Hi, I've got this pesky "Winzip Registry Optimizer" popping up continuously and can't figure out how to get rid of it. I also ran Task Manager and noticed DWM running and I don't know what it is. My computer is running quite slow. Any help would be greatly appreciated!!
Thanks, Dave
Hello,
Welcome to
WhatTheTech . My name is
mowman , and I will be helping you fix your problems.
If you do not make a reply in 3 days, we will have to close your topic.
You may want to keep the link to this topic in your favorites. Alternatively, you can click the
Options button at the top bar of this topic and
Track this topic. The topics you are tracking can be found by clicking on
My Topics at the top of any page.
Please take note of some guidelines for this fix:
•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply .
Only attach them if requested or if they do not fit into the post
Please download
TDSSKiller.zip Extract it to your desktop Double click TDSSKiller.exe Press Start Scan Only if Malicious Cure is selectedsuspicious objects are found select skip Then click Continue > Reboot now Copy and paste the log in your next replyA copy of the log will be saved automatically to the root of the drive (typically C:\)
Please download DDS by sUBs from one of the following links and save it to your desktop.
Disable any script blocking protection (How to Disable your Security Programs ) Double click DDS icon to run the tool (may take up to 3 minutes to run) When done, DDS.txt will open. After a few moments, attach.txt will open in a second window. Save both reports to your desktop. —————————————————
Post DDS.txt and Attach.txt in your next reply
Hi, thank you for your help. It looks like TDSSKiller didn't find anything malicious. Here is the report:
12:37:00.0775 4060 TDSS rootkit removing tool 2.8.10.0 Sep 17 2012 19:23:24
12:37:01.0149 4060 ============================================================
12:37:01.0149 4060 Current date / time: 2012/10/13 12:37:01.0149
12:37:01.0149 4060 SystemInfo:
12:37:01.0149 4060
12:37:01.0149 4060 OS Version: 6.1.7601 ServicePack: 1.0
12:37:01.0149 4060 Product type: Workstation
12:37:01.0150 4060 ComputerName: DAVE-PC
12:37:01.0150 4060 UserName: Dave
12:37:01.0150 4060 Windows directory: C:\Windows
12:37:01.0150 4060 System windows directory: C:\Windows
12:37:01.0150 4060 Processor architecture: Intel x86
12:37:01.0150 4060 Number of processors: 2
12:37:01.0150 4060 Page size: 0x1000
12:37:01.0150 4060 Boot type: Normal boot
12:37:01.0150 4060 ============================================================
12:37:04.0991 4060 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
12:37:04.0994 4060 ============================================================
12:37:04.0994 4060 \Device\Harddisk0\DR0:
12:37:04.0994 4060 MBR partitions:
12:37:04.0994 4060 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x240922A8
12:37:04.0995 4060 ============================================================
12:37:05.0074 4060 C: <-> \Device\Harddisk0\DR0\Partition1
12:37:05.0075 4060 ============================================================
12:37:05.0075 4060 Initialize success
12:37:05.0075 4060 ============================================================
12:37:06.0830 4824 ============================================================
12:37:06.0830 4824 Scan started
12:37:06.0830 4824 Mode: Manual;
12:37:06.0830 4824 ============================================================
12:37:12.0553 4824 ================ Scan system memory ========================
12:37:12.0553 4824 System memory - ok
12:37:12.0555 4824 ================ Scan services =============================
12:37:13.0273 4824 [ 1B133875B8AA8AC48969BD3458AFE9F5 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
12:37:13.0276 4824 1394ohci - ok
12:37:13.0339 4824 [ CEA80C80BED809AA0DA6FEBC04733349 ] ACPI C:\Windows\system32\drivers\ACPI.sys
12:37:13.0345 4824 ACPI - ok
12:37:13.0483 4824 [ 1EFBC664ABFF416D1D07DB115DCB264F ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
12:37:13.0484 4824 AcpiPmi - ok
12:37:13.0686 4824 [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
12:37:13.0687 4824 AdobeARMservice - ok
12:37:13.0978 4824 [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
12:37:13.0982 4824 AdobeFlashPlayerUpdateSvc - ok
12:37:14.0038 4824 [ 21E785EBD7DC90A06391141AAC7892FB ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
12:37:14.0046 4824 adp94xx - ok
12:37:14.0096 4824 [ 0C676BC278D5B59FF5ABD57BBE9123F2 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
12:37:14.0102 4824 adpahci - ok
12:37:14.0146 4824 [ 7C7B5EE4B7B822EC85321FE23A27DB33 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
12:37:14.0149 4824 adpu320 - ok
12:37:14.0217 4824 [ 8B5EEFEEC1E6D1A72A06C526628AD161 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
12:37:14.0219 4824 AeLookupSvc - ok
12:37:14.0334 4824 [ 9EBBBA55060F786F0FCAA3893BFA2806 ] AFD C:\Windows\system32\drivers\afd.sys
12:37:14.0340 4824 AFD - ok
12:37:14.0583 4824 [ 507812C3054C21CEF746B6EE3D04DD6E ] agp440 C:\Windows\system32\drivers\agp440.sys
12:37:14.0608 4824 agp440 - ok
12:37:14.0875 4824 [ 8B30250D573A8F6B4BD23195160D8707 ] aic78xx C:\Windows\system32\DRIVERS\djsvs.sys
12:37:14.0936 4824 aic78xx - ok
12:37:15.0108 4824 [ 18A54E132947CD98FEA9ACCC57F98F13 ] ALG C:\Windows\System32\alg.exe
12:37:15.0111 4824 ALG - ok
12:37:15.0171 4824 [ 0D40BCF52EA90FC7DF2AEAB6503DEA44 ] aliide C:\Windows\system32\drivers\aliide.sys
12:37:15.0173 4824 aliide - ok
12:37:15.0229 4824 [ 3C6600A0696E90A463771C7422E23AB5 ] amdagp C:\Windows\system32\drivers\amdagp.sys
12:37:15.0231 4824 amdagp - ok
12:37:15.0264 4824 [ CD5914170297126B6266860198D1D4F0 ] amdide C:\Windows\system32\drivers\amdide.sys
12:37:15.0266 4824 amdide - ok
12:37:15.0317 4824 [ 00DDA200D71BAC534BF56A9DB5DFD666 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
12:37:15.0319 4824 AmdK8 - ok
12:37:15.0364 4824 [ 3CBF30F5370FDA40DD3E87DF38EA53B6 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
12:37:15.0366 4824 AmdPPM - ok
12:37:15.0452 4824 [ D320BF87125326F996D4904FE24300FC ] amdsata C:\Windows\system32\drivers\amdsata.sys
12:37:15.0455 4824 amdsata - ok
12:37:15.0570 4824 [ EA43AF0C423FF267355F74E7A53BDABA ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
12:37:15.0575 4824 amdsbs - ok
12:37:15.0667 4824 [ 46387FB17B086D16DEA267D5BE23A2F2 ] amdxata C:\Windows\system32\drivers\amdxata.sys
12:37:15.0668 4824 amdxata - ok
12:37:15.0719 4824 [ AEA177F783E20150ACE5383EE368DA19 ] AppID C:\Windows\system32\drivers\appid.sys
12:37:15.0721 4824 AppID - ok
12:37:15.0775 4824 [ 62A9C86CB6085E20DB4823E4E97826F5 ] AppIDSvc C:\Windows\System32\appidsvc.dll
12:37:15.0777 4824 AppIDSvc - ok
12:37:15.0889 4824 [ FB1959012294D6AD43E5304DF65E3C26 ] Appinfo C:\Windows\System32\appinfo.dll
12:37:15.0890 4824 Appinfo - ok
12:37:16.0004 4824 [ 7EF47644B74EBE721CC32211D3C35E76 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
12:37:16.0007 4824 Apple Mobile Device - ok
12:37:16.0155 4824 [ A45D184DF6A8803DA13A0B329517A64A ] AppMgmt C:\Windows\System32\appmgmts.dll
12:37:16.0160 4824 AppMgmt - ok
12:37:16.0216 4824 [ 2932004F49677BD84DBC72EDB754FFB3 ] arc C:\Windows\system32\DRIVERS\arc.sys
12:37:16.0218 4824 arc - ok
12:37:16.0292 4824 [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7 ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
12:37:16.0294 4824 arcsas - ok
12:37:16.0327 4824 [ ADD2ADE1C2B285AB8378D2DAAF991481 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
12:37:16.0328 4824 AsyncMac - ok
12:37:16.0444 4824 [ 338C86357871C167A96AB976519BF59E ] atapi C:\Windows\system32\drivers\atapi.sys
12:37:16.0444 4824 atapi - ok
12:37:16.0553 4824 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
12:37:16.0570 4824 AudioEndpointBuilder - ok
12:37:16.0612 4824 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] Audiosrv C:\Windows\System32\Audiosrv.dll
12:37:16.0617 4824 Audiosrv - ok
12:37:16.0725 4824 [ 6E30D02AAC9CAC84F421622E3A2F6178 ] AxInstSV C:\Windows\System32\AxInstSV.dll
12:37:16.0727 4824 AxInstSV - ok
12:37:16.0856 4824 [ 1A231ABEC60FD316EC54C66715543CEC ] b06bdrv C:\Windows\system32\DRIVERS\bxvbdx.sys
12:37:16.0864 4824 b06bdrv - ok
12:37:16.0929 4824 [ BD8869EB9CDE6BBE4508D869929869EE ] b57nd60x C:\Windows\system32\DRIVERS\b57nd60x.sys
12:37:16.0934 4824 b57nd60x - ok
12:37:17.0029 4824 [ EB7C2DADF52F50F69F198C14C3556DC1 ] BCM43XX C:\Windows\system32\DRIVERS\bcmwl6.sys
12:37:17.0063 4824 BCM43XX - ok
12:37:17.0162 4824 [ EE1E9C3BB8228AE423DD38DB69128E71 ] BDESVC C:\Windows\System32\bdesvc.dll
12:37:17.0165 4824 BDESVC - ok
12:37:17.0202 4824 [ 505506526A9D467307B3C393DEDAF858 ] Beep C:\Windows\system32\drivers\Beep.sys
12:37:17.0205 4824 Beep - ok
12:37:17.0274 4824 [ 1E2BAC209D184BB851E1A187D8A29136 ] BFE C:\Windows\System32\bfe.dll
12:37:17.0293 4824 BFE - ok
12:37:17.0388 4824 [ E585445D5021971FAE10393F0F1C3961 ] BITS C:\Windows\system32\qmgr.dll
12:37:17.0451 4824 BITS - ok
12:37:17.0468 4824 [ 2287078ED48FCFC477B05B20CF38F36F ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
12:37:17.0470 4824 blbdrive - ok
12:37:17.0659 4824 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
12:37:17.0665 4824 Bonjour Service - ok
12:37:17.0733 4824 [ 8F2DA3028D5FCBD1A060A3DE64CD6506 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
12:37:17.0735 4824 bowser - ok
12:37:17.0837 4824 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
12:37:17.0839 4824 BrFiltLo - ok
12:37:17.0861 4824 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
12:37:17.0862 4824 BrFiltUp - ok
12:37:17.0901 4824 [ 3DAA727B5B0A45039B0E1C9A211B8400 ] Browser C:\Windows\System32\browser.dll
12:37:17.0903 4824 Browser - ok
12:37:17.0938 4824 [ 845B8CE732E67F3B4133164868C666EA ] Brserid C:\Windows\System32\Drivers\Brserid.sys
12:37:17.0944 4824 Brserid - ok
12:37:18.0004 4824 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
12:37:18.0661 4824 BrSerWdm - ok
12:37:18.0747 4824 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
12:37:18.0749 4824 BrUsbMdm - ok
12:37:18.0762 4824 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
12:37:18.0763 4824 BrUsbSer - ok
12:37:18.0829 4824 [ 2865A5C8E98C70C605F417908CEBB3A4 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
12:37:18.0831 4824 BthEnum - ok
12:37:18.0995 4824 [ D8ABBCB42C550FD3A29DEC6DAABD0A87 ] BthFilterHelper C:\Program Files\CSR\Vista Profile Pack\BthFilterHelper.exe
12:37:18.0996 4824 BthFilterHelper - ok
12:37:19.0072 4824 [ ED3DF7C56CE0084EB2034432FC56565A ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
12:37:19.0074 4824 BTHMODEM - ok
12:37:19.0112 4824 [ AD1872E5829E8A2C3B5B4B641C3EAB0E ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
12:37:19.0114 4824 BthPan - ok
12:37:19.0188 4824 [ 1153DE2E4F5941E10C399CB5592F78A1 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
12:37:19.0198 4824 BTHPORT - ok
12:37:19.0244 4824 [ 1DF19C96EEF6C29D1C3E1A8678E07190 ] bthserv C:\Windows\system32\bthserv.dll
12:37:19.0245 4824 bthserv - ok
12:37:19.0305 4824 [ C81E9413A25A439F436B1D4B6A0CF9E9 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
12:37:19.0308 4824 BTHUSB - ok
12:37:19.0789 4824 catchme - ok
12:37:20.0053 4824 [ ED5411A69C5BAC78D245C893AF64352A ] cbVSCService C:\Program Files\Cobian Backup 10\cbVSCService.exe
12:37:20.0055 4824 cbVSCService - ok
12:37:20.0431 4824 [ 77EA11B065E0A8AB902D78145CA51E10 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
12:37:20.0434 4824 cdfs - ok
12:37:20.0528 4824 [ BE167ED0FDB9C1FA1133953C18D5A6C9 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
12:37:20.0531 4824 cdrom - ok
12:37:20.0650 4824 [ 319C6B309773D063541D01DF8AC6F55F ] CertPropSvc C:\Windows\System32\certprop.dll
12:37:20.0652 4824 CertPropSvc - ok
12:37:20.0787 4824 [ 3FE3FE94A34DF6FB06E6418D0F6A0060 ] circlass C:\Windows\system32\DRIVERS\circlass.sys
12:37:20.0847 4824 circlass - ok
12:37:20.0990 4824 [ 635181E0E9BBF16871BF5380D71DB02D ] CLFS C:\Windows\system32\CLFS.sys
12:37:21.0073 4824 CLFS - ok
12:37:21.0410 4824 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:37:21.0413 4824 clr_optimization_v2.0.50727_32 - ok
12:37:21.0547 4824 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
12:37:21.0707 4824 clr_optimization_v4.0.30319_32 - ok
12:37:21.0737 4824 [ DEA805815E587DAD1DD2C502220B5616 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
12:37:21.0739 4824 CmBatt - ok
12:37:21.0783 4824 [ C537B1DB64D495B9B4717B4D6D9EDBF2 ] cmdide C:\Windows\system32\drivers\cmdide.sys
12:37:21.0785 4824 cmdide - ok
12:37:21.0837 4824 [ 247B4CE2DAB1160CD422D532D5241E1F ] CNG C:\Windows\system32\Drivers\cng.sys
12:37:21.0857 4824 CNG - ok
12:37:22.0017 4824 [ 06302EA7EDA9DCDD7F82CEC2A03D2015 ] CobianBackup10 C:\Program Files\Cobian Backup 10\cbService.exe
12:37:22.0070 4824 CobianBackup10 - ok
12:37:22.0134 4824 [ A6023D3823C37043986713F118A89BEE ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
12:37:22.0136 4824 Compbatt - ok
12:37:22.0239 4824 [ CBE8C58A8579CFE5FCCF809E6F114E89 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
12:37:22.0240 4824 CompositeBus - ok
12:37:22.0276 4824 COMSysApp - ok
12:37:22.0297 4824 [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
12:37:22.0298 4824 crcdisk - ok
12:37:22.0554 4824 [ E811AA921C33005B310826B8562161AC ] CrossLoopService C:\Users\Dave\AppData\Local\CrossLoop\CrossLoopService.exe
12:37:22.0572 4824 CrossLoopService - ok
12:37:22.0805 4824 [ 96C0E38905CFD788313BE8E11DAE3F2F ] CryptSvc C:\Windows\system32\cryptsvc.dll
12:37:22.0808 4824 CryptSvc - ok
12:37:22.0947 4824 [ 3C2177A897B4CA2788C6FB0C3FD81D4B ] CSC C:\Windows\system32\drivers\csc.sys
12:37:22.0956 4824 CSC - ok
12:37:23.0044 4824 [ 15F93B37F6801943360D9EB42485D5D3 ] CscService C:\Windows\System32\cscsvc.dll
12:37:23.0060 4824 CscService - ok
12:37:23.0257 4824 [ 8E1945984E147562F9F08E1D344A69CC ] CSRBC C:\Windows\system32\Drivers\csrbcxp.sys
12:37:23.0259 4824 CSRBC - ok
12:37:23.0644 4824 [ 7CAAF4AF453EF3582FEF65DD72CAA0AA ] dc3d C:\Windows\system32\DRIVERS\dc3d.sys
12:37:23.0646 4824 dc3d - ok
12:37:24.0215 4824 [ 7660F01D3B38ACA1747E397D21D790AF ] DcomLaunch C:\Windows\system32\rpcss.dll
12:37:24.0222 4824 DcomLaunch - ok
12:37:24.0318 4824 [ 8D6E10A2D9A5EED59562D9B82CF804E1 ] defragsvc C:\Windows\System32\defragsvc.dll
12:37:24.0323 4824 defragsvc - ok
12:37:24.0537 4824 [ F024449C97EC1E464AAFFDA18593DB88 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
12:37:24.0540 4824 DfsC - ok
12:37:24.0666 4824 dgderdrv - ok
12:37:24.0770 4824 [ E9E01EB683C132F7FA27CD607B8A2B63 ] Dhcp C:\Windows\system32\dhcpcore.dll
12:37:24.0775 4824 Dhcp - ok
12:37:24.0842 4824 [ 1A050B0274BFB3890703D490F330C0DA ] discache C:\Windows\system32\drivers\discache.sys
12:37:24.0844 4824 discache - ok
12:37:24.0879 4824 [ 565003F326F99802E68CA78F2A68E9FF ] Disk C:\Windows\system32\DRIVERS\disk.sys
12:37:24.0881 4824 Disk - ok
12:37:24.0943 4824 [ 33EF4861F19A0736B11314AAD9AE28D0 ] Dnscache C:\Windows\System32\dnsrslvr.dll
12:37:24.0946 4824 Dnscache - ok
12:37:25.0279 4824 [ 366BA8FB4B7BB7435E3B9EACB3843F67 ] dot3svc C:\Windows\System32\dot3svc.dll
12:37:25.0308 4824 dot3svc - ok
12:37:25.0406 4824 [ B5E479EB83707DD698F66953E922042C ] dot4 C:\Windows\system32\DRIVERS\Dot4.sys
12:37:25.0410 4824 dot4 - ok
12:37:25.0493 4824 [ CAEFD09B6A6249C53A67D55A9A9FCABF ] Dot4Print C:\Windows\system32\DRIVERS\Dot4Prt.sys
12:37:25.0495 4824 Dot4Print - ok
12:37:25.0701 4824 [ 9F7DE667C505CE6500BECDD8E11644D7 ] Dot4Scan C:\Windows\system32\DRIVERS\Dot4Scan.sys
12:37:25.0703 4824 Dot4Scan - ok
12:37:25.0761 4824 [ CF491FF38D62143203C065260567E2F7 ] dot4usb C:\Windows\system32\DRIVERS\dot4usb.sys
12:37:25.0763 4824 dot4usb - ok
12:37:25.0867 4824 [ 8EC04CA86F1D68DA9E11952EB85973D6 ] DPS C:\Windows\system32\dps.dll
12:37:25.0870 4824 DPS - ok
12:37:26.0111 4824 [ F7BDA38AFBDA04F0A89DEBA767EEDA79 ] DragonSvc C:\Program Files\Common Files\Nuance\dgnsvc.exe
12:37:26.0117 4824 DragonSvc - ok
12:37:26.0169 4824 [ B918E7C5F9BF77202F89E1A9539F2EB4 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
12:37:26.0170 4824 drmkaud - ok
12:37:26.0353 4824 [ 23F5D28378A160352BA8F817BD8C71CB ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
12:37:26.0374 4824 DXGKrnl - ok
12:37:26.0439 4824 [ 8600142FA91C1B96367D3300AD0F3F3A ] EapHost C:\Windows\System32\eapsvc.dll
12:37:26.0441 4824 EapHost - ok
12:37:26.0597 4824 [ 024E1B5CAC09731E4D868E64DBFB4AB0 ] ebdrv C:\Windows\system32\DRIVERS\evbdx.sys
12:37:26.0717 4824 ebdrv - ok
12:37:26.0891 4824 [ 81951F51E318AECC2D68559E47485CC4 ] EFS C:\Windows\System32\lsass.exe
12:37:26.0894 4824 EFS - ok
12:37:27.0360 4824 [ A8C362018EFC87BEB013EE28F29C0863 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
12:37:27.0371 4824 ehRecvr - ok
12:37:27.0426 4824 [ D389BFF34F80CAEDE417BF9D1507996A ] ehSched C:\Windows\ehome\ehsched.exe
12:37:27.0429 4824 ehSched - ok
12:37:27.0509 4824 [ 0ED67910C8C326796FAA00B2BF6D9D3C ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
12:37:27.0527 4824 elxstor - ok
12:37:27.0573 4824 [ 8FC3208352DD3912C94367A206AB3F11 ] ErrDev C:\Windows\system32\drivers\errdev.sys
12:37:27.0608 4824 ErrDev - ok
12:37:27.0728 4824 [ F6916EFC29D9953D5D0DF06882AE8E16 ] EventSystem C:\Windows\system32\es.dll
12:37:27.0735 4824 EventSystem - ok
12:37:27.0789 4824 [ 2DC9108D74081149CC8B651D3A26207F ] exfat C:\Windows\system32\drivers\exfat.sys
12:37:27.0793 4824 exfat - ok
12:37:27.0823 4824 [ 7E0AB74553476622FB6AE36F73D97D35 ] fastfat C:\Windows\system32\drivers\fastfat.sys
12:37:27.0826 4824 fastfat - ok
12:37:27.0968 4824 [ 967EA5B213E9984CBE270205DF37755B ] Fax C:\Windows\system32\fxssvc.exe
12:37:27.0988 4824 Fax - ok
12:37:28.0025 4824 [ E817A017F82DF2A1F8CFDBDA29388B29 ] fdc C:\Windows\system32\DRIVERS\fdc.sys
12:37:28.0027 4824 fdc - ok
12:37:28.0063 4824 [ F3222C893BD2F5821A0179E5C71E88FB ] fdPHost C:\Windows\system32\fdPHost.dll
12:37:28.0065 4824 fdPHost - ok
12:37:28.0180 4824 [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B ] FDResPub C:\Windows\system32\fdrespub.dll
12:37:28.0183 4824 FDResPub - ok
12:37:28.0225 4824 [ 6CF00369C97F3CF563BE99BE983D13D8 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
12:37:28.0228 4824 FileInfo - ok
12:37:28.0427 4824 [ 42C51DC94C91DA21CB9196EB64C45DB9 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
12:37:28.0429 4824 Filetrace - ok
12:37:28.0468 4824 [ 87907AA70CB3C56600F1C2FB8841579B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
12:37:28.0470 4824 flpydisk - ok
12:37:28.0532 4824 [ 7520EC808E0C35E0EE6F841294316653 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
12:37:28.0537 4824 FltMgr - ok
12:37:28.0700 4824 [ B3A5EC6B6B6673DB7E87C2BCDBDDC074 ] FontCache C:\Windows\system32\FntCache.dll
12:37:28.0735 4824 FontCache - ok
12:37:28.0913 4824 [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
12:37:28.0916 4824 FontCache3.0.0.0 - ok
12:37:28.0936 4824 [ 1A16B57943853E598CFF37FE2B8CBF1D ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
12:37:28.0938 4824 FsDepends - ok
12:37:29.0142 4824 [ B07663A810E861EEBFD0EAC7E82CA62D ] FsUsbExDisk C:\Windows\system32\FsUsbExDisk.SYS
12:37:29.0145 4824 FsUsbExDisk - ok
12:37:29.0207 4824 [ 7DAE5EBCC80E45D3253F4923DC424D05 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
12:37:29.0209 4824 Fs_Rec - ok
12:37:29.0391 4824 [ 8A73E79089B282100B9393B644CB853B ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
12:37:29.0396 4824 fvevol - ok
12:37:29.0482 4824 [ 65EE0C7A58B65E74AE05637418153938 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
12:37:29.0485 4824 gagp30kx - ok
12:37:29.0664 4824 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
12:37:29.0666 4824 GEARAspiWDM - ok
12:37:29.0795 4824 [ E897EAF5ED6BA41E081060C9B447A673 ] gpsvc C:\Windows\System32\gpsvc.dll
12:37:29.0803 4824 gpsvc - ok
12:37:30.0136 4824 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
12:37:30.0139 4824 gupdate - ok
12:37:30.0247 4824 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
12:37:30.0249 4824 gupdatem - ok
12:37:30.0362 4824 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
12:37:30.0366 4824 gusvc - ok
12:37:30.0432 4824 [ C44E3C2BAB6837DB337DDEE7544736DB ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
12:37:30.0434 4824 hcw85cir - ok
12:37:30.0538 4824 [ A5EF29D5315111C80A5C1ABAD14C8972 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
12:37:30.0544 4824 HdAudAddService - ok
12:37:30.0578 4824 [ 9036377B8A6C15DC2EEC53E489D159B5 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
12:37:30.0606 4824 HDAudBus - ok
12:37:30.0667 4824 [ 1D58A7F3E11A9731D0EAAAA8405ACC36 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
12:37:30.0669 4824 HidBatt - ok
12:37:30.0707 4824 [ 89448F40E6DF260C206A193A4683BA78 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
12:37:30.0710 4824 HidBth - ok
12:37:30.0892 4824 [ CF50B4CF4A4F229B9F3C08351F99CA5E ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
12:37:30.0956 4824 HidIr - ok
12:37:31.0208 4824 [ 2BC6F6A1992B3A77F5F41432CA6B3B6B ] hidserv C:\Windows\system32\hidserv.dll
12:37:31.0211 4824 hidserv - ok
12:37:31.0561 4824 [ 10C19F8290891AF023EAEC0832E1EB4D ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
12:37:31.0563 4824 HidUsb - ok
12:37:31.0666 4824 [ 196B4E3F4CCCC24AF836CE58FACBB699 ] hkmsvc C:\Windows\system32\kmsvc.dll
12:37:31.0670 4824 hkmsvc - ok
12:37:31.0887 4824 [ 6658F4404DE03D75FE3BA09F7ABA6A30 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
12:37:31.0894 4824 HomeGroupListener - ok
12:37:31.0974 4824 [ DBC02D918FFF1CAD628ACBE0C0EAA8E8 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
12:37:31.0981 4824 HomeGroupProvider - ok
12:37:32.0431 4824 [ D1E9CB573A9EDF7BE12E9C57F32E97F7 ] HP LaserJet Service C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
12:37:32.0434 4824 HP LaserJet Service - ok
12:37:32.0499 4824 [ 299683D4C8AAA3F6F5D5D226A1782A6E ] HPFXBULK C:\Windows\system32\drivers\hpfxbulk.sys
12:37:32.0501 4824 HPFXBULK - ok
12:37:32.0592 4824 [ 6F98A555ACF3C1B68FCC1F50E0FD2091 ] HPFXBULKLEDM C:\Windows\system32\drivers\hppcbulkio.sys
12:37:32.0627 4824 HPFXBULKLEDM - ok
12:37:32.0703 4824 [ F728DB73A87231E27B6BA34D71CE2EDB ] HPFXFAX C:\Windows\system32\drivers\hpfxfax.sys
12:37:32.0705 4824 HPFXFAX - ok
12:37:33.0211 4824 [ 08457D8F8149757C70CEA59C71EC5D27 ] hpqcxs08 C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
12:37:33.0216 4824 hpqcxs08 - ok
12:37:33.0338 4824 [ 75CC8C5146A3FB76221A7606628778D5 ] hpqddsvc C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
12:37:33.0341 4824 hpqddsvc - ok
12:37:33.0432 4824 [ 295FDC419039090EB8B49FFDBB374549 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
12:37:33.0434 4824 HpSAMD - ok
12:37:33.0731 4824 [ 83DB5DD8BE71CBA5447FBD7A48FDBEDA ] HPSLPSVC C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL
12:37:33.0799 4824 HPSLPSVC - ok
12:37:33.0879 4824 [ 871917B07A141BFF43D76D8844D48106 ] HTTP C:\Windows\system32\drivers\HTTP.sys
12:37:33.0896 4824 HTTP - ok
12:37:34.0026 4824 [ 0C4E035C7F105F1299258C90886C64C5 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
12:37:34.0028 4824 hwpolicy - ok
12:37:34.0170 4824 [ F151F0BDC47F4A28B1B20A0818EA36D6 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
12:37:34.0173 4824 i8042prt - ok
12:37:34.0289 4824 [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
12:37:34.0296 4824 iaStorV - ok
12:37:34.0401 4824 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
12:37:34.0404 4824 IDriverT - ok
12:37:34.0534 4824 [ C521D7EB6497BB1AF6AFA89E322FB43C ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
12:37:34.0570 4824 idsvc - ok
12:37:34.0828 4824 [ 9467514EA189475A6E7FDC5D7BDE9D3F ] igfx C:\Windows\system32\DRIVERS\igdkmd32.sys
12:37:35.0008 4824 igfx - ok
12:37:35.0066 4824 [ 4173FF5708F3236CF25195FECD742915 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
12:37:35.0068 4824 iirsp - ok
12:37:35.0658 4824 [ F95622F161474511B8D80D6B093AA610 ] IKEEXT C:\Windows\System32\ikeext.dll
12:37:35.0781 4824 IKEEXT - ok
12:37:35.0836 4824 [ A0F12F2C9BA6C72F3987CE780E77C130 ] intelide C:\Windows\system32\drivers\intelide.sys
12:37:35.0838 4824 intelide - ok
12:37:35.0901 4824 [ 3B514D27BFC4ACCB4037BC6685F766E0 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
12:37:35.0902 4824 intelppm - ok
12:37:35.0934 4824 [ ACB364B9075A45C0736E5C47BE5CAE19 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
12:37:35.0939 4824 IPBusEnum - ok
12:37:36.0040 4824 [ 709D1761D3B19A932FF0238EA6D50200 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
12:37:36.0043 4824 IpFilterDriver - ok
12:37:36.0109 4824 [ 4D65A07B795D6674312F879D09AA7663 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
12:37:36.0127 4824 iphlpsvc - ok
12:37:36.0179 4824 [ 4BD7134618C1D2A27466A099062547BF ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
12:37:36.0181 4824 IPMIDRV - ok
12:37:36.0212 4824 [ A5FA468D67ABCDAA36264E463A7BB0CD ] IPNAT C:\Windows\system32\drivers\ipnat.sys
12:37:36.0215 4824 IPNAT - ok
12:37:36.0805 4824 [ 57EDB35EA2FECA88F8B17C0C095C9A56 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
12:37:36.0827 4824 iPod Service - ok
12:37:36.0927 4824 [ 42996CFF20A3084A56017B7902307E9F ] IRENUM C:\Windows\system32\drivers\irenum.sys
12:37:36.0929 4824 IRENUM - ok
12:37:37.0098 4824 [ 1F32BB6B38F62F7DF1A7AB7292638A35 ] isapnp C:\Windows\system32\drivers\isapnp.sys
12:37:37.0176 4824 isapnp - ok
12:37:37.0920 4824 [ CB7A9ABB12B8415BCE5D74994C7BA3AE ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
12:37:37.0953 4824 iScsiPrt - ok
12:37:38.0038 4824 [ ADEF52CA1AEAE82B50DF86B56413107E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
12:37:38.0041 4824 kbdclass - ok
12:37:38.0129 4824 [ 9E3CED91863E6EE98C24794D05E27A71 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
12:37:38.0131 4824 kbdhid - ok
12:37:38.0155 4824 [ 81951F51E318AECC2D68559E47485CC4 ] KeyIso C:\Windows\system32\lsass.exe
12:37:38.0159 4824 KeyIso - ok
12:37:38.0495 4824 [ B7895B4182C0D16F6EFADEB8081E8D36 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
12:37:38.0498 4824 KSecDD - ok
12:37:39.0781 4824 [ D30159AC9237519FBC62C6EC247D2D46 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
12:37:39.0785 4824 KSecPkg - ok
12:37:39.0823 4824 [ 89A7B9CC98D0D80C6F31B91C0A310FCD ] KtmRm C:\Windows\system32\msdtckrm.dll
12:37:39.0833 4824 KtmRm - ok
12:37:40.0381 4824 [ D64AF876D53ECA3668BB97B51B4E70AB ] LanmanServer C:\Windows\System32\srvsvc.dll
12:37:40.0389 4824 LanmanServer - ok
12:37:41.0550 4824 [ 58405E4F68BA8E4057C6E914F326ABA2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
12:37:41.0556 4824 LanmanWorkstation - ok
12:37:44.0859 4824 [ CC7D978C4F56FB434E841D35788A7F3C ] Lavasoft Ad-Aware Service C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
12:37:45.0005 4824 Lavasoft Ad-Aware Service - ok
12:37:45.0387 4824 [ 3AF6B73A3AD1FC37C5933441F66CEB91 ] LBTServ C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
12:37:45.0390 4824 LBTServ - ok
12:37:45.0680 4824 [ 7F9C7B28CF1C859E1C42619EEA946DC8 ] LHidFilt C:\Windows\system32\DRIVERS\LHidFilt.Sys
12:37:45.0682 4824 LHidFilt - ok
12:37:46.0090 4824 [ B716D4D759663BC4174FD0A379DA8E50 ] libusb0 C:\Windows\system32\DRIVERS\libusb0.sys
12:37:46.0092 4824 libusb0 - ok
12:37:46.0428 4824 [ F7611EC07349979DA9B0AE1F18CCC7A6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
12:37:46.0430 4824 lltdio - ok
12:37:46.0583 4824 [ 5700673E13A2117FA3B9020C852C01E2 ] lltdsvc C:\Windows\System32\lltdsvc.dll
12:37:46.0590 4824 lltdsvc - ok
12:37:46.0628 4824 [ 55CA01BA19D0006C8F2639B6C045E08B ] lmhosts C:\Windows\System32\lmhsvc.dll
12:37:46.0632 4824 lmhosts - ok
12:37:47.0014 4824 [ AB33792A87285344F43B5CE23421BAB0 ] LMouFilt C:\Windows\system32\DRIVERS\LMouFilt.Sys
12:37:47.0603 4824 LMouFilt - ok
12:37:47.0932 4824 [ EB119A53CCF2ACC000AC71B065B78FEF ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
12:37:47.0935 4824 LSI_FC - ok
12:37:48.0047 4824 [ 8ADE1C877256A22E49B75D1CC9161F9C ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
12:37:48.0049 4824 LSI_SAS - ok
12:37:48.0136 4824 [ DC9DC3D3DAA0E276FD2EC262E38B11E9 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
12:37:48.0138 4824 LSI_SAS2 - ok
12:37:48.0315 4824 [ 0A036C7D7CAB643A7F07135AC47E0524 ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
12:37:48.0426 4824 LSI_SCSI - ok
12:37:48.0546 4824 [ 6703E366CC18D3B6E534F5CF7DF39CEE ] luafv C:\Windows\system32\drivers\luafv.sys
12:37:48.0556 4824 luafv - ok
12:37:48.0846 4824 [ BFB9EE8EE977EFE85D1A3105ABEF6DD1 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
12:37:49.0346 4824 Mcx2Svc - ok
12:37:49.0461 4824 [ 0FFF5B045293002AB38EB1FD1FC2FB74 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
12:37:49.0544 4824 megasas - ok
12:37:50.0006 4824 [ DCBAB2920C75F390CAF1D29F675D03D6 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
12:37:50.0078 4824 MegaSR - ok
12:37:50.0708 4824 Microsoft SharePoint Workspace Audit Service - ok
12:37:50.0739 4824 [ 146B6F43A673379A3C670E86D89BE5EA ] MMCSS C:\Windows\system32\mmcss.dll
12:37:50.0743 4824 MMCSS - ok
12:37:50.0809 4824 [ F001861E5700EE84E2D4E52C712F4964 ] Modem C:\Windows\system32\drivers\modem.sys
12:37:50.0811 4824 Modem - ok
12:37:50.0850 4824 [ 79D10964DE86B292320E9DFE02282A23 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
12:37:50.0853 4824 monitor - ok
12:37:50.0882 4824 [ FB18CC1D4C2E716B6B903B0AC0CC0609 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
12:37:50.0884 4824 mouclass - ok
12:37:50.0949 4824 [ 2C388D2CD01C9042596CF3C8F3C7B24D ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
12:37:50.0951 4824 mouhid - ok
12:37:50.0998 4824 [ FC8771F45ECCCFD89684E38842539B9B ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
12:37:51.0001 4824 mountmgr - ok
12:37:51.0085 4824 [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
12:37:51.0088 4824 MozillaMaintenance - ok
12:37:51.0244 4824 [ EE728AF83850DDAD9A3FCAC0AAB3AD97 ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys
12:37:51.0248 4824 MpFilter - ok
12:37:51.0287 4824 [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0 ] mpio C:\Windows\system32\drivers\mpio.sys
12:37:51.0290 4824 mpio - ok
12:37:51.0330 4824 [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
12:37:51.0332 4824 mpsdrv - ok
12:37:51.0382 4824 [ 9835584E999D25004E1EE8E5F3E3B881 ] MpsSvc C:\Windows\system32\mpssvc.dll
12:37:51.0401 4824 MpsSvc - ok
12:37:51.0468 4824 [ CEB46AB7C01C9F825F8CC6BABC18166A ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
12:37:51.0471 4824 MRxDAV - ok
12:37:51.0555 4824 [ 5D16C921E3671636C0EBA3BBAAC5FD25 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
12:37:51.0559 4824 mrxsmb - ok
12:37:51.0966 4824 [ 6D17A4791ACA19328C685D256349FEFC ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
12:37:52.0008 4824 mrxsmb10 - ok
12:37:52.0072 4824 [ B81F204D146000BE76651A50670A5E9E ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
12:37:52.0075 4824 mrxsmb20 - ok
12:37:52.0143 4824 [ 012C5F4E9349E711E11E0F19A8589F0A ] msahci C:\Windows\system32\drivers\msahci.sys
12:37:52.0145 4824 msahci - ok
12:37:52.0240 4824 [ 55055F8AD8BE27A64C831322A780A228 ] msdsm C:\Windows\system32\drivers\msdsm.sys
12:37:52.0243 4824 msdsm - ok
12:37:52.0267 4824 [ E1BCE74A3BD9902B72599C0192A07E27 ] MSDTC C:\Windows\System32\msdtc.exe
12:37:52.0274 4824 MSDTC - ok
12:37:52.0350 4824 [ DAEFB28E3AF5A76ABCC2C3078C07327F ] Msfs C:\Windows\system32\drivers\Msfs.sys
12:37:52.0352 4824 Msfs - ok
12:37:52.0383 4824 [ 3E1E5767043C5AF9367F0056295E9F84 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
12:37:52.0385 4824 mshidkmdf - ok
12:37:52.0486 4824 [ 0A4E5757AE09FA9622E3158CC1AEF114 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
12:37:52.0488 4824 msisadrv - ok
12:37:52.0532 4824 [ 90F7D9E6B6F27E1A707D4A297F077828 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
12:37:52.0537 4824 MSiSCSI - ok
12:37:52.0544 4824 msiserver - ok
12:37:52.0572 4824 [ 8C0860D6366AAFFB6C5BB9DF9448E631 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
12:37:52.0606 4824 MSKSSRV - ok
12:37:52.0745 4824 [ E077FCA2A7E79FB9BF67D3E30B5CE593 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe
12:37:52.0746 4824 MsMpSvc - ok
12:37:52.0808 4824 [ 3EA8B949F963562CEDBB549EAC0C11CE ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
12:37:52.0810 4824 MSPCLOCK - ok
12:37:52.0819 4824 [ F456E973590D663B1073E9C463B40932 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
12:37:52.0821 4824 MSPQM - ok
12:37:52.0856 4824 [ 0E008FC4819D238C51D7C93E7B41E560 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
12:37:52.0860 4824 MsRPC - ok
12:37:52.0923 4824 [ FC6B9FF600CC585EA38B12589BD4E246 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
12:37:52.0924 4824 mssmbios - ok
12:37:53.0249 4824 MSSQL$MSSMLBIZ - ok
12:37:53.0410 4824 [ 1D89EB4E2A99CABD4E81225F4F4C4B25 ] MSSQLServerADHelper c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
12:37:53.0413 4824 MSSQLServerADHelper - ok
12:37:53.0505 4824 [ B42C6B921F61A6E55159B8BE6CD54A36 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
12:37:53.0507 4824 MSTEE - ok
12:37:53.0655 4824 [ 33599130F44E1F34631CEA241DE8AC84 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
12:37:53.0657 4824 MTConfig - ok
12:37:53.0681 4824 [ 159FAD02F64E6381758C990F753BCC80 ] Mup C:\Windows\system32\Drivers\mup.sys
12:37:53.0684 4824 Mup - ok
12:37:53.0791 4824 [ 61D57A5D7C6D9AFE10E77DAE6E1B445E ] napagent C:\Windows\system32\qagentRT.dll
12:37:53.0811 4824 napagent - ok
12:37:53.0863 4824 [ 26384429FCD85D83746F63E798AB1480 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
12:37:53.0870 4824 NativeWifiP - ok
12:37:53.0986 4824 [ 8C9C922D71F1CD4DEF73F186416B7896 ] NDIS C:\Windows\system32\drivers\ndis.sys
12:37:54.0020 4824 NDIS - ok
12:37:54.0120 4824 [ 0E1787AA6C9191D3D319E8BAFE86F80C ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
12:37:54.0123 4824 NdisCap - ok
12:37:54.0197 4824 [ E4A8AEC125A2E43A9E32AFEEA7C9C888 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
12:37:54.0201 4824 NdisTapi - ok
12:37:54.0298 4824 [ D8A65DAFB3EB41CBB622745676FCD072 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
12:37:54.0301 4824 Ndisuio - ok
12:37:54.0351 4824 [ 38FBE267E7E6983311179230FACB1017 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
12:37:54.0354 4824 NdisWan - ok
12:37:54.0449 4824 [ A4BDC541E69674FBFF1A8FF00BE913F2 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
12:37:54.0452 4824 NDProxy - ok
12:37:54.0490 4824 [ A081CB6FB9A12668F233EB5414BE3A0E ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
12:37:54.0493 4824 Net Driver HPZ12 - ok
12:37:54.0530 4824 [ 80B275B1CE3B0E79909DB7B39AF74D51 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
12:37:54.0533 4824 NetBIOS - ok
12:37:54.0682 4824 [ 280122DDCF04B378EDD1AD54D71C1E54 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
12:37:54.0687 4824 NetBT - ok
12:37:54.0700 4824 [ 81951F51E318AECC2D68559E47485CC4 ] Netlogon C:\Windows\system32\lsass.exe
12:37:54.0704 4824 Netlogon - ok
12:37:54.0753 4824 [ 7CCCFCA7510684768DA22092D1FA4DB2 ] Netman C:\Windows\System32\netman.dll
12:37:54.0761 4824 Netman - ok
12:37:54.0813 4824 [ 8C338238C16777A802D6A9211EB2BA50 ] netprofm C:\Windows\System32\netprofm.dll
12:37:54.0832 4824 netprofm - ok
12:37:55.0064 4824 [ F476EC40033CDB91EFBE73EB99B8362D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
12:37:55.0068 4824 NetTcpPortSharing - ok
12:37:55.0111 4824 [ 1D85C4B390B0EE09C7A46B91EFB2C097 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
12:37:55.0114 4824 nfrd960 - ok
12:37:55.0168 4824 [ 2CD24A6AF497D0E9B9BF3DA924ED05E6 ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys
12:37:55.0170 4824 NisDrv - ok
12:37:55.0227 4824 [ 3B846434055F80D9E89D0742F3ADAD34 ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe
12:37:55.0233 4824 NisSrv - ok
12:37:55.0353 4824 [ 912084381D30D8B89EC4E293053F4710 ] NlaSvc C:\Windows\System32\nlasvc.dll
12:37:55.0361 4824 NlaSvc - ok
12:37:55.0421 4824 [ 1DB262A9F8C087E8153D89BEF3D2235F ] Npfs C:\Windows\system32\drivers\Npfs.sys
12:37:55.0423 4824 Npfs - ok
12:37:55.0487 4824 [ BA387E955E890C8A88306D9B8D06BF17 ] nsi C:\Windows\system32\nsisvc.dll
12:37:55.0491 4824 nsi - ok
12:37:55.0550 4824 [ E9A0A4D07E53D8FEA2BB8387A3293C58 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
12:37:55.0868 4824 nsiproxy - ok
12:37:56.0310 4824 [ 0D87503986BB3DFED58E343FE39DDE13 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
12:37:56.0382 4824 Ntfs - ok
12:37:56.0437 4824 [ CF7E041663119E09D2E118521ADA9300 ] NuidFltr C:\Windows\system32\DRIVERS\NuidFltr.sys
12:37:56.0438 4824 NuidFltr - ok
12:37:56.0458 4824 [ F9756A98D69098DCA8945D62858A812C ] Null C:\Windows\system32\drivers\Null.sys
12:37:56.0459 4824 Null - ok
12:37:56.0475 4824 [ B3E25EE28883877076E0E1FF877D02E0 ] nvraid C:\Windows\system32\drivers\nvraid.sys
12:37:56.0478 4824 nvraid - ok
12:37:56.0793 4824 [ 4380E59A170D88C4F1022EFF6719A8A4 ] nvstor C:\Windows\system32\drivers\nvstor.sys
12:37:56.0796 4824 nvstor - ok
12:37:57.0179 4824 [ 5A0983915F02BAE73267CC2A041F717D ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
12:37:57.0183 4824 nv_agp - ok
12:37:57.0256 4824 [ 634FF60F418792906887B3D6CEECB431 ] O2MDRDR C:\Windows\system32\DRIVERS\o2media.sys
12:37:57.0258 4824 O2MDRDR - ok
12:37:57.0294 4824 [ 86326062A90494BDD79CE383511D7D69 ] OEM13Vfx C:\Windows\system32\DRIVERS\OEM13Vfx.sys
12:37:57.0295 4824 OEM13Vfx - ok
12:37:57.0346 4824 [ 12539B57ED05DE7552403A12B3E0161C ] OEM13Vid C:\Windows\system32\DRIVERS\OEM13Vid.sys
12:37:57.0351 4824 OEM13Vid - ok
12:37:57.0443 4824 [ 08A70A1F2CDDE9BB49B885CB817A66EB ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
12:37:57.0445 4824 ohci1394 - ok
12:37:57.0498 4824 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
12:37:57.0502 4824 ose - ok
12:37:57.0830 4824 [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
12:37:57.0967 4824 osppsvc - ok
12:37:58.0026 4824 [ 82A8521DDC60710C3D3D3E7325209BEC ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
12:37:58.0036 4824 p2pimsvc - ok
12:37:58.0096 4824 [ 59C3DDD501E39E006DAC31BF55150D91 ] p2psvc C:\Windows\system32\p2psvc.dll
12:37:58.0106 4824 p2psvc - ok
12:37:58.0161 4824 [ 2EA877ED5DD9713C5AC74E8EA7348D14 ] Parport C:\Windows\system32\DRIVERS\parport.sys
12:37:58.0163 4824 Parport - ok
12:37:58.0252 4824 [ 3F34A1B4C5F6475F320C275E63AFCE9B ] partmgr C:\Windows\system32\drivers\partmgr.sys
12:37:58.0255 4824 partmgr - ok
12:37:58.0271 4824 [ EB0A59F29C19B86479D36B35983DAADC ] Parvdm C:\Windows\system32\DRIVERS\parvdm.sys
12:37:58.0272 4824 Parvdm - ok
12:37:58.0295 4824 [ 358AB7956D3160000726574083DFC8A6 ] PcaSvc C:\Windows\System32\pcasvc.dll
12:37:58.0302 4824 PcaSvc - ok
12:37:58.0317 4824 [ 673E55C3498EB970088E812EA820AA8F ] pci C:\Windows\system32\drivers\pci.sys
12:37:58.0323 4824 pci - ok
12:37:58.0353 4824 [ AFE86F419014DB4E5593F69FFE26CE0A ] pciide C:\Windows\system32\drivers\pciide.sys
12:37:58.0354 4824 pciide - ok
12:37:58.0378 4824 [ F396431B31693E71E8A80687EF523506 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
12:37:58.0382 4824 pcmcia - ok
12:37:58.0494 4824 [ 250F6B43D2B613172035C6747AEEB19F ] pcw C:\Windows\system32\drivers\pcw.sys
12:37:58.0496 4824 pcw - ok
12:37:58.0529 4824 [ 9E0104BA49F4E6973749A02BF41344ED ] PEAUTH C:\Windows\system32\drivers\peauth.sys
12:37:58.0590 4824 PEAUTH - ok
12:37:58.0695 4824 [ AF4D64D2A57B9772CF3801950B8058A6 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
12:37:58.0762 4824 PeerDistSvc - ok
12:37:59.0109 4824 [ 414BBA67A3DED1D28437EB66AEB8A720 ] pla C:\Windows\system32\pla.dll
12:37:59.0155 4824 pla - ok
12:37:59.0335 4824 [ EC7BC28D207DA09E79B3E9FAF8B232CA ] PlugPlay C:\Windows\system32\umpnpmgr.dll
12:37:59.0344 4824 PlugPlay - ok
12:37:59.0392 4824 [ 65BC271F337637731D3C71455AE1F476 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
12:37:59.0396 4824 Pml Driver HPZ12 - ok
12:37:59.0429 4824 [ 63FF8572611249931EB16BB8EED6AFC8 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
12:37:59.0434 4824 PNRPAutoReg - ok
12:37:59.0461 4824 [ 82A8521DDC60710C3D3D3E7325209BEC ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
12:37:59.0467 4824 PNRPsvc - ok
12:37:59.0570 4824 [ 896D916DE06F5502D301E8C4DC442AE8 ] Point32 C:\Windows\system32\DRIVERS\point32.sys
12:37:59.0572 4824 Point32 - ok
12:37:59.0658 4824 [ 53946B69BA0836BD95B03759530C81EC ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
12:37:59.0666 4824 PolicyAgent - ok
12:37:59.0853 4824 [ F87D30E72E03D579A5199CCB3831D6EA ] Power C:\Windows\system32\umpo.dll
12:37:59.0859 4824 Power - ok
12:37:59.0912 4824 [ 631E3E205AD6D86F2AED6A4A8E69F2DB ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
12:37:59.0915 4824 PptpMiniport - ok
12:37:59.0975 4824 [ 85B1E3A0C7585BC4AAE6899EC6FCF011 ] Processor C:\Windows\system32\DRIVERS\processr.sys
12:37:59.0977 4824 Processor - ok
12:38:00.0105 4824 [ CADEFAC453040E370A1BDFF3973BE00D ] ProfSvc C:\Windows\system32\profsvc.dll
12:38:00.0111 4824 ProfSvc - ok
12:38:00.0137 4824 [ 81951F51E318AECC2D68559E47485CC4 ] ProtectedStorage C:\Windows\system32\lsass.exe
12:38:00.0140 4824 ProtectedStorage - ok
12:38:00.0168 4824 [ 6270CCAE2A86DE6D146529FE55B3246A ] Psched C:\Windows\system32\DRIVERS\pacer.sys
12:38:00.0170 4824 Psched - ok
12:38:00.0675 4824 [ 35DD92AF8B4EC79162A6A013884797AF ] QBCFMonitorService C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
12:38:00.0677 4824 QBCFMonitorService - ok
12:38:00.0764 4824 [ 6BEE1814470DC12FA20C53DFC3C97EBB ] QBFCService C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
12:38:00.0768 4824 QBFCService - ok
12:38:00.0856 4824 [ AB95ECF1F6659A60DDC166D8315B0751 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
12:38:00.0924 4824 ql2300 - ok
12:38:01.0144 4824 [ B4DD51DD25182244B86737DC51AF2270 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
12:38:01.0147 4824 ql40xx - ok
12:38:01.0318 4824 [ 31AC809E7707EB580B2BDB760390765A ] QWAVE C:\Windows\system32\qwave.dll
12:38:01.0326 4824 QWAVE - ok
12:38:01.0405 4824 [ 584078CA1B95CA72DF2A27C336F9719D ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
12:38:01.0439 4824 QWAVEdrv - ok
12:38:01.0904 4824 [ 8F97D374AD1857E1EED85A79F29A1D3D ] RapiMgr C:\Windows\WindowsMobile\rapimgr.dll
12:38:01.0910 4824 RapiMgr - ok
12:38:01.0939 4824 [ 30A81B53C766D0133BB86D234E5556AB ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
12:38:01.0940 4824 RasAcd - ok
12:38:01.0978 4824 [ 57EC4AEF73660166074D8F7F31C0D4FD ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
12:38:01.0979 4824 RasAgileVpn - ok
12:38:02.0015 4824 [ A60F1839849C0C00739787FD5EC03F13 ] RasAuto C:\Windows\System32\rasauto.dll
12:38:02.0021 4824 RasAuto - ok
12:38:02.0066 4824 [ D9F91EAFEC2815365CBE6D167E4E332A ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
12:38:02.0069 4824 Rasl2tp - ok
12:38:02.0408 4824 [ CB9E04DC05EACF5B9A36CA276D475006 ] RasMan C:\Windows\System32\rasmans.dll
12:38:02.0419 4824 RasMan - ok
12:38:02.0456 4824 [ 0FE8B15916307A6AC12BFB6A63E45507 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
12:38:02.0459 4824 RasPppoe - ok
12:38:02.0522 4824 [ 44101F495A83EA6401D886E7FD70096B ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
12:38:02.0524 4824 RasSstp - ok
12:38:02.0638 4824 [ D528BC58A489409BA40334EBF96A311B ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
12:38:02.0643 4824 rdbss - ok
12:38:02.0732 4824 [ 0D8F05481CB76E70E1DA06EE9F0DA9DF ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
12:38:02.0734 4824 rdpbus - ok
12:38:02.0835 4824 [ 23DAE03F29D253AE74C44F99E515F9A1 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
12:38:02.0836 4824 RDPCDD - ok
12:38:02.0907 4824 [ B973FCFC50DC1434E1970A146F7E3885 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
12:38:02.0911 4824 RDPDR - ok
12:38:02.0961 4824 [ 5A53CA1598DD4156D44196D200C94B8A ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
12:38:02.0962 4824 RDPENCDD - ok
12:38:03.0085 4824 [ 44B0A53CD4F27D50ED461DAE0C0B4E1F ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
12:38:03.0087 4824 RDPREFMP - ok
12:38:03.0325 4824 [ 68A0387F58E226DEEE23D9715955572A ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
12:38:03.0326 4824 RdpVideoMiniport - ok
12:38:03.0434 4824 [ F031683E6D1FEA157ABB2FF260B51E61 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
12:38:03.0439 4824 RDPWD - ok
12:38:04.0224 4824 [ 518395321DC96FE2C9F0E96AC743B656 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
12:38:04.0229 4824 rdyboost - ok
12:38:04.0298 4824 [ 7B5E1419717FAC363A31CC302895217A ] RemoteAccess C:\Windows\System32\mprdim.dll
12:38:04.0303 4824 RemoteAccess - ok
12:38:04.0532 4824 [ CB9A8683F4EF2BF99E123D79950D7935 ] RemoteRegistry C:\Windows\system32\regsvc.dll
12:38:04.0646 4824 RemoteRegistry - ok
12:38:04.0818 4824 [ CB928D9E6DAF51879DD6BA8D02F01321 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
12:38:04.0880 4824 RFCOMM - ok
12:38:05.0180 4824 [ F17713D108ACA124A139FDE877EEF68A ] RimUsb C:\Windows\system32\Drivers\RimUsb.sys
12:38:05.0182 4824 RimUsb - ok
12:38:05.0204 4824 [ 2C4FB2E9F039287767C384E46EE91030 ] RimVSerPort C:\Windows\system32\DRIVERS\RimSerial.sys
12:38:05.0206 4824 RimVSerPort - ok
12:38:05.0582 4824 [ 564297827D213F52C7A3A2FF749568CA ] ROOTMODEM C:\Windows\system32\Drivers\RootMdm.sys
12:38:05.0584 4824 ROOTMODEM - ok
12:38:05.0637 4824 [ 78D072F35BC45D9E4E1B61895C152234 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
12:38:05.0642 4824 RpcEptMapper - ok
12:38:05.0683 4824 [ 94D36C0E44677DD26981D2BFEEF2A29D ] RpcLocator C:\Windows\system32\locator.exe
12:38:05.0687 4824 RpcLocator - ok
12:38:05.0800 4824 [ 7660F01D3B38ACA1747E397D21D790AF ] RpcSs C:\Windows\system32\rpcss.dll
12:38:05.0807 4824 RpcSs - ok
12:38:06.0023 4824 [ 032B0D36AD92B582D869879F5AF5B928 ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
12:38:06.0026 4824 rspndr - ok
12:38:06.0229 4824 [ 7DFD48E24479B68B258D8770121155A0 ] RTL8167 C:\Windows\system32\DRIVERS\Rt86win7.sys
12:38:06.0233 4824 RTL8167 - ok
12:38:06.0443 4824 [ 7FA7F2E249A5DCBB7970630E15E1F482 ] s3cap C:\Windows\system32\drivers\vms3cap.sys
12:38:06.0444 4824 s3cap - ok
12:38:06.0463 4824 [ 81951F51E318AECC2D68559E47485CC4 ] SamSs C:\Windows\system32\lsass.exe
12:38:06.0466 4824 SamSs - ok
12:38:06.0935 4824 [ 05D860DA1040F111503AC416CCEF2BCA ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
12:38:06.0945 4824 sbp2port - ok
12:38:07.0218 4824 [ 8FC518FFE9519C2631D37515A68009C4 ] SCardSvr C:\Windows\System32\SCardSvr.dll
12:38:07.0225 4824 SCardSvr - ok
12:38:07.0710 4824 [ 0693B5EC673E34DC147E195779A4DCF6 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
12:38:07.0712 4824 scfilter - ok
12:38:07.0977 4824 [ A04BB13F8A72F8B6E8B4071723E4E336 ] Schedule C:\Windows\system32\schedsvc.dll
12:38:08.0011 4824 Schedule - ok
12:38:08.0094 4824 [ 319C6B309773D063541D01DF8AC6F55F ] SCPolicySvc C:\Windows\System32\certprop.dll
12:38:08.0096 4824 SCPolicySvc - ok
12:38:08.0649 4824 [ 0328BE1C7F1CBA23848179F8762E391C ] sdbus C:\Windows\system32\drivers\sdbus.sys
12:38:08.0651 4824 sdbus - ok
12:38:08.0926 4824 [ 08236C4BCE5EDD0A0318A438AF28E0F7 ] SDRSVC C:\Windows\System32\SDRSVC.dll
12:38:08.0933 4824 SDRSVC - ok
12:38:09.0150 4824 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
12:38:09.0152 4824 secdrv - ok
12:38:09.0452 4824 [ A59B3A4442C52060CC7A85293AA3546F ] seclogon C:\Windows\system32\seclogon.dll
12:38:09.0456 4824 seclogon - ok
12:38:09.0492 4824 [ DCB7FCDCC97F87360F75D77425B81737 ] SENS C:\Windows\system32\sens.dll
12:38:09.0497 4824 SENS - ok
12:38:09.0887 4824 [ 50087FE1EE447009C9CC2997B90DE53F ] SensrSvc C:\Windows\system32\sensrsvc.dll
12:38:09.0893 4824 SensrSvc - ok
12:38:10.0549 4824 [ 9AD8B8B515E3DF6ACD4212EF465DE2D1 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
12:38:10.0551 4824 Serenum - ok
12:38:10.0613 4824 [ 5FB7FCEA0490D821F26F39CC5EA3D1E2 ] Serial C:\Windows\system32\DRIVERS\serial.sys
12:38:10.0615 4824 Serial - ok
12:38:10.0717 4824 [ 79BFFB520327FF916A582DFEA17AA813 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
12:38:10.0719 4824 sermouse - ok
12:38:11.0199 4824 [ 4AE380F39A0032EAB7DD953030B26D28 ] SessionEnv C:\Windows\system32\sessenv.dll
12:38:11.0205 4824 SessionEnv - ok
12:38:11.0318 4824 [ 9F976E1EB233DF46FCE808D9DEA3EB9C ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
12:38:11.0320 4824 sffdisk - ok
12:38:11.0335 4824 [ 932A68EE27833CFD57C1639D375F2731 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
12:38:11.0337 4824 sffp_mmc - ok
12:38:11.0547 4824 [ 6D4CCAEDC018F1CF52866BBBAA235982 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
12:38:11.0548 4824 sffp_sd - ok
12:38:11.0577 4824 [ DB96666CC8312EBC45032F30B007A547 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
12:38:11.0608 4824 sfloppy - ok
12:38:11.0709 4824 [ D1A079A0DE2EA524513B6930C24527A2 ] SharedAccess C:\Windows\System32\ipnathlp.dll
12:38:11.0718 4824 SharedAccess - ok
12:38:12.0175 4824 [ 414DA952A35BF5D50192E28263B40577 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
12:38:12.0295 4824 ShellHWDetection - ok
12:38:12.0426 4824 [ 2565CAC0DC9FE0371BDCE60832582B2E ] sisagp C:\Windows\system32\drivers\sisagp.sys
12:38:12.0562 4824 sisagp - ok
12:38:13.0023 4824 [ A9F0486851BECB6DDA1D89D381E71055 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
12:38:13.0025 4824 SiSRaid2 - ok
12:38:13.0181 4824 [ 3727097B55738E2F554972C3BE5BC1AA ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
12:38:13.0183 4824 SiSRaid4 - ok
12:38:13.0368 4824 [ 599F3715602F4CB09AD0FDC606E3B9D9 ] SIUSBXP C:\Windows\system32\drivers\SiUSBXp.sys
12:38:13.0370 4824 SIUSBXP - ok
12:38:13.0448 4824 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
12:38:13.0452 4824 SkypeUpdate - ok
12:38:13.0818 4824 [ 3E21C083B8A01CB70BA1F09303010FCE ] Smb C:\Windows\system32\DRIVERS\smb.sys
12:38:13.0820 4824 Smb - ok
12:38:13.0884 4824 [ 6A984831644ECA1A33FFEAE4126F4F37 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
12:38:13.0889 4824 SNMPTRAP - ok
12:38:14.0710 4824 [ 95CF1AE7527FB70F7816563CBC09D942 ] spldr C:\Windows\system32\drivers\spldr.sys
12:38:14.0712 4824 spldr - ok
12:38:14.0800 4824 [ 9AEA093B8F9C37CF45538382CABA2475 ] Spooler C:\Windows\System32\spoolsv.exe
12:38:14.0811 4824 Spooler - ok
12:38:15.0031 4824 [ CF87A1DE791347E75B98885214CED2B8 ] sppsvc C:\Windows\system32\sppsvc.exe
12:38:15.0134 4824 sppsvc - ok
12:38:15.0268 4824 [ B0180B20B065D89232A78A40FE56EAA6 ] sppuinotify C:\Windows\system32\sppuinotify.dll
12:38:15.0274 4824 sppuinotify - ok
12:38:17.0067 4824 [ 86EBD8B1F23E743AAD21F4D5B4D40985 ] SQLBrowser c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
12:38:17.0072 4824 SQLBrowser - ok
12:38:17.0845 4824 [ D89083C4EB02DACA8F944B0E05E57F9D ] SQLWriter c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
12:38:17.0966 4824 SQLWriter - ok
12:38:18.0360 4824 [ E4C2764065D66EA1D2D3EBC28FE99C46 ] srv C:\Windows\system32\DRIVERS\srv.sys
12:38:18.0496 4824 srv - ok
12:38:18.0854 4824 [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
12:38:18.0860 4824 srv2 - ok
12:38:18.0960 4824 [ BE6BD660CAA6F291AE06A718A4FA8ABC ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
12:38:18.0963 4824 srvnet - ok
12:38:19.0095 4824 [ 6D83FF6722BAF7E82A4521DBEC363E5A ] ssadbus C:\Windows\system32\DRIVERS\ssadbus.sys
12:38:19.0098 4824 ssadbus - ok
12:38:19.0903 4824 [ 5AE42E90F99749E0E35B9989A2D0275C ] ssadmdfl C:\Windows\system32\DRIVERS\ssadmdfl.sys
12:38:19.0904 4824 ssadmdfl - ok
12:38:20.0574 4824 [ 9285D8ABA50A4D6482B1574448F9EB76 ] ssadmdm C:\Windows\system32\DRIVERS\ssadmdm.sys
12:38:20.0615 4824 ssadmdm - ok
12:38:21.0676 4824 [ D887C9FD02AC9FA880F6E5027A43E118 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
12:38:21.0684 4824 SSDPSRV - ok
12:38:21.0803 4824 [ D318F23BE45D5E3A107469EB64815B50 ] SstpSvc C:\Windows\system32\sstpsvc.dll
12:38:21.0810 4824 SstpSvc - ok
12:38:22.0064 4824 [ DB32D325C192B801DF274BFD12A7E72B ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
12:38:22.0065 4824 stexstor - ok
12:38:22.0286 4824 [ EDB05BD63148796F23EA78506404A538 ] StillCam C:\Windows\system32\DRIVERS\serscan.sys
12:38:22.0287 4824 StillCam - ok
12:38:22.0497 4824 [ E1FB3706030FB4578A0D72C2FC3689E4 ] StiSvc C:\Windows\System32\wiaservc.dll
12:38:22.0507 4824 StiSvc - ok
12:38:22.0642 4824 [ 472AF0311073DCECEAA8FA18BA2BDF89 ] storflt C:\Windows\system32\drivers\vmstorfl.sys
12:38:22.0644 4824 storflt - ok
12:38:23.0130 4824 [ DCAFFD62259E0BDB433DD67B5BB37619 ] storvsc C:\Windows\system32\drivers\storvsc.sys
12:38:23.0132 4824 storvsc - ok
12:38:23.0389 4824 [ E58C78A848ADD9610A4DB6D214AF5224 ] swenum C:\Windows\system32\drivers\swenum.sys
12:38:23.0391 4824 swenum - ok
12:38:24.0326 4824 [ A28BD92DF340E57B024BA433165D34D7 ] swprv C:\Windows\System32\swprv.dll
12:38:24.0345 4824 swprv - ok
12:38:24.0352 4824 Synth3dVsc - ok
12:38:24.0544 4824 [ 36650D618CA34C9D357DFD3D89B2C56F ] SysMain C:\Windows\system32\sysmain.dll
12:38:24.0613 4824 SysMain - ok
12:38:24.0729 4824 [ 763FECDC3D30C815FE72DD57936C6CD1 ] TabletInputService C:\Windows\System32\TabSvc.dll
12:38:24.0736 4824 TabletInputService - ok
12:38:24.0915 4824 [ 613BF4820361543956909043A265C6AC ] TapiSrv C:\Windows\System32\tapisrv.dll
12:38:24.0923 4824 TapiSrv - ok
12:38:24.0976 4824 [ B799D9FDB26111737F58288D8DC172D9 ] TBS C:\Windows\System32\tbssvc.dll
12:38:24.0982 4824 TBS - ok
12:38:25.0151 4824 [ A5EBB8F648000E88B7D9390B514976BF ] Tcpip C:\Windows\system32\drivers\tcpip.sys
12:38:25.0186 4824 Tcpip - ok
12:38:25.0323 4824 [ A5EBB8F648000E88B7D9390B514976BF ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
12:38:25.0336 4824 TCPIP6 - ok
12:38:25.0459 4824 [ CCA24162E055C3714CE5A88B100C64ED ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
12:38:25.0461 4824 tcpipreg - ok
12:38:25.0523 4824 [ 1CB91B2BD8F6DD367DFC2EF26FD751B2 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
12:38:25.0541 4824 TDPIPE - ok
12:38:25.0706 4824 [ 2C2C5AFE7EE4F620D69C23C0617651A8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
12:38:25.0708 4824 TDTCP - ok
12:38:25.0767 4824 [ B459575348C20E8121D6039DA063C704 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
12:38:25.0770 4824 tdx - ok
12:38:25.0782 4824 [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20 ] TermDD C:\Windows\system32\drivers\termdd.sys
12:38:25.0784 4824 TermDD - ok
12:38:25.0860 4824 [ 382C804C92811BE57829D8E550A900E2 ] TermService C:\Windows\System32\termsrv.dll
12:38:25.0912 4824 TermService - ok
12:38:25.0959 4824 [ 42FB6AFD6B79D9FE07381609172E7CA4 ] Themes C:\Windows\system32\themeservice.dll
12:38:25.0964 4824 Themes - ok
12:38:26.0031 4824 [ 146B6F43A673379A3C670E86D89BE5EA ] THREADORDER C:\Windows\system32\mmcss.dll
12:38:26.0035 4824 THREADORDER - ok
12:38:26.0057 4824 [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A ] TrkWks C:\Windows\System32\trkwks.dll
12:38:26.0063 4824 TrkWks - ok
12:38:26.0300 4824 [ 2C49B175AEE1D4364B91B531417FE583 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
12:38:26.0304 4824 TrustedInstaller - ok
12:38:26.0366 4824 [ 254BB140EEE3C59D6114C1A86B636877 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
12:38:26.0368 4824 tssecsrv - ok
12:38:26.0432 4824 [ FD1D6C73E6333BE727CBCC6054247654 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
12:38:26.0434 4824 TsUsbFlt - ok
12:38:26.0441 4824 tsusbhub - ok
12:38:26.0590 4824 [ B2FA25D9B17A68BB93D58B0556E8C90D ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
12:38:26.0593 4824 tunnel - ok
12:38:26.0709 4824 [ 750FBCB269F4D7DD2E420C56B795DB6D ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
12:38:26.0711 4824 uagp35 - ok
12:38:26.0816 4824 [ EE43346C7E4B5E63E54F927BABBB32FF ] udfs C:\Windows\system32\DRIVERS\udfs.sys
12:38:26.0821 4824 udfs - ok
12:38:26.0872 4824 [ 8344FD4FCE927880AA1AA7681D4927E5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
12:38:26.0878 4824 UI0Detect - ok
12:38:27.0004 4824 [ 44E8048ACE47BEFBFDC2E9BE4CBC8880 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
12:38:27.0006 4824 uliagpkx - ok
12:38:27.0134 4824 [ D295BED4B898F0FD999FCFA9B32B071B ] umbus C:\Windows\system32\drivers\umbus.sys
12:38:27.0136 4824 umbus - ok
12:38:27.0170 4824 [ 7550AD0C6998BA1CB4843E920EE0FEAC ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
12:38:27.0172 4824 UmPass - ok
12:38:27.0334 4824 [ 409994A8EACEEE4E328749C0353527A0 ] UmRdpService C:\Windows\System32\umrdp.dll
12:38:27.0342 4824 UmRdpService - ok
12:38:27.0411 4824 [ 833FBB672460EFCE8011D262175FAD33 ] upnphost C:\Windows\System32\upnphost.dll
12:38:27.0421 4824 upnphost - ok
12:38:27.0825 4824 [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL C:\Windows\system32\Drivers\usbaapl.sys
12:38:27.0827 4824 USBAAPL - ok
12:38:27.0906 4824 [ 1D9F2BD026E8E2D45033A4DF3F16B78C ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
12:38:27.0909 4824 usbaudio - ok
12:38:28.0050 4824 [ BD9C55D7023C5DE374507ACC7A14E2AC ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
12:38:28.0053 4824 usbccgp - ok
12:38:28.0161 4824 [ 04EC7CEC62EC3B6D9354EEE93327FC82 ] usbcir C:\Windows\system32\drivers\usbcir.sys
12:38:28.0163 4824 usbcir - ok
12:38:28.0258 4824 [ F92DE757E4B7CE9C07C5E65423F3AE3B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
12:38:28.0260 4824 usbehci - ok
12:38:28.0374 4824 [ 8DC94AEC6A7E644A06135AE7506DC2E9 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
12:38:28.0380 4824 usbhub - ok
12:38:28.0466 4824 [ E185D44FAC515A18D9DEDDC23C2CDF44 ] usbohci C:\Windows\system32\drivers\usbohci.sys
12:38:28.0468 4824 usbohci - ok
12:38:28.0523 4824 [ 797D862FE0875E75C7CC4C1AD7B30252 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
12:38:28.0559 4824 usbprint - ok
12:38:28.0648 4824 [ 576096CCBC07E7C4EA4F5E6686D6888F ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
12:38:28.0650 4824 usbscan - ok
12:38:28.0667 4824 [ F991AB9CC6B908DB552166768176896A ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
12:38:28.0669 4824 USBSTOR - ok
12:38:28.0743 4824 [ 68DF884CF41CDADA664BEB01DAF67E3D ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
12:38:28.0744 4824 usbuhci - ok
12:38:28.0891 4824 [ 45F4E7BF43DB40A6C6B4D92C76CBC3F2 ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys
12:38:28.0895 4824 usbvideo - ok
12:38:28.0938 4824 [ D82F43D15FDAA666856C0190CB73E7C9 ] usb_rndisx C:\Windows\system32\DRIVERS\usb8023x.sys
12:38:28.0940 4824 usb_rndisx - ok
12:38:30.0965 4824 [ 52BCDDA1F4668D077EFFF78594FA296E ] uvnc_service C:\Users\Dave\AppData\Local\CrossLoop\winvnc.exe
12:38:31.0034 4824 uvnc_service - ok
12:38:31.0110 4824 [ 081E6E1C91AEC36758902A9F727CD23C ] UxSms C:\Windows\System32\uxsms.dll
12:38:31.0115 4824 UxSms - ok
12:38:31.0270 4824 [ 81951F51E318AECC2D68559E47485CC4 ] VaultSvc C:\Windows\system32\lsass.exe
12:38:31.0273 4824 VaultSvc - ok
12:38:31.0296 4824 [ A059C4C3EDB09E07D21A8E5C0AABD3CB ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
12:38:31.0298 4824 vdrvroot - ok
12:38:31.0371 4824 [ C3CD30495687C2A2F66A65CA6FD89BE9 ] vds C:\Windows\System32\vds.exe
12:38:31.0393 4824 vds - ok
12:38:31.0430 4824 [ 17C408214EA61696CEC9C66E388B14F3 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
12:38:31.0431 4824 vga - ok
12:38:31.0445 4824 [ 8E38096AD5C8570A6F1570A61E251561 ] VgaSave C:\Windows\System32\drivers\vga.sys
12:38:31.0447 4824 VgaSave - ok
12:38:31.0502 4824 VGPU - ok
12:38:31.0705 4824 [ 5461686CCA2FDA57B024547733AB42E3 ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
12:38:31.0709 4824 vhdmp - ok
12:38:31.0751 4824 [ C829317A37B4BEA8F39735D4B076E923 ] viaagp C:\Windows\system32\drivers\viaagp.sys
12:38:31.0753 4824 viaagp - ok
12:38:31.0847 4824 [ E02F079A6AA107F06B16549C6E5C7B74 ] ViaC7 C:\Windows\system32\DRIVERS\viac7.sys
12:38:31.0849 4824 ViaC7 - ok
12:38:32.0028 4824 [ E43574F6A56A0EE11809B48C09E4FD3C ] viaide C:\Windows\system32\drivers\viaide.sys
12:38:32.0030 4824 viaide - ok
12:38:32.0105 4824 [ C2F2911156FDC7817C52829C86DA494E ] vmbus C:\Windows\system32\drivers\vmbus.sys
12:38:32.0109 4824 vmbus - ok
12:38:32.0129 4824 [ D4D77455211E204F370D08F4963063CE ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
12:38:32.0131 4824 VMBusHID - ok
12:38:32.0155 4824 [ 4C63E00F2F4B5F86AB48A58CD990F212 ] volmgr C:\Windows\system32\drivers\volmgr.sys
12:38:32.0157 4824 volmgr - ok
12:38:32.0324 4824 [ B5BB72067DDDDBBFB04B2F89FF8C3C87 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
12:38:32.0330 4824 volmgrx - ok
12:38:32.0390 4824 [ F497F67932C6FA693D7DE2780631CFE7 ] volsnap C:\Windows\system32\drivers\volsnap.sys
12:38:32.0395 4824 volsnap - ok
12:38:32.0450 4824 [ 9DFA0CC2F8855A04816729651175B631 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
12:38:32.0454 4824 vsmraid - ok
12:38:32.0535 4824 [ 209A3B1901B83AEB8527ED211CCE9E4C ] VSS C:\Windows\system32\vssvc.exe
12:38:32.0598 4824 VSS - ok
12:38:32.0688 4824 [ 90567B1E658001E79D7C8BBD3DDE5AA6 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
12:38:32.0690 4824 vwifibus - ok
12:38:32.0896 4824 [ 7090D3436EEB4E7DA3373090A23448F7 ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
12:38:32.0898 4824 vwififlt - ok
12:38:32.0923 4824 [ A3F04CBEA6C2A10E6CB01F8B47611882 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
12:38:32.0924 4824 vwifimp - ok
12:38:33.0056 4824 [ 55187FD710E27D5095D10A472C8BAF1C ] W32Time C:\Windows\system32\w32time.dll
12:38:33.0067 4824 W32Time - ok
12:38:33.0152 4824 [ DE3721E89C653AA281428C8A69745D90 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
12:38:33.0153 4824 WacomPen - ok
12:38:33.0285 4824 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
12:38:33.0288 4824 WANARP - ok
12:38:33.0300 4824 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
12:38:33.0301 4824 Wanarpv6 - ok
12:38:33.0434 4824 [ 353A04C273EC58475D8633E75CCD5604 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
12:38:33.0480 4824 WatAdminSvc - ok
12:38:33.0673 4824 [ 691E3285E53DCA558E1A84667F13E15A ] wbengine C:\Windows\system32\wbengine.exe
12:38:33.0719 4824 wbengine - ok
12:38:33.0818 4824 [ 9614B5D29DC76AC3C29F6D2D3AA70E67 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
12:38:33.0826 4824 WbioSrvc - ok
12:38:33.0861 4824 [ 59E19BD13C3BDB857646B9E436BA27F7 ] WcesComm C:\Windows\WindowsMobile\wcescomm.dll
12:38:33.0868 4824 WcesComm - ok
12:38:33.0918 4824 [ 34EEE0DFAADB4F691D6D5308A51315DC ] wcncsvc C:\Windows\System32\wcncsvc.dll
12:38:33.0928 4824 wcncsvc - ok
12:38:33.0951 4824 [ 5D930B6357A6D2AF4D7653BDABBF352F ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
12:38:33.0957 4824 WcsPlugInService - ok
12:38:34.0015 4824 [ 1112A9BADACB47B7C0BB0392E3158DFF ] Wd C:\Windows\system32\DRIVERS\wd.sys
12:38:34.0017 4824 Wd - ok
12:38:34.0116 4824 [ 9950E3D0F08141C7E89E64456AE7DC73 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
12:38:34.0125 4824 Wdf01000 - ok
12:38:34.0213 4824 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiServiceHost C:\Windows\system32\wdi.dll
12:38:34.0219 4824 WdiServiceHost - ok
12:38:34.0225 4824 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiSystemHost C:\Windows\system32\wdi.dll
12:38:34.0231 4824 WdiSystemHost - ok
12:38:34.0331 4824 [ A9D880F97530D5B8FEE278923349929D ] WebClient C:\Windows\System32\webclnt.dll
12:38:34.0340 4824 WebClient - ok
12:38:34.0464 4824 [ 760F0AFE937A77CFF27153206534F275 ] Wecsvc C:\Windows\system32\wecsvc.dll
12:38:34.0472 4824 Wecsvc - ok
12:38:34.0506 4824 [ AC804569BB2364FB6017370258A4091B ] wercplsupport C:\Windows\System32\wercplsupport.dll
12:38:34.0512 4824 wercplsupport - ok
12:38:34.0658 4824 [ 08E420D873E4FD85241EE2421B02C4A4 ] WerSvc C:\Windows\System32\WerSvc.dll
12:38:34.0664 4824 WerSvc - ok
12:38:34.0720 4824 [ 8B9A943F3B53861F2BFAF6C186168F79 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
12:38:34.0722 4824 WfpLwf - ok
12:38:34.0765 4824 [ 5CF95B35E59E2A38023836FFF31BE64C ] WIMMount C:\Windows\system32\drivers\wimmount.sys
12:38:34.0767 4824 WIMMount - ok
12:38:34.0845 4824 [ 3FAE8F94296001C32EAB62CD7D82E0FD ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
12:38:34.0862 4824 WinDefend - ok
12:38:34.0871 4824 WinHttpAutoProxySvc - ok
12:38:34.0960 4824 [ F62E510B6AD4C21EB9FE8668ED251826 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
12:38:34.0963 4824 Winmgmt - ok
12:38:35.0097 4824 [ 1B91CD34EA3A90AB6A4EF0550174F4CC ] WinRM C:\Windows\system32\WsmSvc.dll
12:38:35.0143 4824 WinRM - ok
12:38:35.0296 4824 [ A67E5F9A400F3BD1BE3D80613B45F708 ] WinUsb C:\Windows\system32\DRIVERS\WinUSB.sys
12:38:35.0298 4824 WinUsb - ok
12:38:35.0434 4824 [ 16935C98FF639D185086A3529B1F2067 ] Wlansvc C:\Windows\System32\wlansvc.dll
12:38:35.0469 4824 Wlansvc - ok
12:38:35.0650 4824 [ 0217679B8FCA58714C3BF2726D2CA84E ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
12:38:35.0651 4824 WmiAcpi - ok
12:38:35.0699 4824 [ 6EB6B66517B048D87DC1856DDF1F4C3F ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
12:38:35.0703 4824 wmiApSrv - ok
12:38:36.0797 4824 [ 3B40D3A61AA8C21B88AE57C58AB3122E ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
12:38:36.0820 4824 WMPNetworkSvc - ok
12:38:36.0854 4824 [ A2F0EC770A92F2B3F9DE6D518E11409C ] WPCSvc C:\Windows\System32\wpcsvc.dll
12:38:36.0860 4824 WPCSvc - ok
12:38:36.0957 4824 [ AA53356D60AF47EACC85BC617A4F3F66 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
12:38:36.0963 4824 WPDBusEnum - ok
12:38:37.0103 4824 [ 6DB3276587B853BF886B69528FDB048C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
12:38:37.0105 4824 ws2ifsl - ok
12:38:37.0148 4824 [ 6F5D49EFE0E7164E03AE773A3FE25340 ] wscsvc C:\Windows\system32\wscsvc.dll
12:38:37.0155 4824 wscsvc - ok
12:38:37.0168 4824 WSearch - ok
12:38:37.0284 4824 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
12:38:37.0353 4824 wuauserv - ok
12:38:37.0437 4824 [ E714A1C0354636837E20CCBF00888EE7 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
12:38:37.0439 4824 WudfPf - ok
12:38:37.0510 4824 [ 1023EE888C9B47178C5293ED5336AB69 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
12:38:37.0514 4824 WUDFRd - ok
12:38:37.0668 4824 [ 8D1E1E529A2C9E9B6A85B55A345F7629 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
12:38:37.0674 4824 wudfsvc - ok
12:38:37.0722 4824 [ FF2D745B560F7C71B31F30F4D49F73D2 ] WwanSvc C:\Windows\System32\wwansvc.dll
12:38:37.0731 4824 WwanSvc - ok
12:38:37.0921 4824 ================ Scan global ===============================
12:38:38.0031 4824 [ DAB748AE0439955ED2FA22357533DDDB ] C:\Windows\system32\basesrv.dll
12:38:38.0428 4824 [ 48CB4FDBCAAEAC7BCE2F5941545FF071 ] C:\Windows\system32\winsrv.dll
12:38:38.0483 4824 [ 48CB4FDBCAAEAC7BCE2F5941545FF071 ] C:\Windows\system32\winsrv.dll
12:38:38.0547 4824 [ 364455805E64882844EE9ACB72522830 ] C:\Windows\system32\sxssrv.dll
12:38:38.0662 4824 [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 ] C:\Windows\system32\services.exe
12:38:38.0670 4824 [Global] - ok
12:38:38.0671 4824 ================ Scan MBR ==================================
12:38:38.0725 4824 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
12:38:39.0560 4824 \Device\Harddisk0\DR0 - ok
12:38:39.0561 4824 ================ Scan VBR ==================================
12:38:40.0101 4824 [ 95D292FE809D133CFD28501D835D77DF ] \Device\Harddisk0\DR0\Partition1
12:38:40.0104 4824 \Device\Harddisk0\DR0\Partition1 - ok
12:38:40.0105 4824 ============================================================
12:38:40.0105 4824 Scan finished
12:38:40.0105 4824 ============================================================
12:38:40.0214 4716 Detected object count: 0
12:38:40.0214 4716 Actual detected object count: 0
12:38:47.0017 5456 Deinitialize success
And here is the log from DDS
DDS (Ver_2012-10-14.01) - NTFS_x86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.7.2
Run by [removed] at 12:43:02 on 2012-10-13
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3062.1149 [GMT -7:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CSR\Vista Profile Pack\BthFilterHelper.exe
C:\Program Files\Cobian Backup 10\cbVSCService.exe
C:\Program Files\Cobian Backup 10\cbService.exe
C:\Users\Dave\AppData\Local\CrossLoop\CrossLoopService.exe
C:\Program Files\Common Files\Nuance\dgnsvc.exe
C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\WerFault.exe
C:\Program Files\HP\HP UT\bin\hppusg.exe
C:\Windows\LockStatusTray.exe
C:\Windows\WindowsMobile\wmdcBase.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\OEM13Mon.exe
C:\Program Files\Cobian Backup 10\cbInterface.exe
C:\Program Files\HP\ToolboxFX\bin\HPTLBXFX.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\itunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\microsoft office\Office14\MSOSYNC.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Users\Dave\AppData\Roaming\Google\Google Talk\googletalk.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Users\Dave\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
C:\Program Files\Google\Drive\googledrivesync.exe
C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Windows\system32\conhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Google\Drive\googledrivesync.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\microsoft office\Office14\OUTLOOK.EXE
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\taskeng.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid;=CT3220468
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uURLSearchHooks: {7473b6bd-4691-4744-a82b-7854eb3d70b6} -
BHO: &Yahoo;! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office14\GROOVEEX.DLL
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
uRun: [Google Update] "c:\users\dave\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [OfficeSyncProcess] "c:\program files\microsoft office\office14\MSOSYNC.EXE"
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [doubleTwist] c:\program files\doubletwist 2.0\DoubleTwist.DeviceHelper.exe
uRun: [cdloader] "c:\users\dave\appdata\roaming\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [googletalk] c:\users\dave\appdata\roaming\google\google talk\googletalk.exe /autostart
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Spotify Web Helper] "c:\users\dave\appdata\roaming\spotify\data\SpotifyWebHelper.exe"
uRun: [MobileDocuments] c:\program files\common files\apple\internet services\ubd.exe
uRun: [GoogleDriveSync] "c:\program files\google\drive\googledrivesync.exe" /autostart
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [HP LaserJet M1522 MFP Series Fax] c:\program files\hp\hp laserjet m1522\hppfaxprintersrv.exe "HP LaserJet M1522 MFP Series Fax"
mRun: [HPUsageTracking] "c:\program files\hp\hp ut\bin\hppusg.exe" "c:\program files\hp\hp ut\"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [LockStatusTray] c:\windows\LockStatusTray.exe
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [Windows Mobile-based device management] c:\windows\windowsmobile\wmdcBase.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [OEM13Mon.exe] c:\windows\OEM13Mon.exe
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [DNS7reminder] "c:\program files\nuance\naturallyspeaking11\ereg\ereg.exe" -r "c:\programdata\nuance\naturallyspeaking11\Ereg.ini
mRun: [Cobian Backup 10 Interface] "c:\program files\cobian backup 10\cbInterface.exe" -service
mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [ToolboxFX] "c:\program files\hp\toolboxfx\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on /tmcp:on
mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\google~1.lnk - c:\program files\google\google calendar sync\GoogleCalendarSync.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000
IE: Se&nd; to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //FWEvent.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} - hxxp://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab
DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} - hxxp://picasaweb.google.com/s/v/62.08/uploader2.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{6FD2D014-3DEE-49C5-BAC4-5EFC7C823EDC} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{79EE02E4-39BE-4C39-881D-F5B949F8BF5E} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{79EE02E4-39BE-4C39-881D-F5B949F8BF5E}\44146554D27457563747 : DHCPNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\intuit\quickbooks 2010\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} -
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\dave\appdata\roaming\mozilla\firefox\profiles\qln39cgr.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3220468&SearchSource;=13
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3220468&SearchSource;=2&q;=
FF - plugin: c:\progra~1\micros~2\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\micros~2\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\logitech\harmony remote driver\NprtHarmonyPlugin.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll
FF - plugin: c:\users\dave\appdata\local\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\users\dave\appdata\roaming\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\users\dave\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\dave\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_287.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-8-30 193552]
R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2005-11-14 34176]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-7-27 63960]
R2 BthFilterHelper;Bluetooth Feature Support;c:\program files\csr\vista profile pack\BthFilterHelper.exe [2006-11-7 127488]
R2 cbVSCService;Cobian Backup 10 Volume Shadow Copy service;c:\program files\cobian backup 10\cbVSCService.exe [2011-2-9 67584]
R2 CobianBackup10;Cobian Backup 10;c:\program files\cobian backup 10\cbService.exe [2011-2-9 1125376]
R2 CrossLoopService;CrossLoop Service;c:\users\dave\appdata\local\crossloop\CrossLoopService.exe [2010-1-26 560792]
R2 DragonSvc;Dragon Service;c:\program files\common files\nuance\dgnsvc.exe [2010-7-23 296808]
R2 HP LaserJet Service;HP LaserJet Service;c:\program files\hp\hplaserjetservice\HPLaserJetService.exe [2010-10-25 145920]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1029456]
R3 OEM13Vfx;Creative Camera OEM013 Video VFX Driver;c:\windows\system32\drivers\OEM13Vfx.sys [2007-3-5 7424]
R3 OEM13Vid;Creative Camera OEM013 Driver;c:\windows\system32\drivers\OEM13Vid.sys [2008-5-28 235840]
R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-6-10 139776]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-13 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-30 135664]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-3-31 250808]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2010-9-22 36640]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-30 135664]
S3 HPFXBULKLEDM;HPFXBULKLEDM;c:\windows\system32\drivers\hppcbulkio.sys [2010-10-3 20504]
S3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [2010-1-27 20504]
S3 libusb0;Jawbone LibUsb-Win32 - Kernel Driver 09/22/2011,1.2.5.0;c:\windows\system32\drivers\libusb0.sys [2012-3-13 42592]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2011-6-12 31125880]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-25 114144]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2012-3-20 99272]
S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2012-9-12 287824]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-7-7 15872]
S3 SIUSBXP;SIUSBXP;c:\windows\system32\drivers\SiUSBXp.sys [2012-9-14 14592]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2011-2-12 96488]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [2011-2-12 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [2011-2-12 121576]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-7-7 52224]
S3 uvnc_service;uvnc_service;c:\users\dave\appdata\local\crossloop\winvnc.exe [2010-1-26 1590216]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-3-1 1343400]
.
=============== File Associations ===============
.
FileExt: .chm: chm.file="c:\windows\hh.exe" %1 [UserChoice]
.
=============== Created Last 30 ================
.
2012-10-13 19:38:39 6980552 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{3830cb3f-bdcd-486a-9534-c787791f2671}\mpengine.dll
2012-10-13 00:24:30 157272 —-a-w- c:\program files\mozilla firefox\updated\webapp-uninstaller.exe
2012-10-13 00:24:29 96224 —-a-w- c:\program files\mozilla firefox\updated\webapprt-stub.exe
2012-10-12 18:27:03 6980552 ——w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-10-10 17:02:22 172544 —-a-w- c:\windows\system32\wintrust.dll
2012-10-10 17:02:17 2048 —-a-w- c:\windows\system32\tzres.dll
2012-10-05 16:38:21 740784 ——w- c:\programdata\microsoft\microsoft antimalware\definition updates\{3c3354fd-23ae-4b15-8788-0cfba01cda00}\gapaengine.dll
2012-09-26 08:56:03 245760 —-a-w- c:\windows\system32\OxpsConverter.exe
2012-09-18 00:10:18 ——– d—–w- c:\users\dave\appdata\local\CRE
2012-09-18 00:09:43 ——– d—–w- c:\program files\Conduit
2012-09-18 00:09:34 ——– d—–w- c:\users\dave\appdata\roaming\Nico Mak Computing
2012-09-18 00:09:31 17224 —-a-w- c:\windows\system32\roboot.exe
2012-09-18 00:09:26 ——– d—–w- c:\users\dave\appdata\local\Conduit
2012-09-18 00:09:20 ——– d—–w- c:\program files\WinZip Registry Optimizer
2012-09-17 23:45:36 ——– d—–w- c:\program files\1ClickDownload
2012-09-14 17:50:08 ——– d—–w- c:\users\dave\appdata\roaming\Temp
2012-09-14 17:34:55 17408 —-a-w- c:\windows\system32\drivers\SiLib.sys
2012-09-14 17:34:55 14592 —-a-w- c:\windows\system32\drivers\SiUSBXp.sys
.
==================== Find3M ====================
.
2012-10-09 17:25:15 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-09 17:25:15 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-09 17:26:45 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-09 17:26:36 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-09-09 17:26:36 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-08-31 17:18:09 1211760 —-a-w- c:\windows\system32\drivers\ntfs.sys
2012-08-31 05:03:50 99272 —-a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-08-31 05:03:50 193552 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-30 17:12:02 3968880 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-30 17:12:02 3914096 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-24 06:59:17 1800704 —-a-w- c:\windows\system32\jscript9.dll
2012-08-24 06:51:27 1129472 —-a-w- c:\windows\system32\wininet.dll
2012-08-24 06:51:02 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-24 06:47:26 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2012-08-24 06:47:12 420864 —-a-w- c:\windows\system32\vbscript.dll
2012-08-24 06:43:58 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2012-08-22 17:16:54 1292144 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-08-22 17:16:46 712048 —-a-w- c:\windows\system32\drivers\ndis.sys
2012-08-22 17:16:46 240496 —-a-w- c:\windows\system32\drivers\netio.sys
2012-08-22 17:16:36 187760 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-08-20 17:40:31 169984 —-a-w- c:\windows\system32\winsrv.dll
2012-08-20 17:40:01 293376 —-a-w- c:\windows\system32\KernelBase.dll
2012-08-20 17:37:58 271360 —-a-w- c:\windows\system32\conhost.exe
2012-08-20 15:33:28 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-08-20 15:33:28 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-08-20 15:33:28 3584 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-08-20 15:33:28 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-08-10 23:56:14 542208 —-a-w- c:\windows\system32\kerberos.dll
2012-08-02 16:57:20 490496 —-a-w- c:\windows\system32\d3d10level9.dll
2012-07-18 17:47:53 2345984 —-a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 12:49:04.99 ===============
Download
Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2
**Note: It is important that it is saved directly to your desktop**
——————————————————————–
IMPORTANT -
Disable your AntiVirus and AntiSpyware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
here
——————————————————————–
Double click on
ComboFix.exe & follow the prompts.
When finished, it will produce a report for you. Please post the C:\ComboFix.txt for further review. NOTE: If you encounter a message
"illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error
ComboFix 12-10-15.01 - Dave 10/15/2012 16:15:50.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3062.1549 [GMT -7:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
C:\sysmon
c:\sysmon\f3install\hmee61571.exe
c:\sysmon\gbkg3421\kdiue732.txt
c:\users\Dave\AppData\Local\.#
c:\users\Dave\AppData\Local\assembly\tmp
c:\users\Dave\AppData\Local\Microsoft\Windows\Temporary Internet Files\{53D26B7A-9883-440D-99C9-F0A9D13D7620}.xps
c:\users\Dave\AppData\Local\Temp\_MEI31242\_ctypes.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\_elementtree.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\_hashlib.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\_socket.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\_ssl.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\pyexpat.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\pysqlite2._sqlite.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\python26.dll
c:\users\Dave\AppData\Local\Temp\_MEI31242\pythoncom26.dll
c:\users\Dave\AppData\Local\Temp\_MEI31242\pywintypes26.dll
c:\users\Dave\AppData\Local\Temp\_MEI31242\select.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\unicodedata.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\win32api.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\win32com.shell.shell.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\win32crypt.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\win32event.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\win32file.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\win32inet.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\win32pdh.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\win32process.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\win32security.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\windows._cacheinvalidation.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\wx._controls_.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\wx._core_.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\wx._gdi_.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\wx._html2.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\wx._misc_.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\wx._windows_.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\wx._wizard.pyd
c:\users\Dave\AppData\Local\Temp\_MEI31242\wxbase293u_net_vc.dll
c:\users\Dave\AppData\Local\Temp\_MEI31242\wxbase293u_vc.dll
c:\users\Dave\AppData\Local\Temp\_MEI31242\wxmsw293u_adv_vc.dll
c:\users\Dave\AppData\Local\Temp\_MEI31242\wxmsw293u_core_vc.dll
c:\users\Dave\AppData\Local\Temp\_MEI31242\wxmsw293u_html_vc.dll
c:\users\Dave\AppData\Local\Temp\_MEI31242\wxmsw293u_webview_vc.dll
c:\users\Dave\Documents\Readiris.DUS
c:\users\Dave\g2mdlhlpx.exe
c:\users\Dave\WINDOWS
c:\windows\iun6002.exe
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\roboot.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-09-15 to 2012-10-15 )))))))))))))))))))))))))))))))
.
.
2012-10-15 23:39 . 2012-10-15 23:39 29904 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{14F00928-9AEB-48E7-B2BA-64913DBF9ABC}\MpKsl9ee911c1.sys
2012-10-15 23:07 . 2012-10-15 23:07 29904 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{14F00928-9AEB-48E7-B2BA-64913DBF9ABC}\MpKslb9f1b773.sys
2012-10-15 15:56 . 2012-08-30 08:17 6980552 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{14F00928-9AEB-48E7-B2BA-64913DBF9ABC}\mpengine.dll
2012-10-14 08:53 . 2012-08-30 08:17 6980552 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-10-10 17:02 . 2012-08-24 16:57 172544 —-a-w- c:\windows\system32\wintrust.dll
2012-10-10 17:02 . 2012-09-14 18:28 2048 —-a-w- c:\windows\system32\tzres.dll
2012-10-05 16:38 . 2012-10-01 14:10 740784 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3C3354FD-23AE-4B15-8788-0CFBA01CDA00}\gapaengine.dll
2012-09-26 08:56 . 2012-08-21 20:12 245760 —-a-w- c:\windows\system32\OxpsConverter.exe
2012-09-18 00:10 . 2012-09-18 00:10 ——– d—–w- c:\users\Dave\AppData\Local\CRE
2012-09-18 00:09 . 2012-09-18 00:09 ——– d—–w- c:\program files\Conduit
2012-09-18 00:09 . 2012-09-18 00:09 ——– d—–w- c:\users\Dave\AppData\Roaming\Nico Mak Computing
2012-09-18 00:09 . 2012-09-19 17:15 ——– d—–w- c:\users\Dave\AppData\Local\Conduit
2012-09-18 00:09 . 2012-10-09 04:19 ——– d—–w- c:\program files\WinZip Registry Optimizer
2012-09-17 23:45 . 2012-09-19 17:14 ——– d—–w- c:\program files\1ClickDownload
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-09 17:25 . 2012-03-31 19:00 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-09 17:25 . 2011-06-23 17:40 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-01 14:10 . 2011-03-26 04:48 740784 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-09-14 17:34 . 2012-09-14 17:34 17408 —-a-w- c:\windows\system32\drivers\SiLib.sys
2012-09-14 17:34 . 2012-09-14 17:34 14592 —-a-w- c:\windows\system32\drivers\SiUSBXp.sys
2012-09-09 17:26 . 2012-09-09 17:27 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-09 17:26 . 2012-06-01 19:57 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-09-09 17:26 . 2010-05-10 16:51 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-08-31 05:03 . 2012-08-31 05:03 193552 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-31 05:03 . 2012-03-21 03:44 99272 —-a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-08-22 17:16 . 2012-09-12 12:41 1292144 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-08-22 17:16 . 2012-09-12 12:41 712048 —-a-w- c:\windows\system32\drivers\ndis.sys
2012-08-22 17:16 . 2012-09-12 12:41 240496 —-a-w- c:\windows\system32\drivers\netio.sys
2012-08-22 17:16 . 2012-09-12 12:41 187760 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-08-02 16:57 . 2012-09-12 12:41 490496 —-a-w- c:\windows\system32\d3d10level9.dll
2012-07-18 17:47 . 2012-08-14 21:49 2345984 —-a-w- c:\windows\system32\win32k.sys
2012-10-13 00:24 . 2012-10-13 00:23 261600 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Dave\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Dave\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Dave\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2012-09-06 22:51 556056 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2012-09-06 22:51 556056 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2012-09-06 22:51 556056 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2012-09-06 22:51 556056 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2008-10-24 206112]
"OfficeSyncProcess"="c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-21 719672]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"cdloader"="c:\users\Dave\AppData\Roaming\mjusbsp\cdloader2.exe" [2010-12-03 50592]
"googletalk"="c:\users\Dave\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-25 39408]
"Spotify Web Helper"="c:\users\Dave\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-05-10 932528]
"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"GoogleDriveSync"="c:\program files\Google\Drive\googledrivesync.exe" [2012-09-06 15668432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2008-10-24 79136]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
"HP LaserJet M1522 MFP Series Fax"="c:\program files\HP\hp LaserJet M1522\hppfaxprintersrv.exe" [2009-09-23 2453504]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2007-08-31 36864]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-08 1394000]
"LockStatusTray"="c:\windows\LockStatusTray.exe" [2008-02-19 192512]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 648072]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-23 150528]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-24 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-24 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-24 150552]
"OEM13Mon.exe"="c:\windows\OEM13Mon.exe" [2008-01-08 36864]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"DNS7reminder"="c:\program files\Nuance\NaturallySpeaking11\Ereg\Ereg.exe" [2007-04-16 259624]
"Cobian Backup 10 Interface"="c:\program files\Cobian Backup 10\cbInterface.exe" [2010-09-24 3154432]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2009-08-31 996616]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"ToolboxFX"="c:\program files\HP\ToolboxFX\bin\HPTLBXFX.exe" [2010-10-25 58936]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1313640]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 1821576]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 947176]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2011-4-8 542264]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-4-20 813584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 19:28 72208 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux5"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 HPFXBULKLEDM;HPFXBULKLEDM;c:\windows\system32\drivers\hppcbulkio.sys [x]
R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [x]
R3 libusb0;Jawbone LibUsb-Win32 - Kernel Driver 09/22/2011,1.2.5.0;c:\windows\system32\DRIVERS\libusb0.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 SIUSBXP;SIUSBXP;c:\windows\system32\drivers\SiUSBXp.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 uvnc_service;uvnc_service;c:\users\Dave\AppData\Local\CrossLoop\winvnc.exe [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [x]
S1 MpKsl9ee911c1;MpKsl9ee911c1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{14F00928-9AEB-48E7-B2BA-64913DBF9ABC}\MpKsl9ee911c1.sys [x]
S1 MpKslb9f1b773;MpKslb9f1b773;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{14F00928-9AEB-48E7-B2BA-64913DBF9ABC}\MpKslb9f1b773.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 BthFilterHelper;Bluetooth Feature Support;c:\program files\CSR\Vista Profile Pack\BthFilterHelper.exe [x]
S2 cbVSCService;Cobian Backup 10 Volume Shadow Copy service;c:\program files\Cobian Backup 10\cbVSCService.exe [x]
S2 CobianBackup10;Cobian Backup 10;c:\program files\Cobian Backup 10\cbService.exe [x]
S2 CrossLoopService;CrossLoop Service;c:\users\Dave\AppData\Local\CrossLoop\CrossLoopService.exe [x]
S2 DragonSvc;Dragon Service;c:\program files\Common Files\Nuance\dgnsvc.exe [x]
S2 HP LaserJet Service;HP LaserJet Service;c:\program files\HP\HPLaserJetService\HPLaserJetService.exe [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]
S3 OEM13Vfx;Creative Camera OEM013 Video VFX Driver;c:\windows\system32\DRIVERS\OEM13Vfx.sys [x]
S3 OEM13Vid;Creative Camera OEM013 Driver;c:\windows\system32\DRIVERS\OEM13Vid.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MPKSL9EE911C1
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPService REG_MULTI_SZ HPSLPSVC
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-15 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49]
.
2012-10-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 17:25]
.
2012-10-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 05:19]
.
2012-10-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 05:19]
.
2012-10-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2557060353-3338967487-1032703843-1000Core.job
- c:\users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-25 06:29]
.
2012-10-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2557060353-3338967487-1032703843-1000UA.job
- c:\users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-25 06:29]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://www.google.com/ie
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid;=CT3220468
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd; to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //FWEvent.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\qln39cgr.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3220468&SearchSource;=13
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3220468&SearchSource;=2&q;=
FF - ExtSQL: !HIDDEN! 2010-08-15 23:37; [removed]; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{7473b6bd-4691-4744-a82b-7854eb3d70b6} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{7473B6BD-4691-4744-A82B-7854EB3D70B6} - (no file)
HKCU-Run-doubleTwist - c:\program files\doubleTwist 2.0\DoubleTwist.DeviceHelper.exe
HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
AddRemove-Blues for Piano and Keyboards Ch. 1 through 9 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Blues for Piano and Keyboards Chapter 10 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Blues for Piano and Keyboards Chapter 11 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Blues for Piano and Keyboards Chapter 12 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Blues for Piano and Keyboards Chapter 13 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Blues for Piano and Keyboards Chapter 14 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Blues for Piano and Keyboards Chapter 15 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Fingerpower Chapter 1 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Intros, Fillers and Endings Chapter 1 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Pattern Piano and Keyboard 4.0 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Phat Chord Voicings Chapter 1 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Phat Chord Voicings Chapter 2 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Phat Chord Voicings Chapter 3 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Salsa for Piano and Keyboards Chapter 1 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Salsa for Piano and Keyboards Chapter 2 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-SIUSBXP&04DA&160A - c:\program files\Panasonic\Telephone Plug-in\DriverUninstaller.exe USBXpress\SIUSBXP&04DA&160A
AddRemove-Slash Chords Chapter 1 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Slash Chords Chapter 2 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Slash Chords Chapter 3 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Slash Chords Chapter 4 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Tension and Release Ch. 1 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Worship Chapter 1 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-Worship Chapter 2 - Full Version4.0 - c:\windows\iun6002.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-12_Symbian_USB_Download_Driver - c:\program files\Samsung\USB Drivers\12_Symbian_USB_Download_Driver\Uninstall.exe
AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\Samsung\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.download\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariDownload"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.safariextz\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariExtension"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webarchive\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(160)
c:\users\Dave\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
———————— Other Running Processes ————————
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Microsoft Security Client\MpCmdRun.exe
.
**************************************************************************
.
Completion time: 2012-10-15 16:48:18 - machine was rebooted
ComboFix-quarantined-files.txt 2012-10-15 23:48
ComboFix2.txt 2010-02-08 19:36
.
Pre-Run: 99,315,757,056 bytes free
Post-Run: 100,013,883,392 bytes free
.
- - End Of File - - E5104EC2B662E4B88D3C3A5D23A7BE3C
Please download
AdwCleaner from here and save it to your desktop.
Right click on AdwCleaner.exe and click "Run as Administrator" to run the tool. Click on Delete. A logfile will automatically open after the scan has finished.
Please post the content of that logfile in your reply.
You can find the logfile at C:\AdwCleaner[Rn].txt as well - (
n is the scan number.)
Please open your MalwareBytes AntiMalware Click the Update Tab and search for updates If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan" , then click Scan. The scan may take some time to finish, so please be patient. When the scan is complete, click OK , then Show Results to view the results. Make sure that everything is checked, and click Remove Selected . <– very important When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Next
ESET Online Scanner I'd like us to scan your machine with ESET Online Scan
Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time. Hold down Control and click on the following link to open ESET OnlineScan in a new window. Click the [external image: Posted Image] button. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop. Double click on the [external image: Posted Image] icon on your desktop. Check [external image: Posted Image] Click the Start button. Accept any security warnings from your browser. Check [external image: Posted Image] Make sure that the option "Remove found threats" is not checked Push the Start button. ESET will then download updates for itself, install itself, and begin When the scan completes, push [external image: Posted Image] Push [external image: Posted Image] , and save the file to your desktop using a unique name, such as Push the Back button. Push Finish
http://www.eset.com/onlinescan/
Also tell me how the computer is running now.
# AdwCleaner v2.005 - Logfile created 10/20/2012 at 19:45:02
# Updated 14/10/2012 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (32 bits)
# User : Dave - DAVE-PC
# Boot Mode : Normal
# Running from : C:\Users\Dave\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\URNUIUMO\adwcleaner.exe
# Option [Search]
***** [Services] *****
***** [Files / Folders] *****
File Found : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
File Found : C:\user.js
File Found : C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\qln39cgr.default\searchplugins\Askcom.xml
File Found : C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\qln39cgr.default\searchplugins\Conduit.xml
File Found : C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\qln39cgr.default\searchplugins\daemon-search.xml
Folder Found : C:\Program Files\Ask.com
Folder Found : C:\Program Files\Conduit
Folder Found : C:\Program Files\Free Offers from Freeze.com
Folder Found : C:\ProgramData\Babylon
Folder Found : C:\ProgramData\Tarma Installer
Folder Found : C:\Users\Dave\AppData\Local\Babylon
Folder Found : C:\Users\Dave\AppData\Local\Conduit
Folder Found : C:\Users\Dave\AppData\Local\OpenCandy
Folder Found : C:\Users\Dave\AppData\LocalLow\Conduit
Folder Found : C:\Users\Dave\AppData\Roaming\Babylon
Folder Found : C:\Users\Dave\AppData\Roaming\OpenCandy
***** [Registry] *****
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Headlight
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{26C9E18C-3717-4BE1-A225-04E4471F5B6E}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{26C9E18C-3717-4BE1-A225-04E4471F5B6E}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKLM\Software\Babylon
Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Found : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{26C9E18C-3717-4BE1-A225-04E4471F5B6E}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3220468
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\Freeze.com
Key Found : HKLM\Software\Iminent
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Found : HKU\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT3220468
-\\ Mozilla Firefox v15.0 (en-US)
Profile name : default
File : C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\qln39cgr.default\prefs.js
Found : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=1[…]
Found : user_pref("Smartbar.ConduitSearchEngineList", "uTorrentControl_v2 Customized Web Search");
Found : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3220468[…]
Found : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.babylon.com/?AF=109221&babsrc=adba[…]
Found : user_pref("Smartbar.keywordURLSelectedCTID", "CT3220468");
Found : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Found : user_pref("browser.search.defaultengine", "Ask.com");
Found : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
Found : user_pref("browser.search.order.1", "Search the web (Babylon)");
Found : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=13");
Found : user_pref("de.soerenrinne.googlebuttons.userlist", "Mail,Mail - Gmail this,Maps,Reader,Scholar,Wave,[…]
Found : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Found : user_pref("extensions.BabylonToolbar_i.babExt", "");
Found : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109221");
Found : user_pref("extensions.BabylonToolbar_i.hardId", "c885e5da000000000000002186cb341c");
Found : user_pref("extensions.BabylonToolbar_i.id", "c885e5da000000000000002186cb341c");
Found : user_pref("extensions.BabylonToolbar_i.instlDay", "15405");
Found : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Found : user_pref("extensions.BabylonToolbar_i.newTab", true);
Found : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?AF=109221&babsrc=NT_s[…]
Found : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Found : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Found : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Found : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Found : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Found : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Found : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1717:20:10");
Found : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Found : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3220468&SearchSource=2&q=[…]
-\\ Google Chrome v22.0.1229.94
File : C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Preferences
Found [l.16] : homepage = "hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=48",
Found [l.20] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=48" ]
Found [l.67] : icon_url = "hxxp://search.conduit.com/fav.ico",
Found [l.70] : keyword = "search.conduit.com",
Found [l.73] : search_url = "hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&ctid=CT3220468",
Found [l.74] : suggest_url = "hxxp://search.conduit.com/"
Found [l.1610] : homepage = "hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=48",
Found [l.2188] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=48" ]
*************************
AdwCleaner[R1].txt - [7372 octets] - [20/10/2012 11:40:06]
AdwCleaner[R2].txt - [7371 octets] - [20/10/2012 19:45:02]
########## EOF - C:\AdwCleaner[R2].txt - [7431 octets] ##########
Malwarebytes' Anti-Malware 1.44
Database version: 3709
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421
10/20/2012 7:57:00 PM
mbam-log-2012-10-20 (19-57-00).txt
Scan type: Quick Scan
Objects scanned: 127930
Time elapsed: 6 minute(s), 59 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
ESETscan results:
C:\Program Files\fbphotozoom\BabDSetup.exe Win32/Toolbar.Babylon application
C:\Program Files\fbphotozoom\EZLDSetup.exe multiple threats
C:\ProgramData\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Qoobox\Quarantine\C\sysmon\f3install\hmee61571.exe.vir Win32/AdInstaller application
C:\Users\All Users\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Users\Dave\Documents\Downloads\dp_genius.exe Win32/Toolbar.Zugo application
My computer seems to still be a bit slow. I really appreciate all of your help!
Rerun adwcleaner and select
delete .
COMBOFIX-Script CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
ComboFix 12-10-25.02 - Dave 10/25/2012 20:43:00.3.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3062.1397 [GMT -7:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
Command switches used :: c:\users\Dave\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files\fbphotozoom\BabDSetup.exe"
"c:\program files\fbphotozoom\EZLDSetup.exe"
"c:\programdata\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll"
"c:\users\All Users\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll"
"c:\users\Dave\Documents\Downloads\dp_genius.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Dave\AppData\Local\assembly\tmp
c:\users\Dave\AppData\Local\Temp\_MEI42202\_ctypes.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\_elementtree.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\_hashlib.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\_socket.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\_ssl.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\pyexpat.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\pysqlite2._sqlite.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\python26.dll
c:\users\Dave\AppData\Local\Temp\_MEI42202\pythoncom26.dll
c:\users\Dave\AppData\Local\Temp\_MEI42202\pywintypes26.dll
c:\users\Dave\AppData\Local\Temp\_MEI42202\select.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\unicodedata.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\win32api.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\win32com.shell.shell.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\win32crypt.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\win32event.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\win32file.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\win32inet.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\win32pdh.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\win32process.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\win32security.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\windows._cacheinvalidation.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\wx._controls_.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\wx._core_.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\wx._gdi_.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\wx._html2.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\wx._misc_.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\wx._windows_.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\wx._wizard.pyd
c:\users\Dave\AppData\Local\Temp\_MEI42202\wxbase293u_net_vc.dll
c:\users\Dave\AppData\Local\Temp\_MEI42202\wxbase293u_vc.dll
c:\users\Dave\AppData\Local\Temp\_MEI42202\wxmsw293u_adv_vc.dll
c:\users\Dave\AppData\Local\Temp\_MEI42202\wxmsw293u_core_vc.dll
c:\users\Dave\AppData\Local\Temp\_MEI42202\wxmsw293u_html_vc.dll
c:\users\Dave\AppData\Local\Temp\_MEI42202\wxmsw293u_webview_vc.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_uvnc_service
.
.
((((((((((((((((((((((((( Files Created from 2012-09-26 to 2012-10-26 )))))))))))))))))))))))))))))))
.
.
2012-10-26 03:59 . 2012-10-26 03:59 ——– d—–w- c:\users\Public\AppData\Local\temp
2012-10-26 03:59 . 2012-10-26 03:59 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-10-26 03:59 . 2012-10-26 03:59 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2012-10-25 16:32 . 2012-10-25 16:34 ——– d—–w- c:\users\Dave\Tracing
2012-10-25 16:29 . 2012-10-25 16:29 ——– d—–w- c:\users\Dave\AppData\Local\Microsoft Lync Attendee
2012-10-25 16:27 . 2012-10-25 16:27 ——– d—–w- c:\users\Dave\AppData\Local\AOCSetup
2012-10-25 07:36 . 2012-10-12 05:56 6918632 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2875B86E-8EA2-4C2F-AFA0-595EB2E4D1DB}\mpengine.dll
2012-10-24 04:51 . 2012-10-12 05:56 6918632 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-10-21 09:13 . 2012-10-01 14:10 740784 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A5D8DF19-7147-459C-B675-C97AAF203550}\gapaengine.dll
2012-10-21 03:00 . 2012-10-21 03:00 ——– d—–w- c:\program files\ESET
2012-10-10 17:02 . 2012-08-24 16:57 172544 —-a-w- c:\windows\system32\wintrust.dll
2012-10-10 17:02 . 2012-09-14 18:28 2048 —-a-w- c:\windows\system32\tzres.dll
2012-09-26 08:56 . 2012-08-21 20:12 245760 —-a-w- c:\windows\system32\OxpsConverter.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-09 17:25 . 2012-03-31 19:00 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-09 17:25 . 2011-06-23 17:40 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-01 14:10 . 2011-03-26 04:48 740784 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-09-14 17:34 . 2012-09-14 17:34 17408 —-a-w- c:\windows\system32\drivers\SiLib.sys
2012-09-14 17:34 . 2012-09-14 17:34 14592 —-a-w- c:\windows\system32\drivers\SiUSBXp.sys
2012-09-09 17:26 . 2012-09-09 17:27 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-09 17:26 . 2012-06-01 19:57 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-09-09 17:26 . 2010-05-10 16:51 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-08-31 05:03 . 2012-08-31 05:03 193552 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-31 05:03 . 2012-03-21 03:44 99272 —-a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-08-24 06:59 . 2012-09-23 10:01 1800704 —-a-w- c:\windows\system32\jscript9.dll
2012-08-24 06:51 . 2012-09-23 10:01 1129472 —-a-w- c:\windows\system32\wininet.dll
2012-08-24 06:51 . 2012-09-23 10:01 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-24 06:47 . 2012-09-23 10:01 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2012-08-24 06:47 . 2012-09-23 10:01 420864 —-a-w- c:\windows\system32\vbscript.dll
2012-08-24 06:43 . 2012-09-23 10:01 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2012-08-22 17:16 . 2012-09-12 12:41 1292144 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-08-22 17:16 . 2012-09-12 12:41 712048 —-a-w- c:\windows\system32\drivers\ndis.sys
2012-08-22 17:16 . 2012-09-12 12:41 240496 —-a-w- c:\windows\system32\drivers\netio.sys
2012-08-22 17:16 . 2012-09-12 12:41 187760 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-08-02 16:57 . 2012-09-12 12:41 490496 —-a-w- c:\windows\system32\d3d10level9.dll
2012-10-13 00:24 . 2012-10-13 00:23 261600 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Dave\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Dave\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Dave\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2008-10-24 206112]
"OfficeSyncProcess"="c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-21 719672]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"cdloader"="c:\users\Dave\AppData\Roaming\mjusbsp\cdloader2.exe" [2010-12-03 50592]
"googletalk"="c:\users\Dave\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-25 39408]
"Spotify Web Helper"="c:\users\Dave\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-05-10 932528]
"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"GoogleDriveSync"="c:\program files\Google\Drive\googledrivesync.exe" [2012-09-06 15668432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2008-10-24 79136]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
"HP LaserJet M1522 MFP Series Fax"="c:\program files\HP\hp LaserJet M1522\hppfaxprintersrv.exe" [2009-09-23 2453504]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2007-08-31 36864]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-08 1394000]
"LockStatusTray"="c:\windows\LockStatusTray.exe" [2008-02-19 192512]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 648072]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-23 150528]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-24 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-24 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-24 150552]
"OEM13Mon.exe"="c:\windows\OEM13Mon.exe" [2008-01-08 36864]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"DNS7reminder"="c:\program files\Nuance\NaturallySpeaking11\Ereg\Ereg.exe" [2007-04-16 259624]
"Cobian Backup 10 Interface"="c:\program files\Cobian Backup 10\cbInterface.exe" [2010-09-24 3154432]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2009-08-31 996616]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"ToolboxFX"="c:\program files\HP\ToolboxFX\bin\HPTLBXFX.exe" [2010-10-25 58936]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1313640]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 1821576]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 947176]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2011-4-8 542264]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-4-20 813584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 19:28 72208 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux5"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 HPFXBULKLEDM;HPFXBULKLEDM;c:\windows\system32\drivers\hppcbulkio.sys [x]
R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [x]
R3 libusb0;Jawbone LibUsb-Win32 - Kernel Driver 09/22/2011,1.2.5.0;c:\windows\system32\DRIVERS\libusb0.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 SIUSBXP;SIUSBXP;c:\windows\system32\drivers\SiUSBXp.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 BthFilterHelper;Bluetooth Feature Support;c:\program files\CSR\Vista Profile Pack\BthFilterHelper.exe [x]
S2 cbVSCService;Cobian Backup 10 Volume Shadow Copy service;c:\program files\Cobian Backup 10\cbVSCService.exe [x]
S2 CobianBackup10;Cobian Backup 10;c:\program files\Cobian Backup 10\cbService.exe [x]
S2 CrossLoopService;CrossLoop Service;c:\users\Dave\AppData\Local\CrossLoop\CrossLoopService.exe [x]
S2 DragonSvc;Dragon Service;c:\program files\Common Files\Nuance\dgnsvc.exe [x]
S2 HP LaserJet Service;HP LaserJet Service;c:\program files\HP\HPLaserJetService\HPLaserJetService.exe [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [x]
S3 OEM13Vfx;Creative Camera OEM013 Video VFX Driver;c:\windows\system32\DRIVERS\OEM13Vfx.sys [x]
S3 OEM13Vid;Creative Camera OEM013 Driver;c:\windows\system32\DRIVERS\OEM13Vid.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPService REG_MULTI_SZ HPSLPSVC
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49]
.
2012-10-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 17:25]
.
2012-10-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 05:19]
.
2012-10-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 05:19]
.
2012-10-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2557060353-3338967487-1032703843-1000Core.job
- c:\users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-25 06:29]
.
2012-10-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2557060353-3338967487-1032703843-1000UA.job
- c:\users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-25 06:29]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://www.google.com/ie
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid;=CT3220468
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd; to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //FWEvent.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\qln39cgr.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3220468&SearchSource;=13
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3220468&SearchSource;=2&q;=
FF - ExtSQL: !HIDDEN! 2010-08-15 23:37; [removed]; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} - (no file)
ShellIconOverlayIdentifiers-{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} - (no file)
ShellIconOverlayIdentifiers-{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} - (no file)
ShellIconOverlayIdentifiers-{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.download\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariDownload"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.safariextz\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariExtension"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webarchive\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2557060353-3338967487-1032703843-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2557060353-3338967487-1032703843-1000)
"Progid"="SafariHTML"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(2484)
c:\users\Dave\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
———————— Other Running Processes ————————
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\taskhost.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\conhost.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2012-10-25 21:12:07 - machine was rebooted
ComboFix-quarantined-files.txt 2012-10-26 04:12
ComboFix2.txt 2012-10-15 23:48
ComboFix3.txt 2010-02-08 19:36
.
Pre-Run: 97,606,123,520 bytes free
Post-Run: 98,917,462,016 bytes free
.
- - End Of File - - 3CC4A58F2C87240EC0ABCCC3FAAC01A3
You appear clean of infections,please do the following.
ComboFix - Cleanup Time for some housekeeping
Click Start …select Run from the menu. Copy and paste the following into the text entry box:Combofix /Uninstall Click the OK button. (See image below as reference.) 🖼 Click to load external image (Posted Image)
Download TFC to your desktop
Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean
Here are some recommendations to help you stay clean.
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/
Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices' .
So how did I get infected in the first place.
please take a moment to read
quietman7's excellent prevention tips in post 3 here
Click >>>>
Tips to protect yourself against malware and reduce the potential for re-infection Preventing Infections in the Future Avoid gaming sites , underground web pages, pirated software sites, and peer-to-peer file sharing security risk which can make your computer susceptible to a smörgåsbord of malware infections , remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware P2P Software User Advisories Risks of File-Sharing Technology Update Non-Microsoft Programs
It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting
Secunia Software Inspector and
Calendar of Updates.
Thats it you are good to go.Safe surfing
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here
http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
