What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Firefox constantly freezing, something to do with Feed Reader? [Solved

37 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello,

My computer is a pc laptop whilch has never been great, but has functioned pretty much ok for the 2-ish years that I have had it. Recently it has been constantly freezing while I have been trying to use Firefox, and I think it is related to Feedreader, which I have had installed for ages and has never given me any problems (Feedreader 3.14). I tried to uninstall FeedReader, but it won't fully un-install, saying "unins000.dat does not exist", and giving me another message on start up. I don't know if this is a virus issue or something else, but I have run the HiJack thing as specified here, and have cut and paste my log below:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:10:05, on 26/03/2013
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19401)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE
C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe
C:\Windows\System32\TpShocks.exe
C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE
C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE
C:\Program Files\Lenovo\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\FeedReader30\feedreader.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\Katerina\AppData\Local\Akamai\netsession_win.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Users\Katerina\AppData\Local\Akamai\netsession_win.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\PWMUIAux.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Katerina\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://kingscollege.blackboard.com/webct/l…djavaerror.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Password Manager Browser Helper Object - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe /r
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
O4 - HKLM\..\Run: [LENOVO.TPFNF6R] C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [FingerPrintSoftware] "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [LPMailChecker] C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Lenovo\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [Message Center Plus] C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe /start
O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BTVLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [CreateLMBCShortCut] "C:\Program Files\Lenovo\Mobile Broadband Connect\UserShortcutCreator.exe"
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWlIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWlIcon.exe
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [egui] "c:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
O4 - HKLM\..\Run: [Bing Bar] "C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [feedreader.exe] "C:\Program Files\FeedReader30\feedreader.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Katerina\AppData\Local\Akamai\netsession_win.exe"
O4 - Startup: L'atelier des Chefs.lnk = C:\Program Files\L'atelier des Chefs\L'atelier des Chefs.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device… - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device… - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: Lenovo Password Manager… - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: AD Monitor (ADMonitor) - Unknown owner - C:\Windows\system32\ADMonitor.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Alps Application Launcher Service (ApRunSvc) - Unknown owner - C:\Program Files\Apoint2K\ApRunSvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AuthenTec Fingerprint Service (ATService) - AuthenTec, Inc. - C:\Windows\system32\AtService.exe
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Data Transfer Service (dtsvc) - Unknown owner - C:\Windows\system32\DTS.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - c:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - c:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\Windows\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: Power Manager DBC Service - Lenovo - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - C:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\Windows\System32\TPHDEXLG.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - Lenovo - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: uvnc_service - UltraVNC - C:\Program Files\runPCrun Total Support\vnc\winvnc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 14806 bytes

Many thanks in advance if you can help me to sort this out, it is driving me nuts, as I am having to do an emergency re-start (unplug and take out battery) many many times per day.
Post #2
PS: Apologies in advance if I can't reply immediately, the problems I am having have been so bad, I can not get online properly for hours and hours at a time……
Post #3
Hello inkster and :welcome:

My name is JonTom

  • Malware Logs can sometimes take a lot of time to research and interpret.
  • Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  • PLEASE NOTE: If you do not reply after 3 days your thread will be closed.

Lets take a closer look at your machine with the following scans:

  • Please perform the following scan


    • Please download DDS from here and save it to your desktop.
    • Disable any script blocking protection (How to Disable your Security Programs)
    • Right click on the DDS icon and select "Run as Administrator" to run the tool (may take up to 3 minutes to run).
    • When done, DDS.txt will open.
    • After a few moments, attach.txt will open in a second window.
    • Save both reports to your desktop.
    • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.

  • aswMBR


    • Download aswMBR.exe to your desktop.
    • Double click the aswMBR.exe to run it.
    • When asked if you want to download Avast's virus definitions please select Yes.
    • Click the "Scan" button to start scan.

    [external image: Posted Image]

    • On completion of the scan click save log, save it to your desktop and post in your next reply.

    [external image: Posted Image]

    Please post both DDS logs and the aswMBR log in your next reply.
Post #4
Hello JonTom, Thanks so much for your reply and for taking the time to help me….. I am really grateful! I have downloaded and run the scans as you asked, and here are the logs, cut and pasted: DDS. DDS (Ver_2012-11-20.01) - NTFS_x86 Internet Explorer: 8.0.6001.19401 BrowserJavaVersion: 1.6.0_29 Run by [removed] at 18:50:09 on 2013-03-30 Microsoft® Windows Vista™ Business 6.0.6002.2.1252.44.1033.18.3065.934 [GMT 0:00] . AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5} SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\DTS.exe C:\Windows\system32\ibmpmsvc.exe C:\Windows\system32\AtService.exe C:\Windows\system32\Ati2evxx.exe C:\Program Files\Apoint2K\ApRunSvc.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\system32\WLANExt.exe C:\Windows\System32\spoolsv.exe C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe C:\Program Files\Apoint2K\Apoint.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe c:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Intel\WiFi\bin\EvtEng.exe C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe C:\Program Files\runPCrun Total Support\vnc\winvnc.exe C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\System32\TpShocks.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE C:\Program Files\Lenovo\Drag-to-Disc\DrgToDsc.exe C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe C:\Windows\System32\rundll32.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe C:\Program Files\Lenovo\Client Security Solution\cssauth.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\runPCrun Total Support\vnc\winvnc.exe C:\Program Files\Lenovo\System Update\SUService.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\FeedReader30\feedreader.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Users\Katerina\AppData\Local\Akamai\netsession_win.exe C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Users\Katerina\AppData\Local\Akamai\netsession_win.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\Windows\system32\taskeng.exe C:\PROGRA~1\ThinkPad\UTILIT~1\PWMUIAux.exe C:\Windows\system32\SearchProtocolHost.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Windows\servicing\TrustedInstaller.exe c:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe C:\Windows\System32\TPHDEXLG.exe C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe C:\Program Files\Mozilla Firefox\firefox.exe c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k bthsvcs C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation . ============== Pseudo HJT Report =============== . uStart Page = hxxp://kingscollege.blackboard.com/webct/logonDisplay.dowebct?insId=20830&glcid;=137.73.2.51-1103039060259-2000821000&insName;=King%27s0College0London0e-Learning0Service&loginpage;=customkclinstitutionentrywithlogin-addjavaerror.html BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Spybot-S&D; IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Windows Live Toolbar Helper: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\program files\windows live toolbar\msntb.dll BHO: IePasswordManagerHelper Class: {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: Windows Live Toolbar: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\program files\windows live toolbar\msntb.dll TB: Windows Live Toolbar: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\program files\windows live toolbar\msntb.dll TB: @c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll uRun: [feedreader.exe] "c:\program files\feedreader30\feedreader.exe" uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [MobileDocuments] c:\program files\common files\apple\internet services\ubd.exe uRun: [Akamai NetSession Interface] "c:\users\katerina\appdata\local\akamai\netsession_win.exe" mRun: [EZEJMNAP] c:\progra~1\thinkpad\utilit~1\EzEjMnAp.Exe mRun: [TPFNF7] c:\program files\lenovo\npdirect\TPFNF7SP.exe /r mRun: [TpShocks] TpShocks.exe mRun: [TPHOTKEY] c:\program files\lenovo\hotkey\TPOSDSVC.exe mRun: [LENOVO.TPFNF6R] c:\program files\lenovo\hotkey\TPFNF6R.exe mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [FingerPrintSoftware] "c:\program files\lenovo fingerprint software\fpapp.exe" \s mRun: [TVT Scheduler Proxy] c:\program files\common files\lenovo\scheduler\scheduler_proxy.exe mRun: [LPManager] c:\progra~1\thinkv~1\prdctr\LPMGR.exe mRun: [LPMailChecker] c:\progra~1\thinkv~1\prdctr\LPMLCHK.exe mRun: [RoxioDragToDisc] "c:\program files\lenovo\drag-to-disc\DrgToDsc.exe" mRun: [Message Center Plus] c:\program files\lenovo\message center plus\MCPLaunch.exe /start mRun: [PWMTRV] rundll32 c:\progra~1\thinkpad\utilit~1\PWMTR32V.DLL,PwrMgrBkGndMonitor mRun: [BLOG] rundll32 c:\progra~1\thinkpad\utilit~1\BTVLogEx.DLL,StartBattLog mRun: [CreateLMBCShortCut] "c:\program files\lenovo\mobile broadband connect\UserShortcutCreator.exe" mRun: [ACTray] c:\program files\thinkpad\connectutilities\ACTray.exe mRun: [ACWlIcon] c:\program files\thinkpad\connectutilities\ACWlIcon.exe mRun: [cssauth] "c:\program files\lenovo\client security solution\cssauth.exe" silent mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe mRun: [Bing Bar] "c:\program files\msn toolbar\platform\5.0.1449.0\mswinext.exe" mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume mRun: [Autodesk Sync] c:\program files\autodesk\autodesk sync\AdSync.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" StartupFolder: c:\users\katerina\appdata\roaming\micros~1\windows\startm~1\programs\startup\l'atel~1.lnk - c:\program files\l'atelier des chefs\L'atelier des Chefs.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-Explorer: NoDrives = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: DisableCAD = dword:1 IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200 IE: E&xport; to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth; Device… - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth; Device… - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll IE: {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . . INFO: HKLM has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . TCP: NameServer = 192.168.0.1 TCP: Interfaces\{049789CE-B3CC-4919-9E17-DD3E1FA222F9} : DHCPNameServer = 192.168.0.1 TCP: Interfaces\{DD5C9873-A429-436D-8B57-F475BCEACECC} : DHCPNameServer = 192.168.0.1 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg . ================= FIREFOX =================== . FF - ProfilePath - c:\users\katerina\appdata\roaming\mozilla\firefox\profiles\wmnr2a3x.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.guardian.co.uk/ FF - component: c:\users\katerina\appdata\roaming\mozilla\firefox\profiles\wmnr2a3x.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - component: c:\users\katerina\appdata\roaming\mozilla\firefox\profiles\wmnr2a3x.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_6_602_180.dll FF - ExtSQL: !HIDDEN! 2009-08-27 16:33; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension . ============= SERVICES / DRIVERS =============== . R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [2013-3-21 102008] R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2009-1-29 20520] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-14 107256] R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2008-10-23 13480] R1 RapportCerberus_51755;RapportCerberus_51755;c:\programdata\trusteer\rapport\store\exts\rapportcerberus\baseline\RapportCerberus32_51755.sys [2013-3-29 317112] R1 RapportEI;RapportEI;c:\program files\trusteer\rapport\bin\RapportEI.sys [2013-3-21 102680] R1 RapportPG;RapportPG;c:\program files\trusteer\rapport\bin\RapportPG.sys [2013-3-21 173880] R2 ApRunSvc;Alps Application Launcher Service;c:\program files\apoint2k\ApRunSvc.exe [2009-7-2 36864] R2 ATService;AuthenTec Fingerprint Service;c:\windows\system32\AtService.exe [2008-10-27 1676536] R2 Autodesk Content Service;Autodesk Content Service;c:\program files\autodesk\content service\Connect.Service.ContentService.exe [2012-1-31 19232] R2 dtsvc;Data Transfer Service;c:\windows\system32\DTS.exe [2008-10-27 98304] R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-5-14 731840] R2 epfwwfpr;epfwwfpr;c:\windows\system32\drivers\epfwwfpr.sys [2009-5-14 93312] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-9-14 47640] R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2009-7-2 66848] R2 RapportMgmtService;Rapport Management Service;c:\program files\trusteer\rapport\bin\RapportMgmtService.exe [2013-3-21 1124184] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-8-16 1153368] R2 TPHKSVC;On Screen Display;c:\program files\lenovo\hotkey\TPHKSVC.exe [2009-5-15 62320] R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\lenovo\rescue and recovery\rrpservice.exe [2008-5-24 520192] R2 uvnc_service;uvnc_service;c:\program files\runpcrun total support\vnc\winvnc.exe [2009-8-27 1519168] R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [2008-10-27 482176] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-2 181760] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2009-7-2 29736] R3 MUXMP;My WiFi PAN MUX-IM Virtual Miniport Driver;c:\windows\system32\drivers\mux.sys [2009-2-9 29232] R3 mv2;mv2;c:\windows\system32\drivers\mv2.sys [2009-8-27 11712] R3 NETw5v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\system32\drivers\NETw5v32.sys [2009-2-9 3715072] R3 RapportIaso;RapportIaso;c:\programdata\trusteer\rapport\store\exts\rapportms\baseline\RapportIaso.sys [2012-5-20 55448] R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2008-2-22 37312] S1 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [2009-7-2 48192] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\lenovo\hotkey\micmute.exe [2009-5-15 45424] S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-11-10 374152] S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944] S3 ADMonitor;AD Monitor;c:\windows\system32\ADMonitor.exe [2008-10-27 106496] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-3-21 40776] S3 MUXP;My WiFi PAN Mux-IM Protocol Driver;c:\windows\system32\drivers\mux.sys [2009-2-9 29232] S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\intel\wifi\bin\PanDhcpDns.exe [2009-2-11 204800] S3 RoxMediaDB10;RoxMediaDB10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxMediaDB10.exe [2008-4-25 1120752] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S4 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\lenovo\rescue and recovery\UpdateMonitor.exe [2008-5-24 360448] . =============== File Associations =============== . FileExt: .scr: AutoCADScriptFile=c:\windows\system32\notepad.exe "%1" . =============== Created Last 30 ================ . 2013-03-30 09:57:08 60872 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{be6c25d2-f7f8-4a2a-acbf-dd3b5230a174}\offreg.dll 2013-03-29 20:12:45 7108640 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{be6c25d2-f7f8-4a2a-acbf-dd3b5230a174}\mpengine.dll 2013-03-21 21:55:49 ——– d—–w- C:\B 2013-03-21 09:04:42 102008 —-a-w- c:\windows\system32\drivers\RapportKELL.sys 2013-03-21 00:03:04 40776 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2013-03-20 21:37:40 15872 —-a-w- c:\windows\system32\drivers\usb8023.sys 2013-03-20 21:02:29 ——– d—–w- C:\A 2013-03-12 09:31:36 96664 —-a-w- c:\program files\mozilla firefox\webapprt-stub.exe 2013-03-08 10:59:07 ——– d—–w- c:\program files\Mozilla Firefox(0) 2013-03-07 11:59:55 ——– d—–w- c:\program files\iPod 2013-03-07 11:59:53 ——– d—–w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1 2013-03-07 11:59:53 ——– d—–w- c:\program files\iTunes . ==================== Find3M ==================== . 2013-03-13 14:52:35 73432 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-03-13 14:52:35 693976 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2013-02-28 02:49:23 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2013-02-02 09:18:13 916480 —-a-w- c:\windows\system32\wininet.dll 2013-02-02 09:12:40 43520 —-a-w- c:\windows\system32\licmgr10.dll 2013-02-02 09:12:13 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2013-02-02 09:11:58 71680 —-a-w- c:\windows\system32\iesetup.dll 2013-02-02 09:11:58 109056 —-a-w- c:\windows\system32\iesysprep.dll 2013-02-02 07:37:34 385024 —-a-w- c:\windows\system32\html.iec 2013-02-02 05:52:40 133632 —-a-w- c:\windows\system32\ieUnatt.exe 2013-01-17 01:28:58 232336 ——w- c:\windows\system32\MpSigStub.exe 2013-01-05 05:26:01 3602808 —-a-w- c:\windows\system32\ntkrnlpa.exe 2013-01-05 05:26:01 3550072 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-01-04 11:28:18 905576 —-a-w- c:\windows\system32\drivers\tcpip.sys 2013-01-04 01:38:50 2048512 —-a-w- c:\windows\system32\win32k.sys . ============= FINISH: 18:52:30.77 =============== Attach: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft® Windows Vista™ Business Boot Device: \Device\HarddiskVolume1 Install Date: 02/07/2009 22:03:01 System Uptime: 30/03/2013 18:39:46 (0 hours ago) . Motherboard: LENOVO | | 27327KG Processor: Intel® Core™2 Duo CPU P8700 @ 2.53GHz | None | 2533/266mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 287 GiB total, 120.601 GiB free. E: is CDROM () Q: is FIXED (NTFS) - 10 GiB total, 3.22 GiB free. S: is FIXED (NTFS) - 1 GiB total, 0.691 GiB free. . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP796: 25/03/2013 23:24:05 - Scheduled Checkpoint RP797: 26/03/2013 21:20:50 - Windows Update RP798: 27/03/2013 23:14:15 - Scheduled Checkpoint RP799: 28/03/2013 11:31:39 - Scheduled Checkpoint RP801: 29/03/2013 19:54:26 - Installed Rapport RP802: 30/03/2013 10:42:45 - Scheduled Checkpoint . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) 2007 Microsoft Office system 32 Bit HP CIO Components Installer Access Help Acrobat.com Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Adobe Reader 9.2 Akamai NetSession Interface Apple Application Support Apple Mobile Device Support Apple Software Update AT&T; Service Activation ATI Catalyst Install Manager ATI Uninstaller AutoCAD 2009 - English Autodesk Content Service Autodesk Content Service Language Pack Autodesk Material Library 2013 Autodesk Material Library Base Resolution Image Library 2013 Autodesk Sync BBC iPlayer Desktop Bing Bar Bing Bar Platform BlackBerry Desktop Software 7.0 Bonjour bpd_scan Business Contact Manager for Outlook 2007 SP2 Camera Center Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization Chinese Standard Catalyst Control Center Localization Chinese Traditional Catalyst Control Center Localization Dutch Catalyst Control Center Localization French Catalyst Control Center Localization German Catalyst Control Center Localization Italian Catalyst Control Center Localization Japanese Catalyst Control Center Localization Korean Catalyst Control Center Localization Portuguese Catalyst Control Center Localization Spanish Catalyst Control Center Localization Swedish ccc-core-static ccc-utility CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Dutch CCC Help English CCC Help French CCC Help German CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Portuguese CCC Help Spanish CCC Help Swedish Client Security - Password Manager Conexant HD Audio DocProc Drag-to-Disc ESET NOD32 Antivirus FeedReader Help Center Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) iCloud Integrated Camera Intel PROSet Wireless Intel® Management Engine Interface Intel® PROSet/Wireless WiFi Software InterVideo Register Manager InterVideo WinDVD iTunes Java Auto Updater Java™ 6 Update 29 Lenovo Fingerprint Software Lenovo Registration Lenovo System Interface Driver Lenovo System Toolbox Lenovo Welcome Malwarebytes Anti-Malware version 1.70.0.1100 Message Center Message Center Plus Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Default Manager Microsoft Office 2003 Web Components Microsoft Office 2007 Primary Interop Assemblies Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Professional Hybrid 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Small Business Connectivity Components Microsoft Office Suite Activation Assistant Microsoft Office Word MUI (English) 2007 Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft SQL Server 2005 Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) Microsoft SQL Server Native Client Microsoft SQL Server Setup Support Files (English) Microsoft SQL Server VSS Writer Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Mobile Broadband Connect Mozilla Firefox 19.0 (x86 en-GB) Mozilla Maintenance Service MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) OCR Software by I.R.I.S. 12.0 OGA Notifier 2.0.0048.0 On Screen Display Pando Picasa 3 Presentation Director Product Recovery Disc Burning Utility Productivity Center Supplement for ThinkPad QuickTime Rapport Registry patch for Windows Vista USB S3 PM Enablement Registry patch of Changing Timing of IDLE IRP by Finger Print Driver for Windows Vista Registry Patch of Enabling Device Initiated Power Management(DIPM) on SATA for Windows Vista Registry patch to improve USB device detection on resume from sleep for Windows Vista Repronet Rescue and Recovery RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.02 RICOH R5U230 Media Driver ver.2.02.02.01 Roxio Activation Module Roxio Central Audio Roxio Central Copy Roxio Central Core Roxio Central Data Roxio Central Tools Roxio Creator Business Edition Roxio Express Labeler 3 runPCrun 'Total Support' Version 7.01 Silent Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Security Update for Microsoft .NET Framework 4 Extended (KB2736428) Security Update for Microsoft .NET Framework 4 Extended (KB2742595) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition Skins Skype web features Skype™ 5.10 Sonic CinePlayer Decoder Pack Sonic Icons for Lenovo Spybot - Search & Destroy System Update ThinkPad Bluetooth with Enhanced Data Rate Software ThinkPad EasyEject Utility ThinkPad FullScreen Magnifier ThinkPad Mobility Center Customization ThinkPad Modem Adapter ThinkPad Power Management Driver ThinkPad Power Manager ThinkPad UltraNav Driver ThinkPad UltraNav Utility ThinkVantage Access Connections ThinkVantage Active Protection System ThinkVantage Productivity Center ThinkVantage Status Gadget Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2768024) 32-Bit Edition Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) VBA (2627.01) Verizon Wireless Mobile Broadband Self Activation Wallpapers Windows Driver Package - AuthenTec Inc. (ATSwpWDF) Biometric (10/02/2008 8.1.2.37) Windows Driver Package - Broadcom (b57nd60x) Net (11/29/2007 10.62.1.2) Windows Driver Package - Intel (iaStor) hdc (02/11/2009 8.8.0.1009) Windows Driver Package - Intel hdc (02/20/2008 6.9.1.1001) Windows Driver Package - Intel System (01/30/2008 8.6.1.1001) Windows Driver Package - Intel System (02/20/2008 8.6.1.1002) Windows Driver Package - Intel System (02/20/2008 8.7.0.1007) Windows Driver Package - Intel System (09/15/2006 7.0.0.1011) Windows Driver Package - Intel USB (02/05/2007 8.3.0.1011) Windows Driver Package - Lenovo 1.53 (03/19/2009 1.53) Windows Driver Package - Ricoh Company MMC Host Controller (02/15/2008 6.00.03.05) Windows Driver Package - Ricoh Company MS Host Controller (07/30/2007 6.00.01.11) Windows Driver Package - Ricoh Company xD Host Controller (07/30/2007 6.00.01.13) Windows Live ID Sign-in Assistant Windows Live Toolbar Yahoo! Detect . ==== Event Viewer Messages From Past Week ======== . 30/03/2013 18:44:05, Error: Service Control Manager [7000] - The Windows Font Cache Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 30/03/2013 18:44:04, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Font Cache Service service to connect. 30/03/2013 18:41:08, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: tvtumon 30/03/2013 18:41:02, Error: Service Control Manager [7023] - The Lenovo Microphone Mute service terminated with the following error: The system cannot find the file specified. 30/03/2013 18:41:02, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the LMIGuardianSvc service to connect. 30/03/2013 18:41:02, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 30/03/2013 18:41:02, Error: Service Control Manager [7000] - The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the file specified. 30/03/2013 18:41:02, Error: Service Control Manager [7000] - The LMIGuardianSvc service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 30/03/2013 18:40:40, Error: EventLog [6008] - The previous system shutdown at 18:18:56 on 30/03/2013 was unexpected. 30/03/2013 10:06:22, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period. 30/03/2013 09:31:04, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the IviRegMgr service to connect. 30/03/2013 09:31:04, Error: Service Control Manager [7000] - The IviRegMgr service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 30/03/2013 09:27:25, Error: EventLog [6008] - The previous system shutdown at 09:25:28 on 30/03/2013 was unexpected. 29/03/2013 23:16:40, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the btwdins service. 29/03/2013 23:16:10, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Dnscache service. 29/03/2013 20:05:20, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service. 29/03/2013 20:04:50, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TrkWks service. 29/03/2013 19:53:01, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Adobe Flash Player Update Service service to connect. 29/03/2013 19:53:01, Error: Service Control Manager [7000] - The Adobe Flash Player Update Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 29/03/2013 19:51:25, Error: EventLog [6008] - The previous system shutdown at 19:49:31 on 29/03/2013 was unexpected. 28/03/2013 20:00:02, Error: EventLog [6008] - The previous system shutdown at 19:58:15 on 28/03/2013 was unexpected. 28/03/2013 19:58:15, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the netprofm service. 28/03/2013 19:15:59, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TBS service. 28/03/2013 19:15:29, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the W32Time service. 28/03/2013 19:14:59, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the FDResPub service. 28/03/2013 19:13:59, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanWorkstation service. 28/03/2013 16:36:40, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft Software Shadow Copy Provider service to connect. 28/03/2013 16:36:40, Error: Service Control Manager [7000] - The Microsoft Software Shadow Copy Provider service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 28/03/2013 16:34:08, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service swprv with arguments "" in order to run the server: {65EE1DBA-8FF4-4A58-AC1C-3470EE2F376A} 28/03/2013 11:32:15, Error: Service Control Manager [7034] - The Access Connections Main Service service terminated unexpectedly. It has done this 1 time(s). 28/03/2013 09:32:31, Error: EventLog [6008] - The previous system shutdown at 09:30:29 on 28/03/2013 was unexpected. 27/03/2013 21:55:40, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Eventlog service. 26/03/2013 23:35:43, Error: Service Control Manager [7016] - The Data Transfer Service service has reported an invalid current state 0. 25/03/2013 20:25:26, Error: Service Control Manager [7010] - A timeout (30000 milliseconds) was reached while waiting for ReadFile. 25/03/2013 20:09:35, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect. 25/03/2013 20:06:31, Error: EventLog [6008] - The previous system shutdown at 19:19:00 on 25/03/2013 was unexpected. 24/03/2013 17:18:21, Error: EventLog [6008] - The previous system shutdown at 17:14:40 on 24/03/2013 was unexpected. 23/03/2013 20:13:58, Error: EventLog [6008] - The previous system shutdown at 20:11:05 on 23/03/2013 was unexpected. 23/03/2013 14:24:25, Error: EventLog [6008] - The previous system shutdown at 14:22:44 on 23/03/2013 was unexpected. . ==== End Of File =========================== aswMBR aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software Run date: 2013-03-30 18:57:23 —————————– 18:57:23.215 OS Version: Windows 6.0.6002 Service Pack 2 18:57:23.215 Number of processors: 2 586 0x170A 18:57:23.217 ComputerName: KATRINA-PC UserName: Katerina 18:57:26.563 Initialize success 19:01:39.543 AVAST engine defs: 13033000 19:02:08.968 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 19:02:08.973 Disk 0 Vendor: FUJITSU_ 0084 Size: 305245MB BusType: 3 19:02:09.219 Disk 0 MBR read successfully 19:02:09.225 Disk 0 MBR scan 19:02:09.284 Disk 0 unknown MBR code 19:02:09.323 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 1500 MB offset 2048 19:02:09.366 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 293742 MB offset 3074048 19:02:09.422 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 10000 MB offset 604659712 19:02:09.453 Disk 0 scanning sectors +625139712 19:02:09.665 Disk 0 scanning C:\Windows\system32\drivers 19:02:36.305 Service scanning 19:03:25.093 Modules scanning 19:04:02.959 Disk 0 trace - called modules: 19:04:03.329 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys 19:04:03.335 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8c756ac8] 19:04:03.344 3 CLASSPNP.SYS[903198b3] -> nt!IofCallDriver -> [0x8b161b48] 19:04:03.355 5 acpi.sys[8fc976bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8b192028] 19:04:05.635 AVAST engine scan C:\Windows 19:04:30.348 AVAST engine scan C:\Windows\system32 19:12:22.806 AVAST engine scan C:\Windows\system32\drivers 19:13:10.913 AVAST engine scan C:\Users\Katerina 19:14:24.119 Disk 0 MBR has been saved successfully to "C:\Users\Katerina\Desktop\MBR.dat" 19:14:24.129 The log file has been saved successfully to "C:\Users\Katerina\Desktop\aswMBR.txt" Am now terrified that system will freeze before I have the chance to hit post, so will sign out now! Many thanks….. inkster
Post #5
Hello inkster

Thank you for the logs.

There is nothing obvious jumping out from your system logs, which means we need to do a little more digging.

Besides Firefox freezing is the machine displaying any other symptoms (browser redirects, error messages, popups etc)?

Before we deal with your Feedreader issue, I would like to make sure that there are no malware issues that need our attention.

May I ask if you recognise the the following folders on your machine:

C:\B

C:\A

Are these something that you created yourself?


I would also like to take a closer look at the following file:


  • Please scan the following file


  • Please go to VirusTotal


  • On the page you'll find a "Choose File" button.
  • Click on the Choose File button.
  • In the File Upload window which opens, copy and paste this into the File Name box.


c:\program files\l'atelier des chefs\L'atelier des Chefs.exe


  • Next, click the Open button.
  • Then click the "Scan it" button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File has already been analyzed: click Reanalyze file now.
  • Once scanned, copy and paste the link to the results page in your next reply.

Please describe any other symptoms that are being displayed by the machine, let me know about the folders and post the link to the virus total results page in your next reply :)
Post #6
Hello JonTom, Thanks so much for your prompt reply. I'll do the scans you asked, but re: C:\A and C:\B, I have no idea what they are, I didn't create anything myself. Will re-scan the atelier des chefs thing, but it was a download I did about a year ago (some pop-up recipe thing), which I haven't used for ages. Should probably get rid of it. Re: other problems with the computer, I had a problem with some malware a year or so ago, with a google re-direct going on, but I managed to sort it out with some help from this forum (or one like it). My current problem is the computer freezing constantly (usually when in firefox), plus feed reader pop up messages on start up. One is "ATOM.XSL file not found" and another is if I ever try to uninstall Feedreader, I get "unin000.dat does not exist, Cannot uninstall". Beyond that, it is SLOW and freezes. Have never been able to defragment without the system freezing. I think I have to unplug my computer and remove the battery many many times per day, and I never know how long the computer will function for before freezing. Will scan now and post. Many thanks again.
Post #7
Hi there, I cannot get the VirusTotal to work…. I have done what you said, but it just pops up a message saying: "Path does not exist. Check the path and try again" I tried to find the L'Atelier des Chefs folder in the C drive and Program Files, but I can't find it……. so sorry.
Post #9
Hello inkster

C:\ A and C:\B are both empty folders by the way…..

Thanks for letting me know. There is no harm in double checking (see below).

I tried to find the L'Atelier des Chefs folder in the C drive and Program Files, but I can't find it……. so sorry

Not a problem. Lets inspect the contents of those folders and search for the file to be on the safe side:


  • Please download SystemLook by JPShortstuff


    • Please download SystemLook by JPShortstuff by clicking here or here and save the file (called SystemLook.exe) to your desktop.
    • Right click on SystemLook.exe and select "Run as Administrator" to run the program.
    • Copy the content of the following codebox into the main textfield:

    :filefind
*L'atelier des Chefs*

:dir
C:\B /s 
C:\A /s

    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    • Note: The log can also be found on your Desktop entitled SystemLook.txt

  • Junkware Removal Tool

    Please download Junkware Removal Tool by clicking here and save it to your desktop.

    • Shutdown your antivirus to avoid any conflicts.
    • Double click JRT.exe to run the tool.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

  • MalwareBytes AntiMalware:


    • I can see that you have MBAM installed.
    • Double click on your MalwareBytes AntiMalware icon to launch the program.
    • Click on the "Update" tab and then on "Check for Updates".
    • The program will now install the latest Malware definition files.
    • Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
    • Once the program has scanned your computer, a log file will be created in Notepad.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.


    • If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
    • The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
    • Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
    • Come back here to this thread and Paste the log in your next reply.

    Please post the Systemlook log along with the JRT and MBAM logs in your next reply.
Post #10
Many thanks JonTom, Ok, all scanned. System Look log first: SystemLook 30.07.11 by jpshortstuff Log created at 23:20 on 30/03/2013 by Katerina Administrator - Elevation successful ========== filefind ========== Searching for "*L'atelier des Chefs*" C:\Users\Katerina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\L'atelier des Chefs.lnk –a—- 908 bytes [12:25 13/01/2012] [09:22 21/06/2012] DC380DABD258C998EB6CFE71CE0453C1 ========== dir ========== C:\B - Parameters: "/s" —Files— None found. No folders found. C:\A - Parameters: "/s" —Files— None found. No folders found. -= EOF =- Junkware: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.7.6 (03.30.2013:2) OS: Windows Vista ™ Business x86 Ran by [removed] on 30/03/2013 at 23:25:35.18 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\DisplayName Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\URL Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\DisplayName Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\URL ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox Successfully deleted: [File] C:\Users\Katerina\AppData\Roaming\mozilla\firefox\profiles\wmnr2a3x.default\invalidprefs.js Successfully deleted the following from C:\Users\Katerina\AppData\Roaming\mozilla\firefox\profiles\wmnr2a3x.default\prefs.js user_pref("google.toolbar.button_option.cached.gtbSearchBlogs", "
Post #11
Hello inkster

Thank you for the logs.

JRT has removed a few bits and pieces associated with your Firefox browser. Is Firefox still freezing?

There is not a great deal of information relating to the file we searched for using systemlook. I would like to have the file scanned using virutotal just to be sure (if you run into any problems with the scan just let me know):

  • Please scan the following file


    • Please go to VirusTotal


    • On the page you'll find a "Choose File" button.
    • Click on the Choose File button.
    • In the File Upload window which opens, copy and paste this into the File Name box.


    C:\Users\Katerina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\L'atelier des Chefs.lnk


    • Next, click the Open button.
    • Then click the "Scan it" button just below.
    • This will scan the file. Please be patient.
    • If you get a message saying File has already been analyzed: click Reanalyze file now.
    • Once scanned, copy and paste the link to the results page in your next reply.

  • Please update your Java


    • To update your Java, Click on the "Windows Orb" then on "Control Panel" and then on the Java icon (looks like a coffee cup).
    • In the window that opens, click on the "Update" tab, and then on "Update Now".
    • Your Java should begin to update. Please follow any prompts that you receive.


    Lets take a look at your machine with an online scan to check if there is anything lurking in the shadows:

  • BitDefender


    • Lets perform an online scan with BitDefender QuickScan.
    • Please be patient as scanning can take some time.
    • We recommend that you disable any real time protection that you have before starting the scan.
    • Click here here to access the BitDefender QuickScan page

    • For Firefox users:
    • Click on the Free Scan Now button.
    • You will be prompted to install a plug-in. Please Allow the installation.
    • If the process stalls you may need to refresh the page.
    • A Software Installation window will appear.
    • Click on Install Now and the plugin will be installed as an Add-on.
    • Restart Firefox when done. Go back to the BitDefender QuickScan page again and click on Free Scan Now and proceed accordingly.

    • For Internet Explorer users:
    • Click on the Free Scan Now button.
    • You will be prompted to install an ActiveX control. Please allow the control to install.
    • The page will refresh. Click on the Free Scan Now button again and proceed accordingly.


    • When scan has completed, click on View report and a Notepad log will open.
    • If ant malware has been detected, you will receive a warning and the link to the report will be displayed as the number of infections. Click on it.
    • Post the contents of this report in your next reply.
    • The reports can also be found by navigating to C:\Documents and Settings\\Application Data\QuickScan, (where "" is the Windows log-in name).

    Please post the link to the virus total results page in your next reply along with the BitDefender log :)
Post #12
Hi JonTom, Many thanks for continuing to help me on a sunday! I have tried to follw all instructions, but unfortunately I got the same result with Virustotal as before. Same pop up message again about how the path does not exist. So, none the wiser re: that I'm afraid. I updated my Java, so that's fine, and did the Bit Defender scan, which told me I was all clear. Log below: QuickScan 32-bit v0.9.9.119 ————————— Scan date: Sun Mar 31 17:26:30 2013 Machine ID: 8E027F1D No infection found. ——————- Processes ——— 2007 Microsoft Office system 5236 C:\Program Files\Microsoft Office\Office12\WINWORD.EXE Adobe Reader and Acrobat Manager 2992 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe Akamai NetSession Client 1292 C:\Users\Katerina\AppData\Local\Akamai\netsession_win.exe Akamai NetSession Client 1304 C:\Users\Katerina\AppData\Local\Akamai\netsession_win.exe Bing Bar 3116 C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe Bluetooth Software 5960 C:\Program Files\ThinkPad\Bluetooth Software\BTStackServer.exe Bluetooth Software 2980 C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe Catalyst Control Centre 3904 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe Catalyst Control Centre 3728 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe Client Security Solution 4072 C:\Program Files\Lenovo\Client Security Solution\cssauth.exe Digital Line Detection 3808 C:\Program Files\Digital Line Detect\DLG.exe Drag-to-Disc 3540 C:\Program Files\Lenovo\Drag-to-Disc\DrgToDsc.exe ESET Smart Security 2508 C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe feedreader.exe 1912 C:\Program Files\FeedReader30\feedreader.exe Firefox 6332 C:\Program Files\Mozilla Firefox\firefox.exe Firefox 6020 C:\Program Files\Mozilla Firefox\plugin-container.exe iTunes 1336 C:\Program Files\iTunes\iTunesHelper.exe Message Center Plus 3580 C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe Microsoft® Windows® Operating System 2656 C:\Windows\explorer.exe Microsoft® Windows® Operating System 3628 C:\Windows\System32\rundll32.exe Microsoft® Windows® Operating System 2600 C:\Windows\System32\taskeng.exe Microsoft® Windows® Operating System 5740 C:\Windows\System32\wbem\unsecapp.exe On screen display 4192 C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe On screen display 3452 C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe Power Manager 1012 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMUIAux.EXE Presentation Director 3320 C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe RIMBBLaunchAgent 3108 C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe scheduler_proxy Application 3516 C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe ThinkPad EasyEject Utility 3168 C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE ThinkPad FnF6 Resident Module 3480 C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe ThinkPad UltraZoom 4300 C:\Program Files\Lenovo\ZOOM\TpScrex.exe ThinkVantage Access Connections 3976 C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe ThinkVantage Access Connections 4064 C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe ThinkVantage Active Protection System 3444 C:\Windows\System32\TpShocks.exe ThinkVantage Productivity Center 3524 C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE ThinkVantage Productivity Center 3532 C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE (verified) Microsoft® Windows® Operating System 480 C:\Program Files\Windows Media Player\wmpnscfg.exe (verified) Microsoft® Windows® Operating System 2584 C:\Windows\System32\dwm.exe Network activity —————- Process netsession_win.exe (1304) connected on port 443 (HTTP over SSL) –> [removed] Process firefox.exe (6332) connected on port 80 (HTTP) –> [removed] Process firefox.exe (6332) connected on port 80 (HTTP) –> [removed] Process firefox.exe (6332) connected on port 80 (HTTP) –> [removed] Process firefox.exe (6332) connected on port 80 (HTTP) –> [removed] Process netsession_win.exe (1304) listens on ports: 49180 Autoruns and critical files ————————— Adobe Acrobat C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe Adobe Reader and Acrobat Manager C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe Akamai NetSession Client C:\Users\Katerina\AppData\Local\Akamai\netsession_win.exe Apple Push C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe Autodesk Windows Components C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe Bing Bar C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe BTVLOGEX.DLL C:\Program Files\ThinkPad\Utilities\BTVLOGEX.DLL Catalyst® Control Center C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe Client Security Solution C:\Program Files\Lenovo\Client Security Solution\cssauth.exe Default Manager C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe Digital Line Detection C:\Program Files\Digital Line Detect\DLG.exe Drag-to-Disc C:\Program Files\Lenovo\Drag-to-Disc\DrgToDsc.exe ESET Smart Security C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe feedreader.exe C:\Program Files\FeedReader30\feedreader.exe iTunes C:\Program Files\iTunes\iTunesHelper.exe Java™ Platform SE Auto Updater 2 0 C:\Program Files\Common Files\Java\Java Update\jusched.exe Lenovo Fingerprint C:\Program Files\Lenovo Fingerprint Software\fpapp.exe Message Center Plus C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe Microsoft® Windows® Operating System C:\Windows\system32\BROWSEUI.dll Microsoft® Windows® Operating System C:\Windows\system32\logon.scr On screen display C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe Presentation Director C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe QuickTime C:\Program Files\QuickTime\QTTask.exe RIMBBLaunchAgent C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe scheduler_proxy Application C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe ThinkPad EasyEject Utility C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE ThinkPad FnF6 Resident Module C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe ThinkPad Power Manager C:\Program Files\ThinkPad\Utilities\PWMTR32V.DLL ThinkVantage Access Connections C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe ThinkVantage Access Connections C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe ThinkVantage Active Protection System C:\Windows\System32\TpShocks.exe ThinkVantage Productivity Center C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE ThinkVantage Productivity Center C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE UserShortcutCreator C:\Program Files\Lenovo\Mobile Broadband Connect\UserShortcutCreator.exe (verified) Microsoft® Windows® Operating System C:\Program Files\Windows Media Player\wmpnscfg.exe (verified) Microsoft® Windows® Operating System c:\windows\system32\userinit.exe (verified) Windows® Internet Explorer c:\windows\system32\webcheck.dll Browser plugins ————— Bing Bar c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll Bitdefender QuickScan C:\Users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll Bonjour C:\Program Files\Bonjour\mdnsNSP.dll frozen.dll C:\Users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll googletoolbar-ff3.dll C:\Users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll googletoolbar-ff4.dll C:\Users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff4.dll i-drop control C:\Windows\Downloaded Program Files\IDrop.ocx i-drop control C:\Windows\Downloaded Program Files\IDropENU.dll InstallShield Update Service C:\Windows\Downloaded Program Files\dwusplay.exe Java Deployment Toolkit 7.0.170.2 C:\Windows\system32\npDeployJava1.dll Java™ Platform SE 7 U17 c:\program files\java\jre7\bin\jp2ssv.dll Java™ Platform SE 7 U17 C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll Java™ Platform SE 7 U17 c:\program files\java\jre7\bin\ssv.dll Microsoft Search Enhancement Pack c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll Microsoft® Windows Live ID c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll Microsoft® Windows® Operating System C:\Windows\system32\wshbth.dll npitunes.dll C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll NPSWF32_11_6_602_180.dll C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll NPWebSLLauncher.dll C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll Password Manager c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll Picasa C:\Program Files\Google\Picasa3\npPicasa3.dll QuickTime Plug-in 7.7.3 C:\Program Files\Internet Explorer\plugins\npqtplugin.dll QuickTime Plug-in 7.7.3 C:\Program Files\Internet Explorer\plugins\npqtplugin2.dll QuickTime Plug-in 7.7.3 C:\Program Files\Internet Explorer\plugins\npqtplugin3.dll QuickTime Plug-in 7.7.3 C:\Program Files\Internet Explorer\plugins\npqtplugin4.dll QuickTime Plug-in 7.7.3 C:\Program Files\Internet Explorer\plugins\npqtplugin5.dll QuickTime Plug-in 7.7.3 C:\Program Files\Internet Explorer\plugins\npqtplugin6.dll QuickTime Plug-in 7.7.3 C:\Program Files\Internet Explorer\plugins\npqtplugin7.dll QuickTime Plug-in 7.7.3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll QuickTime Plug-in 7.7.3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll QuickTime Plug-in 7.7.3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll QuickTime Plug-in 7.7.3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll QuickTime Plug-in 7.7.3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll QuickTime Plug-in 7.7.3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll QuickTime Plug-in 7.7.3 C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll SDHelper.dll C:\Program Files\Spybot - Search & Destroy\SDHelper.dll Silverlight Plug-In c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll Software Manager C:\Windows\Downloaded Program Files\isusweb.dll Windows Live Toolbar c:\program files\windows live toolbar\msntb.dll Windows Presentation Foundation c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll Windows® Internet Explorer C:\Windows\system32\ieframe.dll (verified) AcroIEHelperShim Library c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll (verified) Adobe Acrobat C:\Program Files\Internet Explorer\plugins\nppdf32.dll (verified) Adobe Acrobat C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll (verified) InstallShield Update Service C:\Windows\Downloaded Program Files\dwusplay.dll (verified) Microsoft® Windows® Operating System C:\Windows\System32\mswsock.dll (verified) Microsoft® Windows® Operating System C:\Windows\system32\napinsp.dll (verified) Microsoft® Windows® Operating System C:\Windows\system32\NLAapi.dll (verified) Microsoft® Windows® Operating System C:\Windows\system32\pnrpnsp.dll (verified) Microsoft® Windows® Operating System C:\Windows\System32\winrnr.dll Missing files ————- File not found: C:\Program Files\Common Files\Apple\Internet Services\ubd.exe –> HKCU\Software\Microsoft\Windows\CurrentVersion\Run\"MobileDocuments" File not found: C:\Program Files\LogMeIn\x86\LogMeInSystray.exe –> HKLM\Software\Microsoft\Windows\CurrentVersion\Run\"LogMeIn GUI" Scan —- MD5: 55de6e658bc63b862af0d31340484db1 C:\Program Files\Apoint2K\ApRunSvc.exe MD5: 0a7977ff7535f237c8c745ae09887c35 C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll MD5: d68018aebb6226bca5103da8b66a57d6 C:\Program Files\ATI Technologies\ATI.ACE\Core-Implementation\32\wbhelp2.dll MD5: 22218a3c73a237ea228a83a372d72f06 C:\Program Files\ATI Technologies\ATI.ACE\Core-Implementation\32\wbocx.ocx MD5: 25ca1677aaa3cdc99cd4fcf940886f3c C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe MD5: e1e71d80d078c576801b6fe2a29fcf85 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MD5: a28de8e4eb7641639f68c62a32264578 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0709.dll MD5: dab3b370e0c2815fdf5b29204b8fb984 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0712.dll MD5: 7f9a009e33940087fde0fa25d8aa5706 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0804.dll MD5: e681281d9bfc9d45d3b72532717e5880 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe MD5: 904e116925920bbd1f8a1a7e9d82ba57 C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe MD5: f431dc5d94f4b2fdbc927655d8a9b10e C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe MD5: 40947436a70e0034e41123df5a0a7702 C:\Program Files\Bonjour\mdnsNSP.dll MD5: db5bea73edaf19ac68b2c0fad0f92b1a C:\Program Files\Bonjour\mDNSResponder.exe MD5: 46da8e7484ac7a52ce1d6e428398724b C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe MD5: f6fd367c9eaaedf90cd7a7952ae0b336 C:\Program Files\Common Files\Apple\Apple Application Support\ASL.dll MD5: af54247f97ccf3539de7505c09972ff9 C:\Program Files\Common Files\Apple\Apple Application Support\CFNetwork.dll MD5: ef8cd3c64ee9c08980d6d06ccce46c68 C:\Program Files\Common Files\Apple\Apple Application Support\CoreFoundation.dll MD5: 149d74e1128a86dc9cfb2851fbea11eb C:\Program Files\Common Files\Apple\Apple Application Support\icudt46.dll MD5: ff9831030678c7b6d70bac00f68f8976 C:\Program Files\Common Files\Apple\Apple Application Support\libdispatch.dll MD5: 5a963c340de1a01ba6e24945ce05d16a C:\Program Files\Common Files\Apple\Apple Application Support\libicuin.dll MD5: f4bc62990e7e5c29799a895b80fc3177 C:\Program Files\Common Files\Apple\Apple Application Support\libicuuc.dll MD5: 5e33c164dc7fa74728d8a83036c438bb C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll MD5: 78865abc5f5d13190f8b35bd9044714a C:\Program Files\Common Files\Apple\Apple Application Support\objc.dll MD5: 8ba9851e671e8b5e49e303748ffd530c C:\Program Files\Common Files\Apple\Apple Application Support\SQLite3.dll MD5: 2e14406e05789f91c9282ae7cfca3a07 C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll MD5: 4fe5c6d40664ae07be5105874357d2ed C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe MD5: 37cf3324f46ceb3a4f2686c617cbb35c C:\Program Files\Common Files\Apple\Mobile Device Support\iTunesMobileDevice.dll MD5: 079743d98028dbd026344c2e1d40da20 C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll MD5: ea2d28bbe98256654397cd1f6eaebdd8 C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe MD5: e96f286c1340e7cc5e5eb4eb6aabe328 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe MD5: 213822072085b5bbad9af30ab577d817 C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe MD5: 12916e0642e92561c98b18a2a2d01b14 C:\Program Files\Common Files\Java\Java Update\jusched.exe MD5: 8b960d3ddf3ef6c0931f04a7d41dccdb c:\Program Files\Common Files\Lenovo\CDRecord.dll MD5: 5c6b04c03ba45788269e71e1242deed0 C:\Program Files\Common Files\Lenovo\rr_res.dll MD5: 7ed8c3c6ef0d5bbb5f2b93a293d5371b C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe MD5: 58bc366538a8a1f252d2750c1f5193b6 c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe MD5: 1c7b8e69bf9557a17a17f2120892acf9 c:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe MD5: 8d2d2ca912977fbacd8728d38ee9d635 c:\Program Files\Common Files\Lenovo\tvt_think_res.dll MD5: c58eeed6b1d7287d0789395151b5ea8e C:\Program Files\Common Files\Lenovo\ui.dll MD5: acefeea621dca62efb7a7eea59f5e91b C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe MD5: 938acf2a4f7fdaff322fd36f0b14d45a C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll MD5: d34e343bb5237fc28cae6ec1efb5a0cb C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll MD5: 4c5d603a632023bfdb8edd4436882abf C:\Program Files\Common Files\Microsoft Shared\office12\1033\MSOINTL.DLL MD5: 7043d485aeae435312659ff1461f1491 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll MD5: c7d010bd8bcef2eb3fca8f7cd3c08d9f C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSORES.DLL MD5: 8fa9a16022a664f536b616130b2ea866 C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL MD5: 785f487a64950f3cb8e9f16253ba3b7b C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE MD5: 4a1b8af97e3b0aef8be1b8684277200b C:\Program Files\Common Files\Microsoft Shared\OFFICE12\OGL.DLL MD5: 1a8b4857f2caaed89e16b1ed1f24930d C:\Program Files\Common Files\Microsoft Shared\office12\riched20.dll MD5: c2b290ce6b81520b96377e890f4c021c C:\Program Files\Common Files\Microsoft Shared\PROOF\1033\MSGR3EN.DLL MD5: b64d8a3f75c4ab72242910d9f4bbeb75 C:\Program Files\Common Files\microsoft shared\VBA\VBA6\1033\VBE6INTL.DLL MD5: eafef8a6a14b024c5f97d00d0d501078 C:\Program Files\Common Files\microsoft shared\VBA\VBA6\VBE6.DLL MD5: 3ffec3f15ca9dd4363d531a7c5ea8847 C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll MD5: cdb517386a26ae420cb24bdb3cd88779 C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe MD5: eb9eeb379848f356797eb9ef31114ca5 C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe MD5: 1d0063597c3666404fcf97698abeb019 C:\Program Files\Common Files\SureThing Shared\stllssvr.exe MD5: cb1135906d951b574f9f2498be8f11f9 C:\Program Files\Digital Line Detect\BVRPDIAG.dll MD5: f03ffc962e18f36a922e61f96be09925 C:\Program Files\Digital Line Detect\DLG.exe MD5: 07835fd7fad7e0bb3399d402fb36d318 c:\Program Files\ESET\ESET NOD32 Antivirus\DMON.dll MD5: 03b1dc67f343bf2af8cfec3dca09c943 C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe MD5: b7cf6b7178d76c578526db48a6f5d629 c:\Program Files\ESET\ESET NOD32 Antivirus\eguiDmon.dll MD5: b263c9365e54bc997e82aaa767696224 c:\Program Files\ESET\ESET NOD32 Antivirus\eguiScan.dll MD5: f314e446d35945c87c1ba0ac363f8fc4 c:\Program Files\ESET\ESET NOD32 Antivirus\eguiUpdate.dll MD5: 5e245b6c66122614000addfcd41cedce c:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe MD5: a5f63285c1b6c4b396d9ace0dffc88ef c:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe MD5: 126fdf15e14c9d22ea05eef60d7a3b6b C:\Program Files\FeedReader30\fbclient.dll MD5: 7c153262faa390c3f9b82b2d98b541c7 C:\Program Files\FeedReader30\feedreader.exe MD5: 1f1d4da7024cc82e9b58d82f7def5228 C:\Program Files\FeedReader30\icudt30.dll MD5: 6be2075b0abed383ccd6d40649ecb37d C:\Program Files\FeedReader30\icuuc30.dll MD5: 6b171450e38c8569da7258fee21e7d17 C:\Program Files\Google\Picasa3\npPicasa3.dll MD5: a1390c15f217204039f34c595dbd5087 C:\Program Files\Intel\WiFi\bin\EvtEng.exe MD5: c3dece7a0e627750de6b1a27427589c1 C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Internet Explorer\plugins\npqtplugin.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Internet Explorer\plugins\npqtplugin2.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Internet Explorer\plugins\npqtplugin3.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Internet Explorer\plugins\npqtplugin4.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Internet Explorer\plugins\npqtplugin5.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Internet Explorer\plugins\npqtplugin6.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Internet Explorer\plugins\npqtplugin7.dll MD5: e46b17060d3962a384ae484094614788 C:\Program Files\iPod\bin\iPodService.exe MD5: 5082bc510fad849630d09da626bb7cda C:\Program Files\iTunes\iTunesHelper.dll MD5: 8e2a7f1f62467a7dcb8ab2c0642f47ca C:\Program Files\iTunes\iTunesHelper.exe MD5: be643cd44dd06da283634a3e51dc22bc C:\Program Files\iTunes\iTunesHelper.Resources\en.lproj\iTunesHelperLocalized.DLL MD5: afeeafd7cf8ed6958a81acc304c17b7d C:\Program Files\iTunes\iTunesHelper.Resources\iTunesHelper.DLL MD5: 425c4b729a3f64da998051704710c5ab C:\Program Files\iTunes\iTunesMiniPlayer.dll MD5: bff00fac50ed60ecf5efa3e582ec4dca C:\Program Files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll MD5: 0e4c325892d0baf59c9378cb579cc594 C:\Program Files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll MD5: f00a0ef5835e1b96f783d617f1948704 C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll MD5: 27861540f6a834218c9ed6e2fe75e32b c:\program files\java\jre7\bin\jp2ssv.dll MD5: 05c4a7136f3012bb47107333b5d351d3 C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll MD5: 0e0d229cc5ad08adb848878fd167e0c5 c:\program files\java\jre7\bin\ssv.dll MD5: b925cbcfe418354563a10513f3735e10 C:\Program Files\Lenovo Fingerprint Software\atcssint.dll MD5: cbaa5e5db607e081bdf306a4369a84d3 C:\Program Files\Lenovo Fingerprint Software\fpapp.exe MD5: ceb62fb5862e33e0d3b97223be68f797 C:\Program Files\Lenovo Fingerprint Software\FPResource.dll MD5: 42dfcb8ce6a13cad1dc1415982ab9db8 C:\Program Files\Lenovo Fingerprint Software\SharedResources.dll MD5: acb708030799a6e6de2bfb051f909b9b C:\Program Files\Lenovo\Client Security Solution\css_banner.dll MD5: 4dc5bfff231567c9a565582db81b1ef6 C:\Program Files\Lenovo\Client Security Solution\CSS_Enroll.dll MD5: 146d36b9966679971ed46c952d9cb123 C:\Program Files\Lenovo\Client Security Solution\css_strings.dll MD5: 890d35248db52b3c0e54f0daa3aa9db0 C:\Program Files\Lenovo\Client Security Solution\css_think_res.dll MD5: 91cfbfc27586db0ee3ae5e324583f910 C:\Program Files\Lenovo\Client Security Solution\cssauth.exe MD5: b49af6ecdeaf8e9ffcfb7ddff3597dad C:\Program Files\Lenovo\Client Security Solution\cssdlgpwentry.dll MD5: 1f39f9748702a259891e220de7c099df C:\Program Files\Lenovo\Client Security Solution\csswait.dll MD5: d00c5cd4a5de3561398dd0d6795d7a28 C:\Program Files\Lenovo\Client Security Solution\dlganswerprompt.dll MD5: 2373713da0d182338ce33e2d9bec8302 c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll MD5: ddd4a2c9a37b93c7d8a539f785572565 C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe MD5: a977cc9b5f403f34f3e5d25fa473fb80 C:\Program Files\Lenovo\Drag-to-Disc\AS_Storage_w32.dll MD5: 9c0a88418ffd5ddabc1b61642ed72a35 C:\Program Files\Lenovo\Drag-to-Disc\D2DRes.dll MD5: 84de627927756582f4054f99caeed757 C:\Program Files\Lenovo\Drag-to-Disc\DrgToDsc.exe MD5: 513140dfe5141b38a84bc222dd2a9720 C:\Program Files\Lenovo\Drag-to-Disc\Shellex.dll MD5: 0c65f30754ffb4f9e0f90646f8f0b10a C:\Program Files\Lenovo\Drag-to-Disc\ShellRes.dll MD5: f10454a577c8fb6cc529fdffb7b04e9f C:\Program Files\Lenovo\HOTKEY\hkvolkey.dll MD5: 02d0de905a7d32e38496853a94bbdd5c C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe MD5: 33fd3fa73602a600fdb2d4b655903454 C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe MD5: bd87cdc95d68a096268a3efac6c2fe5d C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe MD5: 80ba4aa7cd6d3f9089f91fe34c9108fa C:\Program Files\Lenovo\HOTKEY\tplhmm.dll MD5: 72d9419e4aa1c40c9e34821722d335c8 C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe MD5: d120ef4faed8e6717b87f496fcb41778 C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.dll MD5: 0bf10b23779565bc472beebe3b9a20d9 C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe MD5: 3b376496187ab240fac6ecd7bd1251f6 C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe MD5: c8875dd29c3c1d12b8d8c9c54028f55d C:\Program Files\Lenovo\Mobile Broadband Connect\UserShortcutCreator.exe MD5: a2a81da5512b8f8e4aaea1c60a6ab76d C:\Program Files\Lenovo\NPDIRECT\tpfnf7.dll MD5: 2c91d88b381255ff292139bf3595e42f C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe MD5: 9222dcbb608bc93654abe004b0b10ecf C:\Program Files\Lenovo\Rescue and Recovery\rnr_think_res.dll MD5: 1a9f115d6f82fc0753d06599e42b2295 C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe MD5: 43ffbb6af7245c97865ada74b8ceecf9 C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe MD5: 22a001f3fbb92e3811c3bfd8fdad3ed3 C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe MD5: b71a41cad9de92219c3891e88f822ac3 C:\Program Files\Lenovo\System Update\SUService.exe MD5: df0b028bfc3394dd4f625cdc8adf7dcc C:\Program Files\Lenovo\ZOOM\TpScrex.exe MD5: beda81549fce5fe29fae11dd9a616541 C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe MD5: 0c21724a6923c85d1282821dfc48b71e C:\Program Files\Microsoft Office\Office12\1033\mapir.dll MD5: bef1ead605cf791fdbb48add71075509 C:\Program Files\Microsoft Office\Office12\1033\wwintl.dll MD5: 7e28af47dd4e878271abcae01071fa07 C:\Program Files\Microsoft Office\Office12\MSOHEV.DLL MD5: da79517783552b80229705d9720b8e8d C:\Program Files\Microsoft Office\Office12\msproof6.dll MD5: 3a9fba6005bc10ef8d1e61b9fe589505 C:\Program Files\Microsoft Office\OFFICE12\NLSDATA0009.DLL MD5: 1a514ca70e5faf1cec2f51cdab1367a7 C:\Program Files\Microsoft Office\OFFICE12\NLSLEXICONS0009_SP.dll MD5: 707f023159b541ead5dd6adb2e605443 C:\Program Files\Microsoft Office\OFFICE12\NLSMODELS0009.dll MD5: 2c6e01c2269cd4306ad2bc070a2a68f8 C:\Program Files\Microsoft Office\Office12\oart.dll MD5: b6fcab5092be93ba44daddf8c42e1295 C:\Program Files\Microsoft Office\Office12\olmapi32.dll MD5: 6c8c001ef62cefa7e333af8d0aaed564 C:\Program Files\Microsoft Office\Office12\WINWORD.EXE MD5: 18a67cd5082f436d28dd8007cc4a46b6 C:\Program Files\Microsoft Office\Office12\wwlib.dll MD5: 7c986d3ead437eab009303c69d5eb883 c:\Program Files\Microsoft Silverlight\5.1.20125.0\agcore.dll MD5: 5ebe62dcb077433f8888f9c76d3260c4 c:\Program Files\Microsoft Silverlight\5.1.20125.0\coreclr.dll MD5: b40ca4d4df3a021f26958f2d159d19df c:\Program Files\Microsoft Silverlight\5.1.20125.0\mscorrc.dll MD5: a5c14075b571af1c9592595be724d9d2 c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll MD5: bc5dadaca526f7373e55ca76fdd1ea20 C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmHistoryAddin.dll MD5: 6163664c7e9cd110af70180c126c3fdc C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe MD5: ddfd18ffe503e8aaa5badc6676bfef47 C:\Program Files\Microsoft Small Business\Business Contact Manager\en-US\BcmHistoryAddin.resources.dll MD5: 1d89eb4e2a99cabd4e81225f4f4c4b25 c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe MD5: 86ebd8b1f23e743aad21f4d5b4d40985 c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe MD5: d89083c4eb02daca8f944b0e05e57f9d c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe MD5: 837608240884733792ddae81e50b802a c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe MD5: 9ed4f1d990a3d16112155ea2d50e7975 C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe MD5: 47841291844818781acf852a53827668 C:\Program Files\Mozilla Firefox\components\browsercomps.dll MD5: bf2f2717c13a4bd4fd73f2788534e86b C:\Program Files\Mozilla Firefox\firefox.exe MD5: d308812a7e0ca64e03f1c2c13339f984 C:\Program Files\Mozilla Firefox\freebl3.dll MD5: 03932120e012bf53ff588ec0410a601e C:\Program Files\Mozilla Firefox\gkmedias.dll MD5: a7e1f254d94c4568ade17e6a727ed649 C:\Program Files\Mozilla Firefox\mozalloc.dll MD5: 0a98f5d9f6552fdf3682240714e33f9f C:\Program Files\Mozilla Firefox\mozglue.dll MD5: 8c23d9ab3a680def91a35e655c4fcff3 C:\Program Files\Mozilla Firefox\mozjs.dll MD5: de2af12f6dd62f9c25f00f72cd7776c8 C:\Program Files\Mozilla Firefox\mozsqlite3.dll MD5: 03e9314004f504a14a61c3d364b62f66 C:\Program Files\Mozilla Firefox\MSVCP100.dll MD5: 67ec459e42d3081dd8fd34356f7cafc1 C:\Program Files\Mozilla Firefox\MSVCR100.dll MD5: abbc87352226a6afffe5d6b9dbe40f7f C:\Program Files\Mozilla Firefox\nspr4.dll MD5: 4ad8996ab41b575e2b3af80972aab989 C:\Program Files\Mozilla Firefox\nss3.dll MD5: 04a40046f2f711c830d915dc33ec2a7d C:\Program Files\Mozilla Firefox\nssckbi.dll MD5: be89dc812651d88552a9587f70f63dd3 C:\Program Files\Mozilla Firefox\nssdbm3.dll MD5: 048081d7089297474681385b8e7cadda C:\Program Files\Mozilla Firefox\nssutil3.dll MD5: bd79e872c8cd7098e8d4c7613d01437c C:\Program Files\Mozilla Firefox\plc4.dll MD5: e4f52ab15a3a077b2a3ad96ec892568a C:\Program Files\Mozilla Firefox\plds4.dll MD5: aa6844a5127ed4b20df6d313467b929d C:\Program Files\Mozilla Firefox\plugin-container.exe MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll MD5: 419680fce774976fd752eb425d91aedf C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll MD5: a7be481fe1396ad5658044baad6a5824 C:\Program Files\Mozilla Firefox\smime3.dll MD5: 6f89c374cc912745afeddd4b88cbdba5 C:\Program Files\Mozilla Firefox\softokn3.dll MD5: 0a002104133543f74c83abb455d86e85 C:\Program Files\Mozilla Firefox\ssl3.dll MD5: 1b96e5ec91baa3ab68ecc47174cffbe4 C:\Program Files\Mozilla Firefox\xpcom.dll MD5: 9fa46e0424cdab6ee85c92271d02faa1 C:\Program Files\Mozilla Firefox\xul.dll MD5: 8a7c8f4c713e70d73946833d76b77035 C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe MD5: 3723bee455a04038b039a712115c4cf7 C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe MD5: 2c485862f252b9bdcc765d2791fd6331 c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll MD5: 6cf7d6119fc02fcc558866d1d5ccc182 C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\XmlLite.dll MD5: 8dda2b606279753601f9415da503ca63 C:\Program Files\QuickTime\QTTask.exe MD5: 61a66b66f46a60842d0e40ff241b5b11 C:\Program Files\runPCrun Total Support\vnc\winvnc.exe MD5: f07af60b152221472fbdb2fecec4896d C:\Program Files\Skype\Updater\Updater.exe MD5: 1f247e2047031785741e5d1412af3454 C:\Program Files\ThinkPad\Bluetooth Software\BtAudioHelper.dll MD5: 8147d9eb65526289a96f515458d4e75d C:\Program Files\ThinkPad\Bluetooth Software\BtBalloon.dll MD5: 53918ebf3d2e4cace8d0379066608d54 C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll MD5: 43f9c09e66a9df296e5db72a977f2451 C:\Program Files\ThinkPad\Bluetooth Software\btmmhook.dll MD5: 964052150d66e18b74e421ec33dec580 C:\Program Files\ThinkPad\Bluetooth Software\btncopy.dll MD5: e666425e7a24ffefa9f40bef63c76a3c C:\Program Files\ThinkPad\Bluetooth Software\btosif.dll MD5: d0e09ad0400608c73f7b19ddd8d2b93f C:\Program Files\ThinkPad\Bluetooth Software\btosif_notes.dll MD5: bf9115e2492cc76f5bb67406017185d1 C:\Program Files\ThinkPad\Bluetooth Software\btosif_ol.dll MD5: 6f360234909de2fec57943843ff8c230 C:\Program Files\ThinkPad\Bluetooth Software\btosif_olx.dll MD5: b35417763d234059312145c2654e59e9 C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll MD5: f0e1a57874ad29d45d2b05b3c39ad663 C:\Program Files\ThinkPad\Bluetooth Software\btsendto.dll MD5: 6d88c6e3ed30c390d08bd1556ed9ce71 C:\Program Files\ThinkPad\Bluetooth Software\btsendto_office.dll MD5: f9f52eeddda343e07d45cbc73d269b78 C:\Program Files\ThinkPad\Bluetooth Software\BTStackServer.exe MD5: 6fc492b8769b6e7f0c0dc216c62d9494 C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe MD5: 2239b2f69015f332dbce6f085d99e5ec C:\Program Files\ThinkPad\Bluetooth Software\btwapi.dll MD5: 07737cbab6f60ca9f404bf77559a475e C:\Program Files\ThinkPad\Bluetooth Software\BtwCP.DLL MD5: e44620bec545debf36432d22b7216915 C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe MD5: 1c1bd2077a4584767165daedf7624070 C:\Program Files\ThinkPad\Bluetooth Software\BtWdSdk.dll MD5: 39e901aafcabba137310563d45323ed0 C:\Program Files\ThinkPad\Bluetooth Software\btwhidcs.DLL MD5: 1434dc1478242cfb64fe3cf10ee3f3ef C:\Program Files\ThinkPad\ConnectUtilities\AcCryptHlpr.dll MD5: 719c4d5f613843327fd530f421d90833 C:\Program Files\ThinkPad\ConnectUtilities\ACGUIHlpr.dll MD5: b39e1b558c808246c38d51a1cc514095 C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll MD5: f6a5468a9ee839486ae5c106133b9144 C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll MD5: df340cfabe3826c86d677aa7a7485bb4 C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgr.dll MD5: 4e5259a546cf671021e9d222501cdc7c C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe MD5: 966c52f0d83ebb13c58b1caeeb44a7f0 C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe MD5: ac6d215e3c6d525555aaec97fab4fd1e C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll MD5: 1ae35d9739ca48e09a04f0afa3f0ca11 C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe MD5: a37fdaa1c6cfb6c159106291828f0d48 C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe MD5: 12f8cb899b4c14b76ecd251986362788 C:\Program Files\ThinkPad\ConnectUtilities\MFC71U.DLL MD5: 7aae766e1e7164c864bf613d56c20456 C:\Program Files\ThinkPad\ConnectUtilities\Res\US\GUIHlprRes.dll MD5: 0c1f8125c32d3e78be42aa657075761c C:\Program Files\ThinkPad\ConnectUtilities\Res\US\IconRes.dll MD5: 68d881ea4403eb684b5d487507179162 C:\Program Files\ThinkPad\ConnectUtilities\Res\US\TrayRes.dll MD5: 46372afd062e1017c6c919915d81d111 C:\Program Files\ThinkPad\TpShocks\MUI\0409\TpShocks.dll MD5: f3c09488ee827f0b8b926b9303b92f39 C:\Program Files\ThinkPad\Utilities\ATM.DLL MD5: 1ad2d87782d1d02d74311c9f7f1174c1 C:\Program Files\ThinkPad\Utilities\BTVLOGEX.DLL MD5: 8fec0f6d006909e97cef014dfa637514 C:\Program Files\ThinkPad\Utilities\en-US\PWMUIAux.resources.dll MD5: 13ff0c420aeceb92fb0ad83a9a11a977 C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE MD5: b18abbed1e74ba2cf36be2a78d6d0386 C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE MD5: b86f25b20bc926f0d50290491b43c71c C:\Program Files\ThinkPad\Utilities\PWMIF32V.DLL MD5: 570e550583c44629636d36e16f9c67ea C:\Program Files\ThinkPad\Utilities\PWMTR32V.DLL MD5: 61153b3cf2da386b84abea36921246f8 C:\Program Files\ThinkPad\Utilities\PWMUIAux.EXE MD5: 6ef142dbebc3c2720e139436b772b336 C:\Program Files\ThinkPad\Utilities\PWMUICtl.dll MD5: d090ed8dcb321eb0890927700a7691f2 C:\Program Files\ThinkPad\Utilities\PWRMGR.DLL MD5: f0ad68dc17c4072ac35cc552c4573a11 C:\Program Files\ThinkPad\Utilities\US\EzMApRes.dll MD5: b497f2a59f88dd8474b125f6a58119e7 C:\Program Files\ThinkPad\Utilities\US\PWMROV.DLL MD5: 14c6a20b54338d12487b023d0e8efdbf C:\Program Files\ThinkPad\Utilities\US\PWMRT32V.DLL MD5: ef123e93ce000aa3dbfe3526aac82673 C:\Program Files\ThinkVantage\PrdCtr\LIBEAY32.dll MD5: d1f8d1a965801316a6b2bab1e61c4266 C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE MD5: 6f843a95744c172aa94d487427c29e69 C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE MD5: 839fd5226289e5be2e4cf8719af80ba3 C:\Program Files\ThinkVantage\PrdCtr\SSLEAY32.dll MD5: 9db7e6f343015143a8434015d27971d6 C:\Program Files\ThinkVantage\PrdCtr\US\LPRESMGR.DLL MD5: 28c7ebac2c4a6954d350f27e6a964837 C:\Program Files\Trusteer\Rapport\bin\ATL80.DLL MD5: f9b20034c8ac69eeeaade488759ceb9f C:\Program Files\Trusteer\Rapport\bin\MSVCP80.dll MD5: 2da4a79178cc1b143aacb348a15fef59 C:\Program Files\Trusteer\Rapport\bin\MSVCR80.dll MD5: e839772d6f21484a75788b599294d26a C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys MD5: 9c1e3aa4d0711adf4536544cc3764ae5 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe MD5: 37bdae1bab5ccbda5261d19e4c7b6b90 C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys MD5: 988fba94e8ecd82c4e7494063460dd53 C:\Program Files\Trusteer\Rapport\bin\RapportTanzan19.dll MD5: d7991d85f5ea11e9d0c6d9145bba7d9b c:\program files\trusteer\rapport\bin\RapportUtil.dll MD5: 97c8faee3df3d13138a8003c9412ce8c c:\program files\trusteer\rapport\bin\rooksbas.dll MD5: b4a20cb7ed000397e60e21c1ca393c09 c:\program files\trusteer\rapport\bin\rookscom.dll MD5: 01b76df80d29368ac5282c1d55d32149 c:\program files\trusteer\rapport\bin\rooksdol.dll MD5: c2da5f5b331947dca3d0ec9e2f558c4f C:\Program Files\Trusteer\Rapport\bin\trf.dll MD5: b7dc98f6f4e7611a9c0849945fb28fb9 C:\Program Files\Windows Defender\MpOav.dll MD5: 0faf0281cbc1f5b8293a2a03745c0acb c:\program files\windows live toolbar\msntb.dll MD5: 6baf8b9538b62bd5484449a447bd63d9 C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_51755.sys MD5: f9b20034c8ac69eeeaade488759ceb9f C:\ProgramData\Trusteer\Rapport\store\exts\RapportGP\baseline\MSVCP80.dll MD5: 2da4a79178cc1b143aacb348a15fef59 C:\ProgramData\Trusteer\Rapport\store\exts\RapportGP\baseline\MSVCR80.dll MD5: 1557fadd7deca8c54aab360ec125db41 C:\ProgramData\Trusteer\Rapport\store\exts\RapportGP\baseline\RapportGP.dll MD5: ae845c6b4305aad70b9fe2c1f2d4593d c:\programdata\trusteer\rapport\store\exts\rapportms\baseline\rapportiaso.sys MD5: 28c7ebac2c4a6954d350f27e6a964837 C:\ProgramData\Trusteer\Rapport\store\exts\TanzanLight\baseline\ATL80.DLL MD5: f9b20034c8ac69eeeaade488759ceb9f C:\ProgramData\Trusteer\Rapport\store\exts\TanzanLight\baseline\MSVCP80.dll MD5: 2da4a79178cc1b143aacb348a15fef59 C:\ProgramData\Trusteer\Rapport\store\exts\TanzanLight\baseline\MSVCR80.dll MD5: b170c933c71c439ae44dd0865b01d04d C:\ProgramData\Trusteer\Rapport\store\exts\TanzanLight\baseline\TanzanLight.dll MD5: 61153b3cf2da386b84abea36921246f8 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMUIAux.EXE MD5: aab979089e192acc0fe1e3c018f8b591 C:\Users\Katerina\AppData\Local\Akamai\netsession_win.exe MD5: 61b8fd3549dd183066087ff5edb769ee C:\Users\Katerina\AppData\Local\Microsoft\Toolbar\Applications\AppMgr.dll MD5: fa0d27516dbb558c62d02d747b093c94 C:\Users\Katerina\AppData\Local\Microsoft\Toolbar\Applications\SCExtension.dll MD5: 57e3797aa7ddf087adc8a4c5123a8881 C:\Users\Katerina\AppData\Local\Microsoft\Toolbar\Applications\WLExtension.dll MD5: 8c3de46457b62e82035bfb1cba29fd7d C:\Users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll MD5: 182bc06b8cddb225f1d9444e0af88003 C:\Users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll MD5: eb28fe2670c1670cd077c3976f6a68f7 C:\Users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff4.dll MD5: c9e3864fb9cbfa93d9010bcfe18a5697 C:\Users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll MD5: d6804f089cbb6749e95124e7c4d80900 C:\Windows\AppPatch\AcLayers.DLL MD5: 1bf1820b86f4921d42d74c922044ac18 C:\Windows\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll MD5: 93d5b9634c4744fb115785081ecf9738 C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll MD5: 74ccea571c1b7d8ad5faf8c11320f476 C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3036.27937__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll MD5: b8f4da3029827914cacf7f083409c240 C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3036.27993__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll MD5: 8f0b8e13cea28e04fab1337527ba899c C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3036.27961__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll MD5: b33c98871031810f05484c76f3811a5b C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3036.27993__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll MD5: ef1faecf9353f733acedd8025b2845a6 C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3036.27945__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll MD5: 83339dff92180c9fb92aed6c98a6ad6c C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3096.40949__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll MD5: 70fecc389a7b204610e49838c840727b C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3036.27963__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll MD5: 8f206dccff047748e44bd5413e156202 C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3036.27944__90ba9c70f846762e\AEM.Server.Shared.dll MD5: 7af5fd9c465b726f7b3f00db163acc44 C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3096.40624__90ba9c70f846762e\AEM.Server.dll MD5: c6cd9c5492c89b08392cbdf7b52ba959 C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3036.27961__90ba9c70f846762e\APM.Foundation.dll MD5: 4990b1081f071ff52b36900c5297220f C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3096.40622__90ba9c70f846762e\APM.Server.dll MD5: 6f21077913b6572538a33d40c9d835c1 C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll MD5: 30a1df8002faabf40a443d368c73173b C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.3096.40626__90ba9c70f846762e\ATIDEMOS.dll MD5: 74a97243ab81f912efb1e75c0233cbae C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll MD5: cd632a9274e7e85b9f37f84c91595c27 C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll MD5: 9769072ff6922bb51aeba0bdf4fd65c2 C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3096.40914__90ba9c70f846762e\CCC.Implementation.dll MD5: 95f53dfe25fa0d18f2044341fca2e0b1 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3036.27962__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll MD5: 931de39878b65f17a6e2a99d95753520 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3096.40796__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll MD5: 5f0e96ca4e7384c64e2106631bae1fc2 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3096.40802__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll MD5: 00f14be86e9954c421875ccaedd6e30d C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3036.27976__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll MD5: 7f77dedfcdbc398c0d6d21eee477afeb C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3096.40846__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll MD5: 2e223bed31139ba21f2ba399c9df030e C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3036.27978__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll MD5: f3f138825c21a31e79404fa79b2130d7 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3096.40788__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll MD5: 014cb166d635e489167456fe837b8d73 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3096.40795__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll MD5: 0bf65f87510dfefba94e0963a68f744c C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3036.27976__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll MD5: a3f03a6337679493a2fe6217ec4b6db9 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3096.40839__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll MD5: 15f1f63ca843df66e121a2ebc72fd81a C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3096.40838__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll MD5: 7abed290545cde422f44a6c86fcb8730 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3036.27966__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll MD5: 4ff81cc87201b6a628911f73b2652a5b C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3096.40712__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll MD5: 95bd2127b37c39ec957ee3521d5368f7 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3096.40794__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll MD5: ad26f2d80e7e6f29556c0616a4bd070f C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3036.27959__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll MD5: bfdaf2e0c6c0fc64c58838a6cae99bb1 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3096.40889__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll MD5: e673b0cdd895301fee9d18c8a7b0ee22 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3036.27978__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll MD5: 492396d7194367f877e70e8eb251905d C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3096.40705__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll MD5: 94ba93a60beccf7fd00c13769e652c9f C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3096.40711__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll MD5: 2b516ef628fe5a97de29efe8a3ba8eeb C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3036.27974__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll MD5: 69484a863885760a5d560334a9521734 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3096.40656__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll MD5: 57edff8d8062418fc73a96f9b825de6a C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3096.40676__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll MD5: 9ebe39b7bcf96f34a51222b3059cdfd8 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3096.40822__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll MD5: fb3089f027973779aedb071c310d48ed C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3096.40821__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll MD5: 1aafd7e4ec71c8107607ad37877a1e01 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3036.27977__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll MD5: c5fb91cc9e7dbac65eac261c5b5de104 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3096.40654__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll MD5: 2fb835b5bccf37b1f2b979d15ccf38ab C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3036.27966__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll MD5: 6776a248624bf97cd2a1929e0fa290af C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3096.40698__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll MD5: 5dd59882788c412c67853e246613095f C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3096.40690__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll MD5: 3e843c5b33ee2b00c2c7fe934226597a C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3096.40804__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll MD5: 31f76ead009acfad5d9172d28666bd15 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3096.40803__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll MD5: df48861d0dd4f428daff86a7d1afdc7e C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3036.27976__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll MD5: a7351e74116e45a6a36ab53a598266e3 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3096.40878__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll MD5: 6fe22fc19295b5f2a24c489c159aedcc C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.3096.40925__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.dll MD5: cce8a1cd48ed7ff6c4cbb4280f759725 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3096.40924__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll MD5: bd61ff70e20ecc6e80096cd4516c339b C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.3036.27990__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll MD5: 8cb67b26e2cf1ca00b8e0104e52cd1e1 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3096.40856__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll MD5: d21a6c042f064811efd789730f06c305 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3096.40854__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll MD5: 6f8ca0975b5563e51505a90db5fbf6b7 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3036.27978__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll MD5: 29106c3f349f79c05115956fd6ecfd15 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3096.40863__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll MD5: 401ef35bced09a082baface42ae2b207 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3036.27990__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll MD5: d1aca9eec1180808e3afa9c2691cdfab C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3096.40927__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll MD5: d939ac140c0cb8acf77dd0d612032175 C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3096.40933__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll MD5: 536c558207664f3eb2e1ce75122ffc0d C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3036.27965__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll MD5: 952722711bc14c88e7f53aaaeab201aa C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3096.40649__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll MD5: cd6d516025c627f475b33091a84ea371 C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3036.27979__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll MD5: 3d76b36be239b8a0e3e08ad203600d5e C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3096.40634__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll MD5: 88001ca692751e2bc65984720b40dc87 C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3036.27946__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll MD5: 0d97df2dbed8e0e1dc5d504e62463049 C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3036.27974__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll MD5: be0aea5bf49614cd0308cb6d9654651e C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3096.40669__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll MD5: 3c7b97bfcc49d402e14ba7bbd3b1bb04 C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3036.27949__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll MD5: abc538b4327ba2f4f9b5e917ba196321 C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3036.27940__90ba9c70f846762e\CLI.Component.Client.Shared.dll MD5: 3589c7b40aeb26344e1f6840fa650806 C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3036.27959__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll MD5: dc414b8c5fab8422b047311cd1a81175 C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3036.27945__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll MD5: 49c1b9f3dd8283e742709eec161c32dd C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3096.40643__90ba9c70f846762e\CLI.Component.Dashboard.dll MD5: e8bd56b755bd391b78101a17cc894dd5 C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3096.40624__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll MD5: ba8daa3a0aa2915ba942710ffd07d564 C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3036.27962__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll MD5: 970fe13e63d5d36ad325af7a8c00621b C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3036.27944__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll MD5: c99116b0d36764f78a3870e8b8cfaf52 C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3096.40625__90ba9c70f846762e\CLI.Component.Runtime.dll MD5: 0f385fca955e2782782ad79852e4f6af C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3096.40627__90ba9c70f846762e\CLI.Component.SkinFactory.dll MD5: 640f7991c726d81e55f646cb18b2d57b C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3096.40905__90ba9c70f846762e\CLI.Component.Systemtray.dll MD5: d8b2c98812dc4ee0c319a0a88806bd6b C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3036.27962__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll MD5: f7760b6240381204c76c8a3e678c78f9 C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3036.27948__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll MD5: f15b653b6aab83699c324ce9a16db4ba C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3096.40662__90ba9c70f846762e\CLI.Component.Wizard.dll MD5: 6a70e6796e9726ff325fad63ad9cb0dc C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3036.27937__90ba9c70f846762e\CLI.Foundation.Private.dll MD5: e863a9c82501baaf8583f47ce79a3d6d C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3036.28032__90ba9c70f846762e\CLI.Foundation.XManifest.dll MD5: 05fa72ddd850219ce43baa02b373c060 C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3036.27933__90ba9c70f846762e\CLI.Foundation.dll MD5: 2e7fab502a8615b1aab0eab35afbca3b C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll MD5: 022fad6380ce40b2100ebe254bb5c2dd C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3036.27964__90ba9c70f846762e\DEM.Graphics.dll MD5: 9008567c7b9c287485b4378638dede11 C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3036.27964__90ba9c70f846762e\DEM.OS.I0602.dll MD5: 395188247f397ae537415cc64eaf3059 C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.3036.27964__90ba9c70f846762e\DEM.OS.dll MD5: c65947724c35af7d312f8f141921fad8 C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3096.40961__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll MD5: e1a870e301a3197da00f4e375134f206 C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3036.27941__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll MD5: 816c35d6aa329c7f14b8c6243a9ef475 C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3036.27961__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll MD5: c623c629a8755f87f5b594d939e394e8 C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3096.40912__90ba9c70f846762e\LOG.Foundation.Implementation.dll MD5: 8f9b9cd01fa312960e3806694832aa3c C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3036.27941__90ba9c70f846762e\LOG.Foundation.Private.dll MD5: 26424a7de807054d2b8df6b4c6071a5d C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3036.27930__90ba9c70f846762e\LOG.Foundation.dll MD5: f610354d7cbcc8132b233e7599dc67c1 C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3036.27960__90ba9c70f846762e\MOM.Foundation.dll MD5: 75522603eb972feb8d101449a8219494 C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3096.40915__90ba9c70f846762e\MOM.Implementation.dll MD5: 69989c1af00aa72b1cd348f5c8028606 C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3036.27933__90ba9c70f846762e\NEWAEM.Foundation.dll MD5: 1e98297ee6642918d80902e0cdffe173 C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9b2eef59d0cfc5aff182d0951de5f040\Accessibility.ni.dll MD5: b0d16bc319e37e875c4b491460807051 C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\2227d1559f87943255069398608d5c56\mscorlib.ni.dll MD5: afb3677620c6782b4e778b05c337055a C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\a8080296b18898342ce986091c08b0a4\PresentationCore.ni.dll MD5: ec8d1c7b6a1ec7e337b7350780ba7dc4 C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\4d2c890606d2a3a43a90684115bfccfc\PresentationFramework.Aero.ni.dll MD5: 9d3ad5571b88a5ed4c36255f90264eba C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\668c039655437b25586280e1fbff8ef0\PresentationFramework.ni.dll MD5: 556b911ed67b115010de33151694dcc3 C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d12534a584dfe415cb2724aca14044ac\PresentationFramework.Luna.ni.dll MD5: 765530a69c1533bb84e6d698ecb21575 C:\Windows\assembly\NativeImages_v2.0.50727_32\PWMUIAux\ab67fdff267562219bb51d1aaa5ae0d0\PWMUIAux.ni.exe MD5: 64881cafae17d4e5647caa84b3218b83 C:\Windows\assembly\NativeImages_v2.0.50727_32\PWMUICtl\f592193130ba2c45413085c2d928fec9\PWMUICtl.ni.dll MD5: f9195e4b484b7d659525c45016e7939f C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\004bc6615f9c06df5c98859d35149fe6\System.Configuration.ni.dll MD5: 108c49bb443e08dbe065a66de758b5ba C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\78157a494dc9a7e52be8840decfcd9cc\System.Drawing.ni.dll MD5: cecb7971499c5e84f701afabddffa27c C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b5df40c22ab563a816103629e2ca99d4\System.Runtime.Remoting.ni.dll MD5: 6434516c878e6a291f72758717ff8db0 C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\421cb77e6a4c21f94e3c5ddf766de23b\System.Web.ni.dll MD5: f7bc2822f0388c6dbce3cd179e1075bf C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\e64304962098e90f0d3f4c33c1b080a6\System.Windows.Forms.ni.dll MD5: 44456c5f6c98e63cfa71d6833fdb4e2d C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\42087edbcd2294b7c51d9f27f992d919\System.Xml.ni.dll MD5: 92d1b7e3981a24b8f3093ce42ab31c68 C:\Windows\assembly\NativeImages_v2.0.50727_32\System\cc149d08e75f8c53cd28ac926b38c370\System.ni.dll MD5: b6a6a022e4878dad9f61e069a67e7b76 C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\9126f2ff9fd9c05900f67e963ccc27ef\WindowsBase.ni.dll MD5: 01e2eca759056f23c73a035fdabb2d6d C:\Windows\Downloaded Program Files\dwusplay.exe MD5: bf7ccc9b05be99a0a6b8bf5895493f04 C:\Windows\Downloaded Program Files\IDrop.ocx MD5: cf23c30cdfa3aaf1297801f4ced42876 C:\Windows\Downloaded Program Files\IDropENU.dll MD5: a8e2f76f136a0e664b68a48028d4af93 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll MD5: 4e289c24e5beb5ff9cf5b118ab96fdb0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll MD5: 41826f4a4fcddfcad0a66cf004a67be8 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\wpfgfx_v0300.dll MD5: ab87eeffd18f2baafc274e7075ea6c67 c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll MD5: f5df6846f30e9f54ea60ccaeb3fb2055 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll MD5: c3b58754215358e21a395d9be27c8267 C:\Windows\system32\AcSignIcon.dll MD5: fb0be3b9ebc6219270e7e507582cf0ff C:\Windows\system32\ADMonitor.exe MD5: e86ae04982631a006d8520c02798aa2e C:\Windows\system32\AFSSClientLib.dll MD5: 0fe769cae5855b53c90e23f85e7e89ff C:\Windows\System32\appmgmts.dll MD5: f2c8f8bef03f09e56b4b085d2099367b C:\Windows\system32\Ati2evxx.exe MD5: d25e3489c79007676b9451ad3cd9e3b2 C:\Windows\system32\atiadlxx.dll MD5: 6383c4606ae9746ddb5d2b0c1358885d C:\Windows\system32\ATIDEMGX.dll MD5: b2804e6a77af80e4f462e78e49c9f23f C:\Windows\system32\atipdlxx.dll MD5: 523e935663d746bd55c28c50066a6522 C:\Windows\system32\atitmmxx.dll MD5: 5b2cc880aafd950dbbf2eaf34ae99f77 C:\Windows\system32\atiumdag.dll MD5: 96cc659feb57736a5703ca2d69712452 C:\Windows\system32\atiumdva.dll MD5: 6a0f37bc6e960e4baa47048d6d877d3c C:\Windows\system32\AtService.exe MD5: 3c81024a164f37290fe4b4bb62458d86 C:\Windows\system32\cdral.DLL MD5: 4f9cb399d68cc5ad8982efd4cb613436 C:\Windows\system32\CDRTC.DLL MD5: 74f26fc01b180d4a99a168ed69c30a53 C:\Windows\system32\cmd.exe MD5: b0f9073be86c6d4edd4eba674251e699 C:\Windows\system32\CRYPT32.dll MD5: 09469b8edd2755143fda06867aad7e73 C:\Windows\system32\cryptnet.dll MD5: f1e8c34892336d33eddcdfe44e474f64 C:\Windows\system32\cryptsvc.dll MD5: 2cdaf8849a20d8df8acce36bbb8849f3 C:\Windows\System32\cscobj.dll MD5: c0f9da077eee9b22f59aa312210087fc C:\Windows\system32\cssuserdatadispatcher.dll MD5: 5b149ccfe275f4de0b4b8ec6b9f6821e C:\Windows\System32\DLA\DLABMFSM.SYS MD5: ad4cb3d783634c90a9d0ce360933a63c C:\Windows\System32\DLA\DLABOIOM.SYS MD5: 93d03238cc3f0ee3c0b3985d110ec575 C:\Windows\System32\DLA\DLADResM.SYS MD5: 6a82f77c4a6f5235bf352f0028e2ef52 C:\Windows\System32\DLA\DLAIFS_M.SYS MD5: 0e6052c0ada37504896a847231a3907d C:\Windows\System32\DLA\DLAOPIOM.SYS MD5: 29670bb4e2b973c5b55a76107d4910b2 C:\Windows\System32\DLA\DLAPoolM.SYS MD5: bbeecb95f2841ae4a3e3690d46d7153d C:\Windows\System32\DLA\DLAUDF_M.SYS MD5: 6b087732b86c1d866d69dbbe463ea90a C:\Windows\System32\DLA\DLAUDFAM.SYS MD5: 6279a396b79778b3ef215f2e15b3ac70 C:\Windows\system32\DLAAPI_W.DLL MD5: 85e861d0b88db2b54acb0839654c09f7 C:\Windows\system32\DNSAPI.dll MD5: 57d762f6f5974af0da2be88a3349baaa C:\Windows\System32\dnsrslvr.dll MD5: 062373995eae5f0eac9eaa9192136bfb C:\Windows\system32\dnssd.dll MD5: 3911b972b55fea0478476b2e777b29fa C:\Windows\system32\drivers\afd.sys MD5: 30015c9e6b07bd122e9aba0bed6d5ac6 C:\Windows\system32\drivers\aliide.sys MD5: 0f8f496b9061a71a070950b180ab9e80 C:\Windows\system32\drivers\amdide.sys MD5: 14660206dc539db62f37b4a75a984578 C:\Windows\system32\DRIVERS\Apfiltr.sys MD5: 1282722cf2cc5a88a606b8022d0f8b7e C:\Windows\System32\DRIVERS\ApsHM86.sys MD5: 2108fc5934843e5f346a715e71fa79f9 C:\Windows\System32\DRIVERS\Apsx86.sys MD5: ec9bb15fb5bdd6fe8249955fce1651f2 C:\Windows\system32\DRIVERS\atikmdag.sys MD5: 40e3212da94acf9e120c30acebc6ea80 C:\Windows\System32\Drivers\ATSwpWDF.sys MD5: db76881f34e600fbb29bc3d7c854d056 C:\Windows\system32\DRIVERS\b57nd60x.sys MD5: 35f376253f687bde63976ccb3f2108ca C:\Windows\system32\DRIVERS\bowser.sys MD5: 611ff3f2f095c8d4a6d4cfd9dcc09793 C:\Windows\System32\Drivers\BTHport.sys MD5: d330803eab2a15caec7f011f1d4cb30e C:\Windows\System32\Drivers\BTHUSB.sys MD5: cfde80a2f2a598c9e71b37c2540cb119 C:\Windows\system32\drivers\btwaudio.sys MD5: 9961051afcf130aee786981face4d7ec C:\Windows\system32\drivers\btwavdt.sys MD5: 54c2ee0a3cec586629035d771aacae67 C:\Windows\system32\DRIVERS\btwl2cap.sys MD5: 58c6d944f65df260515e56bd21d795f6 C:\Windows\system32\DRIVERS\btwrchid.sys MD5: d79664efc19d4715fbea091dd47885ac C:\Windows\system32\drivers\CHDRT32.sys MD5: 47e62bc503b969b3162d8e99c2df4988 C:\Windows\system32\drivers\cmdide.sys MD5: 622c41a07ca7e6dd91770f50d532cb6c C:\Windows\System32\Drivers\dfsc.sys MD5: 5230cdb7e715f3a3b4a882e254cdd35d C:\Windows\System32\Drivers\DLACDBHM.SYS MD5: 77fe51f0f8d86804cb81f6ef6bfb86dd C:\Windows\System32\Drivers\DLARTL_M.SYS MD5: 83106585494d5eb96f59187200c144bd C:\Windows\System32\Drivers\DRVMCDB.SYS MD5: ffc371525aa55d1bae18715ebcb8797c C:\Windows\System32\Drivers\DRVNDDM.SYS MD5: c68ac676b0ef30cfbb1080adce49eb1f C:\Windows\System32\drivers\dxgkrnl.sys MD5: 908ed85b7806e8af3af5e9b74f7809d4 C:\Windows\system32\DRIVERS\e1e6032.sys MD5: 2c95a7a87e4272c1fff9baf579677db3 C:\Windows\system32\DRIVERS\ehdrv.sys MD5: 9798f4c71df8a86266bb0476205411f9 C:\Windows\system32\DRIVERS\epfwwfpr.sys MD5: 185ada973b5020655cee342059a86cbb C:\Windows\system32\DRIVERS\GEARAspiWDM.sys MD5: 2df64415a28ce036ac6acec7645a996f C:\Windows\system32\DRIVERS\HECI.sys MD5: bb9cbaf6ac20452b245c324f1f50ee81 C:\Windows\system32\DRIVERS\HSX_CNXT.sys MD5: fadd7095163cb3cb4073793ebb50fe75 C:\Windows\system32\DRIVERS\HSX_DPV.sys MD5: 058783bedd17615d1fece09f77960436 C:\Windows\system32\DRIVERS\HSXHWAZL.sys MD5: 71ecc07bc7c5e24c3dd01d8a29a24054 C:\Windows\system32\DRIVERS\iaStor.sys MD5: 7285cd0c2b686e0590f941b48414a9f4 C:\Windows\system32\DRIVERS\ibmpmdrv.sys MD5: c375328451ec8c74c8874e8acc5a33e5 C:\Windows\system32\drivers\intelide.sys MD5: 4a1445efa932a3baf5bdb02d7131ee20 C:\Windows\System32\Drivers\ksecdd.sys MD5: 1e94971c4b446ab2290deb71d01cf0c2 C:\Windows\system32\DRIVERS\mrxsmb.sys MD5: 4fccb34d793b116423209c0f8b7a3b03 C:\Windows\system32\DRIVERS\mrxsmb10.sys MD5: c3cb1b40ad4a0124d617a1199b0b9d7c C:\Windows\system32\DRIVERS\mrxsmb20.sys MD5: ece9dca494a565eb7c443a516731d813 C:\Windows\system32\drivers\msahci.sys MD5: 2e48d13da92964174a41f9cfea25d1df C:\Windows\system32\DRIVERS\mux.sys MD5: b435f95592ad8e6fc3bacd4a7e89b614 C:\Windows\system32\DRIVERS\mv2.sys MD5: eb959260cf3dac0ad88eae95372bb679 C:\Windows\system32\DRIVERS\NETw5v32.sys MD5: b9c2b89f08670e159f7181891e449cd9 C:\Windows\System32\drivers\partmgr.sys MD5: fbead1a64b9baede0aaa8a04b4745e1b C:\Windows\system32\drivers\pciide.sys MD5: 271f3e304cf2a467188ef393c8fbd2b7 C:\Windows\system32\DRIVERS\psadd.sys MD5: 0311e1b844fb6e6125e15cc04c54dc58 C:\Windows\System32\Drivers\RapportKELL.sys MD5: c2ef513bbe069f0d4ee0938a76f975d3 C:\Windows\system32\DRIVERS\rimmptsk.sys MD5: 3a5633ad615e2b15291bd0b1b97ccd8a C:\Windows\system32\DRIVERS\RimSerial.sys MD5: c398bca91216755b098679a8da8a2300 C:\Windows\system32\DRIVERS\rimsptsk.sys MD5: 4f4a4c09cc5be58a76cac1c337e004e6 C:\Windows\System32\Drivers\RimUsb.sys MD5: 2a2554cb24506e0a0508fc395c4a1b42 C:\Windows\system32\DRIVERS\rixdptsk.sys MD5: 75e8a6bfa7374aba833ae92bf41ae4e6 C:\Windows\System32\Drivers\RootMdm.sys MD5: ef70b3d22b4bffda6ea851ecb063efaa C:\Windows\system32\DRIVERS\serscan.sys MD5: 3c3f7f424e324c6971632c5de5ff458f C:\Windows\system32\DRIVERS\smiif32.sys MD5: 1ef34706531b188d1ce12127d8233e87 C:\Windows\system32\DRIVERS\snp2uvc.sys MD5: 41987f9fc0e61adf54f581e15029ad91 C:\Windows\System32\DRIVERS\srv.sys MD5: ff33aff99564b1aa534f58868cbe41ef C:\Windows\System32\DRIVERS\srv2.sys MD5: 7605c0e1d01a08f3ecd743f38b834a44 C:\Windows\System32\DRIVERS\srvnet.sys MD5: 74e2d020c47bb2b2fccba29a518a7eb4 C:\Windows\System32\drivers\tcpip.sys MD5: cb258c2f726f1be73c507022be33ebb3 C:\Windows\system32\drivers\tpm.sys MD5: 6412da2b8d079d821b99b3a99943284e C:\Windows\System32\drivers\Tppwr32v.sys MD5: 49258a02a1e8d304ed88b0f1c56b1738 C:\Windows\system32\DRIVERS\tvtfilter.sys MD5: 7e66dda1ef146bfc3a6e36e08e036602 C:\Windows\system32\DRIVERS\Tvti2c.sys MD5: fc4d5a1ea9d736907cb547085248199f C:\Windows\system32\DRIVERS\tvtumon.sys MD5: 6e421ccc57059b0186c6259ca3b6dfc9 C:\Windows\System32\Drivers\usbaapl.sys MD5: 300967ca994e09de0f69ec2b74724736 C:\Windows\system32\drivers\viaide.sys MD5: 786db5771f05ef300390399f626bf30a C:\Windows\system32\drivers\volsnap.sys MD5: a840213f1acdcc175b4d1d5aaeac0d7a C:\Windows\system32\drivers\Wdf01000.sys MD5: f9ad3a5e3fd7e0bdb18b8202b0fdd4e4 C:\Windows\system32\DRIVERS\wimfltr.sys MD5: 06e6f32c8d0a3f66d956f57b43a2e070 C:\Windows\system32\drivers\WudfPf.sys MD5: 867c301e8b790040ae9cf6486e8041df C:\Windows\system32\DRIVERS\WUDFRd.sys MD5: cd5f291a1161f15896d1a4d63daff5df C:\Windows\system32\DRIVERS\xaudio.exe MD5: dab33cfa9dd24251aaa389ff36b64d4b C:\Windows\system32\DRIVERS\xaudio.sys MD5: 13f36b3cb0f73ad0a0b89a6afec97954 C:\Windows\system32\DTS.exe MD5: cabd1b34bd05c986b4dbc18bc0e947ee C:\Windows\system32\dwrite.dll MD5: 8ce364388c8eca59b14b539179276d44 C:\Windows\system32\FntCache.dll MD5: a4cb04c22ec6d8bc799ae7e3c8290510 C:\Windows\system32\FXSAPI.dll MD5: 5c23bbf67e6c373926525367d29f6e0c C:\Windows\system32\FXSRESM.DLL MD5: e2554540b42eeae89c17a708ea61854f C:\Windows\system32\fxsst.dll MD5: dfba0f60fa301e5b1bfb1403a93ee23e C:\Windows\system32\fxssvc.exe MD5: 69c503c004f49aee8b8e3067cc047ba7 C:\Windows\system32\HPZinw12.dll MD5: 12b4549d515cb26bb8d375038017ca65 C:\Windows\system32\HPZipm12.dll MD5: 822675eb6dd6f078316aa6ebc545518c C:\Windows\system32\ibmpmsvc.exe MD5: f325be9bf7b8b5c443784bc954757391 C:\Windows\system32\ieframe.dll MD5: a22ef74a3de86b32e1bd7ad3f93f4b93 C:\Windows\system32\iertutil.dll MD5: eb49faa5ebbc06356fb12476438781b9 C:\Windows\system32\imagehlp.dll MD5: 665790240511df6bc40a30e01731f49f C:\Windows\system32\irprops.cpl MD5: 382038fdbf88c0642e308a1e16706e06 C:\Windows\system32\jsproxy.dll MD5: dc3105cc925a0d47f61b54e66ab730fc C:\Windows\system32\kernel32.dll MD5: 07e304fb0faeb32d59e1eab85d73a8a7 C:\Windows\system32\LMIRfsClientNP.dll MD5: b17d18fd6594aaa25cbc95e799b1bf40 C:\Windows\system32\logon.scr MD5: a3e186b4b935905b829219502557314e C:\Windows\system32\lsass.exe MD5: ea856f4a46320389d1899b2caa7bf40f C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe MD5: 47299371607dc2fb234444eeacb1639e C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll MD5: d9963d39f6711e9a1c14c939c3a25605 C:\Windows\system32\MdmXSdk.dll MD5: 2a2c442f00b45e01d4c882eea69a01bc C:\Windows\system32\MFC100ENU.DLL MD5: f3de10aabd5c7a1a186c9966f037d0c0 C:\Windows\system32\mfc100u.dll MD5: ef24642d5fb52a1eef56de9e47cbb993 C:\Windows\system32\MFC42.DLL MD5: 1b593fbb763150bd225df266c69a9329 C:\Windows\system32\MFC42u.DLL MD5: f35a584e947a5b401feb0fe01db4a0d7 C:\Windows\system32\MFC71.DLL MD5: 5b67c0900c67ef6b4de7dd4fa499600f C:\Windows\system32\msfeeds.dll MD5: 9dd03b005d7f3294c14fd76242b1e22d C:\Windows\system32\mshtml.dll MD5: ff41e1ac301f51e16f61ad7c0f45467c C:\Windows\System32\msshsq.dll MD5: bc83108b18756547013ed443b8cdb31b C:\Windows\system32\MSVCP100.dll MD5: 0e37fbfa79d349d672456923ec5fbbe3 C:\Windows\system32\MSVCR100.dll MD5: 17af64d727545f2804f6e6d998327e3f C:\Windows\system32\msvcrt.dll MD5: 6abd253226770eae1292b4c945ed4b4b C:\Windows\System32\msxml3.dll MD5: 13cc59c1b04e9f20a87987c68cd4be3f C:\Windows\system32\ncrypt.dll MD5: 98b656eaf128cd06f625b09c84d959e1 C:\Windows\system32\NETAPI32.dll MD5: d4bd9f86123c87eca570418b69326f99 C:\Windows\system32\npDeployJava1.dll MD5: dda770bbd7c2ed024d6f50e279d90e5b C:\Windows\system32\ntdll.dll MD5: 862363973dcbcc31dd161ef41a69153c C:\Windows\system32\ODBC32.dll MD5: 9586e7cb2255a8b097a7e4538202585e C:\Windows\system32\ole32.dll MD5: dc15ab7168c0309d8f04fd95b6240422 C:\Windows\system32\OLEACC.dll MD5: b218342214d9bba0f54ea12ba2e9278c C:\Windows\system32\OLEAUT32.dll MD5: 4a1feebf039b283258b0e479fa135dba C:\Windows\System32\osbaseln.dll MD5: 7d1a10a1f3562cca1fd38e9bada8fec0 C:\Windows\system32\perfos.dll MD5: 4b555106290bd117334e9a08761c035a C:\Windows\System32\rundll32.exe MD5: 50e3e76b0901bb4fc029bb88bfa5ce79 C:\Windows\system32\schannel.dll MD5: 1a58069db21d05eb2ab58ee5753ebe8d C:\Windows\system32\schedsvc.dll MD5: d602fedbd9155fc2ded6863fb60c950f C:\Windows\system32\Secur32.dll MD5: 0a990afb9f2726323d61c8ecb8b70b17 C:\Windows\system32\security.dll MD5: a68cd8e9084fec463ba8ba38f46b0af5 C:\Windows\system32\Sensor.dll MD5: 167ac31450c0c53a01fa1491e94d7678 C:\Windows\system32\SHDOCVW.dll MD5: aaf101900a23d75ae1ae00840fa6f3b8 C:\Windows\system32\shell32.dll MD5: 420b075cd71ab9e58d15dd258958fba3 C:\Windows\system32\SHLWAPI.dll MD5: c7230fbee14437716701c15be02c27b8 C:\Windows\System32\shsvcs.dll MD5: 77d69478bbd8f3ce6c223e9f3c8d5b28 C:\Windows\system32\spool\DRIVERS\W32X86\3\brci04a.dll MD5: 335b742ebb20aa6439e87fd20158ccc1 C:\Windows\system32\spool\DRIVERS\W32X86\3\brci04ui.dll MD5: 8554097e5136c3bf9f69fe578a1b35f4 C:\Windows\System32\spoolsv.exe MD5: 1bf5eebfd518dd7298434d8c862f825d C:\Windows\System32\srvsvc.dll MD5: b5950df243837d8217f4e597919b224a C:\Windows\system32\stobject.dll MD5: bfa034aac103d8a6f591ac9364688339 C:\Windows\system32\t2embed.dll MD5: 3d50c4b10352367d5cb20ed1f50f8da2 C:\Windows\System32\taskeng.exe MD5: 52e129522c1775dbb8cc252e7a0655c7 C:\Windows\system32\taskschd.dll MD5: 482b8c9e6686ace68c7034ab847263fa C:\Windows\system32\tcsrpc.dll MD5: 8273a4635ca649096268353b84b52e03 C:\Windows\System32\TMM.dll MD5: 5a726e3cc83655ef71912c4775d004f9 C:\Windows\System32\TPHDEXLG.exe MD5: 501f9e058bfbd8d15cfcc31627969986 C:\Windows\System32\TpShocks.exe MD5: 618fa70e475675c42e05d6e9edf7cb34 C:\Windows\system32\tvttsp.dll MD5: ba22d7f28c0f2cdf91634b239b7a0ff6 C:\Windows\system32\urlmon.dll MD5: 80fff14f1757b9af8be9d314fc1ae88b C:\Windows\system32\USP10.dll MD5: 83c2f5076e1b4a63c04f2b14ee7cad47 C:\Windows\system32\wbem\wbemdisp.dll MD5: 2c3b09e586bda2cc49a292be7badc589 C:\Windows\system32\wbem\wmiutils.dll MD5: dbd02e3e6f061ebbbf9b99a9d7cba30b C:\Windows\system32\WINHTTP.dll MD5: 8e2ebcd935ea8d60e4cbce07f20824e4 C:\Windows\system32\WININET.dll MD5: 14ff750efe13b0c21e5a06507c3a97b1 C:\Windows\system32\WINMM.dll MD5: 5ec8fb83f31aa2d6f421f02c3f4f4475 C:\Windows\system32\WINSPOOL.DRV MD5: b2e569ef26dac9d6994a2aff4f601b7a C:\Windows\system32\WINTRUST.dll MD5: fc3ec24fce372c89423e015a2ac1a31e C:\Windows\system32\wuaueng.dll MD5: fe47b7bc8ea320c2d9b5e5bf6e303765 C:\Windows\System32\WUDFSvc.dll MD5: 1908cc7673f72601affdca022689cedf C:\Windows\system32\XmlLite.dll MD5: d5e459bed3db9cf7fc6cc1455f177d2d C:\Windows\WinSxS\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d1cb102c435421d e\ATL80.DLL MD5: 1d109ed0d660654ea7ff1574558031c4 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9 a\msvcm80.dll MD5: 0b3595a4ff0b36d68e5fc67fd7d70fdc C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9 a\MSVCP80.dll MD5: c9564cf4976e7e96b4052737aa2492b4 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9 a\MSVCR80.dll MD5: 1f5afd468eb5e09e9ed75a087529eab5 C:\Windows\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_cbf5e994470a1a8 f\MFC80.DLL MD5: e2c48cd0132d4d1dc7d0df9a6bef686a C:\Windows\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_cbf5e994470a1a8 f\MFC80U.DLL MD5: 28a09777d2d952122567a8a82f1a2c7b C:\Windows\WinSxS\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_03ce2c722059 43d3\MFC80ENU.DLL MD5: 35acd5ea63d75e97dd0e9a1629e582b2 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.6002.18305_none_88f3a38569c2c436\COMCTL32.dll MD5: be3c082837866c4c291adaf163c10ea6 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll MD5: 76eaef4ddebbc7c38853f586c0e91dce C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052 ca1013d0\gdiplus.dll No file uploaded. Scan finished - communication took 2 sec Total traffic - 0.03 MB sent, 2.34 KB recvd Scanned 1087 files and modules - 99 seconds ============================================================================== Meanwhile, I have closed down and re-started my computer anhd done a bit of web brozsing, and it has not actually frozen so that I need to force a re-start, but has been sooooooooooooooooooooooo slooooooooooooooooooooooooooowwwwwwwwwwwwwwwwwwwwww……………. it feels almost sticky, like it's trying tooperate through treacle. Definitely not 100% happy. So, have had intermittant non responsive periods, but then it gets going again (slowly)….. Still getting the "ATOM.XSL file not found" pop up at start up too. Many thanks again!
Post #13
Hello inkster

Thank you for the BitDefender log (it appears to be clean).

Its not a concern that VT was unable to find the file we wanted scanned, if it was infected BitDefender would have picked it up.

it has not actually frozen so that I need to force a re-start, but has been sooooooooooooooooooooooo slooooooooooooooooooooooooooowwwwwwwwwwwwwwwwwwwwww……..

A slow machine is not always a sign of a malware infection. Your system does have many things running simultaneously which can sometime be a heavy drain on system resources.

You mentioned that you tried to uninstall Feedreader before coming here for assistance. Feedreader is still listed as being installed on your system which most likely means that the uninstall was incomplete.

Lets see if we can use the following tool to get it completely uninstalled:


  • Revo Uninstaller


  • You can dowwnload Revo Uninstaller from here.
  • Information about how to use this program is provided on the download page.

Once you have given Revo a try let me know if you are still receiving the "ATOM.XSL file not found" messages :)
Post #14
Hi JonTom, The thing about the running slow, is that it is relatively new…. in other words, the computer has not always run like this. And also, I am running it fairly lightly at the moment (ie, without Autocad, which I often run simultaneously with everything else). But you're right, it doesn't necessarily mean malware…. So, I ran the Revo Uninstaller as you suggested, and it gave me the same message about "uninooo.dat does not exist. Cannot uninstall". It then went on to LOOK as though it was uninstalling, but when I finished, I re-started (and it froze for a while, but managed to keep going), and on start up, I got the ATOM.XSL file not found pop up again, and FeedReader started up. So, still not uninstalled and I am a bit baffled. Thank you!
Post #15
Since my last post, the computer froze again, and I had to force a re-start. When I started it again, I got a new pop up which read "Access violation at address 00718EBE in module "feedreader.exe". Read of address 0000001C". This was repeated aobut 20 times, then I got the old favourite about the ATOM.XSL file.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI