Hi guys,
A couple of days ago I noticed that I have a new warning in my notifications center and was quite amazed to see an actual virus warning. I was very shocked since I did not expect to get any virus on my computer, because I was relying that my Kaspersky internet security 2013 would prevent that (ignorance is bliss, right). Well now I'm stuck with the dayam thing and by the looks of it, you can't get rid of it that easy. I was google browsing for some solutions, but I couldn't realy find anything useful. Seeing that you guys are preety skilled with these sorts of things I was hoping I might get an answer here.
Anyway my DDS.txt is:
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by [removed] at 18:20:12,06 on pet 21.12.2012
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.9.2
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.386.1033.18.4095.2443 [GMT 1:00]
.
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\ProgramData\IBUpdaterService\ibsvc.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Jaka\Desktop\dds.scr
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://startsear.ch/?aff=1
mStart Page = hxxp://startsear.ch/?aff=1
uURLSearchHooks: H - No File
uURLSearchHooks: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll
mURLSearchHooks: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
BHO: Content Blocker Plugin: {5564cc73-efa7-4cbf-918a-5cf7fbbfff4f} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
BHO: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: Virtual Keyboard Plugin: {73455575-e40c-433c-9784-c78dc7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: IE5BarLauncherBHO Class: {78f3a323-798e-4aea-9a57-88f4b05fd5dd} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Safe Money Plugin: {9e6d0d23-3d72-4a94-ae1f-2d167624e3d9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: URL Advisor Plugin: {e33cf602-d945-461a-83f0-819f76a199f8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll
TB: VShareToolBar: {7ac3e13b-3bca-4158-b330-f66dbb03c1b5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll
TB: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
TB: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File
TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport; to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO-X64: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
BHO-X64: ContentBlockerBrowserHelperObject - No File
BHO-X64: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
BHO-X64: VirtualKeyboardBrowserHelperObject - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll
BHO-X64: Safe Money Plugin - No File
BHO-X64: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll
BHO-X64: link filter bho - No File
TB-X64: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
TB-X64: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File
TB-X64: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB-X64: {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No File
TB-X64: {687578B9-7132-4A7A-80E4-30EE31099E03} - No File
mRun-x64: [(Default)]
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Jaka\AppData\Roaming\Mozilla\Firefox\Profiles\52i7ra1z.default-1354660080073\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.si/
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll
FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npvsharetvplg.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Program Files (x86)\Veetle\Player\npvlc.dll
FF - plugin: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
FF - plugin: C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll
FF - plugin: C:\Users\Jaka\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Users\Jaka\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
FF - plugin: C:\Users\Jaka\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2012-8-2 28504]
R1 kltdi;kltdi;C:\Windows\System32\drivers\kltdi.sys [2012-6-8 54104]
R1 kneps;kneps;C:\Windows\System32\drivers\kneps.sys [2012-8-13 178008]
R2 IBUpdaterService;Updater Service;C:\ProgramData\IBUpdaterService\ibsvc.exe [2012-9-29 616160]
R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-7-5 3048136]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-2 382824]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-10-20 2072896]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;C:\Windows\System32\drivers\l160x64.sys [2009-10-13 61440]
R3 Icon7vLifeWebCam;Icon7 vLife audio;C:\Windows\System32\drivers\Icon7VAC.sys [2010-1-20 49664]
R3 klkbdflt;Kaspersky Lab KLKBDFLT;C:\Windows\System32\drivers\klkbdflt.sys [2012-5-25 29016]
R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2012-7-25 29528]
R3 seehcri;Sony Ericsson seehcri Device Driver;C:\Windows\System32\drivers\seehcri.sys [2010-4-23 34032]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-20 11856]
R3 WebCamEffect;WebCamEffect;C:\Windows\System32\drivers\WebCamEffect.sys [2010-1-20 34368]
S2 AVP;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [2012-8-17 356376]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate1cc6e1fb9d6528;gupdate1cc6e1fb9d6528;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-8-3 136176]
S2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-2-21 1258856]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-3-30 250808]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;D:\Dragon Age\bin_ship\daupdatersvc.service.exe [2009-12-15 25832]
S3 ggflt;SEMC USB Flash Driver Filter;C:\Windows\System32\drivers\ggflt.sys [2010-4-23 13352]
S3 gupdatem;Storitev Posodobitve za Google (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-8-3 136176]
S3 LNonPnP;LNonPnP;C:\Windows\System32\drivers\LNonPnP.sys [2010-10-11 18960]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-5 115168]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2011-2-24 20992]
S3 Revoflt;Revoflt;C:\Windows\System32\drivers\revoflt.sys [2011-11-18 31800]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);C:\Windows\System32\drivers\s1018bus.sys [2009-12-13 113704]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;C:\Windows\System32\drivers\s1018mdfl.sys [2009-12-13 19496]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;C:\Windows\System32\drivers\s1018mdm.sys [2009-12-13 153128]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);C:\Windows\System32\drivers\s1018mgmt.sys [2009-12-13 133160]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);C:\Windows\System32\drivers\s1018nd5.sys [2009-12-13 34856]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;C:\Windows\System32\drivers\s1018obex.sys [2009-12-13 128552]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);C:\Windows\System32\drivers\s1018unic.sys [2009-12-13 146472]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-24 59392]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-6-13 1255736]
.
=============== Created Last 30 ================
.
2012-12-18 11:19:27 ——– d—–w- C:\Program Files (x86)\Geeks3D
2012-12-16 20:17:35 76232 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{881BF6E9-AAB8-44AE-AEBE-3174E1732A02}\offreg.dll
2012-12-16 18:03:36 ——– d—–w- C:\TDSSKiller_Quarantine
2012-12-14 17:28:21 9125352 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{881BF6E9-AAB8-44AE-AEBE-3174E1732A02}\mpengine.dll
2012-12-12 19:48:14 2048 —-a-w- C:\Windows\SysWow64\tzres.dll
2012-12-12 19:48:14 2048 —-a-w- C:\Windows\System32\tzres.dll
2012-12-12 19:48:08 3149824 —-a-w- C:\Windows\System32\win32k.sys
2012-12-04 22:51:42 34624 —-a-w- C:\Windows\System32\TURegOpt.exe
2012-12-04 22:51:42 25920 —-a-w- C:\Windows\System32\authuitu.dll
2012-12-04 22:51:40 21312 —-a-w- C:\Windows\SysWow64\authuitu.dll
2012-12-04 22:51:19 ——– d—–w- C:\Program Files (x86)\TuneUp Utilities 2012
2012-12-04 22:49:57 ——– d-sh–w- C:\PROGRA~3\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-12-04 22:31:20 262112 —-a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
.
==================== Find3M ====================
.
2012-12-12 15:01:35 73656 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-12 15:01:35 697272 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-11-15 15:15:08 54104 —-a-w- C:\Windows\System32\drivers\kltdi.sys
2012-11-12 12:28:37 1638912 —-a-w- C:\Windows\System32\mshtml.tlb
2012-11-12 11:52:18 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2012-11-05 21:35:16 46080 —-a-w- C:\Windows\System32\atmlib.dll
2012-11-05 20:41:32 367616 —-a-w- C:\Windows\System32\atmfd.dll
2012-11-05 20:32:16 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll
2012-11-05 20:32:09 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll
2012-11-02 05:59:11 478208 —-a-w- C:\Windows\System32\dpnet.dll
2012-11-02 05:11:31 376832 —-a-w- C:\Windows\SysWow64\dpnet.dll
2012-10-27 06:26:55 981504 —-a-w- C:\Windows\SysWow64\wininet.dll
2012-10-27 05:51:21 1188864 —-a-w- C:\Windows\System32\wininet.dll
2012-10-25 02:12:26 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2012-10-25 02:12:26 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts
2012-10-23 15:23:37 29528 —-a-w- C:\Windows\System32\drivers\klmouflt.sys
2012-10-23 15:23:37 29016 —-a-w- C:\Windows\System32\drivers\klkbdflt.sys
2012-10-16 08:38:37 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38:34 350208 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39:52 561664 —-a-w- C:\Windows\apppatch\AcLayers.dll
2012-10-09 18:17:13 55296 —-a-w- C:\Windows\System32\dhcpcsvc6.dll
2012-10-09 18:17:13 226816 —-a-w- C:\Windows\System32\dhcpcore6.dll
2012-10-09 17:40:31 44032 —-a-w- C:\Windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40:31 193536 —-a-w- C:\Windows\SysWow64\dhcpcore6.dll
2012-10-04 17:46:16 362496 —-a-w- C:\Windows\System32\wow64win.dll
2012-10-04 17:46:15 243200 —-a-w- C:\Windows\System32\wow64.dll
2012-10-04 17:46:15 13312 —-a-w- C:\Windows\System32\wow64cpu.dll
2012-10-04 17:45:55 215040 —-a-w- C:\Windows\System32\winsrv.dll
2012-10-04 17:43:28 16384 —-a-w- C:\Windows\System32\ntvdm64.dll
2012-10-04 17:41:16 424960 —-a-w- C:\Windows\System32\KernelBase.dll
2012-10-04 16:47:41 5120 —-a-w- C:\Windows\SysWow64\wow32.dll
2012-10-04 16:47:41 274944 —-a-w- C:\Windows\SysWow64\KernelBase.dll
2012-10-04 15:21:55 338432 —-a-w- C:\Windows\System32\conhost.exe
2012-10-04 14:46:46 7680 —-a-w- C:\Windows\SysWow64\instnm.exe
2012-10-04 14:46:46 25600 —-a-w- C:\Windows\SysWow64\setup16.exe
2012-10-04 14:46:44 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll
2012-10-04 14:46:43 2048 —-a-w- C:\Windows\SysWow64\user.exe
2012-10-04 14:41:50 6144 —ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2012-10-04 14:41:50 4608 —ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-04 14:41:50 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2012-10-04 14:41:50 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2012-10-03 17:56:54 1914248 —-a-w- C:\Windows\System32\drivers\tcpip.sys
2012-10-03 17:44:21 70656 —-a-w- C:\Windows\System32\nlaapi.dll
2012-10-03 17:44:21 303104 —-a-w- C:\Windows\System32\nlasvc.dll
2012-10-03 17:44:17 246272 —-a-w- C:\Windows\System32\netcorehc.dll
2012-10-03 17:44:17 18944 —-a-w- C:\Windows\System32\netevent.dll
2012-10-03 17:44:16 216576 —-a-w- C:\Windows\System32\ncsi.dll
2012-10-03 17:42:16 569344 —-a-w- C:\Windows\System32\iphlpsvc.dll
2012-10-03 16:42:24 18944 —-a-w- C:\Windows\SysWow64\netevent.dll
2012-10-03 16:42:24 175104 —-a-w- C:\Windows\SysWow64\netcorehc.dll
2012-10-03 16:42:23 156672 —-a-w- C:\Windows\SysWow64\ncsi.dll
2012-10-03 16:07:26 45568 —-a-w- C:\Windows\System32\drivers\tcpipreg.sys
2012-10-02 19:51:11 3293544 —-a-w- C:\Windows\System32\nvsvc64.dll
2012-10-02 19:51:04 6200680 —-a-w- C:\Windows\System32\nvcpl.dll
2012-10-02 19:50:57 891240 —-a-w- C:\Windows\System32\nvvsvc.exe
2012-10-02 19:50:57 63336 —-a-w- C:\Windows\System32\nvshext.dll
2012-10-02 19:50:57 2557800 —-a-w- C:\Windows\System32\nvsvcr.dll
2012-10-02 19:50:57 118120 —-a-w- C:\Windows\System32\nvmctray.dll
2012-10-02 11:15:52 430952 —-a-w- C:\Windows\SysWow64\nvStreaming.exe
2012-09-25 22:47:43 78336 —-a-w- C:\Windows\SysWow64\synceng.dll
2012-09-25 22:46:17 95744 —-a-w- C:\Windows\System32\synceng.dll
2012-09-24 22:16:33 95208 —-a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
.
============= FINISH: 18:20:37,72 ===============
Thanks in advance
Hi and Welcome!!
My name is
Jeff . I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
I will be working on your Malware issues, this may or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for the issues on this machine. Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear. It's often worth reading through these instructions and printing them for ease of reference. If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic. IMPORTANT NOTE : Please do not delete anything unless instructed to.DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision .
Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
Stay with this topic until I give you the all clean post.
———
Please download
aswMBR to your desktop.
Double click the aswMBR icon to run it. Click the Scan button to start scan. If you are asked to update the Avast Virus database please allow it to do so. When it finishes, press the save log button, save the logfile to your desktop and attach its contents in your next reply. [external image: Posted Image] Click the image to enlarge it
———-
Hi Jeff,
thanks for your reply, I realy appriciate your help.
Regards
No problem…when you get the aswMBR log please post that and we can go from there.
Hi Jeff,
got the log file right here:
aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software
Run date: 2012-12-24 15:30:10
—————————–
15:30:10.021 OS Version: Windows x64 6.1.7601 Service Pack 1
15:30:10.021 Number of processors: 4 586 0xF0B
15:30:10.021 ComputerName: JAKA-PC UserName: Jaka
15:30:11.097 Initialize success
15:30:13.168 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-3
15:30:13.168 Disk 0 Vendor: ST3500630AS 3.AAK Size: 476940MB BusType: 3
15:30:13.168 Disk 0 MBR read successfully
15:30:13.168 Disk 0 MBR scan
15:30:13.184 Disk 0 Windows 7 default MBR code
15:30:13.184 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
15:30:13.184 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 108173 MB offset 206848
15:30:13.184 Disk 0 Partition - 00 05 Extended 368663 MB offset 221745195
15:30:13.215 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 122887 MB offset 221745258
15:30:13.215 Disk 0 Partition - 00 05 Extended 122887 MB offset 473419485
15:30:13.230 Disk 0 scanning C:\Windows\system32\drivers
15:30:17.938 Service scanning
15:30:22.988 Service KL1 C:\Windows\system32\DRIVERS\kl1.sys **LOCKED** 5
15:30:23.050 Service KLIM6 C:\Windows\system32\DRIVERS\klim6.sys **LOCKED** 5
15:30:23.081 Service klkbdflt C:\Windows\system32\DRIVERS\klkbdflt.sys **LOCKED** 5
15:30:23.112 Service klmouflt C:\Windows\system32\DRIVERS\klmouflt.sys **LOCKED** 5
15:30:23.144 Service kltdi C:\Windows\system32\DRIVERS\kltdi.sys **LOCKED** 5
15:30:23.175 Service kneps C:\Windows\system32\DRIVERS\kneps.sys **LOCKED** 5
15:30:27.012 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
15:30:30.257 Modules scanning
15:30:30.257 Disk 0 trace - called modules:
15:30:30.273 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80039a22c0]< \Device\Harddisk0\DR0[0xfffffa8004b47060]
15:30:30.288 3 CLASSPNP.SYS[fffff88001e5143f] -> nt!IofCallDriver -> [0xfffffa80048bae40]
15:30:30.288 5 ACPI.sys[fffff8800103a7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP3T0L0-3[0xfffffa80048f3060]
15:30:30.288 \Driver\atapi[0xfffffa80048fd8e0] -> IRP_MJ_CREATE -> 0xfffffa80039a22c0
15:30:30.304 Scan finished successfully
15:31:09.932 Disk 0 MBR has been saved successfully to "C:\Users\Jaka\Desktop\MBR.dat"
15:31:09.938 The log file has been saved successfully to "C:\Users\Jaka\Desktop\aswMBR.txt"
Hi,
After seeing the aswMBR log I think we need a look with a different tool before we begin trying to fix anything…
Please download
TDSSKiller
Double click TDSSKiller.exe Press Start Scan If Malicious objects are found, select Skip Do Not Attempt To Fix Anything Now. We just need to look over the report and be sure we are removing the correct Attach the log in your next reply A copy of the log will be saved automatically to the root of the drive (typically C:\)
———-
ok, here's the copy of the report:
17:41:58.0176 3628 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
17:41:58.0817 3628 ============================================================
17:41:58.0817 3628 Current date / time: 2012/12/24 17:41:58.0817
17:41:58.0817 3628 SystemInfo:
17:41:58.0817 3628
17:41:58.0817 3628 OS Version: 6.1.7601 ServicePack: 1.0
17:41:58.0817 3628 Product type: Workstation
17:41:58.0817 3628 ComputerName: JAKA-PC
17:41:58.0817 3628 UserName: Jaka
17:41:58.0817 3628 Windows directory: C:\Windows
17:41:58.0817 3628 System windows directory: C:\Windows
17:41:58.0817 3628 Running under WOW64
17:41:58.0817 3628 Processor architecture: Intel x64
17:41:58.0817 3628 Number of processors: 4
17:41:58.0817 3628 Page size: 0x1000
17:41:58.0817 3628 Boot type: Normal boot
17:41:58.0817 3628 ============================================================
17:41:59.0895 3628 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0x38080, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000040
17:41:59.0981 3628 Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
17:42:00.0000 3628 ============================================================
17:42:00.0000 3628 \Device\Harddisk0\DR0:
17:42:00.0000 3628 MBR partitions:
17:42:00.0000 3628 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
17:42:00.0000 3628 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xD346800
17:42:00.0014 3628 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0xD37906A, BlocksNum 0xF003E73
17:42:00.0026 3628 \Device\Harddisk0\DR0\Partition4: MBR, Type 0x7, StartLBA 0x1C37CF1C, BlocksNum 0xF003E73
17:42:00.0059 3628 \Device\Harddisk0\DR0\Partition5: MBR, Type 0x7, StartLBA 0x2B380DCE, BlocksNum 0xF003E73
17:42:00.0059 3628 \Device\Harddisk1\DR1:
17:42:00.0059 3628 MBR partitions:
17:42:00.0059 3628 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74705982
17:42:00.0059 3628 ============================================================
17:42:00.0145 3628 C: <-> \Device\Harddisk0\DR0\Partition2
17:42:00.0278 3628 D: <-> \Device\Harddisk0\DR0\Partition3
17:42:00.0388 3628 E: <-> \Device\Harddisk0\DR0\Partition4
17:42:00.0505 3628 F: <-> \Device\Harddisk0\DR0\Partition5
17:42:00.0603 3628 K: <-> \Device\Harddisk1\DR1\Partition1
17:42:00.0653 3628 ============================================================
17:42:00.0654 3628 Initialize success
17:42:00.0654 3628 ============================================================
17:42:11.0130 3264 ============================================================
17:42:11.0130 3264 Scan started
17:42:11.0130 3264 Mode: Manual;
17:42:11.0130 3264 ============================================================
17:42:13.0063 3264 ================ Scan system memory ========================
17:42:13.0063 3264 System memory - ok
17:42:13.0063 3264 ================ Scan services =============================
17:42:13.0406 3264 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
17:42:13.0710 3264 1394ohci - ok
17:42:13.0781 3264 [ 8ACBB0D11A99EF06BFFD09C5B4DF0925 ] 1651538drv C:\Windows\system32\DRIVERS\1651538drv.sys
17:42:13.0790 3264 1651538drv - ok
17:42:13.0834 3264 [ E656FE10D6D27794AFA08136685A69E8 ] 83531325 C:\Windows\system32\DRIVERS\83531325.sys
17:42:13.0841 3264 83531325 - ok
17:42:13.0889 3264 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys
17:42:13.0901 3264 ACPI - ok
17:42:13.0924 3264 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
17:42:13.0925 3264 AcpiPmi - ok
17:42:14.0174 3264 [ 95CE557D16A75606CCC2D7F3B0B0BCCB ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
17:42:14.0178 3264 AdobeFlashPlayerUpdateSvc - ok
17:42:14.0215 3264 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
17:42:14.0223 3264 adp94xx - ok
17:42:14.0245 3264 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
17:42:14.0251 3264 adpahci - ok
17:42:14.0306 3264 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
17:42:14.0309 3264 adpu320 - ok
17:42:14.0343 3264 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
17:42:14.0345 3264 AeLookupSvc - ok
17:42:14.0385 3264 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys
17:42:14.0402 3264 AFD - ok
17:42:14.0429 3264 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys
17:42:14.0431 3264 agp440 - ok
17:42:14.0448 3264 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
17:42:14.0450 3264 ALG - ok
17:42:14.0478 3264 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys
17:42:14.0480 3264 aliide - ok
17:42:14.0508 3264 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys
17:42:14.0510 3264 amdide - ok
17:42:14.0541 3264 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
17:42:14.0543 3264 AmdK8 - ok
17:42:14.0552 3264 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
17:42:14.0555 3264 AmdPPM - ok
17:42:14.0576 3264 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys
17:42:14.0579 3264 amdsata - ok
17:42:14.0593 3264 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
17:42:14.0597 3264 amdsbs - ok
17:42:14.0610 3264 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys
17:42:14.0611 3264 amdxata - ok
17:42:14.0637 3264 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
17:42:14.0639 3264 AppID - ok
17:42:14.0669 3264 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
17:42:14.0671 3264 AppIDSvc - ok
17:42:14.0697 3264 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll
17:42:14.0699 3264 Appinfo - ok
17:42:14.0729 3264 [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt C:\Windows\System32\appmgmts.dll
17:42:14.0733 3264 AppMgmt - ok
17:42:14.0742 3264 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys
17:42:14.0745 3264 arc - ok
17:42:14.0757 3264 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
17:42:14.0760 3264 arcsas - ok
17:42:14.0874 3264 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
17:42:14.0933 3264 aspnet_state - ok
17:42:14.0946 3264 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
17:42:14.0947 3264 AsyncMac - ok
17:42:14.0964 3264 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys
17:42:14.0964 3264 atapi - ok
17:42:14.0999 3264 [ 940E5B876251E04FFFE058AD71FE0F1C ] AtcL001 C:\Windows\system32\DRIVERS\l160x64.sys
17:42:15.0001 3264 AtcL001 - ok
17:42:15.0038 3264 [ FC0E8778C000291CAF60EB88C011E931 ] atksgt C:\Windows\system32\DRIVERS\atksgt.sys
17:42:15.0042 3264 atksgt - ok
17:42:15.0080 3264 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
17:42:15.0090 3264 AudioEndpointBuilder - ok
17:42:15.0122 3264 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
17:42:15.0127 3264 AudioSrv - ok
17:42:15.0391 3264 [ 587EFD6A3A30A35A27904D21AE1FB882 ] AVP C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
17:42:15.0417 3264 AVP - ok
17:42:15.0446 3264 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
17:42:15.0463 3264 AxInstSV - ok
17:42:15.0596 3264 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
17:42:15.0610 3264 b06bdrv - ok
17:42:15.0672 3264 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
17:42:15.0686 3264 b57nd60a - ok
17:42:15.0716 3264 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
17:42:15.0718 3264 BDESVC - ok
17:42:15.0724 3264 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
17:42:15.0725 3264 Beep - ok
17:42:15.0878 3264 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll
17:42:15.0895 3264 BFE - ok
17:42:16.0080 3264 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll
17:42:16.0222 3264 BITS - ok
17:42:16.0276 3264 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
17:42:16.0287 3264 blbdrive - ok
17:42:16.0375 3264 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
17:42:16.0394 3264 bowser - ok
17:42:16.0406 3264 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
17:42:16.0408 3264 BrFiltLo - ok
17:42:16.0417 3264 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
17:42:16.0418 3264 BrFiltUp - ok
17:42:16.0456 3264 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll
17:42:16.0463 3264 Browser - ok
17:42:16.0517 3264 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
17:42:16.0543 3264 Brserid - ok
17:42:16.0561 3264 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
17:42:16.0588 3264 BrSerWdm - ok
17:42:16.0605 3264 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
17:42:16.0642 3264 BrUsbMdm - ok
17:42:16.0699 3264 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
17:42:16.0710 3264 BrUsbSer - ok
17:42:16.0727 3264 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
17:42:16.0729 3264 BTHMODEM - ok
17:42:16.0769 3264 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
17:42:16.0795 3264 bthserv - ok
17:42:16.0917 3264 [ 2BD001601496AE87F7CB86F1FCD6F1EC ] Cardex C:\Windows\SysWOW64\drivers\TBPANELX64.SYS
17:42:16.0928 3264 Cardex - ok
17:42:16.0962 3264 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
17:42:16.0982 3264 cdfs - ok
17:42:17.0054 3264 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\drivers\cdrom.sys
17:42:17.0057 3264 cdrom - ok
17:42:17.0130 3264 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
17:42:17.0133 3264 CertPropSvc - ok
17:42:17.0187 3264 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys
17:42:17.0202 3264 circlass - ok
17:42:17.0235 3264 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
17:42:17.0240 3264 CLFS - ok
17:42:17.0373 3264 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
17:42:17.0419 3264 clr_optimization_v2.0.50727_32 - ok
17:42:17.0626 3264 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
17:42:17.0684 3264 clr_optimization_v2.0.50727_64 - ok
17:42:17.0937 3264 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
17:42:18.0362 3264 clr_optimization_v4.0.30319_32 - ok
17:42:18.0787 3264 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
17:42:19.0125 3264 clr_optimization_v4.0.30319_64 - ok
17:42:19.0199 3264 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
17:42:19.0208 3264 CmBatt - ok
17:42:19.0245 3264 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys
17:42:19.0253 3264 cmdide - ok
17:42:19.0308 3264 [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG C:\Windows\system32\Drivers\cng.sys
17:42:19.0384 3264 CNG - ok
17:42:19.0416 3264 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
17:42:19.0431 3264 Compbatt - ok
17:42:19.0532 3264 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
17:42:19.0560 3264 CompositeBus - ok
17:42:19.0580 3264 COMSysApp - ok
17:42:19.0592 3264 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
17:42:19.0736 3264 crcdisk - ok
17:42:19.0866 3264 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll
17:42:19.0870 3264 CryptSvc - ok
17:42:19.0957 3264 [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC C:\Windows\system32\drivers\csc.sys
17:42:19.0976 3264 CSC - ok
17:42:20.0079 3264 [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService C:\Windows\System32\cscsvc.dll
17:42:20.0114 3264 CscService - ok
17:42:20.0373 3264 [ 914A7156B0C0F10BE645A02E13F576B2 ] DAUpdaterSvc D:\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
17:42:20.0421 3264 DAUpdaterSvc - ok
17:42:20.0657 3264 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
17:42:20.0676 3264 DcomLaunch - ok
17:42:20.0810 3264 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
17:42:20.0861 3264 defragsvc - ok
17:42:20.0954 3264 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
17:42:20.0975 3264 DfsC - ok
17:42:21.0124 3264 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
17:42:21.0150 3264 Dhcp - ok
17:42:21.0203 3264 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
17:42:21.0228 3264 discache - ok
17:42:21.0344 3264 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys
17:42:21.0360 3264 Disk - ok
17:42:21.0445 3264 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll
17:42:21.0471 3264 Dnscache - ok
17:42:21.0635 3264 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
17:42:21.0686 3264 dot3svc - ok
17:42:21.0771 3264 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
17:42:21.0805 3264 DPS - ok
17:42:21.0885 3264 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
17:42:21.0906 3264 drmkaud - ok
17:42:22.0195 3264 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
17:42:22.0237 3264 DXGKrnl - ok
17:42:22.0373 3264 [ 416A2007878ED1D6FC5DDDB9E1F6DB3E ] e1express C:\Windows\system32\DRIVERS\e1e6032e.sys
17:42:22.0381 3264 e1express - ok
17:42:22.0424 3264 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
17:42:22.0434 3264 EapHost - ok
17:42:22.0619 3264 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
17:42:22.0722 3264 ebdrv - ok
17:42:22.0759 3264 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe
17:42:22.0771 3264 EFS - ok
17:42:22.0813 3264 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
17:42:22.0823 3264 ehRecvr - ok
17:42:22.0854 3264 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
17:42:22.0856 3264 ehSched - ok
17:42:22.0887 3264 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
17:42:22.0894 3264 elxstor - ok
17:42:22.0912 3264 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys
17:42:22.0913 3264 ErrDev - ok
17:42:22.0986 3264 esgiguard - ok
17:42:23.0028 3264 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
17:42:23.0038 3264 EventSystem - ok
17:42:23.0053 3264 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
17:42:23.0056 3264 exfat - ok
17:42:23.0078 3264 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
17:42:23.0082 3264 fastfat - ok
17:42:23.0122 3264 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
17:42:23.0149 3264 Fax - ok
17:42:23.0164 3264 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys
17:42:23.0165 3264 fdc - ok
17:42:23.0175 3264 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
17:42:23.0177 3264 fdPHost - ok
17:42:23.0187 3264 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
17:42:23.0189 3264 FDResPub - ok
17:42:23.0197 3264 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
17:42:23.0199 3264 FileInfo - ok
17:42:23.0206 3264 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
17:42:23.0208 3264 Filetrace - ok
17:42:23.0216 3264 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
17:42:23.0218 3264 flpydisk - ok
17:42:23.0248 3264 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
17:42:23.0253 3264 FltMgr - ok
17:42:23.0431 3264 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll
17:42:23.0465 3264 FontCache - ok
17:42:23.0515 3264 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
17:42:23.0589 3264 FontCache3.0.0.0 - ok
17:42:23.0601 3264 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
17:42:23.0610 3264 FsDepends - ok
17:42:23.0639 3264 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
17:42:23.0647 3264 Fs_Rec - ok
17:42:23.0707 3264 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
17:42:23.0719 3264 fvevol - ok
17:42:23.0741 3264 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
17:42:23.0761 3264 gagp30kx - ok
17:42:23.0807 3264 [ A4198F2BD8AA592CB90476277A81B5E1 ] ggflt C:\Windows\system32\DRIVERS\ggflt.sys
17:42:23.0817 3264 ggflt - ok
17:42:23.0840 3264 [ D266350BDAAB9EB6C1AEC370EEAAFF3A ] ggsemc C:\Windows\system32\DRIVERS\ggsemc.sys
17:42:23.0847 3264 ggsemc - ok
17:42:23.0999 3264 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
17:42:24.0025 3264 gpsvc - ok
17:42:24.0114 3264 [ F02A533F517EB38333CB12A9E8963773 ] gupdate1cc6e1fb9d6528 C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
17:42:24.0118 3264 gupdate1cc6e1fb9d6528 - ok
17:42:24.0172 3264 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
17:42:24.0173 3264 gupdatem - ok
17:42:24.0194 3264 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
17:42:24.0206 3264 hcw85cir - ok
17:42:24.0253 3264 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
17:42:24.0268 3264 HdAudAddService - ok
17:42:24.0308 3264 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
17:42:24.0320 3264 HDAudBus - ok
17:42:24.0335 3264 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
17:42:24.0350 3264 HidBatt - ok
17:42:24.0365 3264 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
17:42:24.0368 3264 HidBth - ok
17:42:24.0388 3264 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
17:42:24.0390 3264 HidIr - ok
17:42:24.0416 3264 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll
17:42:24.0418 3264 hidserv - ok
17:42:24.0445 3264 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
17:42:24.0446 3264 HidUsb - ok
17:42:24.0484 3264 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
17:42:24.0494 3264 hkmsvc - ok
17:42:24.0555 3264 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
17:42:24.0572 3264 HomeGroupListener - ok
17:42:24.0628 3264 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
17:42:24.0662 3264 HomeGroupProvider - ok
17:42:24.0746 3264 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
17:42:24.0759 3264 HpSAMD - ok
17:42:24.0822 3264 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
17:42:24.0839 3264 HTTP - ok
17:42:24.0862 3264 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
17:42:24.0886 3264 hwpolicy - ok
17:42:24.0933 3264 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
17:42:24.0940 3264 i8042prt - ok
17:42:25.0035 3264 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
17:42:25.0063 3264 iaStorV - ok
17:42:25.0336 3264 [ B504D76EF533E3AC269789111A0C1BA1 ] IBUpdaterService C:\ProgramData\IBUpdaterService\ibsvc.exe
17:42:25.0345 3264 IBUpdaterService - ok
17:42:25.0415 3264 [ 138ECE3E53DB1A808156C9F1E9AF5FC5 ] Icon7vLifeWebCam C:\Windows\system32\DRIVERS\Icon7VAC.sys
17:42:25.0424 3264 Icon7vLifeWebCam - ok
17:42:25.0613 3264 [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
17:42:25.0662 3264 IDriverT - ok
17:42:25.0942 3264 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
17:42:26.0026 3264 idsvc - ok
17:42:26.0101 3264 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
17:42:26.0141 3264 iirsp - ok
17:42:26.0324 3264 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
17:42:26.0350 3264 IKEEXT - ok
17:42:26.0388 3264 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys
17:42:26.0397 3264 intelide - ok
17:42:26.0422 3264 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
17:42:26.0424 3264 intelppm - ok
17:42:26.0442 3264 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
17:42:26.0445 3264 IPBusEnum - ok
17:42:26.0475 3264 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
17:42:26.0485 3264 IpFilterDriver - ok
17:42:26.0519 3264 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
17:42:26.0528 3264 iphlpsvc - ok
17:42:26.0550 3264 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
17:42:26.0552 3264 IPMIDRV - ok
17:42:26.0563 3264 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
17:42:26.0566 3264 IPNAT - ok
17:42:26.0578 3264 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
17:42:26.0579 3264 IRENUM - ok
17:42:26.0603 3264 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys
17:42:26.0604 3264 isapnp - ok
17:42:26.0623 3264 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
17:42:26.0629 3264 iScsiPrt - ok
17:42:26.0649 3264 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
17:42:26.0651 3264 kbdclass - ok
17:42:26.0665 3264 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
17:42:26.0667 3264 kbdhid - ok
17:42:26.0683 3264 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe
17:42:26.0685 3264 KeyIso - ok
17:42:26.0738 3264 [ 8B5219318DF5895ABD230C373F2DF18A ] KL1 C:\Windows\system32\DRIVERS\kl1.sys
17:42:26.0745 3264 KL1 - ok
17:42:26.0794 3264 [ 65F3B81FA285EAB641F5E6EF7AEB984D ] KLIF C:\Windows\system32\DRIVERS\klif.sys
17:42:26.0804 3264 KLIF - ok
17:42:26.0839 3264 [ 9BD99E1AB3F664120AB95C35F9EC1EB0 ] KLIM6 C:\Windows\system32\DRIVERS\klim6.sys
17:42:26.0840 3264 KLIM6 - ok
17:42:26.0857 3264 [ 2C43FD500522EF3B8C283A5846B7FC41 ] klkbdflt C:\Windows\system32\DRIVERS\klkbdflt.sys
17:42:26.0859 3264 klkbdflt - ok
17:42:26.0869 3264 [ 70A6D2E292017EC47949696F51ABE18D ] klmouflt C:\Windows\system32\DRIVERS\klmouflt.sys
17:42:26.0870 3264 klmouflt - ok
17:42:26.0905 3264 [ A8081ED8D48FA611D11DB97F49A5343D ] kltdi C:\Windows\system32\DRIVERS\kltdi.sys
17:42:26.0907 3264 kltdi - ok
17:42:26.0933 3264 [ 185D21CB8F10CFB351FF65DA88C18BC9 ] kneps C:\Windows\system32\DRIVERS\kneps.sys
17:42:26.0937 3264 kneps - ok
17:42:26.0959 3264 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
17:42:26.0962 3264 KSecDD - ok
17:42:26.0999 3264 [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
17:42:27.0003 3264 KSecPkg - ok
17:42:27.0030 3264 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
17:42:27.0031 3264 ksthunk - ok
17:42:27.0055 3264 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
17:42:27.0062 3264 KtmRm - ok
17:42:27.0095 3264 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll
17:42:27.0100 3264 LanmanServer - ok
17:42:27.0113 3264 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
17:42:27.0118 3264 LanmanWorkstation - ok
17:42:27.0175 3264 [ 156AB2E56DC3CA0B582E3362E07CDED7 ] lirsgt C:\Windows\system32\DRIVERS\lirsgt.sys
17:42:27.0177 3264 lirsgt - ok
17:42:27.0202 3264 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
17:42:27.0204 3264 lltdio - ok
17:42:27.0231 3264 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
17:42:27.0237 3264 lltdsvc - ok
17:42:27.0266 3264 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
17:42:27.0272 3264 lmhosts - ok
17:42:27.0302 3264 [ 64AEB5790901EA8854884981F104CAA6 ] LNonPnP C:\Windows\system32\drivers\LNonPnP.sys
17:42:27.0304 3264 LNonPnP - ok
17:42:27.0332 3264 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
17:42:27.0336 3264 LSI_FC - ok
17:42:27.0348 3264 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
17:42:27.0350 3264 LSI_SAS - ok
17:42:27.0363 3264 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
17:42:27.0365 3264 LSI_SAS2 - ok
17:42:27.0376 3264 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
17:42:27.0378 3264 LSI_SCSI - ok
17:42:27.0399 3264 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
17:42:27.0402 3264 luafv - ok
17:42:27.0433 3264 [ 79D51E7F5926E8CE1B3EBECEBAE28CFF ] mcdbus C:\Windows\system32\DRIVERS\mcdbus.sys
17:42:27.0437 3264 mcdbus - ok
17:42:27.0464 3264 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
17:42:27.0475 3264 Mcx2Svc - ok
17:42:27.0490 3264 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
17:42:27.0492 3264 megasas - ok
17:42:27.0537 3264 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
17:42:27.0550 3264 MegaSR - ok
17:42:27.0689 3264 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe
17:42:27.0701 3264 Microsoft Office Groove Audit Service - ok
17:42:27.0770 3264 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
17:42:27.0784 3264 MMCSS - ok
17:42:27.0795 3264 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
17:42:27.0797 3264 Modem - ok
17:42:27.0822 3264 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
17:42:27.0824 3264 monitor - ok
17:42:27.0850 3264 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
17:42:27.0852 3264 mouclass - ok
17:42:27.0866 3264 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
17:42:27.0867 3264 mouhid - ok
17:42:27.0890 3264 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
17:42:27.0892 3264 mountmgr - ok
17:42:27.0954 3264 [ 8C7336950F1E69CDFD811CBBD9CF00A2 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
17:42:27.0957 3264 MozillaMaintenance - ok
17:42:27.0983 3264 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys
17:42:27.0987 3264 mpio - ok
17:42:27.0992 3264 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
17:42:27.0994 3264 mpsdrv - ok
17:42:28.0046 3264 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll
17:42:28.0089 3264 MpsSvc - ok
17:42:28.0131 3264 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
17:42:28.0136 3264 MRxDAV - ok
17:42:28.0159 3264 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
17:42:28.0163 3264 mrxsmb - ok
17:42:28.0185 3264 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
17:42:28.0189 3264 mrxsmb10 - ok
17:42:28.0207 3264 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
17:42:28.0210 3264 mrxsmb20 - ok
17:42:28.0233 3264 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys
17:42:28.0234 3264 msahci - ok
17:42:28.0247 3264 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys
17:42:28.0250 3264 msdsm - ok
17:42:28.0260 3264 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
17:42:28.0264 3264 MSDTC - ok
17:42:28.0283 3264 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
17:42:28.0285 3264 Msfs - ok
17:42:28.0309 3264 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
17:42:28.0310 3264 mshidkmdf - ok
17:42:28.0328 3264 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
17:42:28.0329 3264 msisadrv - ok
17:42:28.0354 3264 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
17:42:28.0358 3264 MSiSCSI - ok
17:42:28.0362 3264 msiserver - ok
17:42:28.0385 3264 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
17:42:28.0387 3264 MSKSSRV - ok
17:42:28.0399 3264 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
17:42:28.0401 3264 MSPCLOCK - ok
17:42:28.0407 3264 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
17:42:28.0408 3264 MSPQM - ok
17:42:28.0429 3264 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
17:42:28.0435 3264 MsRPC - ok
17:42:28.0463 3264 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
17:42:28.0465 3264 mssmbios - ok
17:42:28.0469 3264 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
17:42:28.0470 3264 MSTEE - ok
17:42:28.0495 3264 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
17:42:28.0497 3264 MTConfig - ok
17:42:28.0524 3264 [ 03B7145C889603537E9FFEABB1AD1089 ] MTsensor C:\Windows\system32\DRIVERS\ASACPI.sys
17:42:28.0525 3264 MTsensor - ok
17:42:28.0539 3264 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
17:42:28.0541 3264 Mup - ok
17:42:28.0574 3264 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
17:42:28.0582 3264 napagent - ok
17:42:28.0615 3264 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
17:42:28.0620 3264 NativeWifiP - ok
17:42:28.0705 3264 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys
17:42:28.0740 3264 NDIS - ok
17:42:28.0746 3264 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
17:42:28.0748 3264 NdisCap - ok
17:42:28.0773 3264 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
17:42:28.0774 3264 NdisTapi - ok
17:42:28.0793 3264 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
17:42:28.0795 3264 Ndisuio - ok
17:42:28.0816 3264 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
17:42:28.0819 3264 NdisWan - ok
17:42:28.0845 3264 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
17:42:28.0847 3264 NDProxy - ok
17:42:28.0860 3264 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
17:42:28.0861 3264 NetBIOS - ok
17:42:28.0891 3264 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
17:42:28.0896 3264 NetBT - ok
17:42:28.0907 3264 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe
17:42:28.0908 3264 Netlogon - ok
17:42:28.0931 3264 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
17:42:28.0938 3264 Netman - ok
17:42:28.0974 3264 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
17:42:29.0010 3264 NetMsmqActivator - ok
17:42:29.0028 3264 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
17:42:29.0030 3264 NetPipeActivator - ok
17:42:29.0058 3264 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
17:42:29.0066 3264 netprofm - ok
17:42:29.0070 3264 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
17:42:29.0072 3264 NetTcpActivator - ok
17:42:29.0076 3264 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
17:42:29.0077 3264 NetTcpPortSharing - ok
17:42:29.0108 3264 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
17:42:29.0109 3264 nfrd960 - ok
17:42:29.0120 3264 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll
17:42:29.0125 3264 NlaSvc - ok
17:42:29.0136 3264 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
17:42:29.0138 3264 Npfs - ok
17:42:29.0151 3264 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
17:42:29.0153 3264 nsi - ok
17:42:29.0183 3264 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
17:42:29.0187 3264 nsiproxy - ok
17:42:29.0355 3264 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
17:42:29.0423 3264 Ntfs - ok
17:42:29.0438 3264 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
17:42:29.0439 3264 Null - ok
17:42:30.0501 3264 [ FE2909F7DFB12B9A20AD207FE23B7E96 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
17:42:30.0734 3264 nvlddmkm - ok
17:42:30.0769 3264 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys
17:42:30.0773 3264 nvraid - ok
17:42:30.0821 3264 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys
17:42:30.0829 3264 nvstor - ok
17:42:30.0879 3264 [ 3341D2C91989BC87C3C0BAA97C27253B ] nvsvc C:\Windows\system32\nvvsvc.exe
17:42:30.0905 3264 nvsvc - ok
17:42:31.0030 3264 [ 551CE34DAD2DFF0A480781E68B286E4D ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
17:42:31.0066 3264 nvUpdatusService - ok
17:42:31.0096 3264 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
17:42:31.0100 3264 nv_agp - ok
17:42:31.0185 3264 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
17:42:31.0196 3264 odserv - ok
17:42:31.0241 3264 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
17:42:31.0250 3264 ohci1394 - ok
17:42:31.0280 3264 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
17:42:31.0283 3264 ose - ok
17:42:31.0304 3264 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
17:42:31.0311 3264 p2pimsvc - ok
17:42:31.0353 3264 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
17:42:31.0360 3264 p2psvc - ok
17:42:31.0392 3264 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys
17:42:31.0395 3264 Parport - ok
17:42:31.0410 3264 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys
17:42:31.0412 3264 partmgr - ok
17:42:31.0449 3264 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
17:42:31.0453 3264 PcaSvc - ok
17:42:31.0519 3264 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys
17:42:31.0544 3264 pci - ok
17:42:31.0610 3264 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys
17:42:31.0620 3264 pciide - ok
17:42:31.0636 3264 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
17:42:31.0641 3264 pcmcia - ok
17:42:31.0650 3264 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
17:42:31.0652 3264 pcw - ok
17:42:31.0671 3264 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
17:42:31.0688 3264 PEAUTH - ok
17:42:31.0744 3264 [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
17:42:31.0787 3264 PeerDistSvc - ok
17:42:32.0287 3264 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
17:42:32.0299 3264 PerfHost - ok
17:42:32.0347 3264 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
17:42:32.0381 3264 pla - ok
17:42:32.0419 3264 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
17:42:32.0427 3264 PlugPlay - ok
17:42:32.0472 3264 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
17:42:32.0475 3264 PNRPAutoReg - ok
17:42:32.0487 3264 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
17:42:32.0491 3264 PNRPsvc - ok
17:42:32.0510 3264 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
17:42:32.0517 3264 PolicyAgent - ok
17:42:32.0543 3264 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
17:42:32.0548 3264 Power - ok
17:42:32.0574 3264 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
17:42:32.0577 3264 PptpMiniport - ok
17:42:32.0590 3264 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys
17:42:32.0592 3264 Processor - ok
17:42:32.0625 3264 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll
17:42:32.0630 3264 ProfSvc - ok
17:42:32.0646 3264 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
17:42:32.0648 3264 ProtectedStorage - ok
17:42:32.0675 3264 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
17:42:32.0678 3264 Psched - ok
17:42:32.0783 3264 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
17:42:32.0829 3264 ql2300 - ok
17:42:32.0847 3264 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
17:42:32.0849 3264 ql40xx - ok
17:42:32.0873 3264 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
17:42:32.0879 3264 QWAVE - ok
17:42:32.0888 3264 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
17:42:32.0890 3264 QWAVEdrv - ok
17:42:32.0899 3264 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
17:42:32.0900 3264 RasAcd - ok
17:42:32.0920 3264 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
17:42:32.0922 3264 RasAgileVpn - ok
17:42:32.0939 3264 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
17:42:32.0942 3264 RasAuto - ok
17:42:32.0964 3264 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
17:42:32.0967 3264 Rasl2tp - ok
17:42:32.0985 3264 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
17:42:32.0992 3264 RasMan - ok
17:42:33.0001 3264 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
17:42:33.0004 3264 RasPppoe - ok
17:42:33.0022 3264 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
17:42:33.0025 3264 RasSstp - ok
17:42:33.0054 3264 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
17:42:33.0059 3264 rdbss - ok
17:42:33.0072 3264 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
17:42:33.0074 3264 rdpbus - ok
17:42:33.0087 3264 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
17:42:33.0088 3264 RDPCDD - ok
17:42:33.0117 3264 [ 1B6163C503398B23FF8B939C67747683 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
17:42:33.0121 3264 RDPDR - ok
17:42:33.0140 3264 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
17:42:33.0141 3264 RDPENCDD - ok
17:42:33.0155 3264 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
17:42:33.0157 3264 RDPREFMP - ok
17:42:33.0182 3264 [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
17:42:33.0183 3264 RdpVideoMiniport - ok
17:42:33.0207 3264 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
17:42:33.0211 3264 RDPWD - ok
17:42:33.0226 3264 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
17:42:33.0230 3264 rdyboost - ok
17:42:33.0255 3264 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
17:42:33.0258 3264 RemoteAccess - ok
17:42:33.0277 3264 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
17:42:33.0281 3264 RemoteRegistry - ok
17:42:33.0331 3264 [ 9C3AC71A9934B884FAC567A8807E9C4D ] Revoflt C:\Windows\system32\DRIVERS\revoflt.sys
17:42:33.0333 3264 Revoflt - ok
17:42:33.0363 3264 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
17:42:33.0366 3264 RpcEptMapper - ok
17:42:33.0377 3264 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
17:42:33.0379 3264 RpcLocator - ok
17:42:33.0410 3264 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll
17:42:33.0414 3264 RpcSs - ok
17:42:33.0443 3264 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
17:42:33.0445 3264 rspndr - ok
17:42:33.0486 3264 [ 301FBA4594FB5C0A469299A65106B4AA ] s1018bus C:\Windows\system32\DRIVERS\s1018bus.sys
17:42:33.0489 3264 s1018bus - ok
17:42:33.0508 3264 [ D1D7C744F79710357E60FC04D125ED01 ] s1018mdfl C:\Windows\system32\DRIVERS\s1018mdfl.sys
17:42:33.0510 3264 s1018mdfl - ok
17:42:33.0520 3264 [ 7DBE12CCCD837D4266B2DDD80A329C09 ] s1018mdm C:\Windows\system32\DRIVERS\s1018mdm.sys
17:42:33.0524 3264 s1018mdm - ok
17:42:33.0538 3264 [ 065FF5E62D2D18A6D93FD925546CD549 ] s1018mgmt C:\Windows\system32\DRIVERS\s1018mgmt.sys
17:42:33.0542 3264 s1018mgmt - ok
17:42:33.0563 3264 [ 5101D815BDF0D667E3D5F0EA727CAAEE ] s1018nd5 C:\Windows\system32\DRIVERS\s1018nd5.sys
17:42:33.0565 3264 s1018nd5 - ok
17:42:33.0574 3264 [ 13F220C65B444AC9BDA49DACFC3230BB ] s1018obex C:\Windows\system32\DRIVERS\s1018obex.sys
17:42:33.0577 3264 s1018obex - ok
17:42:33.0591 3264 [ CE7D8BCE80211D8A35F6BD7A87791860 ] s1018unic C:\Windows\system32\DRIVERS\s1018unic.sys
17:42:33.0594 3264 s1018unic - ok
17:42:33.0612 3264 [ E60C0A09F997826C7627B244195AB581 ] s3cap C:\Windows\system32\drivers\vms3cap.sys
17:42:33.0614 3264 s3cap - ok
17:42:33.0629 3264 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe
17:42:33.0631 3264 SamSs - ok
17:42:33.0646 3264 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
17:42:33.0654 3264 sbp2port - ok
17:42:33.0679 3264 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
17:42:33.0684 3264 SCardSvr - ok
17:42:33.0709 3264 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
17:42:33.0711 3264 scfilter - ok
17:42:33.0764 3264 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
17:42:33.0811 3264 Schedule - ok
17:42:33.0831 3264 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
17:42:33.0832 3264 SCPolicySvc - ok
17:42:33.0852 3264 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
17:42:33.0856 3264 SDRSVC - ok
17:42:33.0875 3264 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
17:42:33.0877 3264 secdrv - ok
17:42:33.0891 3264 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
17:42:33.0894 3264 seclogon - ok
17:42:33.0913 3264 [ EDE7A1D2715AAC2190D51DC07AFD44E3 ] seehcri C:\Windows\system32\DRIVERS\seehcri.sys
17:42:33.0914 3264 seehcri - ok
17:42:33.0937 3264 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll
17:42:33.0940 3264 SENS - ok
17:42:33.0964 3264 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
17:42:33.0967 3264 SensrSvc - ok
17:42:33.0976 3264 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
17:42:33.0978 3264 Serenum - ok
17:42:33.0986 3264 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys
17:42:33.0989 3264 Serial - ok
17:42:34.0010 3264 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
17:42:34.0011 3264 sermouse - ok
17:42:34.0042 3264 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
17:42:34.0047 3264 SessionEnv - ok
17:42:34.0062 3264 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
17:42:34.0064 3264 sffdisk - ok
17:42:34.0077 3264 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
17:42:34.0078 3264 sffp_mmc - ok
17:42:34.0092 3264 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
17:42:34.0093 3264 sffp_sd - ok
17:42:34.0104 3264 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
17:42:34.0106 3264 sfloppy - ok
17:42:34.0125 3264 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
17:42:34.0132 3264 SharedAccess - ok
17:42:34.0151 3264 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
17:42:34.0168 3264 ShellHWDetection - ok
17:42:34.0192 3264 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
17:42:34.0194 3264 SiSRaid2 - ok
17:42:34.0199 3264 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
17:42:34.0200 3264 SiSRaid4 - ok
17:42:34.0441 3264 [ 0F97E7A47A52F4A36969F0FC319654C2 ] Skype C2C Service C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
17:42:34.0531 3264 Skype C2C Service - ok
17:42:34.0594 3264 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
17:42:34.0598 3264 SkypeUpdate - ok
17:42:34.0630 3264 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
17:42:34.0633 3264 Smb - ok
17:42:34.0659 3264 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
17:42:34.0662 3264 SNMPTRAP - ok
17:42:34.0668 3264 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
17:42:34.0670 3264 spldr - ok
17:42:34.0710 3264 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe
17:42:34.0727 3264 Spooler - ok
17:42:34.0927 3264 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
17:42:35.0003 3264 sppsvc - ok
17:42:35.0020 3264 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
17:42:35.0024 3264 sppuinotify - ok
17:42:35.0070 3264 [ 602884696850C86434530790B110E8EB ] sptd C:\Windows\system32\Drivers\sptd.sys
17:42:35.0070 3264 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850C86434530790B110E8EB
17:42:35.0072 3264 sptd ( LockedFile.Multi.Generic ) - warning
17:42:35.0073 3264 sptd - detected LockedFile.Multi.Generic (1)
17:42:35.0103 3264 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys
17:42:35.0109 3264 srv - ok
17:42:35.0148 3264 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
17:42:35.0153 3264 srv2 - ok
17:42:35.0180 3264 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
17:42:35.0184 3264 srvnet - ok
17:42:35.0211 3264 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
17:42:35.0216 3264 SSDPSRV - ok
17:42:35.0231 3264 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
17:42:35.0235 3264 SstpSvc - ok
17:42:35.0262 3264 Steam Client Service - ok
17:42:35.0322 3264 [ 0632004181860960CF6E10DE8DDEF78B ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
17:42:35.0330 3264 Stereo Service - ok
17:42:35.0351 3264 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
17:42:35.0352 3264 stexstor - ok
17:42:35.0389 3264 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
17:42:35.0415 3264 stisvc - ok
17:42:35.0460 3264 [ 7785DC213270D2FC066538DAF94087E7 ] storflt C:\Windows\system32\drivers\vmstorfl.sys
17:42:35.0481 3264 storflt - ok
17:42:35.0528 3264 [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc C:\Windows\system32\drivers\storvsc.sys
17:42:35.0548 3264 storvsc - ok
17:42:35.0585 3264 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys
17:42:35.0587 3264 swenum - ok
17:42:35.0617 3264 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
17:42:35.0628 3264 swprv - ok
17:42:35.0642 3264 Synth3dVsc - ok
17:42:35.0705 3264 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
17:42:35.0763 3264 SysMain - ok
17:42:35.0787 3264 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
17:42:35.0798 3264 TabletInputService - ok
17:42:35.0818 3264 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
17:42:35.0824 3264 TapiSrv - ok
17:42:35.0851 3264 TBPanel - ok
17:42:35.0865 3264 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
17:42:35.0869 3264 TBS - ok
17:42:35.0922 3264 [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
17:42:35.0992 3264 Tcpip - ok
17:42:36.0072 3264 [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
17:42:36.0086 3264 TCPIP6 - ok
17:42:36.0109 3264 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
17:42:36.0111 3264 tcpipreg - ok
17:42:36.0133 3264 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
17:42:36.0134 3264 TDPIPE - ok
17:42:36.0157 3264 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
17:42:36.0159 3264 TDTCP - ok
17:42:36.0184 3264 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
17:42:36.0187 3264 tdx - ok
17:42:36.0207 3264 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys
17:42:36.0209 3264 TermDD - ok
17:42:36.0240 3264 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
17:42:36.0251 3264 TermService - ok
17:42:36.0268 3264 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
17:42:36.0272 3264 Themes - ok
17:42:36.0290 3264 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
17:42:36.0292 3264 THREADORDER - ok
17:42:36.0306 3264 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
17:42:36.0310 3264 TrkWks - ok
17:42:36.0370 3264 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
17:42:36.0378 3264 TrustedInstaller - ok
17:42:36.0408 3264 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
17:42:36.0410 3264 tssecsrv - ok
17:42:36.0430 3264 [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
17:42:36.0432 3264 TsUsbFlt - ok
17:42:36.0435 3264 tsusbhub - ok
17:42:36.0549 3264 [ 7952032BBC51AEADB0C9A4BB79D79DF5 ] TuneUp.UtilitiesSvc C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
17:42:36.0612 3264 TuneUp.UtilitiesSvc - ok
17:42:36.0641 3264 [ DCC94C51D27C7EC0DADECA8F64C94FCF ] TuneUpUtilitiesDrv C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys
17:42:36.0642 3264 TuneUpUtilitiesDrv - ok
17:42:36.0680 3264 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
17:42:36.0683 3264 tunnel - ok
17:42:36.0704 3264 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
17:42:36.0706 3264 uagp35 - ok
17:42:36.0731 3264 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
17:42:36.0737 3264 udfs - ok
17:42:36.0755 3264 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
17:42:36.0758 3264 UI0Detect - ok
17:42:36.0776 3264 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
17:42:36.0778 3264 uliagpkx - ok
17:42:36.0805 3264 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\drivers\umbus.sys
17:42:36.0807 3264 umbus - ok
17:42:36.0824 3264 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
17:42:36.0825 3264 UmPass - ok
17:42:36.0844 3264 [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService C:\Windows\System32\umrdp.dll
17:42:36.0849 3264 UmRdpService - ok
17:42:36.0877 3264 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
17:42:36.0884 3264 upnphost - ok
17:42:36.0924 3264 [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
17:42:36.0927 3264 usbaudio - ok
17:42:36.0947 3264 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
17:42:36.0949 3264 usbccgp - ok
17:42:36.0971 3264 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys
17:42:36.0974 3264 usbcir - ok
17:42:36.0999 3264 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
17:42:37.0001 3264 usbehci - ok
17:42:37.0072 3264 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\drivers\usbhub.sys
17:42:37.0091 3264 usbhub - ok
17:42:37.0112 3264 [ 58E546BBAF87664FC57E0F6081E4F609 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
17:42:37.0114 3264 usbohci - ok
17:42:37.0123 3264 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
17:42:37.0125 3264 usbprint - ok
17:42:37.0144 3264 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
17:42:37.0147 3264 USBSTOR - ok
17:42:37.0168 3264 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
17:42:37.0170 3264 usbuhci - ok
17:42:37.0202 3264 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys
17:42:37.0206 3264 usbvideo - ok
17:42:37.0222 3264 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
17:42:37.0225 3264 UxSms - ok
17:42:37.0236 3264 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe
17:42:37.0237 3264 VaultSvc - ok
17:42:37.0265 3264 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
17:42:37.0266 3264 vdrvroot - ok
17:42:37.0319 3264 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
17:42:37.0347 3264 vds - ok
17:42:37.0379 3264 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
17:42:37.0381 3264 vga - ok
17:42:37.0390 3264 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
17:42:37.0392 3264 VgaSave - ok
17:42:37.0424 3264 VGPU - ok
17:42:37.0498 3264 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
17:42:37.0509 3264 vhdmp - ok
17:42:37.0544 3264 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys
17:42:37.0546 3264 viaide - ok
17:42:37.0572 3264 [ 86EA3E79AE350FEA5331A1303054005F ] vmbus C:\Windows\system32\drivers\vmbus.sys
17:42:37.0576 3264 vmbus - ok
17:42:37.0596 3264 [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
17:42:37.0598 3264 VMBusHID - ok
17:42:37.0621 3264 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys
17:42:37.0624 3264 volmgr - ok
17:42:37.0649 3264 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
17:42:37.0656 3264 volmgrx - ok
17:42:37.0677 3264 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys
17:42:37.0683 3264 volsnap - ok
17:42:37.0711 3264 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
17:42:37.0715 3264 vsmraid - ok
17:42:37.0832 3264 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
17:42:37.0876 3264 VSS - ok
17:42:37.0905 3264 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
17:42:37.0907 3264 vwifibus - ok
17:42:37.0948 3264 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
17:42:37.0967 3264 W32Time - ok
17:42:37.0984 3264 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
17:42:37.0986 3264 WacomPen - ok
17:42:38.0016 3264 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
17:42:38.0018 3264 WANARP - ok
17:42:38.0023 3264 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
17:42:38.0024 3264 Wanarpv6 - ok
17:42:38.0140 3264 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
17:42:38.0184 3264 WatAdminSvc - ok
17:42:38.0394 3264 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
17:42:38.0439 3264 wbengine - ok
17:42:38.0461 3264 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
17:42:38.0467 3264 WbioSrvc - ok
17:42:38.0499 3264 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
17:42:38.0508 3264 wcncsvc - ok
17:42:38.0518 3264 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
17:42:38.0522 3264 WcsPlugInService - ok
17:42:38.0541 3264 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys
17:42:38.0543 3264 Wd - ok
17:42:38.0578 3264 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
17:42:38.0604 3264 Wdf01000 - ok
17:42:38.0628 3264 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
17:42:38.0632 3264 WdiServiceHost - ok
17:42:38.0637 3264 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
17:42:38.0640 3264 WdiSystemHost - ok
17:42:38.0678 3264 [ 772850BC1CE8B2C7048F97C00A762C78 ] WebCamEffect C:\Windows\system32\DRIVERS\WebCamEffect.sys
17:42:38.0680 3264 WebCamEffect - ok
17:42:38.0709 3264 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
17:42:38.0722 3264 WebClient - ok
17:42:38.0744 3264 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
17:42:38.0749 3264 Wecsvc - ok
17:42:38.0771 3264 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
17:42:38.0775 3264 wercplsupport - ok
17:42:38.0799 3264 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
17:42:38.0803 3264 WerSvc - ok
17:42:38.0832 3264 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
17:42:38.0834 3264 WfpLwf - ok
17:42:38.0848 3264 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
17:42:38.0849 3264 WIMMount - ok
17:42:38.0865 3264 WinDefend - ok
17:42:38.0871 3264 WinHttpAutoProxySvc - ok
17:42:38.0913 3264 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
17:42:38.0916 3264 Winmgmt - ok
17:42:39.0023 3264 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
17:42:39.0086 3264 WinRM - ok
17:42:39.0130 3264 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
17:42:39.0133 3264 WinUsb - ok
17:42:39.0163 3264 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
17:42:39.0180 3264 Wlansvc - ok
17:42:39.0301 3264 [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
17:42:39.0355 3264 wlidsvc - ok
17:42:39.0367 3264 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
17:42:39.0368 3264 WmiAcpi - ok
17:42:39.0389 3264 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
17:42:39.0393 3264 wmiApSrv - ok
17:42:39.0415 3264 WMPNetworkSvc - ok
17:42:39.0424 3264 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
17:42:39.0427 3264 WPCSvc - ok
17:42:39.0452 3264 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
17:42:39.0456 3264 WPDBusEnum - ok
17:42:39.0477 3264 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
17:42:39.0478 3264 ws2ifsl - ok
17:42:39.0499 3264 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll
17:42:39.0503 3264 wscsvc - ok
17:42:39.0507 3264 WSearch - ok
17:42:39.0590 3264 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
17:42:39.0663 3264 wuauserv - ok
17:42:39.0685 3264 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
17:42:39.0688 3264 WudfPf - ok
17:42:39.0711 3264 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
17:42:39.0715 3264 WUDFRd - ok
17:42:39.0733 3264 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
17:42:39.0737 3264 wudfsvc - ok
17:42:39.0763 3264 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
17:42:39.0788 3264 WwanSvc - ok
17:42:39.0818 3264 ================ Scan global ===============================
17:42:39.0833 3264 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
17:42:39.0856 3264 [ 72CC564BBC70DE268784BCE91EB8A28F ] C:\Windows\system32\winsrv.dll
17:42:39.0866 3264 [ 72CC564BBC70DE268784BCE91EB8A28F ] C:\Windows\system32\winsrv.dll
17:42:39.0890 3264 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
17:42:39.0911 3264 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
17:42:39.0917 3264 [Global] - ok
17:42:39.0917 3264 ================ Scan MBR ==================================
17:42:39.0935 3264 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
17:42:40.0357 3264 \Device\Harddisk0\DR0 - ok
17:42:40.0375 3264 [ 671B81004FDD1588FA9ED1331C9CECA9 ] \Device\Harddisk1\DR1
17:42:40.0380 3264 \Device\Harddisk1\DR1 - ok
17:42:40.0381 3264 ================ Scan VBR ==================================
17:42:40.0397 3264 [ 72E152931E7E9F696FB9F0815DE71CD9 ] \Device\Harddisk0\DR0\Partition1
17:42:40.0398 3264 \Device\Harddisk0\DR0\Partition1 - ok
17:42:40.0404 3264 [ 42AFA2B9749B05CDD9967CE5A93F6607 ] \Device\Harddisk0\DR0\Partition2
17:42:40.0405 3264 \Device\Harddisk0\DR0\Partition2 - ok
17:42:40.0420 3264 [ DDEB0E69E054C1DA8BB4C3D2ABA27ECB ] \Device\Harddisk0\DR0\Partition3
17:42:40.0422 3264 \Device\Harddisk0\DR0\Partition3 - ok
17:42:40.0448 3264 [ CFC0BD2A127ECFAE933E2CD081BECE8E ] \Device\Harddisk0\DR0\Partition4
17:42:40.0512 3264 \Device\Harddisk0\DR0\Partition4 - ok
17:42:40.0532 3264 [ 86CA70249C62FD9967FCF43F762C6A52 ] \Device\Harddisk0\DR0\Partition5
17:42:40.0533 3264 \Device\Harddisk0\DR0\Partition5 - ok
17:42:40.0536 3264 [ A4929708E1481606E1E5846318F5A3AC ] \Device\Harddisk1\DR1\Partition1
17:42:40.0538 3264 \Device\Harddisk1\DR1\Partition1 - ok
17:42:40.0539 3264 ============================================================
17:42:40.0539 3264 Scan finished
17:42:40.0539 3264 ============================================================
17:42:40.0547 3932 Detected object count: 1
17:42:40.0547 3932 Actual detected object count: 1
17:43:46.0989 3932 sptd ( LockedFile.Multi.Generic ) - skipped by user
17:43:46.0989 3932 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
17:44:30.0736 3592 Deinitialize success
Hi,
Download
Combofix from the link below, and save it to your desktop.
Link
**Note: It is important that it is saved directly to your desktop**
If you get a message saying "
Illegal operation attempted on a registry key that has been marked for deletion ", please restart your computer.
——————————————————————–
IMPORTANT -
Disable your AntiVirus and AntiSpyware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–
Right-Click and Run as Administrator on
ComboFix.exe & follow the prompts.
When finished, it will produce a report for you. Please post the C:\ComboFix.txt for further review.
———-
Posting log:
ComboFix 12-12-23.01 - Jaka 24.12.2012 18:14:38.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.386.1033.18.4095.2943 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jaka\AppData\Roaming\Microsoft\Windows\Recent\dopeman.url
c:\windows\security\Database\tmp.edb
c:\windows\SysWow64\tmp2240.tmp
c:\windows\SysWow64\tmp2251.tmp
c:\windows\SysWow64\tmp7E2A.tmp
c:\windows\SysWow64\URTTemp
c:\windows\SysWow64\URTTemp\regtlib.exe
K:\autorun.inf
K:\install.exe
K:\Setup.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-11-24 to 2012-12-24 )))))))))))))))))))))))))))))))
.
.
2012-12-22 15:42 . 2012-12-22 15:42 ——– d—–w- c:\program files\Enigma Software Group
2012-12-22 15:42 . 2012-12-22 18:35 ——– d—–w- c:\windows\83B952C7F8F34CA3B4C533C85B24E478.TMP
2012-12-22 11:48 . 2012-12-22 12:18 556632 —-a-w- c:\windows\system32\drivers\1651538drv.sys
2012-12-22 11:42 . 2012-12-22 12:18 460888 —-a-w- c:\windows\system32\drivers\83531325.sys
2012-12-21 18:06 . 2012-12-21 18:06 ——– d—–w- c:\program files (x86)\AGEIA Technologies
2012-12-21 17:33 . 2012-08-23 15:09 3072 —-a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui
2012-12-21 17:32 . 2012-12-16 17:11 46080 —-a-w- c:\windows\system32\atmlib.dll
2012-12-21 17:32 . 2012-12-16 14:45 367616 —-a-w- c:\windows\system32\atmfd.dll
2012-12-21 17:32 . 2012-12-16 14:13 295424 —-a-w- c:\windows\SysWow64\atmfd.dll
2012-12-21 17:32 . 2012-12-16 14:13 34304 —-a-w- c:\windows\SysWow64\atmlib.dll
2012-12-21 17:32 . 2012-08-24 18:13 154480 —-a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-12-21 17:32 . 2012-08-24 18:09 458712 —-a-w- c:\windows\system32\drivers\cng.sys
2012-12-21 17:32 . 2012-08-24 18:05 340992 —-a-w- c:\windows\system32\schannel.dll
2012-12-21 17:32 . 2012-08-24 18:04 307200 —-a-w- c:\windows\system32\ncrypt.dll
2012-12-21 17:32 . 2012-08-24 18:03 1448448 —-a-w- c:\windows\system32\lsasrv.dll
2012-12-21 17:32 . 2012-08-24 16:57 247808 —-a-w- c:\windows\SysWow64\schannel.dll
2012-12-21 17:32 . 2012-08-24 16:57 22016 —-a-w- c:\windows\SysWow64\secur32.dll
2012-12-21 17:32 . 2012-08-24 16:57 220160 —-a-w- c:\windows\SysWow64\ncrypt.dll
2012-12-21 17:32 . 2012-08-24 16:53 96768 —-a-w- c:\windows\SysWow64\sspicli.dll
2012-12-18 11:19 . 2012-12-18 11:19 ——– d—–w- c:\program files (x86)\Geeks3D
2012-12-16 18:03 . 2012-12-16 18:03 ——– d—–w- C:\TDSSKiller_Quarantine
2012-12-13 16:45 . 2012-12-13 16:45 181064 —-a-w- c:\windows\PSEXESVC.EXE
2012-12-12 19:48 . 2012-11-09 05:45 2048 —-a-w- c:\windows\system32\tzres.dll
2012-12-12 19:48 . 2012-11-09 04:42 2048 —-a-w- c:\windows\SysWow64\tzres.dll
2012-12-12 19:48 . 2012-11-22 03:26 3149824 —-a-w- c:\windows\system32\win32k.sys
2012-12-12 19:48 . 2012-11-12 14:20 9055744 —-a-w- c:\windows\system32\mshtml.dll
2012-12-04 22:51 . 2011-10-20 14:05 34624 —-a-w- c:\windows\system32\TURegOpt.exe
2012-12-04 22:51 . 2011-10-20 14:04 25920 —-a-w- c:\windows\system32\authuitu.dll
2012-12-04 22:51 . 2011-10-20 14:04 21312 —-a-w- c:\windows\SysWow64\authuitu.dll
2012-12-04 22:51 . 2012-12-15 13:54 ——– d—–w- c:\program files (x86)\TuneUp Utilities 2012
2012-12-04 22:49 . 2012-12-04 22:49 ——– d-sh–w- c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-12-04 22:31 . 2012-11-29 08:26 262112 —-a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll
2012-11-30 21:43 . 2012-11-30 21:43 438632 —-a-w- c:\windows\SysWow64\nvStreaming.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-12 15:01 . 2012-03-30 22:44 697272 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-12-12 15:01 . 2011-05-18 08:33 73656 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-03 15:47 . 2012-09-16 12:12 1504104 —-a-w- c:\windows\system32\nvdispgenco64.dll
2012-12-03 15:47 . 2012-05-29 11:58 1805672 —-a-w- c:\windows\system32\nvdispco64.dll
2012-12-03 15:47 . 2012-05-29 11:58 15122280 —-a-w- c:\windows\SysWow64\nvd3dum.dll
2012-12-03 15:47 . 2012-05-29 11:58 2816824 —-a-w- c:\windows\system32\nvapi64.dll
2012-12-03 15:47 . 2010-10-21 23:17 15016256 —-a-w- c:\windows\system32\nvwgf2umx.dll
2012-12-01 05:49 . 2011-10-27 14:07 63336 —-a-w- c:\windows\system32\nvshext.dll
2012-12-01 05:49 . 2011-10-27 14:07 118120 —-a-w- c:\windows\system32\nvmctray.dll
2012-12-01 05:49 . 2011-10-27 14:07 890216 —-a-w- c:\windows\system32\nvvsvc.exe
2012-12-01 05:48 . 2011-10-27 14:07 6223208 —-a-w- c:\windows\system32\nvcpl.dll
2012-12-01 05:48 . 2011-10-27 14:07 3311464 —-a-w- c:\windows\system32\nvsvc64.dll
2012-11-28 14:58 . 2009-11-30 14:13 67413224 ——w- c:\windows\system32\MRT.exe
2012-11-15 15:15 . 2012-08-13 16:24 613720 —-a-w- c:\windows\system32\drivers\klif.sys
2012-11-15 15:15 . 2012-06-08 09:38 54104 —-a-w- c:\windows\system32\drivers\kltdi.sys
2012-10-25 02:12 . 2012-10-25 02:12 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2012-10-25 02:12 . 2012-10-25 02:12 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts
2012-10-23 15:23 . 2012-07-25 12:53 29528 —-a-w- c:\windows\system32\drivers\klmouflt.sys
2012-10-23 15:23 . 2012-05-25 17:38 29016 —-a-w- c:\windows\system32\drivers\klkbdflt.sys
2012-10-16 08:38 . 2012-11-30 13:33 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-11-30 13:33 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-11-30 13:33 561664 —-a-w- c:\windows\apppatch\AcLayers.dll
2012-10-09 18:17 . 2012-11-15 15:16 55296 —-a-w- c:\windows\system32\dhcpcsvc6.dll
2012-10-09 18:17 . 2012-11-15 15:16 226816 —-a-w- c:\windows\system32\dhcpcore6.dll
2012-10-09 17:40 . 2012-11-15 15:16 44032 —-a-w- c:\windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40 . 2012-11-15 15:16 193536 —-a-w- c:\windows\SysWow64\dhcpcore6.dll
2012-10-04 16:40 . 2012-12-12 19:47 44032 —-a-w- c:\windows\apppatch\acwow64.dll
2012-10-03 17:56 . 2012-11-15 15:16 1914248 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-03 17:44 . 2012-11-15 15:16 70656 —-a-w- c:\windows\system32\nlaapi.dll
2012-10-03 17:44 . 2012-11-15 15:16 303104 —-a-w- c:\windows\system32\nlasvc.dll
2012-10-03 17:44 . 2012-11-15 15:16 246272 —-a-w- c:\windows\system32\netcorehc.dll
2012-10-03 17:44 . 2012-11-15 15:16 18944 —-a-w- c:\windows\system32\netevent.dll
2012-10-03 17:44 . 2012-11-15 15:16 216576 —-a-w- c:\windows\system32\ncsi.dll
2012-10-03 17:42 . 2012-11-15 15:16 569344 —-a-w- c:\windows\system32\iphlpsvc.dll
2012-10-03 16:42 . 2012-11-15 15:16 18944 —-a-w- c:\windows\SysWow64\netevent.dll
2012-10-03 16:42 . 2012-11-15 15:16 175104 —-a-w- c:\windows\SysWow64\netcorehc.dll
2012-10-03 16:42 . 2012-11-15 15:16 156672 —-a-w- c:\windows\SysWow64\ncsi.dll
2012-10-03 16:07 . 2012-11-15 15:16 45568 —-a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-10-02 19:50 . 2011-08-11 12:03 2557800 —-a-w- c:\windows\system32\nvsvcr.dll
2012-09-25 22:47 . 2012-11-15 15:16 78336 —-a-w- c:\windows\SysWow64\synceng.dll
2012-09-25 22:46 . 2012-11-15 15:16 95744 —-a-w- c:\windows\system32\synceng.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{687578b9-7132-4a7a-80e4-30ee31099e03}"= "c:\program files (x86)\uTorrentControl2\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{687578b9-7132-4a7a-80e4-30ee31099e03}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{687578b9-7132-4a7a-80e4-30ee31099e03}]
2011-05-09 08:49 176936 —-a-w- c:\program files (x86)\uTorrentControl2\prxtbuTor.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}]
2011-06-01 15:47 177712 —-a-w- c:\program files (x86)\vShare.tv plugin\BarLcher.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}"= "c:\program files (x86)\vShare.tv plugin\BarLcher.dll" [2011-06-01 177712]
"{687578b9-7132-4a7a-80e4-30ee31099e03}"= "c:\program files (x86)\uTorrentControl2\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{7ac3e13b-3bca-4158-b330-f66dbb03c1b5}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher.1]
[HKEY_CLASSES_ROOT\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher]
.
[HKEY_CLASSES_ROOT\clsid\{687578b9-7132-4a7a-80e4-30ee31099e03}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2012-11-15 356376]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"CPU Thermometer"="c:\program files (x86)\CPU Thermometer\CPUThermometer.exe" -s
"Gainward"=c:\windows\TBPanel.exe /A
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R1 1651538drv;1651538drv;c:\windows\system32\DRIVERS\1651538drv.sys [2012-12-22 556632]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate1cc6e1fb9d6528;gupdate1cc6e1fb9d6528;c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-03 136176]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-07-05 3048136]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\dragon age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-04-23 13352]
R3 LNonPnP;LNonPnP; [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 31800]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [2009-03-25 113704]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [2009-03-25 19496]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [2009-03-25 153128]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [2009-03-25 133160]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [2009-03-25 34856]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [2009-03-25 128552]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [2009-03-25 146472]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-13 1255736]
R3 WebCamEffect;WebCamEffect;c:\windows\system32\DRIVERS\WebCamEffect.sys [2010-01-20 34368]
S0 83531325;83531325;c:\windows\system32\DRIVERS\83531325.sys [2012-12-22 460888]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-12-02 834544]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2012-08-02 28504]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys [2012-11-15 54104]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys [2012-08-13 178008]
S2 IBUpdaterService;Updater Service;c:\programdata\IBUpdaterService\ibsvc.exe [2012-09-29 616160]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-30 382824]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-10-20 2072896]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x64.sys [2009-10-13 61440]
S3 Icon7vLifeWebCam;Icon7 vLife audio;c:\windows\system32\DRIVERS\Icon7VAC.sys [2007-03-19 49664]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys [2012-10-23 29016]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2012-10-23 29528]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-04-23 34032]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-20 11856]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 30750699
*NewlyCreated* - ASWMBR
*Deregistered* - 30750699
*Deregistered* - aswMBR
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 15:01]
.
2012-12-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-03 22:50]
.
2012-12-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-03 22:50]
.
.
——— X64 Entries ———–
.
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://startsear.ch/?aff=1
mStart Page = hxxp://startsear.ch/?aff=1
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1 0.0.0.0
TCP: Interfaces\{D1EAD6C6-1F06-4130-9BE6-A6A8F4BD738A}: NameServer = 209.67.200.200 208.67.222.222
FF - ProfilePath - c:\users\Jaka\AppData\Roaming\Mozilla\Firefox\Profiles\52i7ra1z.default-1354660080073\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.si/
FF - ExtSQL: 2012-10-27 14:55; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - ExtSQL: 2012-12-04 23:38; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Jaka\AppData\Roaming\Mozilla\Firefox\Profiles\52i7ra1z.default-1354660080073\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: 2012-12-04 23:39; {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}; c:\users\Jaka\AppData\Roaming\Mozilla\Firefox\Profiles\52i7ra1z.default-1354660080073\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)
AddRemove-Mafia Game - c:\windows\system32\MafiaSetup.exe
AddRemove-UnityWebPlayer - c:\users\Jaka\AppData\Local\Unity\WebPlayer\Uninstall.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1106419572-3439941104-1156414386-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:61,63,f7,26,50,c1,33,35,35,a0,c9,71,a1,7d,3d,55,d5,f2,86,a3,af,54,50,
7c,31,74,f9,4e,08,19,e7,2d,c2,e8,07,72,7a,79,b7,88,bf,48,38,b8,b1,1f,df,e0,\
"??"=hex:81,73,a6,a3,df,ca,9b,1f,9c,3b,88,d7,34,6a,52,ac
.
[HKEY_USERS\S-1-5-21-1106419572-3439941104-1156414386-1001\Software\SecuROM\License information*]
"datasecu"=hex:d4,aa,a6,78,91,8c,23,cd,9a,0b,54,14,23,30,eb,30,84,6a,fc,cd,89,
c2,23,0a,f9,07,4a,83,9e,ef,f8,3b,5c,87,df,be,6c,6b,bb,d2,5c,17,18,2f,30,7c,\
"rkeysecu"=hex:a9,75,9d,ae,4d,ae,c2,0d,06,3d,27,e9,92,76,1d,5d
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-12-24 18:23:40
ComboFix-quarantined-files.txt 2012-12-24 17:23
.
Pre-Run: 26.103.504.896 bytes free
Post-Run: 27.945.758.720 bytes free
.
- - End Of File - - 7995B6F86AA67E4F9F42D119978CF9E1
AdwCleaner
Please download
AdwCleaner by Xplode onto your desktop.
Double click on AdwCleaner.exe to run the tool. Click on Search . A logfile will automatically open after the scan has finished. Please post the contents of that logfile with your next reply. You can find the logfile at C:\AdwCleaner[R1].txt as well.
———-
# AdwCleaner v2.103 - Logfile created 12/26/2012 at 16:30:58
# Updated 25/12/2012 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)
# User : Jaka - JAKA-PC
# Boot Mode : Normal
# Running from : C:\Users\Jaka\Desktop\AdwCleaner.exe
# Option [Search]
***** [Services] *****
Found : IBUpdaterService
***** [Files / Folders] *****
File Found : C:\Program Files (x86)\Mozilla Firefox\Plugins\npvsharetvplg.dll
Folder Found : C:\Program Files (x86)\Ask.com
Folder Found : C:\Program Files (x86)\Conduit
Folder Found : C:\Program Files (x86)\DAEMON Tools Toolbar
Folder Found : C:\Program Files (x86)\uTorrentControl2
Folder Found : C:\Program Files (x86)\vShare.tv plugin
Folder Found : C:\ProgramData\IBUpdaterService
Folder Found : C:\Users\Jaka\AppData\Local\Conduit
Folder Found : C:\Users\Jaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc
Folder Found : C:\Users\Jaka\AppData\LocalLow\boost_interprocess
Folder Found : C:\Users\Jaka\AppData\LocalLow\Conduit
Folder Found : C:\Users\Jaka\AppData\LocalLow\PriceGong
Folder Found : C:\Users\Jaka\AppData\LocalLow\uTorrentControl2
***** [Registry] *****
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\PriceGong
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\AppDataLow\Software\uTorrentControl2
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\GamePlayLabs
Key Found : HKCU\Software\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955}
Key Found : HKCU\Software\Softonic
Key Found : HKCU\Software\StartSearch
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKLM\SOFTWARE\Classes\AppID\{65C994A2-C65A-4A20-BA92-AADAFC0DCE49}
Key Found : HKLM\SOFTWARE\Classes\AppID\BHO.DLL
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3072253
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{79D60450-56C5-4A8C-9321-6D5BC2A81E5A}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7585478E9D9B42108671C12F8714CEFE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B13A7C41581B411290FBC0395694E2A9}
Key Found : HKLM\Software\uTorrentControl2
Key Found : HKLM\SOFTWARE\Wow6432Node\14919ea49a8f3b4aa3cf1058d9a64cec
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ocphobfcfafpclibolpjdafgaffkaoci
Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{00AF064F-9188-4E9A-86CC-5B208D525F6B}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6982ABE6-E7EA-4999-85E9-FB8D4974BE27}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentControl2 Toolbar
Key Found : HKLM\SOFTWARE\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
Key Found : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Key Found : HKU\S-1-5-21-1106419572-3439941104-1156414386-1001\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKU\S-1-5-21-1106419572-3439941104-1156414386-1001\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{687578B9-7132-4A7A-80E4-30EE31099E03}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{687578B9-7132-4A7A-80E4-30EE31099E03}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{687578B9-7132-4A7A-80E4-30EE31099E03}]
Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{687578B9-7132-4A7A-80E4-30EE31099E03}]
Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.7601.17514
[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://startsear.ch/?aff=1
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Start Page] = hxxp://startsear.ch/?aff=1
-\\ Mozilla Firefox v17.0.1 (sl)
File : C:\Users\Jaka\AppData\Roaming\Mozilla\Firefox\Profiles\52i7ra1z.default-1354660080073\prefs.js
[OK] File is clean.
-\\ Google Chrome v [Unable to get version]
File : C:\Users\Jaka\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [8126 octets] - [26/12/2012 16:30:58]
########## EOF - C:\AdwCleaner[R1].txt - [8186 octets] ##########
# AdwCleaner v2.103 - Logfile created 12/26/2012 at 19:28:53
# Updated 25/12/2012 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)
# User : Jaka - JAKA-PC
# Boot Mode : Normal
# Running from : C:\Users\Jaka\Desktop\AdwCleaner.exe
# Option [Delete]
***** [Services] *****
Stopped & Deleted : IBUpdaterService
***** [Files / Folders] *****
File Deleted : C:\Program Files (x86)\Mozilla Firefox\Plugins\npvsharetvplg.dll
Folder Deleted : C:\Program Files (x86)\Ask.com
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\DAEMON Tools Toolbar
Folder Deleted : C:\Program Files (x86)\uTorrentControl2
Folder Deleted : C:\Program Files (x86)\vShare.tv plugin
Folder Deleted : C:\ProgramData\IBUpdaterService
Folder Deleted : C:\Users\Jaka\AppData\Local\Conduit
Folder Deleted : C:\Users\Jaka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc
Folder Deleted : C:\Users\Jaka\AppData\LocalLow\boost_interprocess
Folder Deleted : C:\Users\Jaka\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Jaka\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Jaka\AppData\LocalLow\uTorrentControl2
***** [Registry] *****
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\AppDataLow\Software\uTorrentControl2
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\GamePlayLabs
Key Deleted : HKCU\Software\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\StartSearch
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{65C994A2-C65A-4A20-BA92-AADAFC0DCE49}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BHO.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3072253
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{79D60450-56C5-4A8C-9321-6D5BC2A81E5A}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7585478E9D9B42108671C12F8714CEFE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B13A7C41581B411290FBC0395694E2A9}
Key Deleted : HKLM\Software\uTorrentControl2
Key Deleted : HKLM\SOFTWARE\Wow6432Node\14919ea49a8f3b4aa3cf1058d9a64cec
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ocphobfcfafpclibolpjdafgaffkaoci
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{00AF064F-9188-4E9A-86CC-5B208D525F6B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6982ABE6-E7EA-4999-85E9-FB8D4974BE27}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{687578B9-7132-4A7A-80E4-30EE31099E03}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentControl2 Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{687578B9-7132-4A7A-80E4-30EE31099E03}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{687578B9-7132-4A7A-80E4-30EE31099E03}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{687578B9-7132-4A7A-80E4-30EE31099E03}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{687578B9-7132-4A7A-80E4-30EE31099E03}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.7601.17514
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://startsear.ch/?aff=1 –> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Start Page] = hxxp://startsear.ch/?aff=1 –> hxxp://www.google.com
-\\ Mozilla Firefox v17.0.1 (sl)
File : C:\Users\Jaka\AppData\Roaming\Mozilla\Firefox\Profiles\52i7ra1z.default-1354660080073\prefs.js
[OK] File is clean.
-\\ Google Chrome v [Unable to get version]
File : C:\Users\Jaka\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [8245 octets] - [26/12/2012 16:30:58]
AdwCleaner[R2].txt - [8864 octets] - [26/12/2012 19:27:37]
AdwCleaner[S1].txt - [8747 octets] - [26/12/2012 19:28:53]
########## EOF - C:\AdwCleaner[S1].txt - [8807 octets] ##########
Hi,
Good job…that got rid of some junk that was on your system. Let's keep going.
Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.[external image: Posted Image] Very Important! Referring to the screenshot above, drag CFScript.txt into ComboFix.exe. ComboFix may request an update; please allow it. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal. When finished, it shall produce a log for you. Post the contents of the log in your next reply. CAUTION : Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
Post the new ComboFix log and let me know how your system is running now.
Posting log:
ComboFix 12-12-25.02 - Jaka 26.12.2012 21:36:32.3.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.386.1033.18.4095.2967 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Jaka\Desktop\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-11-26 to 2012-12-26 )))))))))))))))))))))))))))))))
.
.
2012-12-26 20:44 . 2012-12-26 20:44 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2012-12-26 20:44 . 2012-12-26 20:44 ——– d—–w- c:\users\UpdatusUser.Jaka-PC\AppData\Local\temp
2012-12-26 20:44 . 2012-12-26 20:44 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-12-25 11:53 . 2012-11-08 17:24 9125352 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{105507AB-A554-4163-B24A-B1239F445404}\mpengine.dll
2012-12-22 15:42 . 2012-12-22 15:42 ——– d—–w- c:\program files\Enigma Software Group
2012-12-22 15:42 . 2012-12-22 18:35 ——– d—–w- c:\windows\83B952C7F8F34CA3B4C533C85B24E478.TMP
2012-12-22 11:48 . 2012-12-22 12:18 556632 —-a-w- c:\windows\system32\drivers\1651538drv.sys
2012-12-22 11:42 . 2012-12-22 12:18 460888 —-a-w- c:\windows\system32\drivers\83531325.sys
2012-12-21 18:06 . 2012-12-21 18:06 ——– d—–w- c:\program files (x86)\AGEIA Technologies
2012-12-21 17:33 . 2012-08-23 15:09 3072 —-a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui
2012-12-21 17:32 . 2012-12-16 17:11 46080 —-a-w- c:\windows\system32\atmlib.dll
2012-12-21 17:32 . 2012-12-16 14:45 367616 —-a-w- c:\windows\system32\atmfd.dll
2012-12-21 17:32 . 2012-12-16 14:13 295424 —-a-w- c:\windows\SysWow64\atmfd.dll
2012-12-21 17:32 . 2012-12-16 14:13 34304 —-a-w- c:\windows\SysWow64\atmlib.dll
2012-12-21 17:32 . 2012-08-24 18:13 154480 —-a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-12-21 17:32 . 2012-08-24 18:09 458712 —-a-w- c:\windows\system32\drivers\cng.sys
2012-12-21 17:32 . 2012-08-24 18:05 340992 —-a-w- c:\windows\system32\schannel.dll
2012-12-21 17:32 . 2012-08-24 18:04 307200 —-a-w- c:\windows\system32\ncrypt.dll
2012-12-21 17:32 . 2012-08-24 18:03 1448448 —-a-w- c:\windows\system32\lsasrv.dll
2012-12-21 17:32 . 2012-08-24 16:57 247808 —-a-w- c:\windows\SysWow64\schannel.dll
2012-12-21 17:32 . 2012-08-24 16:57 22016 —-a-w- c:\windows\SysWow64\secur32.dll
2012-12-21 17:32 . 2012-08-24 16:57 220160 —-a-w- c:\windows\SysWow64\ncrypt.dll
2012-12-21 17:32 . 2012-08-24 16:53 96768 —-a-w- c:\windows\SysWow64\sspicli.dll
2012-12-18 11:19 . 2012-12-18 11:19 ——– d—–w- c:\program files (x86)\Geeks3D
2012-12-16 18:03 . 2012-12-16 18:03 ——– d—–w- C:\TDSSKiller_Quarantine
2012-12-13 16:45 . 2012-12-13 16:45 181064 —-a-w- c:\windows\PSEXESVC.EXE
2012-12-12 19:48 . 2012-11-09 05:45 2048 —-a-w- c:\windows\system32\tzres.dll
2012-12-12 19:48 . 2012-11-09 04:42 2048 —-a-w- c:\windows\SysWow64\tzres.dll
2012-12-12 19:48 . 2012-11-22 03:26 3149824 —-a-w- c:\windows\system32\win32k.sys
2012-12-12 19:48 . 2012-11-12 14:20 9055744 —-a-w- c:\windows\system32\mshtml.dll
2012-12-04 22:51 . 2011-10-20 14:05 34624 —-a-w- c:\windows\system32\TURegOpt.exe
2012-12-04 22:51 . 2011-10-20 14:04 25920 —-a-w- c:\windows\system32\authuitu.dll
2012-12-04 22:51 . 2011-10-20 14:04 21312 —-a-w- c:\windows\SysWow64\authuitu.dll
2012-12-04 22:51 . 2012-12-15 13:54 ——– d—–w- c:\program files (x86)\TuneUp Utilities 2012
2012-12-04 22:49 . 2012-12-04 22:49 ——– d-sh–w- c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-12-04 22:31 . 2012-11-29 08:26 262112 —-a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll
2012-11-30 21:43 . 2012-11-30 21:43 438632 —-a-w- c:\windows\SysWow64\nvStreaming.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-12 15:01 . 2012-03-30 22:44 697272 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-12-12 15:01 . 2011-05-18 08:33 73656 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-03 15:47 . 2012-09-16 12:12 1504104 —-a-w- c:\windows\system32\nvdispgenco64.dll
2012-12-03 15:47 . 2012-05-29 11:58 1805672 —-a-w- c:\windows\system32\nvdispco64.dll
2012-12-03 15:47 . 2012-05-29 11:58 15122280 —-a-w- c:\windows\SysWow64\nvd3dum.dll
2012-12-03 15:47 . 2012-05-29 11:58 2816824 —-a-w- c:\windows\system32\nvapi64.dll
2012-12-03 15:47 . 2010-10-21 23:17 15016256 —-a-w- c:\windows\system32\nvwgf2umx.dll
2012-12-01 05:49 . 2011-10-27 14:07 63336 —-a-w- c:\windows\system32\nvshext.dll
2012-12-01 05:49 . 2011-10-27 14:07 118120 —-a-w- c:\windows\system32\nvmctray.dll
2012-12-01 05:49 . 2011-10-27 14:07 890216 —-a-w- c:\windows\system32\nvvsvc.exe
2012-12-01 05:48 . 2011-10-27 14:07 6223208 —-a-w- c:\windows\system32\nvcpl.dll
2012-12-01 05:48 . 2011-10-27 14:07 3311464 —-a-w- c:\windows\system32\nvsvc64.dll
2012-11-28 14:58 . 2009-11-30 14:13 67413224 ——w- c:\windows\system32\MRT.exe
2012-11-15 15:15 . 2012-08-13 16:24 613720 —-a-w- c:\windows\system32\drivers\klif.sys
2012-11-15 15:15 . 2012-06-08 09:38 54104 —-a-w- c:\windows\system32\drivers\kltdi.sys
2012-10-25 02:12 . 2012-10-25 02:12 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2012-10-25 02:12 . 2012-10-25 02:12 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts
2012-10-23 15:23 . 2012-07-25 12:53 29528 —-a-w- c:\windows\system32\drivers\klmouflt.sys
2012-10-23 15:23 . 2012-05-25 17:38 29016 —-a-w- c:\windows\system32\drivers\klkbdflt.sys
2012-10-16 08:38 . 2012-11-30 13:33 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-11-30 13:33 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-11-30 13:33 561664 —-a-w- c:\windows\apppatch\AcLayers.dll
2012-10-09 18:17 . 2012-11-15 15:16 55296 —-a-w- c:\windows\system32\dhcpcsvc6.dll
2012-10-09 18:17 . 2012-11-15 15:16 226816 —-a-w- c:\windows\system32\dhcpcore6.dll
2012-10-09 17:40 . 2012-11-15 15:16 44032 —-a-w- c:\windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40 . 2012-11-15 15:16 193536 —-a-w- c:\windows\SysWow64\dhcpcore6.dll
2012-10-04 16:40 . 2012-12-12 19:47 44032 —-a-w- c:\windows\apppatch\acwow64.dll
2012-10-03 17:56 . 2012-11-15 15:16 1914248 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-03 17:44 . 2012-11-15 15:16 70656 —-a-w- c:\windows\system32\nlaapi.dll
2012-10-03 17:44 . 2012-11-15 15:16 303104 —-a-w- c:\windows\system32\nlasvc.dll
2012-10-03 17:44 . 2012-11-15 15:16 246272 —-a-w- c:\windows\system32\netcorehc.dll
2012-10-03 17:44 . 2012-11-15 15:16 18944 —-a-w- c:\windows\system32\netevent.dll
2012-10-03 17:44 . 2012-11-15 15:16 216576 —-a-w- c:\windows\system32\ncsi.dll
2012-10-03 17:42 . 2012-11-15 15:16 569344 —-a-w- c:\windows\system32\iphlpsvc.dll
2012-10-03 16:42 . 2012-11-15 15:16 18944 —-a-w- c:\windows\SysWow64\netevent.dll
2012-10-03 16:42 . 2012-11-15 15:16 175104 —-a-w- c:\windows\SysWow64\netcorehc.dll
2012-10-03 16:42 . 2012-11-15 15:16 156672 —-a-w- c:\windows\SysWow64\ncsi.dll
2012-10-03 16:07 . 2012-11-15 15:16 45568 —-a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-10-02 19:50 . 2011-08-11 12:03 2557800 —-a-w- c:\windows\system32\nvsvcr.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2012-11-15 356376]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"CPU Thermometer"="c:\program files (x86)\CPU Thermometer\CPUThermometer.exe" -s
"Gainward"=c:\windows\TBPanel.exe /A
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R1 1651538drv;1651538drv;c:\windows\system32\DRIVERS\1651538drv.sys [2012-12-22 556632]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate1cc6e1fb9d6528;gupdate1cc6e1fb9d6528;c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-03 136176]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-07-05 3048136]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\dragon age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-04-23 13352]
R3 LNonPnP;LNonPnP; [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 31800]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [2009-03-25 113704]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [2009-03-25 19496]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [2009-03-25 153128]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [2009-03-25 133160]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [2009-03-25 34856]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [2009-03-25 128552]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [2009-03-25 146472]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-13 1255736]
R3 WebCamEffect;WebCamEffect;c:\windows\system32\DRIVERS\WebCamEffect.sys [2010-01-20 34368]
S0 83531325;83531325;c:\windows\system32\DRIVERS\83531325.sys [2012-12-22 460888]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-12-02 834544]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2012-08-02 28504]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys [2012-11-15 54104]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys [2012-08-13 178008]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-30 382824]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-10-20 2072896]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x64.sys [2009-10-13 61440]
S3 Icon7vLifeWebCam;Icon7 vLife audio;c:\windows\system32\DRIVERS\Icon7VAC.sys [2007-03-19 49664]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys [2012-10-23 29016]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2012-10-23 29528]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-04-23 34032]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-20 11856]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 15:01]
.
2012-12-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-03 22:50]
.
2012-12-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-03 22:50]
.
.
——— X64 Entries ———–
.
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1 0.0.0.0
TCP: Interfaces\{D1EAD6C6-1F06-4130-9BE6-A6A8F4BD738A}: NameServer = 209.67.200.200 208.67.222.222
FF - ProfilePath - c:\users\Jaka\AppData\Roaming\Mozilla\Firefox\Profiles\52i7ra1z.default-1354660080073\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.si/
FF - ExtSQL: 2012-10-27 14:55; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - ExtSQL: 2012-12-04 23:38; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Jaka\AppData\Roaming\Mozilla\Firefox\Profiles\52i7ra1z.default-1354660080073\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: 2012-12-04 23:39; {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}; c:\users\Jaka\AppData\Roaming\Mozilla\Firefox\Profiles\52i7ra1z.default-1354660080073\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Mafia Game - c:\windows\system32\MafiaSetup.exe
AddRemove-vShare.tv plugin - c:\program files (x86)\vShare.tv plugin\uninst.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1106419572-3439941104-1156414386-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:61,63,f7,26,50,c1,33,35,35,a0,c9,71,a1,7d,3d,55,d5,f2,86,a3,af,54,50,
7c,31,74,f9,4e,08,19,e7,2d,c2,e8,07,72,7a,79,b7,88,bf,48,38,b8,b1,1f,df,e0,\
"??"=hex:81,73,a6,a3,df,ca,9b,1f,9c,3b,88,d7,34,6a,52,ac
.
[HKEY_USERS\S-1-5-21-1106419572-3439941104-1156414386-1001\Software\SecuROM\License information*]
"datasecu"=hex:d4,aa,a6,78,91,8c,23,cd,9a,0b,54,14,23,30,eb,30,84,6a,fc,cd,89,
c2,23,0a,f9,07,4a,83,9e,ef,f8,3b,5c,87,df,be,6c,6b,bb,d2,5c,17,18,2f,30,7c,\
"rkeysecu"=hex:a9,75,9d,ae,4d,ae,c2,0d,06,3d,27,e9,92,76,1d,5d
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-12-26 21:46:09
ComboFix-quarantined-files.txt 2012-12-26 20:46
ComboFix2.txt 2012-12-24 17:23
.
Pre-Run: 28.015.542.272 bytes free
Post-Run: 27.946.422.272 bytes free
.
- - End Of File - - A99701EB4CA7D6803B5B09635C0C450D
Anyway my DDS.txt is:
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by [removed] at 18:20:12,06 on pet 21.12.2012
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.9.2
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.386.1033.18.4095.2443 [GMT 1:00]
.
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\ProgramData\IBUpdaterService\ibsvc.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Jaka\Desktop\dds.scr
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://startsear.ch/?aff=1
mStart Page = hxxp://startsear.ch/?aff=1
uURLSearchHooks: H - No File
uURLSearchHooks: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll
mURLSearchHooks: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
BHO: Content Blocker Plugin: {5564cc73-efa7-4cbf-918a-5cf7fbbfff4f} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
BHO: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: Virtual Keyboard Plugin: {73455575-e40c-433c-9784-c78dc7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: IE5BarLauncherBHO Class: {78f3a323-798e-4aea-9a57-88f4b05fd5dd} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Safe Money Plugin: {9e6d0d23-3d72-4a94-ae1f-2d167624e3d9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: URL Advisor Plugin: {e33cf602-d945-461a-83f0-819f76a199f8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll
TB: VShareToolBar: {7ac3e13b-3bca-4158-b330-f66dbb03c1b5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll
TB: uTorrentControl2 Toolbar: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
TB: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File
TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport; to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO-X64: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
BHO-X64: ContentBlockerBrowserHelperObject - No File
BHO-X64: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
BHO-X64: VirtualKeyboardBrowserHelperObject - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll
BHO-X64: Safe Money Plugin - No File
BHO-X64: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll
BHO-X64: link filter bho - No File
TB-X64: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
TB-X64: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File
TB-X64: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB-X64: {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No File
TB-X64: {687578B9-7132-4A7A-80E4-30EE31099E03} - No File
mRun-x64: [(Default)]
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Jaka\AppData\Roaming\Mozilla\Firefox\Profiles\52i7ra1z.default-1354660080073\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.si/
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll
FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npvsharetvplg.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Program Files (x86)\Veetle\Player\npvlc.dll
FF - plugin: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
FF - plugin: C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll
FF - plugin: C:\Users\Jaka\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Users\Jaka\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
FF - plugin: C:\Users\Jaka\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2012-8-2 28504]
R1 kltdi;kltdi;C:\Windows\System32\drivers\kltdi.sys [2012-6-8 54104]
R1 kneps;kneps;C:\Windows\System32\drivers\kneps.sys [2012-8-13 178008]
R2 IBUpdaterService;Updater Service;C:\ProgramData\IBUpdaterService\ibsvc.exe [2012-9-29 616160]
R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-7-5 3048136]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-2 382824]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2011-10-20 2072896]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;C:\Windows\System32\drivers\l160x64.sys [2009-10-13 61440]
R3 Icon7vLifeWebCam;Icon7 vLife audio;C:\Windows\System32\drivers\Icon7VAC.sys [2010-1-20 49664]
R3 klkbdflt;Kaspersky Lab KLKBDFLT;C:\Windows\System32\drivers\klkbdflt.sys [2012-5-25 29016]
R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2012-7-25 29528]
R3 seehcri;Sony Ericsson seehcri Device Driver;C:\Windows\System32\drivers\seehcri.sys [2010-4-23 34032]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-20 11856]
R3 WebCamEffect;WebCamEffect;C:\Windows\System32\drivers\WebCamEffect.sys [2010-1-20 34368]
S2 AVP;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [2012-8-17 356376]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate1cc6e1fb9d6528;gupdate1cc6e1fb9d6528;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-8-3 136176]
S2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-2-21 1258856]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-3-30 250808]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;D:\Dragon Age\bin_ship\daupdatersvc.service.exe [2009-12-15 25832]
S3 ggflt;SEMC USB Flash Driver Filter;C:\Windows\System32\drivers\ggflt.sys [2010-4-23 13352]
S3 gupdatem;Storitev Posodobitve za Google (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-8-3 136176]
S3 LNonPnP;LNonPnP;C:\Windows\System32\drivers\LNonPnP.sys [2010-10-11 18960]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-5 115168]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2011-2-24 20992]
S3 Revoflt;Revoflt;C:\Windows\System32\drivers\revoflt.sys [2011-11-18 31800]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);C:\Windows\System32\drivers\s1018bus.sys [2009-12-13 113704]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;C:\Windows\System32\drivers\s1018mdfl.sys [2009-12-13 19496]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;C:\Windows\System32\drivers\s1018mdm.sys [2009-12-13 153128]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);C:\Windows\System32\drivers\s1018mgmt.sys [2009-12-13 133160]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);C:\Windows\System32\drivers\s1018nd5.sys [2009-12-13 34856]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;C:\Windows\System32\drivers\s1018obex.sys [2009-12-13 128552]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);C:\Windows\System32\drivers\s1018unic.sys [2009-12-13 146472]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-24 59392]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-6-13 1255736]
.
=============== Created Last 30 ================
.
2012-12-18 11:19:27 ——– d—–w- C:\Program Files (x86)\Geeks3D
2012-12-16 20:17:35 76232 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{881BF6E9-AAB8-44AE-AEBE-3174E1732A02}\offreg.dll
2012-12-16 18:03:36 ——– d—–w- C:\TDSSKiller_Quarantine
2012-12-14 17:28:21 9125352 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{881BF6E9-AAB8-44AE-AEBE-3174E1732A02}\mpengine.dll
2012-12-12 19:48:14 2048 —-a-w- C:\Windows\SysWow64\tzres.dll
2012-12-12 19:48:14 2048 —-a-w- C:\Windows\System32\tzres.dll
2012-12-12 19:48:08 3149824 —-a-w- C:\Windows\System32\win32k.sys
2012-12-04 22:51:42 34624 —-a-w- C:\Windows\System32\TURegOpt.exe
2012-12-04 22:51:42 25920 —-a-w- C:\Windows\System32\authuitu.dll
2012-12-04 22:51:40 21312 —-a-w- C:\Windows\SysWow64\authuitu.dll
2012-12-04 22:51:19 ——– d—–w- C:\Program Files (x86)\TuneUp Utilities 2012
2012-12-04 22:49:57 ——– d-sh–w- C:\PROGRA~3\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-12-04 22:31:20 262112 —-a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
.
==================== Find3M ====================
.
2012-12-12 15:01:35 73656 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-12 15:01:35 697272 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-11-15 15:15:08 54104 —-a-w- C:\Windows\System32\drivers\kltdi.sys
2012-11-12 12:28:37 1638912 —-a-w- C:\Windows\System32\mshtml.tlb
2012-11-12 11:52:18 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2012-11-05 21:35:16 46080 —-a-w- C:\Windows\System32\atmlib.dll
2012-11-05 20:41:32 367616 —-a-w- C:\Windows\System32\atmfd.dll
2012-11-05 20:32:16 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll
2012-11-05 20:32:09 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll
2012-11-02 05:59:11 478208 —-a-w- C:\Windows\System32\dpnet.dll
2012-11-02 05:11:31 376832 —-a-w- C:\Windows\SysWow64\dpnet.dll
2012-10-27 06:26:55 981504 —-a-w- C:\Windows\SysWow64\wininet.dll
2012-10-27 05:51:21 1188864 —-a-w- C:\Windows\System32\wininet.dll
2012-10-25 02:12:26 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2012-10-25 02:12:26 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts
2012-10-23 15:23:37 29528 —-a-w- C:\Windows\System32\drivers\klmouflt.sys
2012-10-23 15:23:37 29016 —-a-w- C:\Windows\System32\drivers\klkbdflt.sys
2012-10-16 08:38:37 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38:34 350208 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39:52 561664 —-a-w- C:\Windows\apppatch\AcLayers.dll
2012-10-09 18:17:13 55296 —-a-w- C:\Windows\System32\dhcpcsvc6.dll
2012-10-09 18:17:13 226816 —-a-w- C:\Windows\System32\dhcpcore6.dll
2012-10-09 17:40:31 44032 —-a-w- C:\Windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40:31 193536 —-a-w- C:\Windows\SysWow64\dhcpcore6.dll
2012-10-04 17:46:16 362496 —-a-w- C:\Windows\System32\wow64win.dll
2012-10-04 17:46:15 243200 —-a-w- C:\Windows\System32\wow64.dll
2012-10-04 17:46:15 13312 —-a-w- C:\Windows\System32\wow64cpu.dll
2012-10-04 17:45:55 215040 —-a-w- C:\Windows\System32\winsrv.dll
2012-10-04 17:43:28 16384 —-a-w- C:\Windows\System32\ntvdm64.dll
2012-10-04 17:41:16 424960 —-a-w- C:\Windows\System32\KernelBase.dll
2012-10-04 16:47:41 5120 —-a-w- C:\Windows\SysWow64\wow32.dll
2012-10-04 16:47:41 274944 —-a-w- C:\Windows\SysWow64\KernelBase.dll
2012-10-04 15:21:55 338432 —-a-w- C:\Windows\System32\conhost.exe
2012-10-04 14:46:46 7680 —-a-w- C:\Windows\SysWow64\instnm.exe
2012-10-04 14:46:46 25600 —-a-w- C:\Windows\SysWow64\setup16.exe
2012-10-04 14:46:44 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll
2012-10-04 14:46:43 2048 —-a-w- C:\Windows\SysWow64\user.exe
2012-10-04 14:41:50 6144 —ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2012-10-04 14:41:50 4608 —ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-04 14:41:50 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2012-10-04 14:41:50 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2012-10-03 17:56:54 1914248 —-a-w- C:\Windows\System32\drivers\tcpip.sys
2012-10-03 17:44:21 70656 —-a-w- C:\Windows\System32\nlaapi.dll
2012-10-03 17:44:21 303104 —-a-w- C:\Windows\System32\nlasvc.dll
2012-10-03 17:44:17 246272 —-a-w- C:\Windows\System32\netcorehc.dll
2012-10-03 17:44:17 18944 —-a-w- C:\Windows\System32\netevent.dll
2012-10-03 17:44:16 216576 —-a-w- C:\Windows\System32\ncsi.dll
2012-10-03 17:42:16 569344 —-a-w- C:\Windows\System32\iphlpsvc.dll
2012-10-03 16:42:24 18944 —-a-w- C:\Windows\SysWow64\netevent.dll
2012-10-03 16:42:24 175104 —-a-w- C:\Windows\SysWow64\netcorehc.dll
2012-10-03 16:42:23 156672 —-a-w- C:\Windows\SysWow64\ncsi.dll
2012-10-03 16:07:26 45568 —-a-w- C:\Windows\System32\drivers\tcpipreg.sys
2012-10-02 19:51:11 3293544 —-a-w- C:\Windows\System32\nvsvc64.dll
2012-10-02 19:51:04 6200680 —-a-w- C:\Windows\System32\nvcpl.dll
2012-10-02 19:50:57 891240 —-a-w- C:\Windows\System32\nvvsvc.exe
2012-10-02 19:50:57 63336 —-a-w- C:\Windows\System32\nvshext.dll
2012-10-02 19:50:57 2557800 —-a-w- C:\Windows\System32\nvsvcr.dll
2012-10-02 19:50:57 118120 —-a-w- C:\Windows\System32\nvmctray.dll
2012-10-02 11:15:52 430952 —-a-w- C:\Windows\SysWow64\nvStreaming.exe
2012-09-25 22:47:43 78336 —-a-w- C:\Windows\SysWow64\synceng.dll
2012-09-25 22:46:17 95744 —-a-w- C:\Windows\System32\synceng.dll
2012-09-24 22:16:33 95208 —-a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
.
============= FINISH: 18:20:37,72 ===============
Thanks in advance 
![[external image: Posted Image]](http://i1224.photobucket.com/albums/ee380/jeffce74/aswmbrscan.jpg){kind=link}