 —-a-w- C:\Windows\System32\drivers\RNDISMP.sys 2012-09-12 00:04:00 574464 —-a-w- C:\Windows\System32\d3d10level9.dll 2012-09-12 00:04:00 490496 —-a-w- C:\Windows\SysWow64\d3d10level9.dll 2012-09-12 00:03:59 376688 —-a-w- C:\Windows\System32\drivers\netio.sys 2012-09-12 00:03:59 288624 —-a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS 2012-09-12 00:03:59 1913200 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2012-09-11 15:52:10 0 —-a-w- C:\Windows\ativpsrm.bin 2012-09-11 15:50:28 ——– d—–w- C:\Program Files\Common Files\ATI Technologies 2012-09-11 15:49:58 ——– d—–w- C:\Program Files (x86)\ATI Technologies 2012-09-11 15:49:40 ——– d—–w- C:\Program Files\ATI 2012-09-11 15:49:19 ——– d—–w- C:\Program Files\ATI Technologies 2012-09-11 15:39:59 ——– d—–w- C:\Program Files (x86)\Driver Cleaner Pro 2012-09-11 15:15:35 ——– d—–w- C:\Program Files (x86)\Driver Fusion 2012-09-11 14:47:20 ——– d—–w- C:\Users\Krystal\AppData\Local\{AD7A82E6-2A82-45A4-AB69-AED8D9CFE448} 2012-09-10 18:01:33 ——– d—–w- C:\Users\Krystal\AppData\Local\{1CD435DE-EF8B-41A3-90FF-40647391624A} 2012-09-05 15:24:43 ——– d—–w- C:\Users\Krystal\AppData\Local\{62450FF0-05C5-4F57-87B5-4E98642B27CA} 2012-09-04 16:54:12 ——– d—–w- C:\Users\Krystal\AppData\Local\{EA49E3D6-D0A0-46BA-96B5-D35AF1A01FCA} . ==================== Find3M ==================== . 2012-09-07 22:04:46 25928 —-a-w- C:\Windows\System32\drivers\mbam.sys 2012-08-28 20:13:17 73416 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-08-28 20:13:17 696520 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-08-24 10:31:32 2312704 —-a-w- C:\Windows\System32\jscript9.dll 2012-08-24 10:21:18 1392128 —-a-w- C:\Windows\System32\wininet.dll 2012-08-24 10:20:11 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl 2012-08-24 10:14:45 173056 —-a-w- C:\Windows\System32\ieUnatt.exe 2012-08-24 10:13:29 599040 —-a-w- C:\Windows\System32\vbscript.dll 2012-08-24 10:09:42 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2012-08-24 06:59:17 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll 2012-08-24 06:51:27 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll 2012-08-24 06:51:02 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-08-24 06:47:26 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-08-24 06:47:12 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll 2012-08-24 06:43:58 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2012-07-28 03:47:40 187392 —-a-w- C:\Windows\System32\clinfo.exe 2012-07-28 03:47:10 63488 —-a-w- C:\Windows\System32\OVDecode64.dll 2012-07-28 03:47:06 56320 —-a-w- C:\Windows\SysWow64\OVDecode.dll 2012-07-28 03:43:12 70144 —-a-w- C:\Windows\System32\coinst_8.982.dll 2012-07-18 18:15:06 3148800 —-a-w- C:\Windows\System32\win32k.sys 2012-07-04 22:13:27 59392 —-a-w- C:\Windows\System32\browcli.dll 2012-07-04 22:13:27 136704 —-a-w- C:\Windows\System32\browser.dll 2012-07-04 21:14:34 41984 —-a-w- C:\Windows\SysWow64\browcli.dll . ============= FINISH: 10:34:38.91 ===============

patndoris

Post #2October 2, 2012, 9:26 PM UTC

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. 1. Do not mouse-click anywhere on the screen while it is running. That may cause it to stall. In fact, I suggest you do not do anything else on the computer while Combofix is running as it can cause it to stall. It may appear at times that it isn't doing anything but it is. Just let it run. It may also reboot the machine as a part of what it is doing and that is not unusual. (If your computer requires a login then you WILL need to fill in the login/password for it to continue. If your computer does not have a login then it will continue on it's own..) Then, just sit tight until it finishes. Sometimes it takes 10 minutes, sometimes it takes an hour. Just be patient until the log pops up. If it takes more than an hour and doesn't appear to be doing anything, you can stop it and come back and let me know.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

David714

Post #3October 3, 2012, 3:47 PM UTC

I tried to run ComboFix.exe but it stalled after completing Stage 48. I waited an hour after the stall and it never proceeded. So I stopped and await further instructions. Thanks.

patndoris

Post #4October 3, 2012, 9:15 PM UTC

Let's just double check to ensure that there is no log located at C:\ComboFix.txt. If there is, please open it with Notepad and copy and paste the contents in your next reply.

If not, then please do the following:

Please read carefully and follow these steps. There is a difference between what you see in one of the images below and what I need you to do.
We are only creating a log - I do NOT want you to "cure" or try to fix anything in this step. It is very important that you don't choose Cure when presented with that option.

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

🖼Click to load external image (Posted Image)
If an infected file is detected, the default action will be Cure but I want you to choose SKIP instead , click on Continue.

🖼Click to load external image (Posted Image)
If a suspicious file is detected, the default action will be Skip, click on Continue.

🖼Click to load external image (Posted Image)
It may ask you to reboot the computer to complete the process. Click on Reboot Now.

🖼Click to load external image (Posted Image)
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

David714

Post #5October 4, 2012, 2:18 PM UTC

I did not find a ComboFix log so I ran the TDSSKiller as instructed. Here is the log: 09:14:42.0636 5652 TDSS rootkit removing tool [removed] Sep 17 2012 19:23:24 09:14:43.0042 5652 ============================================================ 09:14:43.0042 5652 Current date / time: 2012/10/04 09:14:43.0042 09:14:43.0042 5652 SystemInfo: 09:14:43.0042 5652 09:14:43.0042 5652 OS Version: 6.1.7601 ServicePack: 1.0 09:14:43.0042 5652 Product type: Workstation 09:14:43.0042 5652 ComputerName: KRYSTAL-PC 09:14:43.0042 5652 UserName: Krystal 09:14:43.0042 5652 Windows directory: C:\Windows 09:14:43.0042 5652 System windows directory: C:\Windows 09:14:43.0042 5652 Running under WOW64 09:14:43.0042 5652 Processor architecture: Intel x64 09:14:43.0042 5652 Number of processors: 8 09:14:43.0042 5652 Page size: 0x1000 09:14:43.0042 5652 Boot type: Normal boot 09:14:43.0042 5652 ============================================================ 09:14:44.0196 5652 Drive \Device\Harddisk0\DR0 - Size: 0x7470900000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED80, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 09:14:44.0196 5652 Drive \Device\Harddisk1\DR1 - Size: 0xEEF00000 (3.73 Gb), SectorSize: 0x200, Cylinders: 0x1E7, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 09:14:44.0212 5652 Drive \Device\Harddisk6\DR6 - Size: 0x7446E00000 (465.11 Gb), SectorSize: 0x200, Cylinders: 0xED2B, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 09:14:44.0227 5652 ============================================================ 09:14:44.0227 5652 \Device\Harddisk0\DR0: 09:14:44.0227 5652 MBR partitions: 09:14:44.0227 5652 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 09:14:44.0227 5652 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x3A351800 09:14:44.0227 5652 \Device\Harddisk1\DR1: 09:14:44.0227 5652 MBR partitions: 09:14:44.0227 5652 \Device\Harddisk1\DR1\Partition1: MBR, Type 0xB, StartLBA 0x20, BlocksNum 0x7777E0 09:14:44.0227 5652 \Device\Harddisk6\DR6: 09:14:44.0227 5652 MBR partitions: 09:14:44.0227 5652 \Device\Harddisk6\DR6\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x3A236800 09:14:44.0227 5652 ============================================================ 09:14:44.0243 5652 C: <-> \Device\Harddisk0\DR0\Partition2 09:14:44.0274 5652 K: <-> \Device\Harddisk6\DR6\Partition1 09:14:44.0274 5652 ============================================================ 09:14:44.0274 5652 Initialize success 09:14:44.0274 5652 ============================================================ 09:16:33.0177 0760 ============================================================ 09:16:33.0177 0760 Scan started 09:16:33.0177 0760 Mode: Manual; 09:16:33.0177 0760 ============================================================ 09:16:34.0082 0760 ================ Scan system memory ======================== 09:16:34.0082 0760 System memory - ok 09:16:34.0082 0760 ================ Scan services ============================= 09:16:34.0207 0760 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys 09:16:34.0223 0760 1394ohci - ok 09:16:34.0238 0760 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys 09:16:34.0254 0760 ACPI - ok 09:16:34.0285 0760 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys 09:16:34.0285 0760 AcpiPmi - ok 09:16:34.0316 0760 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys 09:16:34.0316 0760 adp94xx - ok 09:16:34.0347 0760 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys 09:16:34.0363 0760 adpahci - ok 09:16:34.0379 0760 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys 09:16:34.0379 0760 adpu320 - ok 09:16:34.0394 0760 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll 09:16:34.0410 0760 AeLookupSvc - ok 09:16:34.0441 0760 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys 09:16:34.0441 0760 AFD - ok 09:16:34.0472 0760 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys 09:16:34.0488 0760 agp440 - ok 09:16:34.0488 0760 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe 09:16:34.0488 0760 ALG - ok 09:16:34.0519 0760 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys 09:16:34.0519 0760 aliide - ok 09:16:34.0550 0760 [ 0D3E12216D6F956F05B0B555D53D7ABB ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe 09:16:34.0550 0760 AMD External Events Utility - ok 09:16:34.0566 0760 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys 09:16:34.0566 0760 amdide - ok 09:16:34.0581 0760 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys 09:16:34.0581 0760 AmdK8 - ok 09:16:34.0597 0760 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys 09:16:34.0597 0760 AmdPPM - ok 09:16:34.0628 0760 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys 09:16:34.0628 0760 amdsata - ok 09:16:34.0659 0760 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys 09:16:34.0659 0760 amdsbs - ok 09:16:34.0675 0760 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys 09:16:34.0675 0760 amdxata - ok 09:16:34.0706 0760 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys 09:16:34.0706 0760 AppID - ok 09:16:34.0722 0760 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll 09:16:34.0722 0760 AppIDSvc - ok 09:16:34.0753 0760 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll 09:16:34.0753 0760 Appinfo - ok 09:16:34.0862 0760 [ 7EF47644B74EBE721CC32211D3C35E76 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 09:16:34.0862 0760 Apple Mobile Device - ok 09:16:34.0893 0760 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys 09:16:34.0893 0760 arc - ok 09:16:34.0909 0760 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys 09:16:34.0925 0760 arcsas - ok 09:16:34.0940 0760 [ 0BD8FE611928363A6840DE25FB936EF4 ] asdrm C:\Windows\system32\DRIVERS\asdrm.sys 09:16:34.0940 0760 asdrm - ok 09:16:34.0940 0760 [ 35ACF6E4BC66C7CB43B16624F9A986EB ] asdrs C:\Windows\system32\DRIVERS\asdrs.sys 09:16:34.0940 0760 asdrs - ok 09:16:34.0971 0760 [ 3F9CA1ACFCB7CFF153B4B3DDB7E29373 ] asdsrv C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe 09:16:35.0003 0760 asdsrv - ok 09:16:35.0018 0760 [ 0BB90B97B7E952FFE876DB76CE213487 ] asdws C:\Windows\system32\DRIVERS\asdws.sys 09:16:35.0018 0760 asdws - ok 09:16:35.0112 0760 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 09:16:35.0112 0760 aspnet_state - ok 09:16:35.0127 0760 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys 09:16:35.0127 0760 AsyncMac - ok 09:16:35.0159 0760 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys 09:16:35.0159 0760 atapi - ok 09:16:35.0205 0760 [ 195786ED7A26E1913A4F9799FDBC2C71 ] athr C:\Windows\system32\DRIVERS\athrx.sys 09:16:35.0221 0760 athr - ok 09:16:35.0268 0760 [ B0790FF0E25B7A2674296052F2162C1A ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys 09:16:35.0268 0760 AtiHDAudioService - ok 09:16:35.0377 0760 [ 79CEB8D4F25CABE69F3762C90F5B06B8 ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys 09:16:35.0455 0760 atikmdag - ok 09:16:35.0533 0760 [ 26D973D6D9A0D133DFDA7D8C1ADC04B7 ] atillk64 C:\dell\drivers\R267410\atillk64.sys 09:16:35.0533 0760 atillk64 - ok 09:16:35.0580 0760 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll 09:16:35.0595 0760 AudioEndpointBuilder - ok 09:16:35.0611 0760 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll 09:16:35.0611 0760 AudioSrv - ok 09:16:35.0673 0760 [ 2718DC27571BD1E37813F5759D2DC118 ] AVP C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe 09:16:35.0673 0760 AVP - ok 09:16:35.0720 0760 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll 09:16:35.0720 0760 AxInstSV - ok 09:16:35.0751 0760 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys 09:16:35.0767 0760 b06bdrv - ok 09:16:35.0798 0760 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys 09:16:35.0814 0760 b57nd60a - ok 09:16:35.0845 0760 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll 09:16:35.0845 0760 BDESVC - ok 09:16:35.0845 0760 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys 09:16:35.0845 0760 Beep - ok 09:16:35.0892 0760 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll 09:16:35.0907 0760 BFE - ok 09:16:35.0923 0760 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll 09:16:35.0939 0760 BITS - ok 09:16:35.0954 0760 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys 09:16:35.0954 0760 blbdrive - ok 09:16:36.0017 0760 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 09:16:36.0017 0760 Bonjour Service - ok 09:16:36.0048 0760 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys 09:16:36.0048 0760 bowser - ok 09:16:36.0063 0760 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys 09:16:36.0063 0760 BrFiltLo - ok 09:16:36.0079 0760 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys 09:16:36.0079 0760 BrFiltUp - ok 09:16:36.0095 0760 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys 09:16:36.0095 0760 BridgeMP - ok 09:16:36.0157 0760 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll 09:16:36.0157 0760 Browser - ok 09:16:36.0188 0760 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys 09:16:36.0188 0760 Brserid - ok 09:16:36.0204 0760 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys 09:16:36.0204 0760 BrSerWdm - ok 09:16:36.0219 0760 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys 09:16:36.0219 0760 BrUsbMdm - ok 09:16:36.0235 0760 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys 09:16:36.0235 0760 BrUsbSer - ok 09:16:36.0251 0760 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys 09:16:36.0251 0760 BTHMODEM - ok 09:16:36.0282 0760 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll 09:16:36.0282 0760 bthserv - ok 09:16:36.0282 0760 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys 09:16:36.0282 0760 cdfs - ok 09:16:36.0329 0760 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\drivers\cdrom.sys 09:16:36.0329 0760 cdrom - ok 09:16:36.0375 0760 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll 09:16:36.0375 0760 CertPropSvc - ok 09:16:36.0391 0760 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys 09:16:36.0391 0760 circlass - ok 09:16:36.0407 0760 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys 09:16:36.0407 0760 CLFS - ok 09:16:36.0485 0760 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 09:16:36.0485 0760 clr_optimization_v2.0.50727_32 - ok 09:16:36.0500 0760 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 09:16:36.0500 0760 clr_optimization_v2.0.50727_64 - ok 09:16:36.0578 0760 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 09:16:36.0578 0760 clr_optimization_v4.0.30319_32 - ok 09:16:36.0594 0760 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 09:16:36.0594 0760 clr_optimization_v4.0.30319_64 - ok 09:16:36.0609 0760 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys 09:16:36.0609 0760 CmBatt - ok 09:16:36.0625 0760 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys 09:16:36.0625 0760 cmdide - ok 09:16:36.0672 0760 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys 09:16:36.0672 0760 CNG - ok 09:16:36.0687 0760 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys 09:16:36.0687 0760 Compbatt - ok 09:16:36.0719 0760 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys 09:16:36.0719 0760 CompositeBus - ok 09:16:36.0734 0760 COMSysApp - ok 09:16:36.0734 0760 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys 09:16:36.0734 0760 crcdisk - ok 09:16:36.0797 0760 [ C8BD651E13895B93ED9EC5B4F1DF42BC ] Creative ALchemy AL6 Licensing Service C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe 09:16:36.0797 0760 Creative ALchemy AL6 Licensing Service - ok 09:16:36.0797 0760 [ C0EAD9F8AB83D41FF07303C75589C2B8 ] Creative Audio Engine Licensing Service C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe 09:16:36.0797 0760 Creative Audio Engine Licensing Service - ok 09:16:36.0859 0760 [ D03466C36EF0E5C7694FF38B45271D9D ] Creative Media Toolbox 6 Licensing Service C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe 09:16:36.0859 0760 Creative Media Toolbox 6 Licensing Service - ok 09:16:36.0890 0760 [ 4F5414602E2544A4554D95517948B705 ] CryptSvc C:\Windows\system32\cryptsvc.dll 09:16:36.0906 0760 CryptSvc - ok 09:16:36.0937 0760 [ 07BA6D17E66879018B30B6C3F976EBED ] CTAudSvcService C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe 09:16:36.0953 0760 CTAudSvcService - ok 09:16:36.0999 0760 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll 09:16:37.0015 0760 DcomLaunch - ok 09:16:37.0031 0760 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll 09:16:37.0046 0760 defragsvc - ok 09:16:37.0077 0760 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys 09:16:37.0077 0760 DfsC - ok 09:16:37.0093 0760 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll 09:16:37.0109 0760 Dhcp - ok 09:16:37.0124 0760 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys 09:16:37.0124 0760 discache - ok 09:16:37.0155 0760 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys 09:16:37.0155 0760 Disk - ok 09:16:37.0187 0760 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll 09:16:37.0202 0760 Dnscache - ok 09:16:37.0233 0760 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll 09:16:37.0249 0760 dot3svc - ok 09:16:37.0265 0760 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll 09:16:37.0280 0760 DPS - ok 09:16:37.0311 0760 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys 09:16:37.0311 0760 drmkaud - ok 09:16:37.0358 0760 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys 09:16:37.0358 0760 DXGKrnl - ok 09:16:37.0374 0760 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll 09:16:37.0374 0760 EapHost - ok 09:16:37.0436 0760 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys 09:16:37.0483 0760 ebdrv - ok 09:16:37.0514 0760 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe 09:16:37.0514 0760 EFS - ok 09:16:37.0577 0760 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe 09:16:37.0592 0760 ehRecvr - ok 09:16:37.0608 0760 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe 09:16:37.0608 0760 ehSched - ok 09:16:37.0655 0760 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys 09:16:37.0655 0760 elxstor - ok 09:16:37.0670 0760 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys 09:16:37.0670 0760 ErrDev - ok 09:16:37.0701 0760 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll 09:16:37.0717 0760 EventSystem - ok 09:16:37.0748 0760 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys 09:16:37.0764 0760 exfat - ok 09:16:37.0779 0760 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys 09:16:37.0779 0760 fastfat - ok 09:16:37.0811 0760 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe 09:16:37.0826 0760 Fax - ok 09:16:37.0842 0760 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys 09:16:37.0842 0760 fdc - ok 09:16:37.0873 0760 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll 09:16:37.0873 0760 fdPHost - ok 09:16:37.0873 0760 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll 09:16:37.0873 0760 FDResPub - ok 09:16:37.0904 0760 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys 09:16:37.0904 0760 FileInfo - ok 09:16:37.0904 0760 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys 09:16:37.0904 0760 Filetrace - ok 09:16:37.0967 0760 [ F76D04F7413B07DAA029F6520B64B4E8 ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 09:16:37.0982 0760 FLEXnet Licensing Service - ok 09:16:38.0013 0760 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys 09:16:38.0013 0760 flpydisk - ok 09:16:38.0060 0760 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys 09:16:38.0076 0760 FltMgr - ok 09:16:38.0123 0760 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll 09:16:38.0138 0760 FontCache - ok 09:16:38.0185 0760 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 09:16:38.0185 0760 FontCache3.0.0.0 - ok 09:16:38.0201 0760 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys 09:16:38.0201 0760 FsDepends - ok 09:16:38.0247 0760 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys 09:16:38.0247 0760 Fs_Rec - ok 09:16:38.0294 0760 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys 09:16:38.0294 0760 fvevol - ok 09:16:38.0310 0760 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys 09:16:38.0310 0760 gagp30kx - ok 09:16:38.0357 0760 [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 09:16:38.0357 0760 GEARAspiWDM - ok 09:16:38.0388 0760 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll 09:16:38.0419 0760 gpsvc - ok 09:16:38.0435 0760 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys 09:16:38.0435 0760 hcw85cir - ok 09:16:38.0466 0760 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys 09:16:38.0481 0760 HdAudAddService - ok 09:16:38.0513 0760 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys 09:16:38.0513 0760 HDAudBus - ok 09:16:38.0528 0760 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys 09:16:38.0528 0760 HidBatt - ok 09:16:38.0528 0760 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys 09:16:38.0528 0760 HidBth - ok 09:16:38.0559 0760 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys 09:16:38.0559 0760 HidIr - ok 09:16:38.0575 0760 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\System32\hidserv.dll 09:16:38.0575 0760 hidserv - ok 09:16:38.0606 0760 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\drivers\hidusb.sys 09:16:38.0606 0760 HidUsb - ok 09:16:38.0637 0760 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll 09:16:38.0637 0760 hkmsvc - ok 09:16:38.0669 0760 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll 09:16:38.0684 0760 HomeGroupListener - ok 09:16:38.0715 0760 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll 09:16:38.0731 0760 HomeGroupProvider - ok 09:16:38.0747 0760 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys 09:16:38.0747 0760 HpSAMD - ok 09:16:38.0762 0760 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys 09:16:38.0793 0760 HTTP - ok 09:16:38.0809 0760 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys 09:16:38.0809 0760 hwpolicy - ok 09:16:38.0840 0760 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys 09:16:38.0840 0760 i8042prt - ok 09:16:38.0856 0760 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys 09:16:38.0856 0760 iaStorV - ok 09:16:38.0887 0760 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 09:16:38.0903 0760 idsvc - ok 09:16:38.0934 0760 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys 09:16:38.0934 0760 iirsp - ok 09:16:38.0949 0760 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll 09:16:38.0965 0760 IKEEXT - ok 09:16:38.0996 0760 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys 09:16:38.0996 0760 intelide - ok 09:16:39.0027 0760 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys 09:16:39.0027 0760 intelppm - ok 09:16:39.0043 0760 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll 09:16:39.0059 0760 IPBusEnum - ok 09:16:39.0090 0760 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys 09:16:39.0090 0760 IpFilterDriver - ok 09:16:39.0121 0760 [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll 09:16:39.0137 0760 iphlpsvc - ok 09:16:39.0152 0760 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys 09:16:39.0152 0760 IPMIDRV - ok 09:16:39.0168 0760 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys 09:16:39.0168 0760 IPNAT - ok 09:16:39.0215 0760 [ 50D6CCC6FF5561F9F56946B3E6164FB8 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 09:16:39.0215 0760 iPod Service - ok 09:16:39.0230 0760 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys 09:16:39.0230 0760 IRENUM - ok 09:16:39.0246 0760 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys 09:16:39.0246 0760 isapnp - ok 09:16:39.0261 0760 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys 09:16:39.0277 0760 iScsiPrt - ok 09:16:39.0308 0760 [ BD5BF20EC242E003A2F570B8754A56D1 ] ivusb C:\Windows\system32\DRIVERS\ivusb.sys 09:16:39.0308 0760 ivusb - ok 09:16:39.0308 0760 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\drivers\kbdclass.sys 09:16:39.0308 0760 kbdclass - ok 09:16:39.0339 0760 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys 09:16:39.0339 0760 kbdhid - ok 09:16:39.0355 0760 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe 09:16:39.0355 0760 KeyIso - ok 09:16:39.0402 0760 [ E656FE10D6D27794AFA08136685A69E8 ] KL1 C:\Windows\system32\DRIVERS\kl1.sys 09:16:39.0417 0760 KL1 - ok 09:16:39.0433 0760 [ D865DD8B0448E3F963D68C04C532858F ] kl2 C:\Windows\system32\DRIVERS\kl2.sys 09:16:39.0433 0760 kl2 - ok 09:16:39.0480 0760 [ C7D4F357C482DD37E2B05F34093B7B0C ] KLIF C:\Windows\system32\DRIVERS\klif.sys 09:16:39.0480 0760 KLIF - ok 09:16:39.0511 0760 [ 89FB5A33D7171B6D84F5EB721D5055E1 ] KLIM6 C:\Windows\system32\DRIVERS\klim6.sys 09:16:39.0511 0760 KLIM6 - ok 09:16:39.0542 0760 [ 9468D07E91BA136D82415F5DFC1FE168 ] klmouflt C:\Windows\system32\DRIVERS\klmouflt.sys 09:16:39.0542 0760 klmouflt - ok 09:16:39.0558 0760 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys 09:16:39.0558 0760 KSecDD - ok 09:16:39.0589 0760 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys 09:16:39.0589 0760 KSecPkg - ok 09:16:39.0605 0760 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys 09:16:39.0605 0760 ksthunk - ok 09:16:39.0636 0760 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll 09:16:39.0651 0760 KtmRm - ok 09:16:39.0698 0760 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\System32\srvsvc.dll 09:16:39.0714 0760 LanmanServer - ok 09:16:39.0745 0760 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll 09:16:39.0745 0760 LanmanWorkstation - ok 09:16:39.0761 0760 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys 09:16:39.0761 0760 lltdio - ok 09:16:39.0776 0760 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll 09:16:39.0807 0760 lltdsvc - ok 09:16:39.0823 0760 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll 09:16:39.0823 0760 lmhosts - ok 09:16:39.0839 0760 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys 09:16:39.0839 0760 LSI_FC - ok 09:16:39.0854 0760 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys 09:16:39.0854 0760 LSI_SAS - ok 09:16:39.0854 0760 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys 09:16:39.0854 0760 LSI_SAS2 - ok 09:16:39.0870 0760 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys 09:16:39.0885 0760 LSI_SCSI - ok 09:16:39.0885 0760 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys 09:16:39.0885 0760 luafv - ok 09:16:39.0917 0760 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll 09:16:39.0917 0760 Mcx2Svc - ok 09:16:39.0932 0760 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys 09:16:39.0932 0760 megasas - ok 09:16:39.0963 0760 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys 09:16:39.0963 0760 MegaSR - ok 09:16:39.0979 0760 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll 09:16:39.0979 0760 MMCSS - ok 09:16:39.0995 0760 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys 09:16:39.0995 0760 Modem - ok 09:16:40.0010 0760 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys 09:16:40.0010 0760 monitor - ok 09:16:40.0057 0760 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\drivers\mouclass.sys 09:16:40.0057 0760 mouclass - ok 09:16:40.0073 0760 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys 09:16:40.0073 0760 mouhid - ok 09:16:40.0104 0760 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys 09:16:40.0104 0760 mountmgr - ok 09:16:40.0151 0760 [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 09:16:40.0151 0760 MozillaMaintenance - ok 09:16:40.0182 0760 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys 09:16:40.0182 0760 mpio - ok 09:16:40.0197 0760 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys 09:16:40.0197 0760 mpsdrv - ok 09:16:40.0244 0760 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll 09:16:40.0260 0760 MpsSvc - ok 09:16:40.0275 0760 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys 09:16:40.0275 0760 MRxDAV - ok 09:16:40.0307 0760 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys 09:16:40.0307 0760 mrxsmb - ok 09:16:40.0338 0760 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys 09:16:40.0353 0760 mrxsmb10 - ok 09:16:40.0369 0760 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys 09:16:40.0369 0760 mrxsmb20 - ok 09:16:40.0400 0760 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys 09:16:40.0400 0760 msahci - ok 09:16:40.0416 0760 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys 09:16:40.0416 0760 msdsm - ok 09:16:40.0431 0760 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe 09:16:40.0447 0760 MSDTC - ok 09:16:40.0478 0760 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys 09:16:40.0478 0760 Msfs - ok 09:16:40.0494 0760 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys 09:16:40.0494 0760 mshidkmdf - ok 09:16:40.0509 0760 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys 09:16:40.0509 0760 msisadrv - ok 09:16:40.0525 0760 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll 09:16:40.0541 0760 MSiSCSI - ok 09:16:40.0541 0760 msiserver - ok 09:16:40.0572 0760 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys 09:16:40.0572 0760 MSKSSRV - ok 09:16:40.0587 0760 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys 09:16:40.0587 0760 MSPCLOCK - ok 09:16:40.0603 0760 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys 09:16:40.0603 0760 MSPQM - ok 09:16:40.0619 0760 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys 09:16:40.0634 0760 MsRPC - ok 09:16:40.0650 0760 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys 09:16:40.0650 0760 mssmbios - ok 09:16:40.0712 0760 MSSQLSERVER - ok 09:16:40.0806 0760 [ 04EF36EAF5C4DBCE424D81B76F1E9231 ] MSSQLServerADHelper100 c:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE 09:16:40.0806 0760 MSSQLServerADHelper100 - ok 09:16:40.0821 0760 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys 09:16:40.0821 0760 MSTEE - ok 09:16:40.0821 0760 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys 09:16:40.0821 0760 MTConfig - ok 09:16:40.0837 0760 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys 09:16:40.0837 0760 Mup - ok 09:16:40.0868 0760 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll 09:16:40.0884 0760 napagent - ok 09:16:40.0931 0760 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys 09:16:40.0946 0760 NativeWifiP - ok 09:16:40.0977 0760 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys 09:16:41.0009 0760 NDIS - ok 09:16:41.0024 0760 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys 09:16:41.0024 0760 NdisCap - ok 09:16:41.0055 0760 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys 09:16:41.0055 0760 NdisTapi - ok 09:16:41.0071 0760 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys 09:16:41.0071 0760 Ndisuio - ok 09:16:41.0102 0760 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys 09:16:41.0102 0760 NdisWan - ok 09:16:41.0133 0760 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys 09:16:41.0133 0760 NDProxy - ok 09:16:41.0149 0760 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys 09:16:41.0149 0760 NetBIOS - ok 09:16:41.0196 0760 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys 09:16:41.0211 0760 NetBT - ok 09:16:41.0211 0760 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe 09:16:41.0211 0760 Netlogon - ok 09:16:41.0227 0760 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll 09:16:41.0243 0760 Netman - ok 09:16:41.0274 0760 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 09:16:41.0289 0760 NetMsmqActivator - ok 09:16:41.0305 0760 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 09:16:41.0305 0760 NetPipeActivator - ok 09:16:41.0321 0760 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll 09:16:41.0336 0760 netprofm - ok 09:16:41.0352 0760 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 09:16:41.0352 0760 NetTcpActivator - ok 09:16:41.0367 0760 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 09:16:41.0367 0760 NetTcpPortSharing - ok 09:16:41.0383 0760 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys 09:16:41.0383 0760 nfrd960 - ok 09:16:41.0430 0760 [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc C:\Windows\System32\nlasvc.dll 09:16:41.0445 0760 NlaSvc - ok 09:16:41.0445 0760 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys 09:16:41.0445 0760 Npfs - ok 09:16:41.0461 0760 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll 09:16:41.0461 0760 nsi - ok 09:16:41.0477 0760 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys 09:16:41.0477 0760 nsiproxy - ok 09:16:41.0523 0760 [ A2F74975097F52A00745F9637451FDD8 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys 09:16:41.0555 0760 Ntfs - ok 09:16:41.0555 0760 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys 09:16:41.0555 0760 Null - ok 09:16:41.0601 0760 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys 09:16:41.0601 0760 nvraid - ok 09:16:41.0633 0760 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys 09:16:41.0633 0760 nvstor - ok 09:16:41.0664 0760 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys 09:16:41.0664 0760 nv_agp - ok 09:16:41.0711 0760 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 09:16:41.0726 0760 odserv - ok 09:16:41.0742 0760 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys 09:16:41.0742 0760 ohci1394 - ok 09:16:41.0773 0760 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 09:16:41.0773 0760 ose - ok 09:16:41.0789 0760 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll 09:16:41.0804 0760 p2pimsvc - ok 09:16:41.0835 0760 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll 09:16:41.0851 0760 p2psvc - ok 09:16:41.0882 0760 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys 09:16:41.0882 0760 Parport - ok 09:16:41.0913 0760 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys 09:16:41.0913 0760 partmgr - ok 09:16:41.0913 0760 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll 09:16:41.0929 0760 PcaSvc - ok 09:16:42.0007 0760 [ 7317A0B550F7AC0223B7070897670476 ] PCDSRVC{1E208CE0-FB7451FF-06020101}_0 c:\program files\dell support center\pcdsrvc_x64.pkms 09:16:42.0007 0760 PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - ok 09:16:42.0023 0760 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys 09:16:42.0023 0760 pci - ok 09:16:42.0054 0760 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys 09:16:42.0054 0760 pciide - ok 09:16:42.0085 0760 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys 09:16:42.0101 0760 pcmcia - ok 09:16:42.0132 0760 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys 09:16:42.0132 0760 pcw - ok 09:16:42.0179 0760 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys 09:16:42.0179 0760 PEAUTH - ok 09:16:42.0257 0760 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe 09:16:42.0257 0760 PerfHost - ok 09:16:42.0319 0760 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll 09:16:42.0350 0760 pla - ok 09:16:42.0381 0760 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll 09:16:42.0397 0760 PlugPlay - ok 09:16:42.0413 0760 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll 09:16:42.0413 0760 PNRPAutoReg - ok 09:16:42.0428 0760 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll 09:16:42.0428 0760 PNRPsvc - ok 09:16:42.0444 0760 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll 09:16:42.0475 0760 PolicyAgent - ok 09:16:42.0491 0760 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll 09:16:42.0491 0760 Power - ok 09:16:42.0537 0760 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys 09:16:42.0537 0760 PptpMiniport - ok 09:16:42.0553 0760 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys 09:16:42.0553 0760 Processor - ok 09:16:42.0569 0760 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll 09:16:42.0584 0760 ProfSvc - ok 09:16:42.0600 0760 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe 09:16:42.0600 0760 ProtectedStorage - ok 09:16:42.0631 0760 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys 09:16:42.0631 0760 Psched - ok 09:16:42.0662 0760 [ AED797CCA02783296C68AA10D0CFF8A9 ] PxHlpa64 C:\Windows\system32\Drivers\PxHlpa64.sys 09:16:42.0662 0760 PxHlpa64 - ok 09:16:42.0709 0760 [ EE46F431B25C14778D2E89D6F10F1D65 ] QBCFMonitorService C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe 09:16:42.0709 0760 QBCFMonitorService - ok 09:16:42.0756 0760 [ 6BEE1814470DC12FA20C53DFC3C97EBB ] QBFCService C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe 09:16:42.0756 0760 QBFCService - ok 09:16:42.0818 0760 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys 09:16:42.0834 0760 ql2300 - ok 09:16:42.0865 0760 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys 09:16:42.0865 0760 ql40xx - ok 09:16:42.0881 0760 QuickBooksDB20 - ok 09:16:42.0896 0760 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll 09:16:42.0912 0760 QWAVE - ok 09:16:42.0927 0760 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys 09:16:42.0927 0760 QWAVEdrv - ok 09:16:42.0927 0760 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys 09:16:42.0927 0760 RasAcd - ok 09:16:42.0959 0760 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys 09:16:42.0959 0760 RasAgileVpn - ok 09:16:42.0974 0760 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll 09:16:42.0974 0760 RasAuto - ok 09:16:42.0990 0760 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys 09:16:42.0990 0760 Rasl2tp - ok 09:16:43.0021 0760 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll 09:16:43.0052 0760 RasMan - ok 09:16:43.0068 0760 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys 09:16:43.0068 0760 RasPppoe - ok 09:16:43.0083 0760 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys 09:16:43.0083 0760 RasSstp - ok 09:16:43.0099 0760 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys 09:16:43.0115 0760 rdbss - ok 09:16:43.0130 0760 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys 09:16:43.0130 0760 rdpbus - ok 09:16:43.0146 0760 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys 09:16:43.0146 0760 RDPCDD - ok 09:16:43.0146 0760 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys 09:16:43.0146 0760 RDPENCDD - ok 09:16:43.0161 0760 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys 09:16:43.0161 0760 RDPREFMP - ok 09:16:43.0177 0760 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys 09:16:43.0208 0760 RDPWD - ok 09:16:43.0239 0760 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys 09:16:43.0239 0760 rdyboost - ok 09:16:43.0255 0760 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll 09:16:43.0255 0760 RemoteAccess - ok 09:16:43.0286 0760 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll 09:16:43.0302 0760 RemoteRegistry - ok 09:16:43.0411 0760 [ E0BEF062C8950B698E3D79DF432AD250 ] RoxLiveShare10 C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe 09:16:43.0411 0760 RoxLiveShare10 - ok 09:16:43.0489 0760 [ 8475CEF8C9C7DE0918C61235ED06606A ] RoxMediaDB10 C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe 09:16:43.0520 0760 RoxMediaDB10 - ok 09:16:43.0536 0760 [ 5AB029B4CF15E5FD7BBA73694856C477 ] RoxWatch10 C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe 09:16:43.0536 0760 RoxWatch10 - ok 09:16:43.0551 0760 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll 09:16:43.0551 0760 RpcEptMapper - ok 09:16:43.0567 0760 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe 09:16:43.0567 0760 RpcLocator - ok 09:16:43.0614 0760 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll 09:16:43.0614 0760 RpcSs - ok 09:16:43.0661 0760 [ EB1C539E621A35A49F7692B0EB565AB9 ] RsFx0150 C:\Windows\system32\DRIVERS\RsFx0150.sys 09:16:43.0676 0760 RsFx0150 - ok 09:16:43.0692 0760 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys 09:16:43.0692 0760 rspndr - ok 09:16:43.0707 0760 [ ABCB5A38A0D85BDF69B7877E1AD1EED5 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys 09:16:43.0707 0760 RTL8167 - ok 09:16:43.0723 0760 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe 09:16:43.0723 0760 SamSs - ok 09:16:43.0754 0760 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys 09:16:43.0754 0760 sbp2port - ok 09:16:43.0770 0760 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll 09:16:43.0785 0760 SCardSvr - ok 09:16:43.0817 0760 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys 09:16:43.0817 0760 scfilter - ok 09:16:43.0848 0760 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll 09:16:43.0879 0760 Schedule - ok 09:16:43.0910 0760 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll 09:16:43.0910 0760 SCPolicySvc - ok 09:16:43.0941 0760 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll 09:16:43.0957 0760 SDRSVC - ok 09:16:43.0988 0760 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys 09:16:43.0988 0760 secdrv - ok 09:16:44.0019 0760 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll 09:16:44.0019 0760 seclogon - ok 09:16:44.0035 0760 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll 09:16:44.0035 0760 SENS - ok 09:16:44.0051 0760 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll 09:16:44.0051 0760 SensrSvc - ok 09:16:44.0066 0760 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys 09:16:44.0066 0760 Serenum - ok 09:16:44.0082 0760 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys 09:16:44.0097 0760 Serial - ok 09:16:44.0129 0760 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys 09:16:44.0129 0760 sermouse - ok 09:16:44.0175 0760 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll 09:16:44.0175 0760 SessionEnv - ok 09:16:44.0222 0760 SessionLauncher - ok 09:16:44.0269 0760 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys 09:16:44.0269 0760 sffdisk - ok 09:16:44.0269 0760 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys 09:16:44.0269 0760 sffp_mmc - ok 09:16:44.0285 0760 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys 09:16:44.0285 0760 sffp_sd - ok 09:16:44.0300 0760 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys 09:16:44.0300 0760 sfloppy - ok 09:16:44.0316 0760 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll 09:16:44.0331 0760 SharedAccess - ok 09:16:44.0363 0760 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll 09:16:44.0378 0760 ShellHWDetection - ok 09:16:44.0394 0760 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys 09:16:44.0394 0760 SiSRaid2 - ok 09:16:44.0409 0760 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys 09:16:44.0409 0760 SiSRaid4 - ok 09:16:44.0425 0760 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys 09:16:44.0441 0760 Smb - ok 09:16:44.0472 0760 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe 09:16:44.0472 0760 SNMPTRAP - ok 09:16:44.0487 0760 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys 09:16:44.0487 0760 spldr - ok 09:16:44.0519 0760 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe 09:16:44.0519 0760 Spooler - ok 09:16:44.0581 0760 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe 09:16:44.0643 0760 sppsvc - ok 09:16:44.0643 0760 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll 09:16:44.0659 0760 sppuinotify - ok 09:16:44.0706 0760 [ 7D67C07C63796775CC5492BCFEAFF125 ] SQLBrowser c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe 09:16:44.0721 0760 SQLBrowser - ok 09:16:44.0815 0760 [ BEA7FEA5BB31EB58D78971F821AE6844 ] SQLSERVERAGENT c:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE 09:16:44.0831 0760 SQLSERVERAGENT - ok 09:16:44.0924 0760 [ F98DDFBFE0EE66D4C4B00693512B9527 ] SQLWriter c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 09:16:44.0924 0760 SQLWriter - ok 09:16:44.0955 0760 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys 09:16:44.0955 0760 srv - ok 09:16:44.0971 0760 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys 09:16:44.0971 0760 srv2 - ok 09:16:44.0987 0760 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys 09:16:44.0987 0760 srvnet - ok 09:16:45.0018 0760 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll 09:16:45.0033 0760 SSDPSRV - ok 09:16:45.0033 0760 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll 09:16:45.0049 0760 SstpSvc - ok 09:16:45.0065 0760 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys 09:16:45.0065 0760 stexstor - ok 09:16:45.0111 0760 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll 09:16:45.0127 0760 stisvc - ok 09:16:45.0174 0760 [ 5889618EEBD7D2FF13C30D73FCFF8CD0 ] stllssvr C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe 09:16:45.0174 0760 stllssvr - ok 09:16:45.0205 0760 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys 09:16:45.0205 0760 swenum - ok 09:16:45.0221 0760 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll 09:16:45.0236 0760 swprv - ok 09:16:45.0283 0760 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll 09:16:45.0314 0760 SysMain - ok 09:16:45.0361 0760 [ 6B153E518DBE6EF59191152E1ECF7ED4 ] t3 C:\Windows\system32\drivers\t3.sys 09:16:45.0361 0760 t3 - ok 09:16:45.0392 0760 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll 09:16:45.0392 0760 TabletInputService - ok 09:16:45.0423 0760 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll 09:16:45.0439 0760 TapiSrv - ok 09:16:45.0470 0760 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll 09:16:45.0470 0760 TBS - ok 09:16:45.0517 0760 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] Tcpip C:\Windows\system32\drivers\tcpip.sys 09:16:45.0548 0760 Tcpip - ok 09:16:45.0579 0760 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys 09:16:45.0579 0760 TCPIP6 - ok 09:16:45.0611 0760 [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys 09:16:45.0611 0760 tcpipreg - ok 09:16:45.0626 0760 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys 09:16:45.0626 0760 TDPIPE - ok 09:16:45.0657 0760 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys 09:16:45.0657 0760 TDTCP - ok 09:16:45.0673 0760 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys 09:16:45.0673 0760 tdx - ok 09:16:45.0704 0760 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys 09:16:45.0704 0760 TermDD - ok 09:16:45.0751 0760 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll 09:16:45.0751 0760 TermService - ok 09:16:45.0767 0760 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll 09:16:45.0767 0760 Themes - ok 09:16:45.0798 0760 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll 09:16:45.0798 0760 THREADORDER - ok 09:16:45.0813 0760 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll 09:16:45.0813 0760 TrkWks - ok 09:16:45.0845 0760 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe 09:16:45.0845 0760 TrustedInstaller - ok 09:16:45.0845 0760 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys 09:16:45.0845 0760 tssecsrv - ok 09:16:45.0891 0760 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys 09:16:45.0891 0760 TsUsbFlt - ok 09:16:45.0938 0760 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys 09:16:45.0938 0760 tunnel - ok 09:16:45.0954 0760 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys 09:16:45.0954 0760 uagp35 - ok 09:16:46.0001 0760 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys 09:16:46.0001 0760 udfs - ok 09:16:46.0016 0760 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe 09:16:46.0016 0760 UI0Detect - ok 09:16:46.0016 0760 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys 09:16:46.0032 0760 uliagpkx - ok 09:16:46.0063 0760 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\drivers\umbus.sys 09:16:46.0063 0760 umbus - ok 09:16:46.0094 0760 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys 09:16:46.0094 0760 UmPass - ok 09:16:46.0110 0760 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll 09:16:46.0125 0760 upnphost - ok 09:16:46.0141 0760 [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys 09:16:46.0141 0760 USBAAPL64 - ok 09:16:46.0157 0760 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys 09:16:46.0157 0760 usbccgp - ok 09:16:46.0203 0760 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys 09:16:46.0203 0760 usbcir - ok 09:16:46.0203 0760 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys 09:16:46.0203 0760 usbehci - ok 09:16:46.0235 0760 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys 09:16:46.0235 0760 usbhub - ok 09:16:46.0250 0760 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys 09:16:46.0250 0760 usbohci - ok 09:16:46.0266 0760 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys 09:16:46.0266 0760 usbprint - ok 09:16:46.0281 0760 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS 09:16:46.0281 0760 USBSTOR - ok 09:16:46.0281 0760 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys 09:16:46.0281 0760 usbuhci - ok 09:16:46.0313 0760 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll 09:16:46.0313 0760 UxSms - ok 09:16:46.0313 0760 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe 09:16:46.0313 0760 VaultSvc - ok 09:16:46.0328 0760 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys 09:16:46.0328 0760 vdrvroot - ok 09:16:46.0359 0760 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe 09:16:46.0375 0760 vds - ok 09:16:46.0391 0760 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys 09:16:46.0391 0760 vga - ok 09:16:46.0391 0760 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys 09:16:46.0391 0760 VgaSave - ok 09:16:46.0406 0760 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys 09:16:46.0422 0760 vhdmp - ok 09:16:46.0453 0760 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys 09:16:46.0453 0760 viaide - ok 09:16:46.0453 0760 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys 09:16:46.0453 0760 volmgr - ok 09:16:46.0484 0760 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys 09:16:46.0500 0760 volmgrx - ok 09:16:46.0515 0760 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys 09:16:46.0515 0760 volsnap - ok 09:16:46.0547 0760 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys 09:16:46.0562 0760 vsmraid - ok 09:16:46.0609 0760 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe 09:16:46.0640 0760 VSS - ok 09:16:46.0640 0760 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys 09:16:46.0640 0760 vwifibus - ok 09:16:46.0656 0760 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys 09:16:46.0656 0760 vwififlt - ok 09:16:46.0671 0760 [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys 09:16:46.0671 0760 vwifimp - ok 09:16:46.0703 0760 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll 09:16:46.0718 0760 W32Time - ok 09:16:46.0734 0760 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys 09:16:46.0734 0760 WacomPen - ok 09:16:46.0749 0760 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys 09:16:46.0749 0760 WANARP - ok 09:16:46.0765 0760 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys 09:16:46.0765 0760 Wanarpv6 - ok 09:16:46.0812 0760 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe 09:16:46.0843 0760 WatAdminSvc - ok 09:16:46.0874 0760 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe 09:16:46.0905 0760 wbengine - ok 09:16:46.0937 0760 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll 09:16:46.0937 0760 WbioSrvc - ok 09:16:46.0952 0760 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll 09:16:46.0968 0760 wcncsvc - ok 09:16:46.0968 0760 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll 09:16:46.0983 0760 WcsPlugInService - ok 09:16:46.0999 0760 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys 09:16:46.0999 0760 Wd - ok 09:16:47.0030 0760 [ A3D04EBF5227886029B4532F20D026F7 ] WDC_SAM C:\Windows\system32\DRIVERS\wdcsam64.sys 09:16:47.0030 0760 WDC_SAM - ok 09:16:47.0046 0760 [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys 09:16:47.0061 0760 Wdf01000 - ok 09:16:47.0077 0760 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll 09:16:47.0077 0760 WdiServiceHost - ok 09:16:47.0077 0760 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll 09:16:47.0077 0760 WdiSystemHost - ok 09:16:47.0108 0760 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll 09:16:47.0139 0760 WebClient - ok 09:16:47.0139 0760 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll 09:16:47.0155 0760 Wecsvc - ok 09:16:47.0171 0760 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll 09:16:47.0171 0760 wercplsupport - ok 09:16:47.0186 0760 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll 09:16:47.0186 0760 WerSvc - ok 09:16:47.0202 0760 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys 09:16:47.0202 0760 WfpLwf - ok 09:16:47.0202 0760 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys 09:16:47.0202 0760 WIMMount - ok 09:16:47.0217 0760 WinDefend - ok 09:16:47.0233 0760 WinHttpAutoProxySvc - ok 09:16:47.0264 0760 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll 09:16:47.0264 0760 Winmgmt - ok 09:16:47.0295 0760 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll 09:16:47.0342 0760 WinRM - ok 09:16:47.0373 0760 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys 09:16:47.0373 0760 WinUsb - ok 09:16:47.0389 0760 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll 09:16:47.0420 0760 Wlansvc - ok 09:16:47.0498 0760 [ 2BACD71123F42CEA603F4E205E1AE337 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 09:16:47.0514 0760 wlidsvc - ok 09:16:47.0529 0760 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys 09:16:47.0529 0760 WmiAcpi - ok 09:16:47.0561 0760 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe 09:16:47.0561 0760 wmiApSrv - ok 09:16:47.0576 0760 WMPNetworkSvc - ok 09:16:47.0592 0760 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll 09:16:47.0592 0760 WPCSvc - ok 09:16:47.0623 0760 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll 09:16:47.0623 0760 WPDBusEnum - ok 09:16:47.0639 0760 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys 09:16:47.0639 0760 ws2ifsl - ok 09:16:47.0639 0760 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\system32\wscsvc.dll 09:16:47.0639 0760 wscsvc - ok 09:16:47.0654 0760 WSearch - ok 09:16:47.0701 0760 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll 09:16:47.0748 0760 wuauserv - ok 09:16:47.0763 0760 [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf C:\Windows\system32\drivers\WudfPf.sys 09:16:47.0779 0760 WudfPf - ok 09:16:47.0810 0760 [ CF8D590BE3373029D57AF80914190682 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys 09:16:47.0810 0760 WUDFRd - ok 09:16:47.0841 0760 [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc C:\Windows\System32\WUDFSvc.dll 09:16:47.0841 0760 wudfsvc - ok 09:16:47.0873 0760 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll 09:16:47.0873 0760 WwanSvc - ok 09:16:47.0888 0760 ================ Scan global =============================== 09:16:47.0904 0760 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll 09:16:47.0919 0760 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll 09:16:47.0935 0760 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll 09:16:47.0951 0760 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll 09:16:47.0982 0760 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe 09:16:47.0982 0760 [Global] - ok 09:16:47.0982 0760 ================ Scan MBR ================================== 09:16:47.0982 0760 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0 09:16:48.0153 0760 \Device\Harddisk0\DR0 - ok 09:16:48.0153 0760 [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk1\DR1 09:16:48.0169 0760 \Device\Harddisk1\DR1 - ok 09:16:48.0169 0760 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk6\DR6 09:16:48.0169 0760 \Device\Harddisk6\DR6 - ok 09:16:48.0169 0760 ================ Scan VBR ================================== 09:16:48.0169 0760 [ D479F7AA2A3876858A0D8B5EECF0C573 ] \Device\Harddisk0\DR0\Partition1 09:16:48.0169 0760 \Device\Harddisk0\DR0\Partition1 - ok 09:16:48.0185 0760 [ 3A9DAC3A376C04BD6D4E8EC967909163 ] \Device\Harddisk0\DR0\Partition2 09:16:48.0185 0760 \Device\Harddisk0\DR0\Partition2 - ok 09:16:48.0185 0760 [ A8C6C79D5A6578E4182962A8B6611316 ] \Device\Harddisk1\DR1\Partition1 09:16:48.0185 0760 \Device\Harddisk1\DR1\Partition1 - ok 09:16:48.0185 0760 [ 12465CB012D0FF36E8A8E89B655EF92A ] \Device\Harddisk6\DR6\Partition1 09:16:48.0200 0760 \Device\Harddisk6\DR6\Partition1 - ok 09:16:48.0200 0760 ============================================================ 09:16:48.0200 0760 Scan finished 09:16:48.0200 0760 ============================================================ 09:16:48.0200 5328 Detected object count: 0 09:16:48.0200 5328 Actual detected object count: 0

patndoris

Post #6October 4, 2012, 8:11 PM UTC

Boot your computer in Safe Mode

Turn the computer on or Restart the computer
As soon as BIOS is loaded, start tapping the F8 key.
The Windows Advanced Options Menu appears.
If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Use the arrow keys to select the Safe Mode with Networking menu option.
Press Enter.
The computer then begins to start in Safe mode.
Log into your usual account
Double click on Combofix and run it as per the previous instructions. If it prompts to allow for update please do so.
When you are finished with all troubleshooting, close all programs and restart the computer as you normally would.

Please let me know if it runs ok this way. If not, we will try a different method.

David714

Post #7October 5, 2012, 2:00 AM UTC

I had an unexpected trip out of town come up. I will be back Monday and I will post the results then. I didn't want you to close my thread thinking I'd abandoned it. Thanks.

patndoris

Post #8October 6, 2012, 5:11 PM UTC

No problem. Thank you for letting me know. I can keep this open until you return.

David714

Post #9October 8, 2012, 2:58 PM UTC

Thank you for waiting. My ComboFix log is included below. ComboFix.txt log ComboFix 12-10-08.01 - Krystal 10/08/2012 9:37.2.8 - x64 NETWORKMicrosoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12279.10290 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984} FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF} SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Krystal\AppData\Local\Diagnostics\Deployment\kvokl.dll c:\users\Krystal\GoToAssistDownloadHelper.exe c:\windows\A5F4E84E0C164F6EA68C60AFC943350E.dll c:\windows\SysWow64\FlashPlayerInstaller.exe . . ((((((((((((((((((((((((( Files Created from 2012-09-08 to 2012-10-08 ))))))))))))))))))))))))))))))) . . 2012-10-08 14:43 . 2012-10-08 14:43 ——– d—–w- c:\users\QBDataServiceUser20\AppData\Local\temp 2012-10-08 14:43 . 2012-10-08 14:43 ——– d—–w- c:\users\MSSQL$CREATIVESOLUTION\AppData\Local\temp 2012-10-08 14:43 . 2012-10-08 14:43 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-10-05 06:53 . 2012-08-30 07:27 9308616 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EF1A4078-1699-4322-933E-DEC7F8462CD1}\mpengine.dll 2012-10-02 15:18 . 2012-10-02 15:18 ——– d—–w- c:\users\Krystal\AppData\Local\ElevatedDiagnostics 2012-10-02 15:12 . 2012-10-02 15:12 ——– d—–w- c:\users\Krystal\AppData\Roaming\Anvisoft 2012-10-02 15:12 . 2012-10-02 15:12 ——– d—–w- c:\programdata\Anvisoft 2012-10-02 15:12 . 2012-08-20 09:23 23376 —-a-w- c:\windows\system32\drivers\asdrs.sys 2012-10-02 15:12 . 2012-08-20 09:23 18768 —-a-w- c:\windows\system32\drivers\asdrm.sys 2012-10-02 15:12 . 2012-08-20 09:23 17232 —-a-w- c:\windows\system32\drivers\asdws.sys 2012-10-02 15:12 . 2012-10-02 15:12 ——– d—–w- c:\program files (x86)\Anvisoft 2012-10-01 17:02 . 2012-10-01 17:02 ——– d—–w- c:\users\Krystal\AppData\Roaming\SUPERAntiSpyware.com 2012-09-27 17:03 . 2012-09-27 17:03 ——– d—–w- c:\users\Krystal\AppData\Local\Creative Solutions 2012-09-27 16:30 . 2012-09-27 16:30 ——– d—–w- c:\program files (x86)\Microsoft SDKs 2012-09-27 16:30 . 2012-09-27 16:30 ——– d—–w- c:\program files (x86)\Microsoft Synchronization Services 2012-09-27 15:20 . 2010-04-03 18:51 47456 —-a-w- c:\windows\SysWow64\perf-MSSQL10_50.MSSQLSERVER-sqlagtctr.dll 2012-09-27 15:20 . 2010-04-03 17:57 77152 —-a-w- c:\windows\system32\perf-MSSQL10_50.MSSQLSERVER-sqlagtctr.dll 2012-09-27 15:20 . 2010-04-03 17:57 79200 —-a-w- c:\windows\system32\perf-MSSQLSERVER-sqlctr10.50.1600.1.dll 2012-09-27 15:19 . 2012-09-27 15:19 ——– d—–w- c:\windows\system32\RsFx 2012-09-27 15:19 . 2012-09-27 16:30 ——– d—–w- c:\program files (x86)\Microsoft Visual Studio 9.0 2012-09-27 15:19 . 2012-09-27 15:19 ——– d—–w- c:\program files\Microsoft Visual Studio 9.0 2012-09-27 15:18 . 2012-09-27 15:18 ——– d—–w- c:\program files\Microsoft.NET 2012-09-27 15:17 . 2012-09-27 15:17 ——– d—–w- c:\windows\SysWow64\1033 2012-09-27 15:17 . 2012-09-27 15:17 ——– d—–w- c:\windows\system32\1033 2012-09-26 01:18 . 2012-08-21 21:01 245760 —-a-w- c:\windows\system32\OxpsConverter.exe 2012-09-21 16:02 . 2012-09-21 16:02 ——– d—–w- C:\Accounting CS 2012.1.0 Download 2012-09-12 00:04 . 2012-08-22 18:12 950128 —-a-w- c:\windows\system32\drivers\ndis.sys 2012-09-12 00:04 . 2012-07-04 20:26 41472 —-a-w- c:\windows\system32\drivers\RNDISMP.sys 2012-09-12 00:04 . 2012-08-02 17:58 574464 —-a-w- c:\windows\system32\d3d10level9.dll 2012-09-12 00:04 . 2012-08-02 16:57 490496 —-a-w- c:\windows\SysWow64\d3d10level9.dll 2012-09-12 00:03 . 2012-08-22 18:12 1913200 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-09-12 00:03 . 2012-08-22 18:12 376688 —-a-w- c:\windows\system32\drivers\netio.sys 2012-09-12 00:03 . 2012-08-22 18:12 288624 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2012-09-11 15:52 . 2012-09-11 15:52 0 —-a-w- c:\windows\ativpsrm.bin 2012-09-11 15:50 . 2012-09-11 15:50 ——– d—–w- c:\program files\Common Files\ATI Technologies 2012-09-11 15:49 . 2012-09-11 15:49 ——– d—–w- c:\program files (x86)\ATI Technologies 2012-09-11 15:49 . 2012-09-11 15:49 ——– d—–w- c:\program files\ATI 2012-09-11 15:49 . 2012-09-11 15:49 ——– d—–w- c:\program files\ATI Technologies 2012-09-11 15:39 . 2012-09-11 15:40 ——– d—–w- c:\program files (x86)\Driver Cleaner Pro 2012-09-11 15:15 . 2012-09-11 15:20 ——– d—–w- c:\program files (x86)\Driver Fusion . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-04 15:36 . 2012-08-14 19:42 73136 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-10-04 15:36 . 2012-08-14 19:42 696240 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-09-12 08:01 . 2011-02-17 17:19 64462936 —-a-w- c:\windows\system32\MRT.exe 2012-09-07 22:04 . 2011-06-20 19:47 25928 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-07-28 03:47 . 2012-07-28 03:47 187392 —-a-w- c:\windows\system32\clinfo.exe 2012-07-28 03:47 . 2012-07-28 03:47 63488 —-a-w- c:\windows\system32\OVDecode64.dll 2012-07-28 03:47 . 2012-07-28 03:47 56320 —-a-w- c:\windows\SysWow64\OVDecode.dll 2012-07-28 03:43 . 2012-07-28 03:43 70144 —-a-w- c:\windows\system32\coinst_8.982.dll 2012-07-18 18:15 . 2012-08-14 19:25 3148800 —-a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X] "VolPanel"="c:\program files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2009-02-03 237693] "Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2012-07-31 41944] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-28 59280] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "Anvi Smart Defender"="c:\program files (x86)\Anvisoft\Anvi Smart Defender\ASDTray.exe" [2012-08-23 1229104] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "ConsentPromptBehaviorAdmin"= 0 (0x0) "EnableLUA"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . R1 asdrm;asdrm;c:\windows\system32\DRIVERS\asdrm.sys [2012-08-20 18768] R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-09-19 202752] R2 asdrs;AntiMalware Host-based Intrusion Prevention System;c:\windows\system32\DRIVERS\asdrs.sys [2012-08-20 23376] R2 asdsrv;Anvi Smart Defender Realtime Guard Service;c:\program files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe [2012-08-23 686896] R2 asdws;AnviSmartDefender Web Guard;c:\windows\system32\DRIVERS\asdws.sys [2012-08-20 17232] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 SessionLauncher;SessionLauncher;c:\users\Krystal\AppData\Local\Temp\DX9\SessionLauncher.exe [x] R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896] R3 atillk64;atillk64;c:\dell\drivers\R267410\atillk64.sys [2006-07-19 14608] R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-07-29 29720] R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-03 22544] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-19 114144] R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2012-04-10 25072] R3 QuickBooksDB20;QuickBooksDB20;c:\progra~2\Intuit\QUICKB~1\QBDBMgrN.exe [2009-08-18 678912] R3 t3;Sound Blaster X-Fi Xtreme Audio;c:\windows\system32\drivers\t3.sys [2009-05-06 639512] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-02-17 1255736] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464] R4 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-02-17 79360] R4 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-02-17 79360] R4 Creative Media Toolbox 6 Licensing Service;Creative Media Toolbox 6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [2011-02-17 79360] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2010-04-03 59744] R4 RoxLiveShare10;LiveShare P2P Server 10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [2009-06-10 309744] R4 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-10 1124848] R4 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [2009-06-10 166384] R4 RsFx0150;RsFx0150 Driver;c:\windows\system32\DRIVERS\RsFx0150.sys [2010-04-03 313696] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-05-20 55280] S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2011-03-04 11864] S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2011-03-11 29488] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-03-02 187392] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920] . . Contents of the 'Scheduled Tasks' folder . 2012-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473717349-1388009716-367698941-1000Core.job - c:\users\Krystal\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-07 15:23] . 2012-10-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473717349-1388009716-367698941-1000UA.job - c:\users\Krystal\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-07 15:23] . . ——— X64 Entries ———– . . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.yahoo.com/?fr=fp-yie9 mStart Page = hxxp://www.yahoo.com/?fr=fp-yie9 mDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie9 mLocal Page = c:\windows\system32\blank.htm uInternet Settings,ProxyOverride = *.local mSearchAssistant = about:blank IE: Add to Anti-Banner - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm Trusted Zone: facebook.com\apps TCP: DhcpNameServer = 192.168.1.254 DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab FF - ProfilePath - c:\users\Krystal\AppData\Roaming\Mozilla\Firefox\Profiles\ujdhaxyv.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2559647&SearchSource=3&q={searchTerms} FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2559647&SearchSource=2&q= . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-MobileDocuments - c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe Wow6432Node-HKCU-Run-Deployment - c:\users\Krystal\AppData\Local\Diagnostics\Deployment\kvokl.dll Wow6432Node-HKLM-Run- - (no file) Wow6432Node-HKU-Default-Run-Deployment - c:\users\Krystal\AppData\Local\Diagnostics\Deployment\kvokl.dll AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-ExamMatrix CPA Exam Review 2011 - c:\users\Krystal\ExamMatrix\ExamMatrix CPA Exam Review 2011\Uninstall ExamMatrix CPA Exam Review 2011 . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0] "ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-1473717349-1388009716-367698941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (S-1-5-21-1473717349-1388009716-367698941-1000) @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-1473717349-1388009716-367698941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (S-1-5-21-1473717349-1388009716-367698941-1000) @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_278_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_278_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}] @Denied: (A) (Everyone) "Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane\0] "Key"="ActionsPane" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-10-08 09:45:38 ComboFix-quarantined-files.txt 2012-10-08 14:45 . Pre-Run: 356,870,868,992 bytes free Post-Run: 356,654,161,920 bytes free . - - End Of File - - 9AF5D70F0404DF839C0A0F2438849C95

patndoris

Post #10October 8, 2012, 3:40 PM UTC

Are you still getting the redirects?

David714

Post #11October 8, 2012, 7:50 PM UTC

So far no more redirects. My IE browser doesnt' seem too stable though. It has been slow and locked up several times. I've gotten the internet explorer has encountered a problem and needs to close message a few times. This may be totally unrelated to the original problem I don't know. Thanks for your response.

patndoris

Post #12October 8, 2012, 9:10 PM UTC

So that we don't have conflicts with Kaspersky, I would recommend turning off Windows Defender. To do this:

Open Windows Defender by clicking the Start button , clicking All Programs, and then clicking Windows Defender.
Click Tools, and then click Options.
Under Administrator options, select or clear the Use Windows Defender check box, and then click Save.

If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

DDS::
Trusted Zone: facebook.com\apps

Firefox::
FF - ProfilePath - c:\users\Krystal\AppData\Roaming\Mozilla\Firefox\Profiles\ujdhaxyv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2559647&SearchSource=3&q={searchTerms}
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2559647&SearchSource=2&q=

ClearJavaCache::

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe. ComboFix may request an update; please allow it.

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Be sure to tell me how Internet Explorer is behaving now please.

David714

Post #13October 9, 2012, 8:17 PM UTC

So far it seems to be doing ok. Still no more redirects and seems more stable. ComboFix.txt log below. ComboFix 12-10-09.01 - Krystal 10/09/2012 13:38:11.3.8 - x64 NETWORK Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12279.10858 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Krystal\Desktop\CFScript.txt AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984} FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF} SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((( Files Created from 2012-09-09 to 2012-10-09 ))))))))))))))))))))))))))))))) . . 2012-10-09 18:43 . 2012-10-09 18:43 ——– d—–w- c:\users\QBDataServiceUser20\AppData\Local\temp 2012-10-09 18:43 . 2012-10-09 18:43 ——– d—–w- c:\users\MSSQL$CREATIVESOLUTION\AppData\Local\temp 2012-10-09 18:43 . 2012-10-09 18:43 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-10-09 15:05 . 2012-10-09 18:03 ——– d—–w- c:\program files (x86)\DeleteFilesPermanently 2012-10-09 14:26 . 2012-08-21 18:01 33240 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-10-09 14:25 . 2012-10-09 14:26 ——– d—–w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69 2012-10-09 14:25 . 2012-10-09 14:26 ——– d—–w- c:\program files\iTunes 2012-10-09 14:25 . 2012-10-09 14:25 ——– d—–w- c:\program files\iPod 2012-10-09 06:17 . 2012-08-30 07:27 9308616 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{476C7FCC-0A6E-4DE1-B436-FE5B7B14E854}\mpengine.dll 2012-10-02 15:18 . 2012-10-02 15:18 ——– d—–w- c:\users\Krystal\AppData\Local\ElevatedDiagnostics 2012-10-02 15:12 . 2012-10-02 15:12 ——– d—–w- c:\users\Krystal\AppData\Roaming\Anvisoft 2012-10-02 15:12 . 2012-10-02 15:12 ——– d—–w- c:\programdata\Anvisoft 2012-10-02 15:12 . 2012-08-20 09:23 23376 —-a-w- c:\windows\system32\drivers\asdrs.sys 2012-10-02 15:12 . 2012-08-20 09:23 18768 —-a-w- c:\windows\system32\drivers\asdrm.sys 2012-10-02 15:12 . 2012-08-20 09:23 17232 —-a-w- c:\windows\system32\drivers\asdws.sys 2012-10-02 15:12 . 2012-10-02 15:12 ——– d—–w- c:\program files (x86)\Anvisoft 2012-10-01 17:02 . 2012-10-01 17:02 ——– d—–w- c:\users\Krystal\AppData\Roaming\SUPERAntiSpyware.com 2012-09-27 17:03 . 2012-09-27 17:03 ——– d—–w- c:\users\Krystal\AppData\Local\Creative Solutions 2012-09-27 16:30 . 2012-09-27 16:30 ——– d—–w- c:\program files (x86)\Microsoft SDKs 2012-09-27 16:30 . 2012-09-27 16:30 ——– d—–w- c:\program files (x86)\Microsoft Synchronization Services 2012-09-27 15:20 . 2010-04-03 18:51 47456 —-a-w- c:\windows\SysWow64\perf-MSSQL10_50.MSSQLSERVER-sqlagtctr.dll 2012-09-27 15:20 . 2010-04-03 17:57 77152 —-a-w- c:\windows\system32\perf-MSSQL10_50.MSSQLSERVER-sqlagtctr.dll 2012-09-27 15:20 . 2010-04-03 17:57 79200 —-a-w- c:\windows\system32\perf-MSSQLSERVER-sqlctr10.50.1600.1.dll 2012-09-27 15:19 . 2012-09-27 15:19 ——– d—–w- c:\windows\system32\RsFx 2012-09-27 15:19 . 2012-09-27 16:30 ——– d—–w- c:\program files (x86)\Microsoft Visual Studio 9.0 2012-09-27 15:19 . 2012-09-27 15:19 ——– d—–w- c:\program files\Microsoft Visual Studio 9.0 2012-09-27 15:18 . 2012-09-27 15:18 ——– d—–w- c:\program files\Microsoft.NET 2012-09-27 15:17 . 2012-09-27 15:17 ——– d—–w- c:\windows\SysWow64\1033 2012-09-27 15:17 . 2012-09-27 15:17 ——– d—–w- c:\windows\system32\1033 2012-09-26 01:18 . 2012-08-21 21:01 245760 —-a-w- c:\windows\system32\OxpsConverter.exe 2012-09-21 16:02 . 2012-09-21 16:02 ——– d—–w- C:\Accounting CS 2012.1.0 Download 2012-09-12 00:04 . 2012-08-22 18:12 950128 —-a-w- c:\windows\system32\drivers\ndis.sys 2012-09-12 00:04 . 2012-07-04 20:26 41472 —-a-w- c:\windows\system32\drivers\RNDISMP.sys 2012-09-12 00:04 . 2012-08-02 17:58 574464 —-a-w- c:\windows\system32\d3d10level9.dll 2012-09-12 00:04 . 2012-08-02 16:57 490496 —-a-w- c:\windows\SysWow64\d3d10level9.dll 2012-09-12 00:03 . 2012-08-22 18:12 1913200 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-09-12 00:03 . 2012-08-22 18:12 376688 —-a-w- c:\windows\system32\drivers\netio.sys 2012-09-12 00:03 . 2012-08-22 18:12 288624 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2012-09-11 15:52 . 2012-09-11 15:52 0 —-a-w- c:\windows\ativpsrm.bin 2012-09-11 15:50 . 2012-09-11 15:50 ——– d—–w- c:\program files\Common Files\ATI Technologies 2012-09-11 15:49 . 2012-09-11 15:49 ——– d—–w- c:\program files (x86)\ATI Technologies 2012-09-11 15:49 . 2012-09-11 15:49 ——– d—–w- c:\program files\ATI 2012-09-11 15:49 . 2012-09-11 15:49 ——– d—–w- c:\program files\ATI Technologies 2012-09-11 15:39 . 2012-09-11 15:40 ——– d—–w- c:\program files (x86)\Driver Cleaner Pro 2012-09-11 15:15 . 2012-09-11 15:20 ——– d—–w- c:\program files (x86)\Driver Fusion . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-04 15:36 . 2012-08-14 19:42 73136 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-10-04 15:36 . 2012-08-14 19:42 696240 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-09-12 08:01 . 2011-02-17 17:19 64462936 —-a-w- c:\windows\system32\MRT.exe 2012-09-07 22:04 . 2011-06-20 19:47 25928 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-08-21 18:01 . 2012-03-05 15:34 125872 —-a-w- c:\windows\system32\GEARAspi64.dll 2012-08-21 18:01 . 2012-03-05 15:34 106928 —-a-w- c:\windows\SysWow64\GEARAspi.dll 2012-07-28 03:47 . 2012-07-28 03:47 187392 —-a-w- c:\windows\system32\clinfo.exe 2012-07-28 03:47 . 2012-07-28 03:47 63488 —-a-w- c:\windows\system32\OVDecode64.dll 2012-07-28 03:47 . 2012-07-28 03:47 56320 —-a-w- c:\windows\SysWow64\OVDecode.dll 2012-07-28 03:43 . 2012-07-28 03:43 70144 —-a-w- c:\windows\system32\coinst_8.982.dll 2012-07-18 18:15 . 2012-08-14 19:25 3148800 —-a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X] "VolPanel"="c:\program files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2009-02-03 237693] "Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2012-07-31 41944] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-28 59280] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "Anvi Smart Defender"="c:\program files (x86)\Anvisoft\Anvi Smart Defender\ASDTray.exe" [2012-08-23 1229104] "avp"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-25 202296] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-10 421776] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "ConsentPromptBehaviorAdmin"= 0 (0x0) "EnableLUA"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . R1 asdrm;asdrm;c:\windows\system32\DRIVERS\asdrm.sys [2012-08-20 18768] R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-09-19 202752] R2 asdrs;AntiMalware Host-based Intrusion Prevention System;c:\windows\system32\DRIVERS\asdrs.sys [2012-08-20 23376] R2 asdsrv;Anvi Smart Defender Realtime Guard Service;c:\program files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe [2012-08-23 686896] R2 asdws;AnviSmartDefender Web Guard;c:\windows\system32\DRIVERS\asdws.sys [2012-08-20 17232] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 SessionLauncher;SessionLauncher;c:\users\Krystal\AppData\Local\Temp\DX9\SessionLauncher.exe [x] R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896] R3 atillk64;atillk64;c:\dell\drivers\R267410\atillk64.sys [2006-07-19 14608] R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-07-29 29720] R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-03 22544] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-19 114144] R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2012-04-10 25072] R3 QuickBooksDB20;QuickBooksDB20;c:\progra~2\Intuit\QUICKB~1\QBDBMgrN.exe [2009-08-18 678912] R3 t3;Sound Blaster X-Fi Xtreme Audio;c:\windows\system32\drivers\t3.sys [2009-05-06 639512] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-02-17 1255736] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464] R4 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-02-17 79360] R4 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-02-17 79360] R4 Creative Media Toolbox 6 Licensing Service;Creative Media Toolbox 6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [2011-02-17 79360] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2010-04-03 59744] R4 RoxLiveShare10;LiveShare P2P Server 10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [2009-06-10 309744] R4 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-10 1124848] R4 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [2009-06-10 166384] R4 RsFx0150;RsFx0150 Driver;c:\windows\system32\DRIVERS\RsFx0150.sys [2010-04-03 313696] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-05-20 55280] S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2011-03-04 11864] S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2011-03-11 29488] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-03-02 187392] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920] . . Contents of the 'Scheduled Tasks' folder . 2012-10-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473717349-1388009716-367698941-1000Core.job - c:\users\Krystal\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-07 15:23] . 2012-10-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473717349-1388009716-367698941-1000UA.job - c:\users\Krystal\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-07 15:23] . . ——— X64 Entries ———– . . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.yahoo.com/?fr=fp-yie9 mStart Page = hxxp://www.yahoo.com/?fr=fp-yie9 mDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie9 mLocal Page = c:\windows\system32\blank.htm uInternet Settings,ProxyOverride = *.local mSearchAssistant = about:blank TCP: DhcpNameServer = 192.168.1.254 DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab FF - ProfilePath - c:\users\Krystal\AppData\Roaming\Mozilla\Firefox\Profiles\ujdhaxyv.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run- - (no file) AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0] "ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-1473717349-1388009716-367698941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (S-1-5-21-1473717349-1388009716-367698941-1000) @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-1473717349-1388009716-367698941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (S-1-5-21-1473717349-1388009716-367698941-1000) @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_278_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_278_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}] @Denied: (A) (Everyone) "Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane\0] "Key"="ActionsPane" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-10-09 13:45:59 ComboFix-quarantined-files.txt 2012-10-09 18:45 ComboFix2.txt 2012-10-08 14:45 . Pre-Run: 357,225,934,848 bytes free Post-Run: 356,828,278,784 bytes free . - - End Of File - - B1BF3636C730503DA0A9FE9C17EB8764

patndoris

Post #14October 9, 2012, 8:34 PM UTC

Great to hear things are better. Since different tools look in different places, let's run a couple more scans to check nothing else is hiding anywhere.

I see you have Malwarebytes already on your machine. Please run it by right-clicking and choosing Run as Administrator on the icon on the desktop.

Click on the tab labeled Update and then click on the button Check for updates.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

This scan make take awhile depending on how many items are on the computer. You may want to run it at a time you won't be needing the machine. It should be run from IE and I'd recommend not doing anything else while it's running.

Go here to run an online scannner from ESET.

Note: For browsers other than Internet Explorer, you will need to download and install esetsmartinstaller_enu.exe. Click on it and save the file to a convenient location. Double click on it to install and a new window will open.
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic and also let me know how things are now.

David714

Post #15October 11, 2012, 2:34 PM UTC

Thanks for you help. I think everything is working much better. Malwarebytes log: Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Database version: v2012.10.10.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Krystal :: KRYSTAL-PC [administrator] 10/10/2012 3:13:58 PM mbam-log-2012-10-10 (15-13-58).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 274968 Time elapsed: 3 minute(s), 18 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ESET log: ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK OnlineScanner.ocx - registred OK

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Beesq.net redirect [Solved]

✨ Ask AI

Ask AI