Adware [Solved]

I keep getting a popup websites of what appears to be a down load for Adobe Flash. These are some of the pages that open.
hxxp://www.redorbit.com/news/video/todays-picks/
hxxp://ad.directrev.com/RealMedia/ads/adst…randomNo%5d@x10

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:57:40 PM, on 1/29/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16457)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
C:\Program Files (x86)\Lenovo\FanSpeedControl\LenovoFSC.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
C:\PROGRA~2\AD-AWA~1\AdAware.exe
C:\Program Files (x86)\IObit\Game Booster\gbtray.exe
C:\Program Files (x86)\IObit\Advanced SystemCare 6\Monitor.exe
C:\Program Files (x86)\IObit\Smart Defrag 2\SmartDefrag.exe
C:\PROGRAM FILES (X86)\CITRIX\ICA CLIENT\CONCENTR.EXE
C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe
C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
C:\Program Files (x86)\Logitech\LWS\Webcam Software\lws.exe
C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Users\Gina Hungerford\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Gina Hungerford\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Gina Hungerford\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE
Q:\140066.enu\Office14\WINWORDC.EXE
C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
Q:\140066.enu\Office14\OffSpon.EXE
C:\Users\Gina Hungerford\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Gina Hungerford\Desktop\HiJackThis.exe
C:\ProgramData\FLEXnet\Connect\11\agent.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.yahoo.com?type=198484&fr=spigot-yhp-ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: IObit Apps Toolbar - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files (x86)\IObit Apps Toolbar\IE\6.7\iobitappsToolbarIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll
O3 - Toolbar: IObit Apps Toolbar - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files (x86)\IObit Apps Toolbar\IE\6.7\iobitappsToolbarIE.dll
O4 - HKLM\..\Run: [LenovoFSC] C:\Program Files (x86)\Lenovo\FanSpeedControl\LenovoFSC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKLM\..\Run: [Ad-Aware Antivirus] "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" –windows-run
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [WLStart] "C:\Program Files (x86)\Windows Live\Installer\wlstart.exe" /nosearch /nohomepage (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [WLStart] "C:\Program Files (x86)\Windows Live\Installer\wlstart.exe" /nosearch /nohomepage (User 'Default user')
O4 - .DEFAULT User Startup: Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (User 'Default user')
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: linkscanner - (no CLSID) - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: Ad-Aware Service - Lavasoft Limited - C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Advanced SystemCare Service 6 (AdvancedSystemCareService6) - IObit - C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Ad-Aware (SBAMSvc) - GFI Software - C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: UMVPFSrv - Logitech Inc. - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 14354 bytes

Hello there,

Please download DDS by sUBs from one of the following links and save it to your desktop.

• • DDS.com
  • DDS.pif
• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

===================================================

Please download aswMBR.exe and save it to your desktop.

• Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)
• Allow it to update where necessary
• Click Scan
  
  
• Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
• You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

===================================================

Download TDSSKiller.exe and save it to your desktop

Execute TDSSKiller.exe by doubleclicking on it.
Press Start Scan
If Malicious objects are found, do NOT select Cure. Change the action to Skip, and save the log.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.log.txt

===================================================

On your next reply please post :
DDS log
aswMBR log
TDSSKiller log

Please STOP and let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 1.6.0_37 Run by [removed] at 17:13:11 on 2013-02-01 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8157.6135 [GMT -10:00] . AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} AV: Lavasoft Ad-Aware *Disabled/Updated* {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Lavasoft Ad-Aware *Disabled/Updated* {5BB89C30-6480-BC7C-9F17-199BD76F557A} SP: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} FW: Lavasoft Ad-Aware *Disabled* {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC} . ============== Running Processes =============== . C:\windows\system32\lsm.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe C:\windows\system32\svchost.exe -k RPCSS C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe C:\windows\system32\svchost.exe -k GPSvcGroup C:\windows\system32\svchost.exe -k LocalService C:\windows\system32\svchost.exe -k NetworkService C:\windows\System32\spoolsv.exe C:\windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe C:\windows\SysWOW64\svchost.exe -k hpdevmgmt C:\windows\System32\svchost.exe -k HPZ12 C:\windows\System32\svchost.exe -k HPZ12 C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\windows\system32\svchost.exe -k HPService C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\windows\system32\taskhost.exe C:\windows\Explorer.EXE C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe C:\Program Files (x86)\Lenovo\FanSpeedControl\LenovoFSC.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\AVG\AVG2013\avgui.exe C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe C:\windows\system32\taskeng.exe C:\windows\system32\SearchIndexer.exe C:\Program Files (x86)\IObit\Game Booster\gbtray.exe C:\Program Files (x86)\IObit\Advanced SystemCare 6\Monitor.exe C:\Program Files (x86)\IObit\Smart Defrag 2\SmartDefrag.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Internet Explorer\iexplore.exe C:\windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRAM FILES (X86)\CITRIX\ICA CLIENT\CONCENTR.EXE C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe C:\WINDOWS\SYSTEM32\IGFXTRAY.EXE C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe C:\windows\system32\svchost.exe -k SDRSVC C:\Program Files\Internet Explorer\iexplore.exe C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\Dwm.exe C:\windows\system32\taskeng.exe C:\windows\system32\wbem\wmiprvse.exe C:\windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://search.yahoo.com?type=198484&fr=spigot-yhp-ie uSearch Bar = Preserve mWinlogon: Userinit = userinit.exe, BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files (x86)\IObit Apps Toolbar\IE\6.7\iobitappsToolbarIE.dll BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll BHO: Ad-Aware Security Add-on: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll TB: Ad-Aware Security Add-on: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll TB: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files (x86)\IObit Apps Toolbar\IE\6.7\iobitappsToolbarIE.dll EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe uRun: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler mRun: [LenovoFSC] C:\Program Files (x86)\Lenovo\FanSpeedControl\LenovoFSC.exe mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY mRun: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" mRun: [Ad-Aware Antivirus] "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" –windows-run dRunOnce: [WLStart] "C:\Program Files (x86)\Windows Live\Installer\wlstart.exe" /nosearch /nohomepage uPolicies-Explorer: NoDriveTypeAutoRun = dword:149 mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:0 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableLUA = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: PromptOnSecureDesktop = dword:0 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab TCP: NameServer = 24.25.227.55 209.18.47.61 24.25.227.53 TCP: Interfaces\{A8A8C631-CC71-4F8E-9A12-1418D9D34BD9} : DHCPNameServer = [removed] [removed] [removed] Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll Handler: linkscanner - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll Notify: igfxcui - SSODL: WebCheck - x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s x64-Run: [HotKeysCmds] C:\windows\System32\hkcmd.exe x64-Run: [Persistence] C:\windows\System32\igfxpers.exe x64-Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - x64-Handler: linkscanner - x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - x64-Notify: igfxcui - igfxdev.dll x64-SSODL: WebCheck - . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Gina Hungerford\AppData\Roaming\Mozilla\Firefox\Profiles\etzq40d3.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com?type=198484&fr=spigot-yhp-ff FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=198484&p= FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Nitro PDF\Reader 2\npdf.dll FF - plugin: C:\Program Files (x86)\Nitro PDF\Reader 2\npnitroie.dll FF - plugin: C:\Program Files (x86)\Nitro PDF\Reader 2\npnitromozilla.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\Gina Hungerford\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\Users\Gina Hungerford\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll FF - plugin: C:\Users\Gina Hungerford\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll FF - plugin: C:\windows\SysWOW64\npdeployJava1.dll FF - plugin: C:\windows\SysWOW64\npmproxy.dll FF - ExtSQL: 2013-01-25 18:23; {87934c42-161d-45bc-8cef-ef18abe2a30c}; C:\Users\Gina Hungerford\AppData\Roaming\Mozilla\Firefox\Profiles\etzq40d3.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c} FF - ExtSQL: 2013-01-25 18:23; jid1-yZwVFzbsyfMrqQ@jetpack; C:\Users\Gina Hungerford\AppData\Roaming\Mozilla\Firefox\Profiles\etzq40d3.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack FF - ExtSQL: 2013-01-28 08:04; [removed]; C:\Program Files (x86)\IObit Apps Toolbar\FF FF - ExtSQL: !HIDDEN! 2012-02-13 17:02; [removed]; C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 . —- FIREFOX POLICIES —- FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: network.http.max-connections - 48 FF - user.js: network.http.max-connections-per-server - 16 FF - user.js: network.http.max-persistent-connections-per-proxy - 16 FF - user.js: network.http.max-persistent-connections-per-server - 8 FF - user.js: browser.turbo.enabled - true FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.chrome.favicons - false FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: content.notify.ontimer - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 2250000 FF - user.js: content.switch.threshold - 750000 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 . ============= SERVICES / DRIVERS =============== . R0 AVGIDSHA;AVGIDSHA;C:\windows\System32\drivers\avgidsha.sys [2012-10-15 63328] R0 Avgloga;AVG Logging Driver;C:\windows\System32\drivers\avgloga.sys [2012-9-21 225120] R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\windows\System32\drivers\avgmfx64.sys [2012-11-15 111968] R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\windows\System32\drivers\avgrkx64.sys [2012-9-14 40800] R0 gfibto;gfibto;C:\windows\System32\drivers\gfibto.sys [2013-1-25 14456] R0 SmartDefragDriver;SmartDefragDriver;C:\windows\System32\drivers\SmartDefragDriver.sys [2012-4-24 17720] R1 AVGIDSDriver;AVGIDSDriver;C:\windows\System32\drivers\avgidsdrivera.sys [2012-10-22 154464] R1 Avgldx64;AVG AVI Loader Driver;C:\windows\System32\drivers\avgldx64.sys [2012-10-2 185696] R1 Avgtdia;AVG TDI Driver;C:\windows\System32\drivers\avgtdia.sys [2012-9-21 200032] R1 ctxusbm;Citrix USB Monitor Driver;C:\windows\System32\drivers\ctxusbm.sys [2011-8-10 91864] R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928] R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368] R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2012-7-11 140672] R2 Ad-Aware Service;Ad-Aware Service;C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [2012-12-14 1236968] R2 AdvancedSystemCareService6;Advanced SystemCare Service 6;C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe [2012-11-14 465216] R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664] R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624] R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-3-31 1153368] R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776] R2 UMVPFSrv;UMVPFSrv;C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe [2012-1-17 450848] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUStor.sys [2010-12-28 219136] R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2010-12-28 215040] R3 Sftfs;Sftfs;C:\windows\System32\drivers\Sftfslh.sys [2011-10-1 764264] R3 Sftplay;Sftplay;C:\windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648] R3 Sftredir;Sftredir;C:\windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960] R3 Sftvol;Sftvol;C:\windows\System32\drivers\Sftvollh.sys [2011-10-1 22376] R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496] R3 SuperIO;Lenovo ASD HWM Driver;C:\windows\System32\drivers\spio.sys [2009-6-5 11848] R3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\IObit\Game Booster\Driver\WinRing0x64.sys [2012-5-5 14544] S2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-15 5814904] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-1-26 398184] S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-1-26 682344] S2 SBAMSvc;Ad-Aware;C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [2012-9-20 3677000] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-1-8 161536] S3 LVPr2M64;Logitech LVPr2M64 Driver;C:\windows\System32\drivers\LVPr2M64.sys [2009-10-6 30232] S3 LVRS64;Logitech RightSound Filter Driver;C:\windows\System32\drivers\lvrs64.sys [2012-1-17 351136] S3 LVUVC64;Logitech HD Pro Webcam C920(UVC);C:\windows\System32\drivers\lvuvc64.sys [2012-1-17 4865568] S3 MBAMProtector;MBAMProtector;C:\windows\System32\drivers\mbam.sys [2013-1-26 24176] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\windows\System32\drivers\rdpvideominiport.sys [2012-10-25 19456] S3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;C:\windows\System32\drivers\Rtnic64.sys [2009-6-10 51712] S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2012-10-25 57856] S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2011-3-16 1255736] S3 wsvd;wsvd;C:\windows\System32\drivers\wsvd.sys [2009-7-21 121840] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\windows\System32\drivers\yk62x64.sys [2009-6-10 389120] S4 DragonSvc;Dragon Service;C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe [2011-6-4 296808] S4 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2012-8-22 216080] S4 TeamViewer7;TeamViewer 7;C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-8-24 2735528] . =============== Created Last 30 ================ . 2013-01-28 18:04:09 ——– d—–w- C:\Program Files (x86)\IObit Apps Toolbar 2013-01-28 18:03:49 ——– d—–w- C:\ProgramData\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A} 2013-01-26 17:45:06 24176 —-a-w- C:\windows\System32\drivers\mbam.sys 2013-01-26 17:45:06 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-01-26 05:58:04 697864 —-a-w- C:\windows\SysWow64\FlashPlayerApp.exe 2013-01-26 05:20:57 ——– d—–w- C:\ProgramData\Ad-Aware Antivirus 2013-01-26 05:20:04 ——– d—–w- C:\Users\Gina Hungerford\AppData\Roaming\LavasoftStatistics 2013-01-26 04:26:46 ——– d—–w- C:\Program Files (x86)\Ad-Aware Antivirus 2013-01-26 04:26:28 ——– d—–w- C:\Users\Gina Hungerford\AppData\Local\Downloaded Installations 2013-01-26 04:26:25 47496 —-a-w- C:\windows\System32\sbbd.exe 2013-01-26 04:26:25 14456 —-a-w- C:\windows\System32\drivers\gfibto.sys 2013-01-26 04:23:51 ——– d—–w- C:\ProgramData\blekko toolbars 2013-01-26 04:23:50 ——– d—–w- C:\Users\Gina Hungerford\AppData\Local\adawarebp 2013-01-26 04:23:49 ——– d—–w- C:\ProgramData\Ad-Aware Browsing Protection 2013-01-26 04:23:45 ——– d—–w- C:\Program Files (x86)\Toolbar Cleaner 2013-01-26 04:23:40 ——– d—–w- C:\Program Files (x86)\adawaretb 2013-01-26 04:22:25 ——– d—–w- C:\Users\Gina Hungerford\AppData\Roaming\Ad-Aware Antivirus 2013-01-13 19:55:47 800768 —-a-w- C:\windows\System32\usp10.dll 2013-01-09 19:06:27 46080 —-a-w- C:\windows\System32\atmlib.dll 2013-01-09 19:06:27 34304 —-a-w- C:\windows\SysWow64\atmlib.dll 2013-01-09 19:06:26 367616 —-a-w- C:\windows\System32\atmfd.dll 2013-01-09 19:06:26 295424 —-a-w- C:\windows\SysWow64\atmfd.dll 2013-01-09 19:00:59 2002432 —-a-w- C:\windows\System32\msxml6.dll 2013-01-09 19:00:59 1882624 —-a-w- C:\windows\System32\msxml3.dll 2013-01-09 19:00:59 1389568 —-a-w- C:\windows\SysWow64\msxml6.dll 2013-01-09 19:00:59 1236992 —-a-w- C:\windows\SysWow64\msxml3.dll 2013-01-09 19:00:56 750592 —-a-w- C:\windows\System32\win32spl.dll 2013-01-09 19:00:56 492032 —-a-w- C:\windows\SysWow64\win32spl.dll 2013-01-09 19:00:55 307200 —-a-w- C:\windows\System32\ncrypt.dll 2013-01-09 19:00:55 220160 —-a-w- C:\windows\SysWow64\ncrypt.dll 2013-01-09 19:00:47 68608 —-a-w- C:\windows\System32\taskhost.exe 2013-01-09 19:00:12 3149824 —-a-w- C:\windows\System32\win32k.sys 2013-01-09 18:09:40 ——– d—–w- C:\Users\Gina Hungerford\AppData\Local\Programs . ==================== Find3M ==================== . 2013-01-30 01:53:14 74248 —-a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-01-13 19:55:47 626688 —-a-w- C:\windows\SysWow64\usp10.dll 2012-12-20 19:10:12 741 —-a-w- C:\windows\SysWow64\lod1.vbs 2012-12-16 19:13:15 2048 —-a-w- C:\windows\SysWow64\tzres.dll 2012-12-16 19:13:15 2048 —-a-w- C:\windows\System32\tzres.dll 2012-12-16 19:12:07 2382848 —-a-w- C:\windows\SysWow64\mshtml.tlb 2012-12-16 19:12:07 2382848 —-a-w- C:\windows\System32\mshtml.tlb 2012-12-16 19:12:06 1800704 —-a-w- C:\windows\SysWow64\jscript9.dll 2012-12-16 19:12:06 173056 —-a-w- C:\windows\System32\ieUnatt.exe 2012-12-16 19:12:06 142848 —-a-w- C:\windows\SysWow64\ieUnatt.exe 2012-12-16 19:12:05 599040 —-a-w- C:\windows\System32\vbscript.dll 2012-12-16 19:12:05 420864 —-a-w- C:\windows\SysWow64\vbscript.dll 2012-12-16 19:12:05 2312704 —-a-w- C:\windows\System32\jscript9.dll 2012-12-16 19:12:05 1392128 —-a-w- C:\windows\System32\wininet.dll 2012-12-16 19:12:05 1129472 —-a-w- C:\windows\SysWow64\wininet.dll 2012-12-16 19:12:04 1494528 —-a-w- C:\windows\System32\inetcpl.cpl 2012-12-16 19:12:04 1427968 —-a-w- C:\windows\SysWow64\inetcpl.cpl 2012-12-16 19:09:46 478208 —-a-w- C:\windows\System32\dpnet.dll 2012-12-16 19:09:46 376832 —-a-w- C:\windows\SysWow64\dpnet.dll 2012-12-01 19:12:22 561664 —-a-w- C:\windows\apppatch\AcLayers.dll 2012-12-01 19:12:22 350208 —-a-w- C:\windows\apppatch\AppPatch64\AcLayers.dll 2012-12-01 19:12:22 135168 —-a-w- C:\windows\apppatch\AppPatch64\AcXtrnal.dll 2012-11-19 01:21:41 87040 —-a-w- C:\windows\System32\drivers\WUDFPf.sys 2012-11-19 01:21:41 84992 —-a-w- C:\windows\System32\WUDFSvc.dll 2012-11-19 01:21:41 744448 —-a-w- C:\windows\System32\WUDFx.dll 2012-11-19 01:21:41 45056 —-a-w- C:\windows\System32\WUDFCoinstaller.dll 2012-11-19 01:21:41 229888 —-a-w- C:\windows\System32\WUDFHost.exe 2012-11-19 01:21:41 198656 —-a-w- C:\windows\System32\drivers\WUDFRd.sys 2012-11-19 01:21:41 194048 —-a-w- C:\windows\System32\WUDFPlatform.dll 2012-11-19 01:21:24 9728 —-a-w- C:\windows\System32\Wdfres.dll 2012-11-19 01:21:24 785512 —-a-w- C:\windows\System32\drivers\Wdf01000.sys 2012-11-19 01:21:24 54376 —-a-w- C:\windows\System32\drivers\WdfLdr.sys 2012-11-16 09:33:24 111968 —-a-w- C:\windows\System32\drivers\avgmfx64.sys . ============= FINISH: 17:13:19.71 =============== 18:02:22.0195 1900 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35 18:02:22.0725 1900 ============================================================ 18:02:22.0725 1900 Current date / time: 2013/02/01 18:02:22.0725 18:02:22.0725 1900 SystemInfo: 18:02:22.0725 1900 18:02:22.0725 1900 OS Version: 6.1.7601 ServicePack: 1.0 18:02:22.0725 1900 Product type: Workstation 18:02:22.0725 1900 ComputerName: PC 18:02:22.0725 1900 UserName: Gina Hungerford 18:02:22.0725 1900 Windows directory: C:\windows 18:02:22.0725 1900 System windows directory: C:\windows 18:02:22.0725 1900 Running under WOW64 18:02:22.0725 1900 Processor architecture: Intel x64 18:02:22.0725 1900 Number of processors: 2 18:02:22.0725 1900 Page size: 0x1000 18:02:22.0725 1900 Boot type: Normal boot 18:02:22.0725 1900 ============================================================ 18:02:23.0568 1900 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 18:02:23.0568 1900 ============================================================ 18:02:23.0568 1900 \Device\Harddisk0\DR0: 18:02:23.0568 1900 MBR partitions: 18:02:23.0568 1900 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 18:02:23.0568 1900 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x714AE800 18:02:23.0568 1900 ============================================================ 18:02:23.0599 1900 C: <-> \Device\Harddisk0\DR0\Partition2 18:02:23.0599 1900 ============================================================ 18:02:23.0599 1900 Initialize success 18:02:23.0599 1900 ============================================================ 18:02:46.0609 3640 ============================================================ 18:02:46.0609 3640 Scan started 18:02:46.0609 3640 Mode: Manual; 18:02:46.0609 3640 ============================================================ 18:02:47.0233 3640 ================ Scan system memory ======================== 18:02:47.0248 3640 System memory - ok 18:02:47.0248 3640 ================ Scan services ============================= 18:02:47.0295 3640 [ 581D88B25C4D4121824FED2CA38E562F ] !SASCORE C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE 18:02:47.0311 3640 !SASCORE - ok 18:02:47.0404 3640 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\windows\system32\drivers\1394ohci.sys 18:02:47.0420 3640 1394ohci - ok 18:02:47.0436 3640 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\windows\system32\drivers\ACPI.sys 18:02:47.0436 3640 ACPI - ok 18:02:47.0451 3640 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\windows\system32\drivers\acpipmi.sys 18:02:47.0451 3640 AcpiPmi - ok 18:02:47.0529 3640 [ A09A61CFDE15E5A67701EA812CE3F43F ] Ad-Aware Service C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe 18:02:47.0545 3640 Ad-Aware Service - ok 18:02:47.0623 3640 [ 424877CB9D5517F980FF7BACA2EB379D ] AdobeFlashPlayerUpdateSvc C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 18:02:47.0623 3640 AdobeFlashPlayerUpdateSvc - ok 18:02:47.0654 3640 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\windows\system32\DRIVERS\adp94xx.sys 18:02:47.0654 3640 adp94xx - ok 18:02:47.0670 3640 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\windows\system32\DRIVERS\adpahci.sys 18:02:47.0670 3640 adpahci - ok 18:02:47.0701 3640 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\windows\system32\DRIVERS\adpu320.sys 18:02:47.0701 3640 adpu320 - ok 18:02:47.0841 3640 [ CBFAA333EBA2E402A0439A3A0E5413F3 ] AdvancedSystemCareService6 C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe 18:02:47.0841 3640 AdvancedSystemCareService6 - ok 18:02:47.0857 3640 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\windows\System32\aelupsvc.dll 18:02:47.0857 3640 AeLookupSvc - ok 18:02:47.0904 3640 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\windows\system32\drivers\afd.sys 18:02:47.0904 3640 AFD - ok 18:02:47.0919 3640 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\windows\system32\drivers\agp440.sys 18:02:47.0919 3640 agp440 - ok 18:02:47.0935 3640 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\windows\System32\alg.exe 18:02:47.0935 3640 ALG - ok 18:02:47.0966 3640 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\windows\system32\drivers\aliide.sys 18:02:47.0966 3640 aliide - ok 18:02:47.0966 3640 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\windows\system32\drivers\amdide.sys 18:02:47.0966 3640 amdide - ok 18:02:47.0997 3640 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\windows\system32\DRIVERS\amdk8.sys 18:02:47.0997 3640 AmdK8 - ok 18:02:48.0013 3640 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\windows\system32\DRIVERS\amdppm.sys 18:02:48.0013 3640 AmdPPM - ok 18:02:48.0044 3640 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\windows\system32\drivers\amdsata.sys 18:02:48.0044 3640 amdsata - ok 18:02:48.0060 3640 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\windows\system32\DRIVERS\amdsbs.sys 18:02:48.0060 3640 amdsbs - ok 18:02:48.0075 3640 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\windows\system32\drivers\amdxata.sys 18:02:48.0075 3640 amdxata - ok 18:02:48.0091 3640 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\windows\system32\drivers\appid.sys 18:02:48.0091 3640 AppID - ok 18:02:48.0106 3640 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\windows\System32\appidsvc.dll 18:02:48.0106 3640 AppIDSvc - ok 18:02:48.0138 3640 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\windows\System32\appinfo.dll 18:02:48.0138 3640 Appinfo - ok 18:02:48.0216 3640 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 18:02:48.0216 3640 Apple Mobile Device - ok 18:02:48.0247 3640 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\windows\system32\DRIVERS\arc.sys 18:02:48.0247 3640 arc - ok 18:02:48.0262 3640 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\windows\system32\DRIVERS\arcsas.sys 18:02:48.0262 3640 arcsas - ok 18:02:48.0340 3640 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 18:02:48.0340 3640 aspnet_state - ok 18:02:48.0356 3640 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\windows\system32\DRIVERS\asyncmac.sys 18:02:48.0356 3640 AsyncMac - ok 18:02:48.0372 3640 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\windows\system32\drivers\atapi.sys 18:02:48.0372 3640 atapi - ok 18:02:48.0481 3640 [ 3EFD964D52221360AF0673CD61C2F4F5 ] atikmdag C:\windows\system32\drivers\atikmdag.sys 18:02:48.0528 3640 atikmdag - ok 18:02:48.0559 3640 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll 18:02:48.0559 3640 AudioEndpointBuilder - ok 18:02:48.0574 3640 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\windows\System32\Audiosrv.dll 18:02:48.0574 3640 AudioSrv - ok 18:02:48.0715 3640 [ 4AFC14AFA58878FAA1D249E7E90EA54B ] AVGIDSAgent C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe 18:02:48.0746 3640 AVGIDSAgent - ok 18:02:48.0777 3640 [ 388056EBD5FE6718FE669078DBE37897 ] AVGIDSDriver C:\windows\system32\DRIVERS\avgidsdrivera.sys 18:02:48.0777 3640 AVGIDSDriver - ok 18:02:48.0808 3640 [ 550E981747D6A6C55078C77346FFC2C6 ] AVGIDSHA C:\windows\system32\DRIVERS\avgidsha.sys 18:02:48.0808 3640 AVGIDSHA - ok 18:02:48.0824 3640 [ 5989592A91A17587799792A81E1541D4 ] Avgldx64 C:\windows\system32\DRIVERS\avgldx64.sys 18:02:48.0840 3640 Avgldx64 - ok 18:02:48.0855 3640 [ 3FC43AA02545FCDDC22817829114DEC8 ] Avgloga C:\windows\system32\DRIVERS\avgloga.sys 18:02:48.0855 3640 Avgloga - ok 18:02:48.0855 3640 [ 841C40C193889730848849AC220D9242 ] Avgmfx64 C:\windows\system32\DRIVERS\avgmfx64.sys 18:02:48.0855 3640 Avgmfx64 - ok 18:02:48.0886 3640 [ FE4F444DBE4BBBDFD8FECF49398DEFC7 ] Avgrkx64 C:\windows\system32\DRIVERS\avgrkx64.sys 18:02:48.0886 3640 Avgrkx64 - ok 18:02:48.0902 3640 [ 6E634525613D48A1D1657FB21F21F3B2 ] Avgtdia C:\windows\system32\DRIVERS\avgtdia.sys 18:02:48.0902 3640 Avgtdia - ok 18:02:48.0933 3640 [ 6B72E1E329C4E98C6B6FDD2D265E3BA3 ] avgwd C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe 18:02:48.0933 3640 avgwd - ok 18:02:48.0964 3640 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\windows\System32\AxInstSV.dll 18:02:48.0964 3640 AxInstSV - ok 18:02:48.0996 3640 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\windows\system32\DRIVERS\bxvbda.sys 18:02:49.0011 3640 b06bdrv - ok 18:02:49.0027 3640 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\windows\system32\DRIVERS\b57nd60a.sys 18:02:49.0027 3640 b57nd60a - ok 18:02:49.0058 3640 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\windows\System32\bdesvc.dll 18:02:49.0058 3640 BDESVC - ok 18:02:49.0074 3640 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\windows\system32\drivers\Beep.sys 18:02:49.0074 3640 Beep - ok 18:02:49.0105 3640 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\windows\System32\bfe.dll 18:02:49.0105 3640 BFE - ok 18:02:49.0120 3640 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\windows\System32\qmgr.dll 18:02:49.0136 3640 BITS - ok 18:02:49.0152 3640 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\windows\system32\DRIVERS\blbdrive.sys 18:02:49.0152 3640 blbdrive - ok 18:02:49.0214 3640 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 18:02:49.0214 3640 Bonjour Service - ok 18:02:49.0245 3640 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\windows\system32\DRIVERS\bowser.sys 18:02:49.0245 3640 bowser - ok 18:02:49.0261 3640 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\windows\system32\DRIVERS\BrFiltLo.sys 18:02:49.0261 3640 BrFiltLo - ok 18:02:49.0276 3640 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\windows\system32\DRIVERS\BrFiltUp.sys 18:02:49.0276 3640 BrFiltUp - ok 18:02:49.0292 3640 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\windows\System32\browser.dll 18:02:49.0292 3640 Browser - ok 18:02:49.0308 3640 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\windows\System32\Drivers\Brserid.sys 18:02:49.0308 3640 Brserid - ok 18:02:49.0323 3640 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\windows\System32\Drivers\BrSerWdm.sys 18:02:49.0323 3640 BrSerWdm - ok 18:02:49.0339 3640 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\windows\System32\Drivers\BrUsbMdm.sys 18:02:49.0339 3640 BrUsbMdm - ok 18:02:49.0339 3640 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\windows\System32\Drivers\BrUsbSer.sys 18:02:49.0339 3640 BrUsbSer - ok 18:02:49.0354 3640 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\windows\system32\DRIVERS\bthmodem.sys 18:02:49.0354 3640 BTHMODEM - ok 18:02:49.0386 3640 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\windows\system32\bthserv.dll 18:02:49.0386 3640 bthserv - ok 18:02:49.0401 3640 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\windows\system32\DRIVERS\cdfs.sys 18:02:49.0401 3640 cdfs - ok 18:02:49.0417 3640 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\windows\system32\drivers\cdrom.sys 18:02:49.0432 3640 cdrom - ok 18:02:49.0464 3640 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\windows\System32\certprop.dll 18:02:49.0464 3640 CertPropSvc - ok 18:02:49.0479 3640 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\windows\system32\DRIVERS\circlass.sys 18:02:49.0479 3640 circlass - ok 18:02:49.0495 3640 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\windows\system32\CLFS.sys 18:02:49.0495 3640 CLFS - ok 18:02:49.0542 3640 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 18:02:49.0542 3640 clr_optimization_v2.0.50727_32 - ok 18:02:49.0573 3640 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 18:02:49.0573 3640 clr_optimization_v2.0.50727_64 - ok 18:02:49.0620 3640 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 18:02:49.0620 3640 clr_optimization_v4.0.30319_32 - ok 18:02:49.0635 3640 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 18:02:49.0635 3640 clr_optimization_v4.0.30319_64 - ok 18:02:49.0651 3640 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\windows\system32\DRIVERS\CmBatt.sys 18:02:49.0651 3640 CmBatt - ok 18:02:49.0682 3640 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\windows\system32\drivers\cmdide.sys 18:02:49.0682 3640 cmdide - ok 18:02:49.0698 3640 [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG C:\windows\system32\Drivers\cng.sys 18:02:49.0713 3640 CNG - ok 18:02:49.0713 3640 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\windows\system32\DRIVERS\compbatt.sys 18:02:49.0713 3640 Compbatt - ok 18:02:49.0744 3640 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\windows\system32\drivers\CompositeBus.sys 18:02:49.0744 3640 CompositeBus - ok 18:02:49.0744 3640 COMSysApp - ok 18:02:49.0760 3640 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\windows\system32\DRIVERS\crcdisk.sys 18:02:49.0760 3640 crcdisk - ok 18:02:49.0791 3640 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\windows\system32\cryptsvc.dll 18:02:49.0791 3640 CryptSvc - ok 18:02:49.0822 3640 [ BF62FF663AE55E4ED99DE76881C2C0F1 ] ctxusbm C:\windows\system32\DRIVERS\ctxusbm.sys 18:02:49.0822 3640 ctxusbm - ok 18:02:49.0900 3640 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE 18:02:49.0916 3640 cvhsvc - ok 18:02:49.0947 3640 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\windows\system32\rpcss.dll 18:02:49.0947 3640 DcomLaunch - ok 18:02:49.0963 3640 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\windows\System32\defragsvc.dll 18:02:49.0963 3640 defragsvc - ok 18:02:49.0994 3640 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\windows\system32\Drivers\dfsc.sys 18:02:49.0994 3640 DfsC - ok 18:02:50.0010 3640 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\windows\system32\dhcpcore.dll 18:02:50.0010 3640 Dhcp - ok 18:02:50.0041 3640 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\windows\system32\drivers\discache.sys 18:02:50.0041 3640 discache - ok 18:02:50.0056 3640 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\windows\system32\DRIVERS\disk.sys 18:02:50.0056 3640 Disk - ok 18:02:50.0072 3640 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\windows\System32\dnsrslvr.dll 18:02:50.0072 3640 Dnscache - ok 18:02:50.0103 3640 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\windows\System32\dot3svc.dll 18:02:50.0103 3640 dot3svc - ok 18:02:50.0134 3640 [ B42ED0320C6E41102FDE0005154849BB ] Dot4 C:\windows\system32\DRIVERS\Dot4.sys 18:02:50.0134 3640 Dot4 - ok 18:02:50.0166 3640 [ E9F5969233C5D89F3C35E3A66A52A361 ] Dot4Print C:\windows\system32\DRIVERS\Dot4Prt.sys 18:02:50.0166 3640 Dot4Print - ok 18:02:50.0197 3640 [ FD05A02B0370BC3000F402E543CA5814 ] dot4usb C:\windows\system32\DRIVERS\dot4usb.sys 18:02:50.0197 3640 dot4usb - ok 18:02:50.0197 3640 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\windows\system32\dps.dll 18:02:50.0212 3640 DPS - ok 18:02:50.0228 3640 [ B123656688D67DF3A08FE5912203F71B ] DragonSvc C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe 18:02:50.0244 3640 DragonSvc - ok 18:02:50.0259 3640 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\windows\system32\drivers\drmkaud.sys 18:02:50.0259 3640 drmkaud - ok 18:02:50.0290 3640 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\windows\System32\drivers\dxgkrnl.sys 18:02:50.0306 3640 DXGKrnl - ok 18:02:50.0322 3640 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\windows\System32\eapsvc.dll 18:02:50.0322 3640 EapHost - ok 18:02:50.0368 3640 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\windows\system32\DRIVERS\evbda.sys 18:02:50.0400 3640 ebdrv - ok 18:02:50.0431 3640 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\windows\System32\lsass.exe 18:02:50.0431 3640 EFS - ok 18:02:50.0493 3640 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\windows\ehome\ehRecvr.exe 18:02:50.0493 3640 ehRecvr - ok 18:02:50.0509 3640 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\windows\ehome\ehsched.exe 18:02:50.0509 3640 ehSched - ok 18:02:50.0556 3640 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\windows\system32\DRIVERS\elxstor.sys 18:02:50.0556 3640 elxstor - ok 18:02:50.0571 3640 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\windows\system32\drivers\errdev.sys 18:02:50.0571 3640 ErrDev - ok 18:02:50.0602 3640 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\windows\system32\es.dll 18:02:50.0602 3640 EventSystem - ok 18:02:50.0634 3640 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\windows\system32\drivers\exfat.sys 18:02:50.0634 3640 exfat - ok 18:02:50.0649 3640 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\windows\system32\drivers\fastfat.sys 18:02:50.0649 3640 fastfat - ok 18:02:50.0665 3640 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\windows\system32\fxssvc.exe 18:02:50.0680 3640 Fax - ok 18:02:50.0696 3640 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\windows\system32\DRIVERS\fdc.sys 18:02:50.0696 3640 fdc - ok 18:02:50.0712 3640 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\windows\system32\fdPHost.dll 18:02:50.0712 3640 fdPHost - ok 18:02:50.0727 3640 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\windows\system32\fdrespub.dll 18:02:50.0727 3640 FDResPub - ok 18:02:50.0743 3640 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\windows\system32\drivers\fileinfo.sys 18:02:50.0743 3640 FileInfo - ok 18:02:50.0758 3640 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\windows\system32\drivers\filetrace.sys 18:02:50.0758 3640 Filetrace - ok 18:02:50.0774 3640 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\windows\system32\DRIVERS\flpydisk.sys 18:02:50.0774 3640 flpydisk - ok 18:02:50.0805 3640 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\windows\system32\drivers\fltmgr.sys 18:02:50.0805 3640 FltMgr - ok 18:02:50.0852 3640 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\windows\system32\FntCache.dll 18:02:50.0852 3640 FontCache - ok 18:02:50.0899 3640 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 18:02:50.0899 3640 FontCache3.0.0.0 - ok 18:02:50.0914 3640 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\windows\system32\drivers\FsDepends.sys 18:02:50.0914 3640 FsDepends - ok 18:02:50.0946 3640 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\windows\system32\drivers\Fs_Rec.sys 18:02:50.0946 3640 Fs_Rec - ok 18:02:50.0961 3640 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\windows\system32\DRIVERS\fvevol.sys 18:02:50.0961 3640 fvevol - ok 18:02:50.0977 3640 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\windows\system32\DRIVERS\gagp30kx.sys 18:02:50.0977 3640 gagp30kx - ok 18:02:51.0008 3640 [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM C:\windows\system32\DRIVERS\GEARAspiWDM.sys 18:02:51.0008 3640 GEARAspiWDM - ok 18:02:51.0055 3640 [ 14908F4F9005C29DE8F5587E271390EE ] gfibto C:\windows\system32\drivers\gfibto.sys 18:02:51.0055 3640 gfibto - ok 18:02:51.0086 3640 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\windows\System32\gpsvc.dll 18:02:51.0086 3640 gpsvc - ok 18:02:51.0133 3640 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 18:02:51.0133 3640 gupdate - ok 18:02:51.0133 3640 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 18:02:51.0133 3640 gupdatem - ok 18:02:51.0164 3640 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\windows\system32\drivers\hcw85cir.sys 18:02:51.0164 3640 hcw85cir - ok 18:02:51.0195 3640 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys 18:02:51.0195 3640 HdAudAddService - ok 18:02:51.0211 3640 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\windows\system32\drivers\HDAudBus.sys 18:02:51.0211 3640 HDAudBus - ok 18:02:51.0226 3640 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\windows\system32\DRIVERS\HidBatt.sys 18:02:51.0226 3640 HidBatt - ok 18:02:51.0242 3640 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\windows\system32\DRIVERS\hidbth.sys 18:02:51.0242 3640 HidBth - ok 18:02:51.0258 3640 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\windows\system32\DRIVERS\hidir.sys 18:02:51.0258 3640 HidIr - ok 18:02:51.0289 3640 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\windows\system32\hidserv.dll 18:02:51.0289 3640 hidserv - ok 18:02:51.0304 3640 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\windows\system32\DRIVERS\hidusb.sys 18:02:51.0304 3640 HidUsb - ok 18:02:51.0336 3640 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\windows\system32\kmsvc.dll 18:02:51.0336 3640 hkmsvc - ok 18:02:51.0351 3640 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\windows\system32\ListSvc.dll 18:02:51.0351 3640 HomeGroupListener - ok 18:02:51.0382 3640 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\windows\system32\provsvc.dll 18:02:51.0398 3640 HomeGroupProvider - ok 18:02:51.0476 3640 [ 0A3C6AA4A9FC38C20BA4EAC2C3351C05 ] hpqcxs08 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll 18:02:51.0476 3640 hpqcxs08 - ok 18:02:51.0507 3640 [ F3F72A2A86C22610BCA5439FA789DD52 ] hpqddsvc C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll 18:02:51.0507 3640 hpqddsvc - ok 18:02:51.0538 3640 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\windows\system32\drivers\HpSAMD.sys 18:02:51.0538 3640 HpSAMD - ok 18:02:51.0570 3640 [ F37882F128EFACEFE353E0BAE2766909 ] HPSLPSVC C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL 18:02:51.0585 3640 HPSLPSVC - ok 18:02:51.0616 3640 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\windows\system32\drivers\HTTP.sys 18:02:51.0616 3640 HTTP - ok 18:02:51.0648 3640 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\windows\system32\drivers\hwpolicy.sys 18:02:51.0648 3640 hwpolicy - ok 18:02:51.0663 3640 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\windows\system32\drivers\i8042prt.sys 18:02:51.0663 3640 i8042prt - ok 18:02:51.0694 3640 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\windows\system32\drivers\iaStorV.sys 18:02:51.0694 3640 iaStorV - ok 18:02:51.0741 3640 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 18:02:51.0757 3640 idsvc - ok 18:02:51.0913 3640 [ C6238C6ABD6AC99F5D152DA4E9439A3D ] igfx C:\windows\system32\DRIVERS\igdkmd64.sys 18:02:52.0006 3640 igfx - ok 18:02:52.0038 3640 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\windows\system32\DRIVERS\iirsp.sys 18:02:52.0038 3640 iirsp - ok 18:02:52.0069 3640 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\windows\System32\ikeext.dll 18:02:52.0084 3640 IKEEXT - ok 18:02:52.0116 3640 [ 9AA6A93852E36FE76C3F7FC2904F3B01 ] IntcAzAudAddService C:\windows\system32\drivers\RTKVHD64.sys 18:02:52.0131 3640 IntcAzAudAddService - ok 18:02:52.0147 3640 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\windows\system32\drivers\intelide.sys 18:02:52.0147 3640 intelide - ok 18:02:52.0162 3640 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\windows\system32\DRIVERS\intelppm.sys 18:02:52.0178 3640 intelppm - ok 18:02:52.0194 3640 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\windows\system32\ipbusenum.dll 18:02:52.0194 3640 IPBusEnum - ok 18:02:52.0225 3640 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\windows\system32\DRIVERS\ipfltdrv.sys 18:02:52.0225 3640 IpFilterDriver - ok 18:02:52.0256 3640 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\windows\System32\iphlpsvc.dll 18:02:52.0272 3640 iphlpsvc - ok 18:02:52.0287 3640 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\windows\system32\drivers\IPMIDrv.sys 18:02:52.0287 3640 IPMIDRV - ok 18:02:52.0318 3640 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\windows\system32\drivers\ipnat.sys 18:02:52.0318 3640 IPNAT - ok 18:02:52.0350 3640 [ 0F261EC4F514926177C70C1832374231 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 18:02:52.0350 3640 iPod Service - ok 18:02:52.0365 3640 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\windows\system32\drivers\irenum.sys 18:02:52.0365 3640 IRENUM - ok 18:02:52.0381 3640 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\windows\system32\drivers\isapnp.sys 18:02:52.0381 3640 isapnp - ok 18:02:52.0396 3640 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\windows\system32\drivers\msiscsi.sys 18:02:52.0412 3640 iScsiPrt - ok 18:02:52.0412 3640 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\windows\system32\DRIVERS\kbdclass.sys 18:02:52.0412 3640 kbdclass - ok 18:02:52.0428 3640 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\windows\system32\DRIVERS\kbdhid.sys 18:02:52.0428 3640 kbdhid - ok 18:02:52.0443 3640 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\windows\system32\lsass.exe 18:02:52.0443 3640 KeyIso - ok 18:02:52.0474 3640 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\windows\system32\Drivers\ksecdd.sys 18:02:52.0474 3640 KSecDD - ok 18:02:52.0474 3640 [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg C:\windows\system32\Drivers\ksecpkg.sys 18:02:52.0474 3640 KSecPkg - ok 18:02:52.0490 3640 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\windows\system32\drivers\ksthunk.sys 18:02:52.0490 3640 ksthunk - ok 18:02:52.0521 3640 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\windows\system32\msdtckrm.dll 18:02:52.0521 3640 KtmRm - ok 18:02:52.0552 3640 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\windows\system32\srvsvc.dll 18:02:52.0552 3640 LanmanServer - ok 18:02:52.0584 3640 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\windows\System32\wkssvc.dll 18:02:52.0584 3640 LanmanWorkstation - ok 18:02:52.0599 3640 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\windows\system32\DRIVERS\lltdio.sys 18:02:52.0599 3640 lltdio - ok 18:02:52.0615 3640 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\windows\System32\lltdsvc.dll 18:02:52.0630 3640 lltdsvc - ok 18:02:52.0646 3640 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\windows\System32\lmhsvc.dll 18:02:52.0646 3640 lmhosts - ok 18:02:52.0662 3640 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\windows\system32\DRIVERS\lsi_fc.sys 18:02:52.0662 3640 LSI_FC - ok 18:02:52.0677 3640 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\windows\system32\DRIVERS\lsi_sas.sys 18:02:52.0677 3640 LSI_SAS - ok 18:02:52.0677 3640 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\windows\system32\DRIVERS\lsi_sas2.sys 18:02:52.0677 3640 LSI_SAS2 - ok 18:02:52.0708 3640 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\windows\system32\DRIVERS\lsi_scsi.sys 18:02:52.0708 3640 LSI_SCSI - ok 18:02:52.0724 3640 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\windows\system32\drivers\luafv.sys 18:02:52.0724 3640 luafv - ok 18:02:52.0740 3640 [ DED333DBDBBCC3555A6E6244522E2F1A ] LVPr2M64 C:\windows\system32\DRIVERS\LVPr2M64.sys 18:02:52.0740 3640 LVPr2M64 - ok 18:02:52.0771 3640 [ 0C85B2B6FB74B36A251792D45E0EF860 ] LVRS64 C:\windows\system32\DRIVERS\lvrs64.sys 18:02:52.0786 3640 LVRS64 - ok 18:02:52.0849 3640 [ FF3A488924B0032B1A9CA6948C1FA9E8 ] LVUVC64 C:\windows\system32\DRIVERS\lvuvc64.sys 18:02:52.0896 3640 LVUVC64 - ok 18:02:52.0958 3640 [ 92EB844D90615CB266F84C3202B8786E ] MBAMProtector C:\windows\system32\drivers\mbam.sys 18:02:52.0958 3640 MBAMProtector - ok 18:02:53.0020 3640 [ 1ACAA67676E9E7BDA5E0C41B6E0DECAF ] MBAMScheduler C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe 18:02:53.0020 3640 MBAMScheduler - ok 18:02:53.0067 3640 [ 916B8954AC3E06DC9E898AFFB41F3FB6 ] MBAMService C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe 18:02:53.0067 3640 MBAMService - ok 18:02:53.0098 3640 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\windows\system32\Mcx2Svc.dll 18:02:53.0098 3640 Mcx2Svc - ok 18:02:53.0114 3640 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\windows\system32\DRIVERS\megasas.sys 18:02:53.0114 3640 megasas - ok 18:02:53.0130 3640 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\windows\system32\DRIVERS\MegaSR.sys 18:02:53.0145 3640 MegaSR - ok 18:02:53.0161 3640 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\windows\system32\mmcss.dll 18:02:53.0161 3640 MMCSS - ok 18:02:53.0176 3640 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\windows\system32\drivers\modem.sys 18:02:53.0176 3640 Modem - ok 18:02:53.0192 3640 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\windows\system32\DRIVERS\monitor.sys 18:02:53.0192 3640 monitor - ok 18:02:53.0223 3640 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\windows\system32\DRIVERS\mouclass.sys 18:02:53.0223 3640 mouclass - ok 18:02:53.0223 3640 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\windows\system32\DRIVERS\mouhid.sys 18:02:53.0223 3640 mouhid - ok 18:02:53.0254 3640 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\windows\system32\drivers\mountmgr.sys 18:02:53.0254 3640 mountmgr - ok 18:02:53.0270 3640 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\windows\system32\drivers\mpio.sys 18:02:53.0270 3640 mpio - ok 18:02:53.0301 3640 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\windows\system32\drivers\mpsdrv.sys 18:02:53.0301 3640 mpsdrv - ok 18:02:53.0332 3640 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\windows\system32\mpssvc.dll 18:02:53.0348 3640 MpsSvc - ok 18:02:53.0379 3640 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\windows\system32\drivers\mrxdav.sys 18:02:53.0379 3640 MRxDAV - ok 18:02:53.0395 3640 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\windows\system32\DRIVERS\mrxsmb.sys 18:02:53.0395 3640 mrxsmb - ok 18:02:53.0426 3640 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\windows\system32\DRIVERS\mrxsmb10.sys 18:02:53.0426 3640 mrxsmb10 - ok 18:02:53.0442 3640 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\windows\system32\DRIVERS\mrxsmb20.sys 18:02:53.0442 3640 mrxsmb20 - ok 18:02:53.0457 3640 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\windows\system32\drivers\msahci.sys 18:02:53.0457 3640 msahci - ok 18:02:53.0473 3640 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\windows\system32\drivers\msdsm.sys 18:02:53.0473 3640 msdsm - ok 18:02:53.0488 3640 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\windows\System32\msdtc.exe 18:02:53.0488 3640 MSDTC - ok 18:02:53.0520 3640 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\windows\system32\drivers\Msfs.sys 18:02:53.0520 3640 Msfs - ok 18:02:53.0535 3640 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\windows\System32\drivers\mshidkmdf.sys 18:02:53.0535 3640 mshidkmdf - ok 18:02:53.0551 3640 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\windows\system32\drivers\msisadrv.sys 18:02:53.0551 3640 msisadrv - ok 18:02:53.0566 3640 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\windows\system32\iscsiexe.dll 18:02:53.0566 3640 MSiSCSI - ok 18:02:53.0582 3640 msiserver - ok 18:02:53.0598 3640 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\windows\system32\drivers\MSKSSRV.sys 18:02:53.0598 3640 MSKSSRV - ok 18:02:53.0613 3640 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\windows\system32\drivers\MSPCLOCK.sys 18:02:53.0613 3640 MSPCLOCK - ok 18:02:53.0629 3640 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\windows\system32\drivers\MSPQM.sys 18:02:53.0629 3640 MSPQM - ok 18:02:53.0644 3640 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\windows\system32\drivers\MsRPC.sys 18:02:53.0660 3640 MsRPC - ok 18:02:53.0660 3640 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\windows\system32\drivers\mssmbios.sys 18:02:53.0660 3640 mssmbios - ok 18:02:53.0691 3640 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\windows\system32\drivers\MSTEE.sys 18:02:53.0691 3640 MSTEE - ok 18:02:53.0691 3640 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\windows\system32\DRIVERS\MTConfig.sys 18:02:53.0691 3640 MTConfig - ok 18:02:53.0707 3640 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\windows\system32\Drivers\mup.sys 18:02:53.0707 3640 Mup - ok 18:02:53.0754 3640 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\windows\system32\qagentRT.dll 18:02:53.0754 3640 napagent - ok 18:02:53.0769 3640 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\windows\system32\DRIVERS\nwifi.sys 18:02:53.0769 3640 NativeWifiP - ok 18:02:53.0816 3640 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\windows\system32\drivers\ndis.sys 18:02:53.0816 3640 NDIS - ok 18:02:53.0832 3640 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\windows\system32\DRIVERS\ndiscap.sys 18:02:53.0832 3640 NdisCap - ok 18:02:53.0847 3640 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\windows\system32\DRIVERS\ndistapi.sys 18:02:53.0847 3640 NdisTapi - ok 18:02:53.0878 3640 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\windows\system32\DRIVERS\ndisuio.sys 18:02:53.0878 3640 Ndisuio - ok 18:02:53.0894 3640 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\windows\system32\DRIVERS\ndiswan.sys 18:02:53.0910 3640 NdisWan - ok 18:02:53.0925 3640 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\windows\system32\drivers\NDProxy.sys 18:02:53.0925 3640 NDProxy - ok 18:02:53.0956 3640 [ 2334DC48997BA203B794DF3EE70521DB ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll 18:02:53.0956 3640 Net Driver HPZ12 - ok 18:02:53.0972 3640 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\windows\system32\DRIVERS\netbios.sys 18:02:53.0972 3640 NetBIOS - ok 18:02:54.0003 3640 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\windows\system32\DRIVERS\netbt.sys 18:02:54.0003 3640 NetBT - ok 18:02:54.0003 3640 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\windows\system32\lsass.exe 18:02:54.0003 3640 Netlogon - ok 18:02:54.0034 3640 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\windows\System32\netman.dll 18:02:54.0034 3640 Netman - ok 18:02:54.0066 3640 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 18:02:54.0066 3640 NetMsmqActivator - ok 18:02:54.0066 3640 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 18:02:54.0066 3640 NetPipeActivator - ok 18:02:54.0081 3640 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\windows\System32\netprofm.dll 18:02:54.0097 3640 netprofm - ok 18:02:54.0097 3640 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 18:02:54.0097 3640 NetTcpActivator - ok 18:02:54.0097 3640 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 18:02:54.0097 3640 NetTcpPortSharing - ok 18:02:54.0128 3640 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\windows\system32\DRIVERS\nfrd960.sys 18:02:54.0128 3640 nfrd960 - ok 18:02:54.0206 3640 [ 39645FF63EE21582D40704C2CAAC1252 ] NitroReaderDriverReadSpool2 C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe 18:02:54.0206 3640 NitroReaderDriverReadSpool2 - ok 18:02:54.0237 3640 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\windows\System32\nlasvc.dll 18:02:54.0237 3640 NlaSvc - ok 18:02:54.0253 3640 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\windows\system32\drivers\Npfs.sys 18:02:54.0253 3640 Npfs - ok 18:02:54.0284 3640 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\windows\system32\nsisvc.dll 18:02:54.0284 3640 nsi - ok 18:02:54.0300 3640 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\windows\system32\drivers\nsiproxy.sys 18:02:54.0300 3640 nsiproxy - ok 18:02:54.0362 3640 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\windows\system32\drivers\Ntfs.sys 18:02:54.0362 3640 Ntfs - ok 18:02:54.0378 3640 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\windows\system32\drivers\Null.sys 18:02:54.0378 3640 Null - ok 18:02:54.0409 3640 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\windows\system32\drivers\nvraid.sys 18:02:54.0409 3640 nvraid - ok 18:02:54.0440 3640 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\windows\system32\drivers\nvstor.sys 18:02:54.0440 3640 nvstor - ok 18:02:54.0456 3640 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\windows\system32\drivers\nv_agp.sys 18:02:54.0456 3640 nv_agp - ok 18:02:54.0471 3640 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\windows\system32\drivers\ohci1394.sys 18:02:54.0471 3640 ohci1394 - ok 18:02:54.0502 3640 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 18:02:54.0502 3640 ose - ok 18:02:54.0596 3640 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 18:02:54.0643 3640 osppsvc - ok 18:02:54.0674 3640 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\windows\system32\pnrpsvc.dll 18:02:54.0674 3640 p2pimsvc - ok 18:02:54.0690 3640 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\windows\system32\p2psvc.dll 18:02:54.0690 3640 p2psvc - ok 18:02:54.0721 3640 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\windows\system32\DRIVERS\parport.sys 18:02:54.0721 3640 Parport - ok 18:02:54.0752 3640 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\windows\system32\drivers\partmgr.sys 18:02:54.0752 3640 partmgr - ok 18:02:54.0768 3640 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\windows\System32\pcasvc.dll 18:02:54.0768 3640 PcaSvc - ok 18:02:54.0783 3640 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\windows\system32\drivers\pci.sys 18:02:54.0783 3640 pci - ok 18:02:54.0799 3640 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\windows\system32\drivers\pciide.sys 18:02:54.0799 3640 pciide - ok 18:02:54.0830 3640 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\windows\system32\DRIVERS\pcmcia.sys 18:02:54.0830 3640 pcmcia - ok 18:02:54.0830 3640 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\windows\system32\drivers\pcw.sys 18:02:54.0830 3640 pcw - ok 18:02:54.0861 3640 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\windows\system32\drivers\peauth.sys 18:02:54.0861 3640 PEAUTH - ok 18:02:54.0924 3640 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\windows\SysWow64\perfhost.exe 18:02:54.0924 3640 PerfHost - ok 18:02:54.0986 3640 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\windows\system32\pla.dll 18:02:55.0002 3640 pla - ok 18:02:55.0033 3640 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\windows\system32\umpnpmgr.dll 18:02:55.0048 3640 PlugPlay - ok 18:02:55.0080 3640 [ AC78DF349F0E4CFB8B667C0CFFF83CCE ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll 18:02:55.0080 3640 Pml Driver HPZ12 - ok 18:02:55.0095 3640 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\windows\system32\pnrpauto.dll 18:02:55.0095 3640 PNRPAutoReg - ok 18:02:55.0126 3640 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\windows\system32\pnrpsvc.dll 18:02:55.0126 3640 PNRPsvc - ok 18:02:55.0142 3640 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\windows\System32\ipsecsvc.dll 18:02:55.0142 3640 PolicyAgent - ok 18:02:55.0173 3640 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\windows\system32\umpo.dll 18:02:55.0173 3640 Power - ok 18:02:55.0189 3640 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\windows\system32\DRIVERS\raspptp.sys 18:02:55.0189 3640 PptpMiniport - ok 18:02:55.0204 3640 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\windows\system32\DRIVERS\processr.sys 18:02:55.0204 3640 Processor - ok 18:02:55.0236 3640 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\windows\system32\profsvc.dll 18:02:55.0236 3640 ProfSvc - ok 18:02:55.0251 3640 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\windows\system32\lsass.exe 18:02:55.0251 3640 ProtectedStorage - ok 18:02:55.0282 3640 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\windows\system32\DRIVERS\pacer.sys 18:02:55.0282 3640 Psched - ok 18:02:55.0314 3640 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\windows\system32\DRIVERS\ql2300.sys 18:02:55.0329 3640 ql2300 - ok 18:02:55.0329 3640 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\windows\system32\DRIVERS\ql40xx.sys 18:02:55.0329 3640 ql40xx - ok 18:02:55.0360 3640 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\windows\system32\qwave.dll 18:02:55.0376 3640 QWAVE - ok 18:02:55.0376 3640 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\windows\system32\drivers\qwavedrv.sys 18:02:55.0376 3640 QWAVEdrv - ok 18:02:55.0392 3640 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\windows\system32\DRIVERS\rasacd.sys 18:02:55.0392 3640 RasAcd - ok 18:02:55.0407 3640 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\windows\system32\DRIVERS\AgileVpn.sys 18:02:55.0423 3640 RasAgileVpn - ok 18:02:55.0423 3640 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\windows\System32\rasauto.dll 18:02:55.0423 3640 RasAuto - ok 18:02:55.0454 3640 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\windows\system32\DRIVERS\rasl2tp.sys 18:02:55.0454 3640 Rasl2tp - ok 18:02:55.0501 3640 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\windows\System32\rasmans.dll 18:02:55.0501 3640 RasMan - ok 18:02:55.0516 3640 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\windows\system32\DRIVERS\raspppoe.sys 18:02:55.0516 3640 RasPppoe - ok 18:02:55.0516 3640 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\windows\system32\DRIVERS\rassstp.sys 18:02:55.0516 3640 RasSstp - ok 18:02:55.0548 3640 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\windows\system32\DRIVERS\rdbss.sys 18:02:55.0548 3640 rdbss - ok 18:02:55.0579 3640 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\windows\system32\DRIVERS\rdpbus.sys 18:02:55.0579 3640 rdpbus - ok 18:02:55.0594 3640 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\windows\system32\DRIVERS\RDPCDD.sys 18:02:55.0594 3640 RDPCDD - ok 18:02:55.0594 3640 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\windows\system32\drivers\rdpencdd.sys 18:02:55.0594 3640 RDPENCDD - ok 18:02:55.0610 3640 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\windows\system32\drivers\rdprefmp.sys 18:02:55.0610 3640 RDPREFMP - ok 18:02:55.0641 3640 [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\windows\system32\drivers\rdpvideominiport.sys 18:02:55.0641 3640 RdpVideoMiniport - ok 18:02:55.0657 3640 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\windows\system32\drivers\RDPWD.sys 18:02:55.0657 3640 RDPWD - ok 18:02:55.0688 3640 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\windows\system32\drivers\rdyboost.sys 18:02:55.0688 3640 rdyboost - ok 18:02:55.0735 3640 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\windows\System32\mprdim.dll 18:02:55.0735 3640 RemoteAccess - ok 18:02:55.0750 3640 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\windows\system32\regsvc.dll 18:02:55.0750 3640 RemoteRegistry - ok 18:02:55.0750 3640 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\windows\System32\RpcEpMap.dll 18:02:55.0750 3640 RpcEptMapper - ok 18:02:55.0766 3640 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\windows\system32\locator.exe 18:02:55.0766 3640 RpcLocator - ok 18:02:55.0797 3640 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\windows\system32\rpcss.dll 18:02:55.0797 3640 RpcSs - ok 18:02:55.0813 3640 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\windows\system32\DRIVERS\rspndr.sys 18:02:55.0813 3640 rspndr - ok 18:02:55.0844 3640 [ B1D04ED92D148B54169499D9568A3C55 ] RSUSBSTOR C:\windows\system32\Drivers\RtsUStor.sys 18:02:55.0844 3640 RSUSBSTOR - ok 18:02:55.0860 3640 [ 68DD0457D18FCCEF7384AE84022F0C86 ] RTL8023x64 C:\windows\system32\DRIVERS\Rtnic64.sys 18:02:55.0860 3640 RTL8023x64 - ok 18:02:55.0875 3640 [ B49DC435AE3695BAC5623DD94B05732D ] RTL8167 C:\windows\system32\DRIVERS\Rt64win7.sys 18:02:55.0875 3640 RTL8167 - ok 18:02:55.0875 3640 RtsUIR - ok 18:02:55.0891 3640 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\windows\system32\lsass.exe 18:02:55.0891 3640 SamSs - ok 18:02:55.0938 3640 [ 3289766038DB2CB14D07DC84392138D5 ] SASDIFSV C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS 18:02:55.0938 3640 SASDIFSV - ok 18:02:55.0953 3640 [ 58A38E75F3316A83C23DF6173D41F2B5 ] SASKUTIL C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS 18:02:55.0953 3640 SASKUTIL - ok 18:02:56.0048 3640 [ 99FC1599F89A80216E41175B8CA44D89 ] SBAMSvc C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe 18:02:56.0079 3640 SBAMSvc - ok 18:02:56.0095 3640 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\windows\system32\drivers\sbp2port.sys 18:02:56.0095 3640 sbp2port - ok 18:02:56.0157 3640 [ 794D4B48DFB6E999537C7C3947863463 ] SBSDWSCService C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe 18:02:56.0173 3640 SBSDWSCService - ok 18:02:56.0204 3640 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\windows\System32\SCardSvr.dll 18:02:56.0204 3640 SCardSvr - ok 18:02:56.0219 3640 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\windows\system32\DRIVERS\scfilter.sys 18:02:56.0219 3640 scfilter - ok 18:02:56.0266 3640 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\windows\system32\schedsvc.dll 18:02:56.0266 3640 Schedule - ok 18:02:56.0313 3640 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\windows\System32\certprop.dll 18:02:56.0313 3640 SCPolicySvc - ok 18:02:56.0329 3640 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\windows\System32\SDRSVC.dll 18:02:56.0329 3640 SDRSVC - ok 18:02:56.0391 3640 [ 16A252022535B680046F6E34E136D378 ] SeaPort C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 18:02:56.0391 3640 SeaPort - ok 18:02:56.0422 3640 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\windows\system32\drivers\secdrv.sys 18:02:56.0422 3640 secdrv - ok 18:02:56.0422 3640 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\windows\system32\seclogon.dll 18:02:56.0438 3640 seclogon - ok 18:02:56.0438 3640 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\windows\System32\sens.dll 18:02:56.0438 3640 SENS - ok 18:02:56.0453 3640 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\windows\system32\sensrsvc.dll 18:02:56.0453 3640 SensrSvc - ok 18:02:56.0469 3640 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\windows\system32\DRIVERS\serenum.sys 18:02:56.0469 3640 Serenum - ok 18:02:56.0485 3640 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\windows\system32\DRIVERS\serial.sys 18:02:56.0485 3640 Serial - ok 18:02:56.0516 3640 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\windows\system32\DRIVERS\sermouse.sys 18:02:56.0516 3640 sermouse - ok 18:02:56.0547 3640 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\windows\system32\sessenv.dll 18:02:56.0547 3640 SessionEnv - ok 18:02:56.0563 3640 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\windows\system32\drivers\sffdisk.sys 18:02:56.0563 3640 sffdisk - ok 18:02:56.0578 3640 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\windows\system32\drivers\sffp_mmc.sys 18:02:56.0578 3640 sffp_mmc - ok 18:02:56.0594 3640 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\windows\system32\drivers\sffp_sd.sys 18:02:56.0594 3640 sffp_sd - ok 18:02:56.0609 3640 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\windows\system32\DRIVERS\sfloppy.sys 18:02:56.0609 3640 sfloppy - ok 18:02:56.0641 3640 [ C6CC9297BD53E5229653303E556AA539 ] Sftfs C:\windows\system32\DRIVERS\Sftfslh.sys 18:02:56.0641 3640 Sftfs - ok 18:02:56.0703 3640 [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe 18:02:56.0703 3640 sftlist - ok 18:02:56.0719 3640 [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay C:\windows\system32\DRIVERS\Sftplaylh.sys 18:02:56.0719 3640 Sftplay - ok 18:02:56.0719 3640 [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir C:\windows\system32\DRIVERS\Sftredirlh.sys 18:02:56.0734 3640 Sftredir - ok 18:02:56.0734 3640 [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol C:\windows\system32\DRIVERS\Sftvollh.sys 18:02:56.0734 3640 Sftvol - ok 18:02:56.0765 3640 [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe 18:02:56.0765 3640 sftvsa - ok 18:02:56.0797 3640 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\windows\System32\ipnathlp.dll 18:02:56.0812 3640 SharedAccess - ok 18:02:56.0843 3640 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\windows\System32\shsvcs.dll 18:02:56.0843 3640 ShellHWDetection - ok 18:02:56.0859 3640 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\windows\system32\DRIVERS\SiSRaid2.sys 18:02:56.0859 3640 SiSRaid2 - ok 18:02:56.0875 3640 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\windows\system32\DRIVERS\sisraid4.sys 18:02:56.0875 3640 SiSRaid4 - ok 18:02:56.0906 3640 [ 8C4F0DCC6A5100D48F9B2F950CDD220F ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe 18:02:56.0906 3640 SkypeUpdate - ok 18:02:56.0937 3640 [ DD0443BC6CC78A19FD399817F8C51401 ] SmartDefragDriver C:\windows\system32\Drivers\SmartDefragDriver.sys 18:02:56.0937 3640 SmartDefragDriver - ok 18:02:56.0953 3640 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\windows\system32\DRIVERS\smb.sys 18:02:56.0953 3640 Smb - ok 18:02:56.0984 3640 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\windows\System32\snmptrap.exe 18:02:56.0984 3640 SNMPTRAP - ok 18:02:56.0984 3640 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\windows\system32\drivers\spldr.sys 18:02:56.0984 3640 spldr - ok 18:02:57.0031 3640 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\windows\System32\spoolsv.exe 18:02:57.0031 3640 Spooler - ok 18:02:57.0109 3640 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\windows\system32\sppsvc.exe 18:02:57.0124 3640 sppsvc - ok 18:02:57.0155 3640 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\windows\system32\sppuinotify.dll 18:02:57.0155 3640 sppuinotify - ok 18:02:57.0187 3640 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\windows\system32\DRIVERS\srv.sys 18:02:57.0187 3640 srv - ok 18:02:57.0202 3640 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\windows\system32\DRIVERS\srv2.sys 18:02:57.0202 3640 srv2 - ok 18:02:57.0202 3640 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\windows\system32\DRIVERS\srvnet.sys 18:02:57.0202 3640 srvnet - ok 18:02:57.0218 3640 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\windows\System32\ssdpsrv.dll 18:02:57.0218 3640 SSDPSRV - ok 18:02:57.0233 3640 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\windows\system32\sstpsvc.dll 18:02:57.0233 3640 SstpSvc - ok 18:02:57.0265 3640 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\windows\system32\DRIVERS\stexstor.sys 18:02:57.0265 3640 stexstor - ok 18:02:57.0296 3640 [ DECACB6921DED1A38642642685D77DAC ] StillCam C:\windows\system32\DRIVERS\serscan.sys 18:02:57.0296 3640 StillCam - ok 18:02:57.0327 3640 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\windows\System32\wiaservc.dll 18:02:57.0327 3640 stisvc - ok 18:02:57.0358 3640 [ D310DA4BB3D61A52F8C50DDB1A62FF5E ] SuperIO C:\windows\system32\DRIVERS\spio.sys 18:02:57.0358 3640 SuperIO - ok 18:02:57.0374 3640 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\windows\system32\drivers\swenum.sys 18:02:57.0374 3640 swenum - ok 18:02:57.0405 3640 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\windows\System32\swprv.dll 18:02:57.0405 3640 swprv - ok 18:02:57.0452 3640 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\windows\system32\sysmain.dll 18:02:57.0467 3640 SysMain - ok 18:02:57.0499 3640 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\windows\System32\TabSvc.dll 18:02:57.0499 3640 TabletInputService - ok 18:02:57.0514 3640 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\windows\System32\tapisrv.dll 18:02:57.0514 3640 TapiSrv - ok 18:02:57.0530 3640 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\windows\System32\tbssvc.dll 18:02:57.0545 3640 TBS - ok 18:02:57.0592 3640 [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip C:\windows\system32\drivers\tcpip.sys 18:02:57.0592 3640 Tcpip - ok 18:02:57.0623 3640 [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6 C:\windows\system32\DRIVERS\tcpip.sys 18:02:57.0623 3640 TCPIP6 - ok 18:02:57.0655 3640 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\windows\system32\drivers\tcpipreg.sys 18:02:57.0655 3640 tcpipreg - ok 18:02:57.0670 3640 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\windows\system32\drivers\tdpipe.sys 18:02:57.0670 3640 TDPIPE - ok 18:02:57.0701 3640 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\windows\system32\drivers\tdtcp.sys 18:02:57.0701 3640 TDTCP - ok 18:02:57.0733 3640 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\windows\system32\DRIVERS\tdx.sys 18:02:57.0733 3640 tdx - ok 18:02:57.0795 3640 [ 9C1F776825207C203CB44CA3C63B5A6E ] TeamViewer7 C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe 18:02:57.0811 3640 TeamViewer7 - ok 18:02:57.0826 3640 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\windows\system32\drivers\termdd.sys 18:02:57.0826 3640 TermDD - ok 18:02:57.0857 3640 [ 2E648163254233755035B46DD7B89123 ] TermService C:\windows\System32\termsrv.dll 18:02:57.0873 3640 TermService - ok 18:02:57.0889 3640 [ F0344071948D1A1FA732231785A0664C ] Themes C:\windows\system32\themeservice.dll 18:02:57.0889 3640 Themes - ok 18:02:57.0904 3640 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\windows\system32\mmcss.dll 18:02:57.0904 3640 THREADORDER - ok 18:02:57.0920 3640 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\windows\System32\trkwks.dll 18:02:57.0920 3640 TrkWks - ok 18:02:57.0982 3640 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe 18:02:57.0982 3640 TrustedInstaller - ok 18:02:57.0998 3640 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\windows\system32\DRIVERS\tssecsrv.sys 18:02:57.0998 3640 tssecsrv - ok 18:02:58.0029 3640 [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt C:\windows\system32\drivers\tsusbflt.sys 18:02:58.0029 3640 TsUsbFlt - ok 18:02:58.0060 3640 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\windows\system32\DRIVERS\tunnel.sys 18:02:58.0060 3640 tunnel - ok 18:02:58.0076 3640 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\windows\system32\DRIVERS\uagp35.sys 18:02:58.0076 3640 uagp35 - ok 18:02:58.0107 3640 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\windows\system32\DRIVERS\udfs.sys 18:02:58.0107 3640 udfs - ok 18:02:58.0123 3640 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\windows\system32\UI0Detect.exe 18:02:58.0123 3640 UI0Detect - ok 18:02:58.0138 3640 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\windows\system32\drivers\uliagpkx.sys 18:02:58.0138 3640 uliagpkx - ok 18:02:58.0154 3640 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\windows\system32\DRIVERS\umbus.sys 18:02:58.0154 3640 umbus - ok 18:02:58.0169 3640 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\windows\system32\DRIVERS\umpass.sys 18:02:58.0169 3640 UmPass - ok 18:02:58.0232 3640 [ 67A95B9D129ED5399E7965CD09CF30E7 ] UMVPFSrv C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe 18:02:58.0232 3640 UMVPFSrv - ok 18:02:58.0263 3640 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\windows\System32\upnphost.dll 18:02:58.0263 3640 upnphost - ok 18:02:58.0279 3640 [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio C:\windows\system32\drivers\usbaudio.sys 18:02:58.0279 3640 usbaudio - ok 18:02:58.0310 3640 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\windows\system32\DRIVERS\usbccgp.sys 18:02:58.0310 3640 usbccgp - ok 18:02:58.0310 3640 USBCCID - ok 18:02:58.0325 3640 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\windows\system32\drivers\usbcir.sys 18:02:58.0325 3640 usbcir - ok 18:02:58.0357 3640 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\windows\system32\DRIVERS\usbehci.sys 18:02:58.0357 3640 usbehci - ok 18:02:58.0403 3640 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\windows\system32\DRIVERS\usbhub.sys 18:02:58.0403 3640 usbhub - ok 18:02:58.0419 3640 [ 58E546BBAF87664FC57E0F6081E4F609 ] usbohci C:\windows\system32\DRIVERS\usbohci.sys 18:02:58.0419 3640 usbohci - ok 18:02:58.0435 3640 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\windows\system32\DRIVERS\usbprint.sys 18:02:58.0435 3640 usbprint - ok 18:02:58.0466 3640 [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan C:\windows\system32\DRIVERS\usbscan.sys 18:02:58.0466 3640 usbscan - ok 18:02:58.0481 3640 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\windows\system32\DRIVERS\USBSTOR.SYS 18:02:58.0481 3640 USBSTOR - ok 18:02:58.0513 3640 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\windows\system32\DRIVERS\usbuhci.sys 18:02:58.0513 3640 usbuhci - ok 18:02:58.0544 3640 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\windows\system32\Drivers\usbvideo.sys 18:02:58.0544 3640 usbvideo - ok 18:02:58.0559 3640 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\windows\System32\uxsms.dll 18:02:58.0559 3640 UxSms - ok 18:02:58.0575 3640 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\windows\system32\lsass.exe 18:02:58.0575 3640 VaultSvc - ok 18:02:58.0575 3640 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\windows\system32\drivers\vdrvroot.sys 18:02:58.0575 3640 vdrvroot - ok 18:02:58.0622 3640 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\windows\System32\vds.exe 18:02:58.0622 3640 vds - ok 18:02:58.0637 3640 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\windows\system32\DRIVERS\vgapnp.sys 18:02:58.0637 3640 vga - ok 18:02:58.0669 3640 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\windows\System32\drivers\vga.sys 18:02:58.0669 3640 VgaSave - ok 18:02:58.0684 3640 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\windows\system32\drivers\vhdmp.sys 18:02:58.0684 3640 vhdmp - ok 18:02:58.0700 3640 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\windows\system32\drivers\viaide.sys 18:02:58.0700 3640 viaide - ok 18:02:58.0700 3640 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\windows\system32\drivers\volmgr.sys 18:02:58.0715 3640 volmgr - ok 18:02:58.0747 3640 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\windows\system32\drivers\volmgrx.sys 18:02:58.0747 3640 volmgrx - ok 18:02:58.0762 3640 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\windows\system32\drivers\volsnap.sys 18:02:58.0762 3640 volsnap - ok 18:02:58.0778 3640 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\windows\system32\DRIVERS\vsmraid.sys 18:02:58.0778 3640 vsmraid - ok 18:02:58.0825 3640 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\windows\system32\vssvc.exe 18:02:58.0840 3640 VSS - ok 18:02:58.0840 3640 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\windows\System32\drivers\vwifibus.sys 18:02:58.0840 3640 vwifibus - ok 18:02:58.0871 3640 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\windows\system32\w32time.dll 18:02:58.0871 3640 W32Time - ok 18:02:58.0887 3640 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\windows\system32\DRIVERS\wacompen.sys 18:02:58.0887 3640 WacomPen - ok 18:02:58.0903 3640 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\windows\system32\DRIVERS\wanarp.sys 18:02:58.0903 3640 WANARP - ok 18:02:58.0903 3640 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\windows\system32\DRIVERS\wanarp.sys 18:02:58.0903 3640 Wanarpv6 - ok 18:02:58.0949 3640 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\windows\system32\Wat\WatAdminSvc.exe 18:02:58.0965 3640 WatAdminSvc - ok 18:02:58.0996 3640 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\windows\system32\wbengine.exe 18:02:59.0012 3640 wbengine - ok 18:02:59.0027 3640 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\windows\System32\wbiosrvc.dll 18:02:59.0027 3640 WbioSrvc - ok 18:02:59.0059 3640 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\windows\System32\wcncsvc.dll 18:02:59.0074 3640 wcncsvc - ok 18:02:59.0090 3640 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll 18:02:59.0090 3640 WcsPlugInService - ok 18:02:59.0105 3640 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\windows\system32\DRIVERS\wd.sys 18:02:59.0105 3640 Wd - ok 18:02:59.0137 3640 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\windows\system32\drivers\Wdf01000.sys 18:02:59.0152 3640 Wdf01000 - ok 18:02:59.0168 3640 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\windows\system32\wdi.dll 18:02:59.0168 3640 WdiServiceHost - ok 18:02:59.0168 3640 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\windows\system32\wdi.dll 18:02:59.0168 3640 WdiSystemHost - ok 18:02:59.0199 3640 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\windows\System32\webclnt.dll 18:02:59.0199 3640 WebClient - ok 18:02:59.0230 3640 [ D5BA7D43FA2EF656BF7E98A188391E40 ] Wecsvc C:\windows\system32\wecsvc.dll 18:02:59.0246 3640 Wecsvc - ok 18:02:59.0246 3640 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\windows\System32\wercplsupport.dll 18:02:59.0246 3640 wercplsupport - ok 18:02:59.0261 3640 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\windows\System32\WerSvc.dll 18:02:59.0261 3640 WerSvc - ok 18:02:59.0261 3640 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\windows\system32\DRIVERS\wfplwf.sys 18:02:59.0277 3640 WfpLwf - ok 18:02:59.0293 3640 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\windows\system32\drivers\wimmount.sys 18:02:59.0293 3640 WIMMount - ok 18:02:59.0308 3640 WinDefend - ok 18:02:59.0308 3640 WinHttpAutoProxySvc - ok 18:02:59.0339 3640 [ 136760C1E9697BAF4ECDEAE5590A0806 ] Winmgmt C:\windows\system32\wbem\WMIsvc.dll 18:02:59.0355 3640 Winmgmt - ok 18:02:59.0417 3640 [ 0C0195C48B6B8582FA6F6373032118DA ] WinRing0_1_2_0 C:\Program Files (x86)\IObit\Game Booster\Driver\WinRing0x64.sys 18:02:59.0417 3640 WinRing0_1_2_0 - ok 18:02:59.0464 3640 [ 3BB6B401A780BF434C8F58137DE10BF7 ] WinRM C:\windows\system32\WsmSvc.dll 18:02:59.0495 3640 WinRM - ok 18:02:59.0527 3640 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\windows\System32\wlansvc.dll 18:02:59.0542 3640 Wlansvc - ok 18:02:59.0605 3640 [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 18:02:59.0620 3640 wlidsvc - ok 18:02:59.0651 3640 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\windows\system32\drivers\wmiacpi.sys 18:02:59.0651 3640 WmiAcpi - ok 18:02:59.0683 3640 [ 4DF841632B62A7CF19A79A05046A8AB1 ] wmiApSrv C:\windows\system32\wbem\WmiApSrv.exe 18:02:59.0683 3640 wmiApSrv - ok 18:02:59.0683 3640 WMPNetworkSvc - ok 18:02:59.0698 3640 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\windows\System32\wpcsvc.dll 18:02:59.0698 3640 WPCSvc - ok 18:02:59.0729 3640 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\windows\system32\wpdbusenum.dll 18:02:59.0729 3640 WPDBusEnum - ok 18:02:59.0761 3640 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\windows\system32\drivers\ws2ifsl.sys 18:02:59.0761 3640 ws2ifsl - ok 18:02:59.0776 3640 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\windows\System32\wscsvc.dll 18:02:59.0776 3640 wscsvc - ok 18:02:59.0807 3640 [ 8D918B1DB190A4D9B1753A66FA8C96E8 ] WSDPrintDevice C:\windows\system32\DRIVERS\WSDPrint.sys 18:02:59.0807 3640 WSDPrintDevice - ok 18:02:59.0807 3640 WSearch - ok 18:02:59.0839 3640 [ 83575C43B2BFE9AB0661A7F957E843C0 ] wsvd C:\windows\system32\DRIVERS\wsvd.sys 18:02:59.0839 3640 wsvd - ok 18:02:59.0885 3640 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\windows\system32\wuaueng.dll 18:02:59.0917 3640 wuauserv - ok 18:02:59.0948 3640 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\windows\system32\drivers\WudfPf.sys 18:02:59.0948 3640 WudfPf - ok 18:02:59.0963 3640 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\windows\system32\DRIVERS\WUDFRd.sys 18:02:59.0963 3640 WUDFRd - ok 18:02:59.0979 3640 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\windows\System32\WUDFSvc.dll 18:02:59.0979 3640 wudfsvc - ok 18:02:59.0995 3640 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\windows\System32\wwansvc.dll 18:02:59.0995 3640 WwanSvc - ok 18:03:00.0010 3640 [ B3EEACF62445E24FBB2CD4B0FB4DB026 ] yukonw7 C:\windows\system32\DRIVERS\yk62x64.sys 18:03:00.0010 3640 yukonw7 - ok 18:03:00.0026 3640 ================ Scan global =============================== 18:03:00.0041 3640 [ BA0CD8C393E8C9F83354106093832C7B ] C:\windows\system32\basesrv.dll 18:03:00.0088 3640 [ 9E479C2B605C25DA4971ABA36250FAEF ] C:\windows\system32\winsrv.dll 18:03:00.0088 3640 [ 9E479C2B605C25DA4971ABA36250FAEF ] C:\windows\system32\winsrv.dll 18:03:00.0104 3640 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\windows\system32\sxssrv.dll 18:03:00.0119 3640 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\windows\system32\services.exe 18:03:00.0119 3640 [Global] - ok 18:03:00.0135 3640 ================ Scan MBR ================================== 18:03:00.0135 3640 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0 18:03:00.0291 3640 \Device\Harddisk0\DR0 - ok 18:03:00.0291 3640 ================ Scan VBR ================================== 18:03:00.0291 3640 [ 0F22680C9B28B28433C449D83B712015 ] \Device\Harddisk0\DR0\Partition1 18:03:00.0291 3640 \Device\Harddisk0\DR0\Partition1 - ok 18:03:00.0307 3640 [ 9012B4548B9D8BE6966E1D317C193896 ] \Device\Harddisk0\DR0\Partition2 18:03:00.0307 3640 \Device\Harddisk0\DR0\Partition2 - ok 18:03:00.0307 3640 ============================================================ 18:03:00.0307 3640 Scan finished 18:03:00.0307 3640 ============================================================ 18:03:00.0307 2332 Detected object count: 0 18:03:00.0307 2332 Actual detected object count: 0

ComboFix 13-02-02.05 - Gina Hungerford 02/02/2013 9:44.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8157.6063 [GMT -10:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} AV: Lavasoft Ad-Aware *Disabled/Updated* {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7} FW: Lavasoft Ad-Aware *Disabled* {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC} SP: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Lavasoft Ad-Aware *Disabled/Updated* {5BB89C30-6480-BC7C-9F17-199BD76F557A} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\a c:\a\lp.crx c:\windows\SysWow64\c.bat c:\windows\SysWow64\v.vbs c:\windows\wininit.ini . . ((((((((((((((((((((((((( Files Created from 2013-01-02 to 2013-02-02 ))))))))))))))))))))))))))))))) . . 2013-02-02 19:48 . 2013-02-02 19:48 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-01-28 18:04 . 2013-01-28 18:04 ——– d—–w- c:\program files (x86)\IObit Apps Toolbar 2013-01-28 18:03 . 2013-01-28 18:03 ——– d—–w- c:\programdata\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A} 2013-01-26 17:45 . 2013-01-26 17:45 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2013-01-26 17:45 . 2012-12-15 02:49 24176 —-a-w- c:\windows\system32\drivers\mbam.sys 2013-01-26 05:58 . 2013-01-30 01:53 697864 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-01-26 05:20 . 2013-01-26 05:20 ——– d—–w- c:\programdata\Ad-Aware Antivirus 2013-01-26 05:20 . 2013-01-26 05:20 ——– d—–w- c:\users\Gina Hungerford\AppData\Roaming\LavasoftStatistics 2013-01-26 04:26 . 2013-01-26 04:26 ——– d—–w- c:\programdata\Lavasoft 2013-01-26 04:26 . 2013-01-26 05:21 ——– d—–w- c:\program files (x86)\Ad-Aware Antivirus 2013-01-26 04:26 . 2013-01-26 04:26 ——– d—–w- c:\users\Gina Hungerford\AppData\Local\Downloaded Installations 2013-01-26 04:26 . 2013-01-26 04:26 47496 —-a-w- c:\windows\system32\sbbd.exe 2013-01-26 04:26 . 2013-01-26 04:26 14456 —-a-w- c:\windows\system32\drivers\gfibto.sys 2013-01-26 04:23 . 2013-01-26 04:23 ——– d—–w- c:\programdata\blekko toolbars 2013-01-26 04:23 . 2013-01-26 04:23 ——– d—–w- c:\users\Gina Hungerford\AppData\Local\adawarebp 2013-01-26 04:23 . 2013-01-26 04:23 ——– d—–w- c:\programdata\Ad-Aware Browsing Protection 2013-01-26 04:23 . 2013-01-26 04:23 ——– d—–w- c:\program files (x86)\Toolbar Cleaner 2013-01-26 04:23 . 2013-01-26 04:23 ——– d—–w- c:\program files (x86)\adawaretb 2013-01-26 04:22 . 2013-02-02 03:09 ——– d—–w- c:\users\Gina Hungerford\AppData\Roaming\Ad-Aware Antivirus 2013-01-25 01:13 . 2013-01-25 01:13 ——– d—–w- c:\program files (x86)\Common Files\Skype 2013-01-13 19:55 . 2013-01-13 19:55 800768 —-a-w- c:\windows\system32\usp10.dll 2013-01-10 18:32 . 2013-01-10 18:32 ——– d—–w- c:\users\Default\AppData\Roaming\TuneUp Software 2013-01-09 19:06 . 2012-12-16 17:11 46080 —-a-w- c:\windows\system32\atmlib.dll 2013-01-09 19:06 . 2012-12-16 14:13 34304 —-a-w- c:\windows\SysWow64\atmlib.dll 2013-01-09 19:06 . 2012-12-16 14:45 367616 —-a-w- c:\windows\system32\atmfd.dll 2013-01-09 19:06 . 2012-12-16 14:13 295424 —-a-w- c:\windows\SysWow64\atmfd.dll 2013-01-09 19:00 . 2012-11-01 05:43 2002432 —-a-w- c:\windows\system32\msxml6.dll 2013-01-09 19:00 . 2012-11-01 05:43 1882624 —-a-w- c:\windows\system32\msxml3.dll 2013-01-09 19:00 . 2012-11-01 04:47 1389568 —-a-w- c:\windows\SysWow64\msxml6.dll 2013-01-09 19:00 . 2012-11-01 04:47 1236992 —-a-w- c:\windows\SysWow64\msxml3.dll 2013-01-09 19:00 . 2012-11-09 05:45 750592 —-a-w- c:\windows\system32\win32spl.dll 2013-01-09 19:00 . 2012-11-09 04:43 492032 —-a-w- c:\windows\SysWow64\win32spl.dll 2013-01-09 19:00 . 2012-11-20 05:48 307200 —-a-w- c:\windows\system32\ncrypt.dll 2013-01-09 19:00 . 2012-11-20 04:51 220160 —-a-w- c:\windows\SysWow64\ncrypt.dll 2013-01-09 19:00 . 2012-11-23 03:13 68608 —-a-w- c:\windows\system32\taskhost.exe 2013-01-09 19:00 . 2012-11-23 03:26 3149824 —-a-w- c:\windows\system32\win32k.sys 2013-01-09 18:09 . 2013-01-09 18:09 ——– d—–w- c:\users\Gina Hungerford\AppData\Local\Programs . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-01-30 01:53 . 2011-06-02 02:31 74248 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-01-13 19:56 . 2013-01-13 19:56 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2013-01-09 19:06 . 2011-03-25 01:06 67599240 —-a-w- c:\windows\system32\MRT.exe 2012-12-20 19:10 . 2012-12-20 19:10 741 —-a-w- c:\windows\SysWow64\lod1.vbs 2012-12-16 19:15 . 2012-12-16 19:15 83456 —-a-w- c:\windows\SysWow64\wevtfwd.dll 2012-12-16 19:15 . 2012-12-16 19:15 138752 —-a-w- c:\windows\SysWow64\WsmAuto.dll 2012-12-16 19:15 . 2012-12-16 19:15 78336 —-a-w- c:\windows\SysWow64\wecutil.exe 2012-12-16 19:15 . 2012-12-16 19:15 61440 —-a-w- c:\windows\SysWow64\wecapi.dll 2012-12-16 19:15 . 2012-12-16 19:15 60416 —-a-w- c:\windows\SysWow64\WsmRes.dll 2012-12-16 19:15 . 2012-12-16 19:15 56832 —-a-w- c:\windows\SysWow64\WSManMigrationPlugin.dll 2012-12-16 19:15 . 2012-12-16 19:15 526848 —-a-w- c:\windows\SysWow64\WsmGCDeps.dll 2012-12-16 19:15 . 2012-12-16 19:15 39936 —-a-w- c:\windows\SysWow64\winrs.exe 2012-12-16 19:15 . 2012-12-16 19:15 35840 —-a-w- c:\windows\SysWow64\wsmprovhost.exe 2012-12-16 19:15 . 2012-12-16 19:15 30208 —-a-w- c:\windows\SysWow64\WSManHTTPConfig.exe 2012-12-16 19:15 . 2012-12-16 19:15 227328 —-a-w- c:\windows\SysWow64\WsmWmiPl.dll 2012-12-16 19:15 . 2012-12-16 19:15 21504 —-a-w- c:\windows\SysWow64\WsmAgent.dll 2012-12-16 19:15 . 2012-12-16 19:15 20480 —-a-w- c:\windows\SysWow64\winrshost.exe 2012-12-16 19:15 . 2012-12-16 19:15 204105 —-a-w- c:\windows\SysWow64\winrm.vbs 2012-12-16 19:15 . 2012-12-16 19:15 2039296 —-a-w- c:\windows\SysWow64\WsmSvc.dll 2012-12-16 19:15 . 2012-12-16 19:15 10240 —-a-w- c:\windows\SysWow64\wsmplpxy.dll 2012-12-16 19:15 . 2012-12-16 19:15 9728 —-a-w- c:\windows\SysWow64\winrssrv.dll 2012-12-16 19:15 . 2012-12-16 19:15 92160 —-a-w- c:\windows\SysWow64\winrscmd.dll 2012-12-16 19:15 . 2012-12-16 19:15 42496 —-a-w- c:\windows\SysWow64\pwrshplugin.dll 2012-12-16 19:15 . 2012-12-16 19:15 1536 —-a-w- c:\windows\SysWow64\winrsmgr.dll 2012-12-16 19:15 . 2012-12-16 19:15 66560 —-a-w- c:\windows\system32\WSManMigrationPlugin.dll 2012-12-16 19:15 . 2012-12-16 19:15 46080 —-a-w- c:\windows\system32\winrs.exe 2012-12-16 19:15 . 2012-12-16 19:15 23040 —-a-w- c:\windows\system32\winrshost.exe 2012-12-16 19:15 . 2012-12-16 19:15 157184 —-a-w- c:\windows\system32\WsmAuto.dll 2012-12-16 19:15 . 2012-12-16 19:15 1536 —-a-w- c:\windows\system32\winrsmgr.dll 2012-12-16 19:15 . 2012-12-16 19:15 12800 —-a-w- c:\windows\system32\winrssrv.dll 2012-12-16 19:15 . 2012-12-16 19:15 108544 —-a-w- c:\windows\system32\wevtfwd.dll 2012-12-16 19:15 . 2012-12-16 19:15 106496 —-a-w- c:\windows\system32\winrscmd.dll 2012-12-16 19:15 . 2012-12-16 19:15 83456 —-a-w- c:\windows\system32\wecapi.dll 2012-12-16 19:15 . 2012-12-16 19:15 69632 —-a-w- c:\windows\system32\wbem\wbemcons.dll 2012-12-16 19:15 . 2012-12-16 19:15 630784 —-a-w- c:\windows\system32\WsmGCDeps.dll 2012-12-16 19:15 . 2012-12-16 19:15 60416 —-a-w- c:\windows\system32\WsmRes.dll 2012-12-16 19:15 . 2012-12-16 19:15 45568 —-a-w- c:\windows\system32\wbem\SMTPCons.dll 2012-12-16 19:15 . 2012-12-16 19:15 44544 —-a-w- c:\windows\system32\wbem\scrcons.exe 2012-12-16 19:15 . 2012-12-16 19:15 309248 —-a-w- c:\windows\system32\WsmWmiPl.dll 2012-12-16 19:15 . 2012-12-16 19:15 30720 —-a-w- c:\windows\system32\wsmprovhost.exe 2012-12-16 19:15 . 2012-12-16 19:15 28672 —-a-w- c:\windows\system32\WSManHTTPConfig.exe 2012-12-16 19:15 . 2012-12-16 19:15 2832384 —-a-w- c:\windows\system32\WsmSvc.dll 2012-12-16 19:15 . 2012-12-16 19:15 26112 —-a-w- c:\windows\system32\WsmAgent.dll 2012-12-16 19:15 . 2012-12-16 19:15 216576 —-a-w- c:\windows\system32\wecsvc.dll 2012-12-16 19:15 . 2012-12-16 19:15 204105 —-a-w- c:\windows\system32\winrm.vbs 2012-12-16 19:15 . 2012-12-16 19:15 195072 —-a-w- c:\windows\SysWow64\wbem\mofd.dll 2012-12-16 19:15 . 2012-12-16 19:15 13824 —-a-w- c:\windows\system32\wsmplpxy.dll 2012-12-16 19:15 . 2012-12-16 19:15 105472 —-a-w- c:\windows\system32\wecutil.exe 2012-12-16 19:15 . 2012-12-16 19:15 93184 —-a-w- c:\windows\SysWow64\wbem\WmiApRpl.dll 2012-12-16 19:15 . 2012-12-16 19:15 91136 —-a-w- c:\windows\SysWow64\wbem\wmiutils.dll 2012-12-16 19:15 . 2012-12-16 19:15 89088 —-a-w- c:\windows\SysWow64\mi.dll 2012-12-16 19:15 . 2012-12-16 19:15 88064 —-a-w- c:\windows\system32\wbem\WMICOOKR.dll 2012-12-16 19:15 . 2012-12-16 19:15 77824 —-a-w- c:\windows\SysWow64\wbem\WinMgmt.exe 2012-12-16 19:15 . 2012-12-16 19:15 73728 —-a-w- c:\windows\system32\wbem\xml\wmi2xml.dll 2012-12-16 19:15 . 2012-12-16 19:15 72192 —-a-w- c:\windows\SysWow64\wbem\WMICOOKR.dll 2012-12-16 19:15 . 2012-12-16 19:15 71168 —-a-w- c:\windows\system32\wbem\mofinstall.dll 2012-12-16 19:15 . 2012-12-16 19:15 64512 —-a-w- c:\windows\system32\wbem\wbemsvc.dll 2012-12-16 19:15 . 2012-12-16 19:15 59904 —-a-w- c:\windows\SysWow64\prvdmofcomp.dll 2012-12-16 19:15 . 2012-12-16 19:15 58368 —-a-w- c:\windows\system32\ncobjapi.dll 2012-12-16 19:15 . 2012-12-16 19:15 51712 —-a-w- c:\windows\system32\wbem\wmitimep.dll 2012-12-16 19:15 . 2012-12-16 19:15 49664 —-a-w- c:\windows\SysWow64\wbem\wbemsvc.dll 2012-12-16 19:15 . 2012-12-16 19:15 494592 —-a-w- c:\windows\system32\wbemcomn2.dll 2012-12-16 19:15 . 2012-12-16 19:15 48128 —-a-w- c:\windows\system32\PSModuleDiscoveryProvider.dll 2012-12-16 19:15 . 2012-12-16 19:15 46080 —-a-w- c:\windows\SysWow64\ncobjapi.dll 2012-12-16 19:15 . 2012-12-16 19:15 453120 —-a-w- c:\windows\system32\wbem\wbemess.dll 2012-12-16 19:15 . 2012-12-16 19:15 396288 —-a-w- c:\windows\system32\wbem\repdrvfs.dll 2012-12-16 19:15 . 2012-12-16 19:15 39424 —-a-w- c:\windows\system32\wbem\wbemprox.dll 2012-12-16 19:15 . 2012-12-16 19:15 31744 —-a-w- c:\windows\system32\wbem\WinMgmtR.dll 2012-12-16 19:15 . 2012-12-16 19:15 29184 —-a-w- c:\windows\SysWow64\wbem\wbemprox.dll 2012-12-16 19:15 . 2012-12-16 19:15 283136 —-a-w- c:\windows\SysWow64\wbem\esscli.dll 2012-12-16 19:15 . 2012-12-16 19:15 258048 —-a-w- c:\windows\system32\wbem\mofd.dll 2012-12-16 19:15 . 2012-12-16 19:15 247296 —-a-w- c:\windows\system32\framedynos.dll 2012-12-16 19:15 . 2012-12-16 19:15 22528 —-a-w- c:\windows\system32\wbem\mofcomp.exe 2012-12-16 19:15 . 2012-12-16 19:15 2048 —-a-w- c:\windows\system32\wbem\WmiApRes.dll 2012-12-16 19:15 . 2012-12-16 19:15 194560 —-a-w- c:\windows\system32\wbem\WmiApSrv.exe 2012-12-16 19:15 . 2012-12-16 19:15 192512 —-a-w- c:\windows\SysWow64\framedynos.dll 2012-12-16 19:15 . 2012-12-16 19:15 189952 —-a-w- c:\windows\SysWow64\framedyn.dll 2012-12-16 19:15 . 2012-12-16 19:15 18944 —-a-w- c:\windows\SysWow64\wbem\mofcomp.exe 2012-12-16 19:15 . 2012-12-16 19:15 172544 —-a-w- c:\windows\SysWow64\miutils.dll 2012-12-16 19:15 . 2012-12-16 19:15 12800 —-a-w- c:\windows\SysWow64\Register-CimProvider.exe 2012-12-16 19:15 . 2012-12-16 19:15 123904 —-a-w- c:\windows\SysWow64\wbem\WMIADAP.exe 2012-12-16 19:15 . 2012-12-16 19:15 857088 —-a-w- c:\windows\system32\wbem\fastprox.dll 2012-12-16 19:15 . 2012-12-16 19:15 79872 —-a-w- c:\windows\system32\wbem\WinMgmt.exe 2012-12-16 19:15 . 2012-12-16 19:15 79360 —-a-w- c:\windows\system32\prvdmofcomp.dll 2012-12-16 19:15 . 2012-12-16 19:15 74240 —-a-w- c:\windows\system32\wbem\NCProv.dll 2012-12-16 19:15 . 2012-12-16 19:15 724480 —-a-w- c:\windows\system32\wbem\WmiPrvSD.dll 2012-12-16 19:15 . 2012-12-16 19:15 636928 —-a-w- c:\windows\SysWow64\wbem\fastprox.dll 2012-12-16 19:15 . 2012-12-16 19:15 63488 —-a-w- c:\windows\SysWow64\wbem\xml\wmi2xml.dll 2012-12-16 19:15 . 2012-12-16 19:15 44544 —-a-w- c:\windows\system32\wbem\unsecapp.exe 2012-12-16 19:15 . 2012-12-16 19:15 432128 —-a-w- c:\windows\system32\wbem\WmiPrvSE.exe 2012-12-16 19:15 . 2012-12-16 19:15 401408 —-a-w- c:\windows\system32\wbem\esscli.dll 2012-12-16 19:15 . 2012-12-16 19:15 382464 —-a-w- c:\windows\SysWow64\wbemcomn2.dll 2012-12-16 19:15 . 2012-12-16 19:15 36352 —-a-w- c:\windows\SysWow64\PSModuleDiscoveryProvider.dll 2012-12-16 19:15 . 2012-12-16 19:15 328704 —-a-w- c:\windows\SysWow64\wbem\WmiPrvSE.exe 2012-12-16 19:15 . 2012-12-16 19:15 242688 —-a-w- c:\windows\system32\framedyn.dll 2012-12-16 19:15 . 2012-12-16 19:15 223232 —-a-w- c:\windows\system32\miutils.dll 2012-12-16 19:15 . 2012-12-16 19:15 219136 —-a-w- c:\windows\system32\wbem\WMIsvc.dll 2012-12-16 19:15 . 2012-12-16 19:15 214528 —-a-w- c:\windows\system32\wmitomi.dll 2012-12-16 19:15 . 2012-12-16 19:15 208384 —-a-w- c:\windows\system32\wbem\wbemtest.exe 2012-12-16 19:15 . 2012-12-16 19:15 180736 —-a-w- c:\windows\system32\wbem\WmiDcPrv.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{03EB0E9C-7A91-4381-A220-9B52B641CDB1}] 2013-01-11 02:54 1348416 —-a-w- c:\program files (x86)\IObit Apps Toolbar\IE\6.7\iobitappsToolbarIE.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}] 2012-12-12 10:48 87448 —-a-w- c:\program files (x86)\adawaretb\adawareDx.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{6c97a91e-4524-4019-86af-2aa2d567bf5c}"= "c:\program files (x86)\adawaretb\adawareDx.dll" [2012-12-12 87448] "{03EB0E9C-7A91-4381-A220-9B52B641CDB1}"= "c:\program files (x86)\IObit Apps Toolbar\IE\6.7\iobitappsToolbarIE.dll" [2013-01-11 1348416] . [HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}] . [HKEY_CLASSES_ROOT\clsid\{03eb0e9c-7a91-4381-a220-9b52b641cdb1}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-01 5629312] "ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2011-06-04 222496] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Ad-Aware Antivirus"="c:\program files (x86)\Ad-Aware Antivirus\AdAwareLauncher –windows-run" [X] "LenovoFSC"="c:\program files (x86)\Lenovo\FanSpeedControl\LenovoFSC.exe" [2009-07-29 49152] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896] "AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2012-12-11 3147384] "Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2012-12-11 542104] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "WLStart"="c:\program files (x86)\Windows Live\Installer\wlstart.exe" [2009-07-26 768336] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Best Buy pc app.lnk - c:\programdata\Best Buy pc app\ClickOnceSetup.exe [2010-10-26 9216] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux3"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0SmartDefragBootTime.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service] @="Ad-Aware Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc] @="Service" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" "HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-19 138576] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536] R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [2009-10-07 30232] R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2012-01-18 351136] R3 LVUVC64;Logitech HD Pro Webcam C920(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [2012-01-18 4865568] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-10-26 19456] R3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;c:\windows\system32\DRIVERS\Rtnic64.sys [2009-06-10 51712] R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-10-26 57856] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-17 1255736] R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster\Driver\WinRing0x64.sys [2010-11-01 14544] R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120] R4 DragonSvc;Dragon Service;c:\program files (x86)\Common Files\Nuance\dgnsvc.exe [2011-06-04 296808] R4 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2012-08-23 216080] R4 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-24 2735528] S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-10-15 63328] S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2012-09-21 225120] S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2012-11-16 111968] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-09-14 40800] S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys [2013-01-26 14456] S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [2010-11-27 17720] S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2012-10-22 154464] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-10-02 185696] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-09-21 200032] S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2011-08-11 91864] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-07-11 140672] S2 Ad-Aware Service;Ad-Aware Service;c:\program files (x86)\Ad-Aware Antivirus\AdAwareService.exe [2012-12-15 1236968] S2 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files (x86)\IObit\Advanced SystemCare 6\ASCService.exe [2013-01-16 465216] S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-16 5814904] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-05 822624] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-15 398184] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-15 682344] S2 SBAMSvc;Ad-Aware;c:\program files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [2012-09-20 3677000] S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-27 1153368] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-15 24176] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-06-26 219136] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-22 215040] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] S3 SuperIO;Lenovo ASD HWM Driver;c:\windows\system32\DRIVERS\spio.sys [2009-06-06 11848] . . — Other Services/Drivers In Memory — . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2013-02-02 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-26 01:53] . 2013-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-17 05:02] . 2013-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-17 05:02] . 2013-02-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3758289344-697551801-2976451627-1002Core.job - c:\users\Gina Hungerford\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-27 22:08] . 2013-02-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3758289344-697551801-2976451627-1002UA.job - c:\users\Gina Hungerford\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-27 22:08] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-05 8060960] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 417304] . ——- Supplementary Scan ——- . uStart Page = hxxp://search.yahoo.com?type=198484&fr=spigot-yhp-ie uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local Trusted Zone: san-diego.ca.us\mhmis.co TCP: DhcpNameServer = [removed] [removed] [removed] FF - ProfilePath - c:\users\Gina Hungerford\AppData\Roaming\Mozilla\Firefox\Profiles\etzq40d3.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com?type=198484&fr=spigot-yhp-ff FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=198484&p= FF - ExtSQL: 2013-01-25 18:23; {87934c42-161d-45bc-8cef-ef18abe2a30c}; c:\users\Gina Hungerford\AppData\Roaming\Mozilla\Firefox\Profiles\etzq40d3.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c} FF - ExtSQL: 2013-01-25 18:23; jid1-yZwVFzbsyfMrqQ@jetpack; c:\users\Gina Hungerford\AppData\Roaming\Mozilla\Firefox\Profiles\etzq40d3.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack FF - ExtSQL: 2013-01-28 08:04; [removed]; c:\program files (x86)\IObit Apps Toolbar\FF FF - ExtSQL: !HIDDEN! 2012-02-13 17:02; [removed]; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: network.http.max-connections - 48 FF - user.js: network.http.max-connections-per-server - 16 FF - user.js: network.http.max-persistent-connections-per-proxy - 16 FF - user.js: network.http.max-persistent-connections-per-server - 8 FF - user.js: browser.turbo.enabled - true FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.chrome.favicons - false FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: content.notify.ontimer - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 2250000 FF - user.js: content.switch.threshold - 750000 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run- - (no file) Notify-igfxcui - (no file) SafeBoot-mcmscsvc SafeBoot-MCODS Toolbar-Locked - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a, eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c "{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b, 27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b "{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54, 06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64 "{0347C33E-8762-4905-BF09-768834316C61}"=hex:51,66,7a,6c,4c,1d,38,12,50,c0,54, 07,50,c9,6b,0c,c0,1f,35,c8,31,6f,28,75 "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc, 1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7 "{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1, 38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4 "{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63, 57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b "{6EBF7485-159F-4BFF-A14F-B9E3AAC4465B}"=hex:51,66,7a,6c,4c,1d,38,12,eb,77,ac, 6a,ad,5b,91,0e,de,59,fa,a3,af,9a,02,4f "{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07, 72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57 "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b, ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3 "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd "{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be, f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95 "{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}"=hex:51,66,7a,6c,4c,1d,38,12,91,fc,ec, fb,7c,81,45,0a,c2,d4,4d,32,e4,48,ec,42 "{555D4D79-4BD2-4094-A395-CFC534424A05}"=hex:51,66,7a,6c,4c,1d,38,12,17,4e,4e, 51,e0,05,fa,05,dc,83,8c,85,31,1c,0e,11 . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:b6,21,c7,82,ba,06,cd,01 . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2b,dd,9e,d3,4e,04,46,4c,9a,a4,dd,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2b,dd,9e,d3,4e,04,46,4c,9a,a4,dd,\ . [HKEY_USERS\S-1-5-21-3758289344-697551801-2976451627-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-3758289344-697551801-2976451627-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe c:\program files (x86)\IObit\Advanced SystemCare 6\Monitor.exe c:\program files (x86)\IObit\Game Booster\gbtray.exe c:\program files (x86)\IObit\Smart Defrag 2\SmartDefrag.exe . ************************************************************************** . Completion time: 2013-02-02 10:02:50 - machine was rebooted ComboFix-quarantined-files.txt 2013-02-02 20:02 . Pre-Run: 897,392,697,344 bytes free Post-Run: 897,105,731,584 bytes free . - - End Of File - - 613773B8DFD9F8DE021B013B73E55CBE

Hi,

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click on Delete.
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

===================================================

Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right-mouse click JRT.exe and select Run as administrator
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message

===================================================

On your next reply please post :
Adwcleaner log
JRT log


Please STOP and let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

# AdwCleaner v2.109 - Logfile created 02/02/2013 at 23:38:26 # Updated 26/01/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Gina Hungerford - PC # Boot Mode : Normal # Running from : C:\Users\Gina Hungerford\Desktop\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Folder Deleted : C:\Program Files (x86)\adawaretb Folder Deleted : C:\ProgramData\blekko toolbars Folder Deleted : C:\Users\Gina Hungerford\AppData\LocalLow\adawaretb Folder Deleted : C:\Users\Gina Hungerford\AppData\LocalLow\Search Settings Folder Deleted : C:\Users\Gina Hungerford\AppData\LocalLow\ShoppingReport2 Folder Deleted : C:\Users\Gina Hungerford\AppData\Roaming\Mozilla\Firefox\Profiles\etzq40d3.default\adawaretb ***** [Registry] ***** Key Deleted : HKCU\Software\1ClickDownload Key Deleted : HKCU\Software\AppDataLow\Software\Mp3Tube Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings Key Deleted : HKCU\Software\AppDataLow\Software\ShoppingReport2 Key Deleted : HKCU\Software\Search Settings Key Deleted : HKLM\Software\AVG Secure Search Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Key Deleted : HKLM\Software\Iminent Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\Software\Search Settings Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C97A91E-4524-4019-86AF-2AA2D567BF5C} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B} Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{6C97A91E-4524-4019-86AF-2AA2D567BF5C}] ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 [OK] Registry is clean. -\\ Mozilla Firefox v11.0 (en-US) File : C:\Users\Gina Hungerford\AppData\Roaming\Mozilla\Firefox\Profiles\etzq40d3.default\prefs.js C:\Users\Gina Hungerford\AppData\Roaming\Mozilla\Firefox\Profiles\etzq40d3.default\user.js … Deleted ! [OK] File is clean. -\\ Google Chrome v24.0.1312.57 File : C:\Users\Gina Hungerford\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[S1].txt - [2809 octets] - [02/02/2013 23:38:26] ########## EOF - C:\AdwCleaner[S1].txt - [2869 octets] ########## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.6.2 (02.02.2013:2) OS: Windows 7 Home Premium x64 Ran by [removed] on Sat 02/02/2013 at 23:42:50.59 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_users\.default\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_users\s-1-5-18\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_users\s-1-5-19\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_users\s-1-5-20\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_users\S-1-5-21-3758289344-697551801-2976451627-1002\software\microsoft\internet explorer\searchscopes\\DefaultScope ~~~ Registry Keys Successfully deleted: [Registry Key] hkey_current_user\software\systweak Successfully deleted: [Registry Key] hkey_local_machine\software\systweak ~~~ Files Successfully deleted: [File] "C:\users\default user\start menu\programs\startup\best buy pc app.lnk" ~~~ Folders Failed to delete: [Folder] "C:\ProgramData\best buy pc app" Successfully deleted: [Folder] "C:\Users\Gina Hungerford\AppData\Roaming\systweak" Successfully deleted: [Folder] "C:\Users\Gina Hungerford\appdata\local\adawarebp" Successfully deleted: [Folder] "C:\Users\Gina Hungerford\appdata\local\best buy pc app" Successfully deleted: [Folder] "C:\Users\Gina Hungerford\appdata\locallow\oovootoolbar" Successfully deleted: [Folder] "C:\Program Files (x86)\w3i, llc" ~~~ FireFox Successfully deleted: [Folder] C:\Users\Gina Hungerford\AppData\Roaming\mozilla\firefox\profiles\etzq40d3.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack Failed to delete: [Folder] C:\Users\Gina Hungerford\AppData\Roaming\mozilla\firefox\profiles\etzq40d3.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c} ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Sat 02/02/2013 at 23:49:31.54 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~