Spyware / Malware / Virus Removal

Default Programs Changed & McAfee Shut Down

36 min read

Looking for the outcome? Ask AI

gino5555 Topic Starter

Post #1April 6, 2013, 6:55 PM UTC

This is the computer that my 12 year old uses for school and play. I have McAfee installed with parental security settings. When he told me all his default programs were messed up and his word documents were changed into txt files then opened as nothing I went to do a security scan only to find out McAfee is not running and I can't open it. Here are results of the Hijack This scan:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:47:32 AM, on 4/6/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16521)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Users\Admin\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.amazon.com/websearch/ref=bit_bd…513_US_ie_sp_W7
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=adknlg&s…hTerms}&f=4
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: CrossriderApp0002258 - {11111111-1111-1111-1111-110011221158} - C:\Program Files (x86)\I Want This\I Want This.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120712162147.dll
O2 - BHO: TSBHO Class - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [HP CoolSense] C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [DW7] "C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3676186530-107332292-1146024077-1001\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent (User 'Brandon')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\mcafee\msc\mcsniepl.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Active File Monitor V9 (AdobeActiveFileMonitor9.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Program Files\IDT\WDM\AESTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel® Centrino® Bluetooth 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel® Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: TrueSuiteService (FPLService) - HP - C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Client Services (HPClientSvc) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe (file missing)
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel® Identity Protection Technology Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - Unknown owner - C:\Windows\system32\mfevtps.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10101 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 16375 bytes

mowman

Post #2April 8, 2013, 12:08 AM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
  If suspicious objects are found select skip
- Then click Continue > Reboot now
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

gino5555

Post #3April 8, 2013, 2:00 AM UTC

TDS Killer - No threats found when scanned from ADMIN: 18:06:36.0983 3872 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 18:06:38.0053 3872 ============================================================ 18:06:38.0053 3872 Current date / time: 2013/04/07 18:06:38.0053 18:06:38.0053 3872 SystemInfo: 18:06:38.0053 3872 18:06:38.0053 3872 OS Version: 6.1.7601 ServicePack: 1.0 18:06:38.0053 3872 Product type: Workstation 18:06:38.0054 3872 ComputerName: HPDM4 18:06:38.0054 3872 UserName: Admin 18:06:38.0054 3872 Windows directory: C:\Windows 18:06:38.0054 3872 System windows directory: C:\Windows 18:06:38.0054 3872 Running under WOW64 18:06:38.0054 3872 Processor architecture: Intel x64 18:06:38.0054 3872 Number of processors: 4 18:06:38.0054 3872 Page size: 0x1000 18:06:38.0054 3872 Boot type: Normal boot 18:06:38.0054 3872 ============================================================ 18:06:41.0338 3872 Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 18:06:41.0348 3872 ============================================================ 18:06:41.0348 3872 \Device\Harddisk0\DR0: 18:06:41.0348 3872 MBR partitions: 18:06:41.0348 3872 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800 18:06:41.0348 3872 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x4761A800 18:06:41.0348 3872 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x4767E800, BlocksNum 0x29E9800 18:06:41.0349 3872 \Device\Harddisk0\DR0\Partition4: MBR, Type 0xC, StartLBA 0x4A068000, BlocksNum 0x7EFAB0 18:06:41.0349 3872 ============================================================ 18:06:41.0375 3872 C: <-> \Device\Harddisk0\DR0\Partition2 18:06:41.0402 3872 E: <-> \Device\Harddisk0\DR0\Partition4 18:06:41.0440 3872 D: <-> \Device\Harddisk0\DR0\Partition3 18:06:41.0440 3872 ============================================================ 18:06:41.0440 3872 Initialize success 18:06:41.0440 3872 ============================================================ 18:06:45.0878 9756 ============================================================ 18:06:45.0878 9756 Scan started 18:06:45.0878 9756 Mode: Manual; 18:06:45.0878 9756 ============================================================ 18:06:46.0274 9756 ================ Scan system memory ======================== 18:06:46.0275 9756 System memory - ok 18:06:46.0276 9756 ================ Scan services ============================= 18:06:46.0604 9756 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys 18:06:46.0636 9756 1394ohci - ok 18:06:46.0695 9756 [ 5C368F4B04ED2A923E6AFCA2D37BAFF5 ] Accelerometer C:\Windows\system32\drivers\Accelerometer.sys 18:06:46.0821 9756 Accelerometer - ok 18:06:46.0856 9756 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys 18:06:46.0862 9756 ACPI - ok 18:06:46.0888 9756 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys 18:06:46.0908 9756 AcpiPmi - ok 18:06:47.0014 9756 [ 1474F121C3DF1232D3E7239C03691EE6 ] AdobeActiveFileMonitor9.0 C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe 18:06:47.0166 9756 AdobeActiveFileMonitor9.0 - ok 18:06:47.0285 9756 [ B1EA9681502EE57F87DB71D726288A5B ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 18:06:47.0430 9756 AdobeARMservice - ok 18:06:47.0603 9756 [ EA856F4A46320389D1899B2CAA7BF40F ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 18:06:47.0609 9756 AdobeFlashPlayerUpdateSvc - ok 18:06:47.0651 9756 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys 18:06:47.0679 9756 adp94xx - ok 18:06:47.0735 9756 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\drivers\adpahci.sys 18:06:47.0782 9756 adpahci - ok 18:06:47.0829 9756 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\drivers\adpu320.sys 18:06:47.0846 9756 adpu320 - ok 18:06:47.0887 9756 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll 18:06:47.0889 9756 AeLookupSvc - ok 18:06:47.0986 9756 [ A6FB9DB8F1A86861D955FD6975977AE0 ] AESTFilters C:\Program Files\IDT\WDM\AESTSr64.exe 18:06:47.0989 9756 AESTFilters - ok 18:06:48.0033 9756 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys 18:06:48.0044 9756 AFD - ok 18:06:48.0101 9756 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys 18:06:48.0112 9756 agp440 - ok 18:06:48.0193 9756 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe 18:06:48.0305 9756 ALG - ok 18:06:48.0340 9756 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys 18:06:48.0350 9756 aliide - ok 18:06:48.0367 9756 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys 18:06:48.0373 9756 amdide - ok 18:06:48.0429 9756 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys 18:06:48.0455 9756 AmdK8 - ok 18:06:48.0463 9756 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\drivers\amdppm.sys 18:06:48.0487 9756 AmdPPM - ok 18:06:48.0513 9756 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys 18:06:48.0647 9756 amdsata - ok 18:06:48.0673 9756 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\drivers\amdsbs.sys 18:06:48.0691 9756 amdsbs - ok 18:06:48.0733 9756 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys 18:06:48.0735 9756 amdxata - ok 18:06:48.0764 9756 [ 9921E78BC29634235F4BF5809E7E8CDE ] AMPPAL C:\Windows\system32\DRIVERS\AMPPAL.sys 18:06:48.0770 9756 AMPPAL - ok 18:06:48.0809 9756 [ 9921E78BC29634235F4BF5809E7E8CDE ] AMPPALP C:\Windows\system32\DRIVERS\amppal.sys 18:06:48.0814 9756 AMPPALP - ok 18:06:48.0943 9756 [ 83A0E7BA4AE616D3654E700D9C5FF9DB ] AMPPALR3 C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe 18:06:49.0074 9756 AMPPALR3 - ok 18:06:49.0139 9756 [ 5F87E363F83E8A6F5606991C256F703A ] ApfiltrService C:\Windows\system32\drivers\Apfiltr.sys 18:06:49.0146 9756 ApfiltrService - ok 18:06:49.0185 9756 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys 18:06:49.0217 9756 AppID - ok 18:06:49.0251 9756 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll 18:06:49.0296 9756 AppIDSvc - ok 18:06:49.0390 9756 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll 18:06:49.0439 9756 Appinfo - ok 18:06:49.0617 9756 [ 7EF47644B74EBE721CC32211D3C35E76 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 18:06:49.0769 9756 Apple Mobile Device - ok 18:06:49.0820 9756 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\drivers\arc.sys 18:06:49.0829 9756 arc - ok 18:06:49.0842 9756 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\drivers\arcsas.sys 18:06:49.0857 9756 arcsas - ok 18:06:49.0975 9756 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 18:06:50.0107 9756 aspnet_state - ok 18:06:50.0149 9756 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys 18:06:50.0177 9756 AsyncMac - ok 18:06:50.0209 9756 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys 18:06:50.0211 9756 atapi - ok 18:06:50.0277 9756 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll 18:06:50.0342 9756 AudioEndpointBuilder - ok 18:06:50.0364 9756 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll 18:06:50.0375 9756 AudioSrv - ok 18:06:50.0424 9756 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll 18:06:50.0501 9756 AxInstSV - ok 18:06:50.0587 9756 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys 18:06:50.0638 9756 b06bdrv - ok 18:06:50.0698 9756 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys 18:06:50.0731 9756 b57nd60a - ok 18:06:50.0811 9756 [ 9E84A931DBEE0292E38ED672F6293A99 ] BCM43XX C:\Windows\system32\DRIVERS\bcmwl664.sys 18:06:50.0831 9756 BCM43XX - ok 18:06:50.0872 9756 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll 18:06:50.0924 9756 BDESVC - ok 18:06:50.0974 9756 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys 18:06:50.0993 9756 Beep - ok 18:06:51.0039 9756 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll 18:06:51.0125 9756 BFE - ok 18:06:51.0186 9756 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll 18:06:51.0366 9756 BITS - ok 18:06:51.0393 9756 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\drivers\blbdrive.sys 18:06:51.0434 9756 blbdrive - ok 18:06:51.0521 9756 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 18:06:51.0660 9756 Bonjour Service - ok 18:06:51.0688 9756 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys 18:06:51.0717 9756 bowser - ok 18:06:51.0745 9756 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys 18:06:51.0766 9756 BrFiltLo - ok 18:06:51.0801 9756 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys 18:06:51.0820 9756 BrFiltUp - ok 18:06:51.0862 9756 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll 18:06:51.0913 9756 Browser - ok 18:06:51.0940 9756 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys 18:06:51.0971 9756 Brserid - ok 18:06:51.0992 9756 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys 18:06:52.0015 9756 BrSerWdm - ok 18:06:52.0042 9756 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys 18:06:52.0064 9756 BrUsbMdm - ok 18:06:52.0081 9756 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys 18:06:52.0102 9756 BrUsbSer - ok 18:06:52.0122 9756 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys 18:06:52.0156 9756 BTHMODEM - ok 18:06:52.0198 9756 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll 18:06:52.0268 9756 bthserv - ok 18:06:52.0315 9756 [ A5B3E8B2B78C7B3DA56A0DE490E6718C ] BTHSSecurityMgr C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe 18:06:52.0466 9756 BTHSSecurityMgr - ok 18:06:52.0494 9756 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys 18:06:52.0521 9756 cdfs - ok 18:06:52.0571 9756 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys 18:06:52.0604 9756 cdrom - ok 18:06:52.0635 9756 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll 18:06:52.0691 9756 CertPropSvc - ok 18:06:52.0767 9756 [ D2B3252AD4EB499C935A56467997AA3C ] cfwids C:\Windows\system32\drivers\cfwids.sys 18:06:52.0894 9756 cfwids - ok 18:06:52.0926 9756 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\drivers\circlass.sys 18:06:52.0951 9756 circlass - ok 18:06:52.0992 9756 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys 18:06:53.0001 9756 CLFS - ok 18:06:53.0064 9756 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 18:06:53.0074 9756 clr_optimization_v2.0.50727_32 - ok 18:06:53.0134 9756 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 18:06:53.0146 9756 clr_optimization_v2.0.50727_64 - ok 18:06:53.0324 9756 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 18:06:53.0473 9756 clr_optimization_v4.0.30319_32 - ok 18:06:53.0516 9756 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 18:06:53.0667 9756 clr_optimization_v4.0.30319_64 - ok 18:06:53.0733 9756 [ 50F92C943F18B070F166D019DFAB3D9A ] clwvd C:\Windows\system32\DRIVERS\clwvd.sys 18:06:53.0735 9756 clwvd - ok 18:06:53.0761 9756 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\drivers\CmBatt.sys 18:06:53.0783 9756 CmBatt - ok 18:06:53.0800 9756 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys 18:06:53.0809 9756 cmdide - ok 18:06:53.0862 9756 [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG C:\Windows\system32\Drivers\cng.sys 18:06:53.0968 9756 CNG - ok 18:06:54.0008 9756 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\drivers\compbatt.sys 18:06:54.0019 9756 Compbatt - ok 18:06:54.0033 9756 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys 18:06:54.0056 9756 CompositeBus - ok 18:06:54.0077 9756 COMSysApp - ok 18:06:54.0092 9756 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys 18:06:54.0098 9756 crcdisk - ok 18:06:54.0151 9756 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll 18:06:54.0207 9756 CryptSvc - ok 18:06:54.0257 9756 [ 1CA90212A99DB6975C344826D11055C9 ] dc3d C:\Windows\system32\DRIVERS\dc3d.sys 18:06:54.0391 9756 dc3d - ok 18:06:54.0454 9756 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll 18:06:54.0468 9756 DcomLaunch - ok 18:06:54.0519 9756 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll 18:06:54.0579 9756 defragsvc - ok 18:06:54.0609 9756 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys 18:06:54.0656 9756 DfsC - ok 18:06:54.0720 9756 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll 18:06:54.0794 9756 Dhcp - ok 18:06:54.0820 9756 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys 18:06:54.0822 9756 discache - ok 18:06:54.0867 9756 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\drivers\disk.sys 18:06:54.0880 9756 Disk - ok 18:06:54.0921 9756 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll 18:06:55.0000 9756 Dnscache - ok 18:06:55.0070 9756 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll 18:06:55.0126 9756 dot3svc - ok 18:06:55.0146 9756 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll 18:06:55.0153 9756 DPS - ok 18:06:55.0216 9756 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys 18:06:55.0233 9756 drmkaud - ok 18:06:55.0290 9756 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys 18:06:55.0457 9756 DXGKrnl - ok 18:06:55.0511 9756 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll 18:06:55.0588 9756 EapHost - ok 18:06:55.0726 9756 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\drivers\evbda.sys 18:06:55.0894 9756 ebdrv - ok 18:06:55.0930 9756 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe 18:06:55.0934 9756 EFS - ok 18:06:56.0017 9756 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe 18:06:56.0110 9756 ehRecvr - ok 18:06:56.0172 9756 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe 18:06:56.0259 9756 ehSched - ok 18:06:56.0318 9756 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\drivers\elxstor.sys 18:06:56.0342 9756 elxstor - ok 18:06:56.0369 9756 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys 18:06:56.0389 9756 ErrDev - ok 18:06:56.0471 9756 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll 18:06:56.0482 9756 EventSystem - ok 18:06:56.0567 9756 [ 54FC81B0162478A72A93DBBEAFB35671 ] EvtEng C:\Program Files\Intel\WiFi\bin\EvtEng.exe 18:06:56.0690 9756 EvtEng - ok 18:06:56.0718 9756 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys 18:06:56.0751 9756 exfat - ok 18:06:56.0774 9756 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys 18:06:56.0805 9756 fastfat - ok 18:06:56.0873 9756 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe 18:06:57.0039 9756 Fax - ok 18:06:57.0065 9756 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\drivers\fdc.sys 18:06:57.0103 9756 fdc - ok 18:06:57.0141 9756 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll 18:06:57.0185 9756 fdPHost - ok 18:06:57.0219 9756 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll 18:06:57.0265 9756 FDResPub - ok 18:06:57.0293 9756 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys 18:06:57.0300 9756 FileInfo - ok 18:06:57.0320 9756 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys 18:06:57.0382 9756 Filetrace - ok 18:06:57.0423 9756 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\drivers\flpydisk.sys 18:06:57.0442 9756 flpydisk - ok 18:06:57.0489 9756 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys 18:06:57.0588 9756 FltMgr - ok 18:06:57.0653 9756 [ C4C183E6551084039EC862DA1C945E3D ] FontCache C:\Windows\system32\FntCache.dll 18:06:57.0792 9756 FontCache - ok 18:06:57.0843 9756 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 18:06:57.0845 9756 FontCache3.0.0.0 - ok 18:06:57.0914 9756 [ 26065327BB2AA358140381FC76520908 ] FPLService C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe 18:06:58.0076 9756 FPLService - ok 18:06:58.0114 9756 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys 18:06:58.0124 9756 FsDepends - ok 18:06:58.0140 9756 [ 07DA62C960DDCCC2D35836AEAB4FC578 ] fssfltr C:\Windows\system32\DRIVERS\fssfltr.sys 18:06:58.0272 9756 fssfltr - ok 18:06:58.0369 9756 [ 28DDEEEC44E988657B732CF404D504CB ] fsssvc C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe 18:06:58.0548 9756 fsssvc - ok 18:06:58.0564 9756 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys 18:06:58.0700 9756 Fs_Rec - ok 18:06:58.0728 9756 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys 18:06:58.0734 9756 fvevol - ok 18:06:58.0785 9756 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys 18:06:58.0799 9756 gagp30kx - ok 18:06:58.0821 9756 [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 18:06:58.0948 9756 GEARAspiWDM - ok 18:06:59.0000 9756 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll 18:06:59.0092 9756 gpsvc - ok 18:06:59.0217 9756 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 18:06:59.0221 9756 gupdate - ok 18:06:59.0230 9756 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 18:06:59.0234 9756 gupdatem - ok 18:06:59.0257 9756 [ 1E6438D4EA6E1174A3B3B1EDC4DE660B ] hamachi C:\Windows\system32\DRIVERS\hamachi.sys 18:06:59.0400 9756 hamachi - ok 18:06:59.0416 9756 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys 18:06:59.0438 9756 hcw85cir - ok 18:06:59.0468 9756 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys 18:06:59.0546 9756 HdAudAddService - ok 18:06:59.0588 9756 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys 18:06:59.0614 9756 HDAudBus - ok 18:06:59.0653 9756 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\drivers\HidBatt.sys 18:06:59.0674 9756 HidBatt - ok 18:06:59.0684 9756 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\drivers\hidbth.sys 18:06:59.0740 9756 HidBth - ok 18:06:59.0749 9756 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\drivers\hidir.sys 18:06:59.0776 9756 HidIr - ok 18:06:59.0810 9756 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll 18:06:59.0855 9756 hidserv - ok 18:06:59.0910 9756 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys 18:06:59.0912 9756 HidUsb - ok 18:06:59.0983 9756 [ A894FB2CAE6A29F5D9C8EDA47B074623 ] HipShieldK C:\Windows\system32\drivers\HipShieldK.sys 18:07:00.0116 9756 HipShieldK - ok 18:07:00.0158 9756 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll 18:07:00.0218 9756 hkmsvc - ok 18:07:00.0237 9756 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll 18:07:00.0301 9756 HomeGroupListener - ok 18:07:00.0344 9756 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll 18:07:00.0400 9756 HomeGroupProvider - ok 18:07:00.0468 9756 [ BB1FC298BE53AAB1E110F6E786BD8AC5 ] HP Support Assistant Service C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe 18:07:00.0470 9756 HP Support Assistant Service - ok 18:07:00.0518 9756 [ 6A181452D4E240B8ECC7614B9A19BDE9 ] HPClientSvc C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe 18:07:00.0658 9756 HPClientSvc - ok 18:07:00.0741 9756 [ B7382BEC806B7B00FC84B3E2061FF48E ] HPDrvMntSvc.exe C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe 18:07:00.0891 9756 HPDrvMntSvc.exe - ok 18:07:00.0925 9756 [ 4E0BEC0F78096FFD6D3314B497FC49D3 ] hpdskflt C:\Windows\system32\drivers\hpdskflt.sys 18:07:01.0056 9756 hpdskflt - ok 18:07:01.0129 9756 [ 9B7EDD3FE7C211C36E921D34D18A3A0A ] hpqwmiex C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe 18:07:01.0145 9756 hpqwmiex - ok 18:07:01.0204 9756 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys 18:07:01.0337 9756 HpSAMD - ok 18:07:01.0366 9756 [ FC7C13B5A9E9BE23B7AE72BBC7FDB278 ] hpsrv C:\Windows\system32\Hpservice.exe 18:07:01.0494 9756 hpsrv - ok 18:07:01.0544 9756 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys 18:07:01.0561 9756 HTTP - ok 18:07:01.0573 9756 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys 18:07:01.0575 9756 hwpolicy - ok 18:07:01.0607 9756 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys 18:07:01.0644 9756 i8042prt - ok 18:07:01.0714 9756 [ 26CF4275034214ECEDD8EC17B0A18A99 ] iaStor C:\Windows\system32\drivers\iaStor.sys 18:07:01.0724 9756 iaStor - ok 18:07:01.0830 9756 [ E79A8E33BD136D14BAE1FA20EB2EF124 ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe 18:07:01.0966 9756 IAStorDataMgrSvc - ok 18:07:02.0004 9756 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys 18:07:02.0151 9756 iaStorV - ok 18:07:02.0267 9756 [ 3A0FF117B4ADC5ABE4D968E26A337158 ] IconMan_R C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe 18:07:02.0313 9756 IconMan_R - ok 18:07:02.0401 9756 [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 18:07:02.0490 9756 IDriverT - ok 18:07:02.0559 9756 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 18:07:02.0720 9756 idsvc - ok 18:07:03.0141 9756 [ 6383899C5F964D71B0F96B81FBE59BB8 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys 18:07:03.0320 9756 igfx - ok 18:07:03.0364 9756 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\drivers\iirsp.sys 18:07:03.0376 9756 iirsp - ok 18:07:03.0440 9756 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll 18:07:03.0514 9756 IKEEXT - ok 18:07:03.0567 9756 [ CADDF0927DAC63EDAE48F5C35A61D87D ] intaud_WaveExtensible C:\Windows\system32\drivers\intelaud.sys 18:07:03.0698 9756 intaud_WaveExtensible - ok 18:07:03.0733 9756 [ FC727061C0F47C8059E88E05D5C8E381 ] IntcDAud C:\Windows\system32\DRIVERS\IntcDAud.sys 18:07:03.0740 9756 IntcDAud - ok 18:07:03.0760 9756 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys 18:07:03.0766 9756 intelide - ok 18:07:03.0795 9756 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\drivers\intelppm.sys 18:07:03.0820 9756 intelppm - ok 18:07:03.0862 9756 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll 18:07:03.0918 9756 IPBusEnum - ok 18:07:03.0949 9756 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys 18:07:03.0976 9756 IpFilterDriver - ok 18:07:04.0032 9756 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll 18:07:04.0102 9756 iphlpsvc - ok 18:07:04.0127 9756 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys 18:07:04.0154 9756 IPMIDRV - ok 18:07:04.0174 9756 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys 18:07:04.0207 9756 IPNAT - ok 18:07:04.0293 9756 [ 50D6CCC6FF5561F9F56946B3E6164FB8 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 18:07:04.0463 9756 iPod Service - ok 18:07:04.0493 9756 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys 18:07:04.0514 9756 IRENUM - ok 18:07:04.0554 9756 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys 18:07:04.0562 9756 isapnp - ok 18:07:04.0582 9756 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys 18:07:04.0725 9756 iScsiPrt - ok 18:07:04.0750 9756 [ 716F66336F10885D935B08174DC54242 ] iwdbus C:\Windows\system32\drivers\iwdbus.sys 18:07:04.0879 9756 iwdbus - ok 18:07:04.0935 9756 [ 6C85719A21B3F62C2C76280F4BD36C7B ] jhi_service C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe 18:07:04.0939 9756 jhi_service - ok 18:07:04.0975 9756 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys 18:07:04.0977 9756 kbdclass - ok 18:07:05.0036 9756 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys 18:07:05.0069 9756 kbdhid - ok 18:07:05.0097 9756 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe 18:07:05.0101 9756 KeyIso - ok 18:07:05.0143 9756 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys 18:07:05.0241 9756 KSecDD - ok 18:07:05.0278 9756 [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys 18:07:05.0409 9756 KSecPkg - ok 18:07:05.0443 9756 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys 18:07:05.0492 9756 ksthunk - ok 18:07:05.0545 9756 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll 18:07:05.0605 9756 KtmRm - ok 18:07:05.0670 9756 [ 173666119D217E3739205C169E2BF0E5 ] L1C C:\Windows\system32\DRIVERS\L1C62x64.sys 18:07:05.0673 9756 L1C - ok 18:07:05.0728 9756 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll 18:07:05.0789 9756 LanmanServer - ok 18:07:05.0822 9756 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll 18:07:05.0878 9756 LanmanWorkstation - ok 18:07:05.0915 9756 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys 18:07:05.0917 9756 lltdio - ok 18:07:05.0950 9756 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll 18:07:06.0014 9756 lltdsvc - ok 18:07:06.0051 9756 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll 18:07:06.0094 9756 lmhosts - ok 18:07:06.0175 9756 [ E7859BA062DB5E23C6DD34AD66B09F50 ] LMS C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe 18:07:06.0400 9756 LMS - ok 18:07:06.0471 9756 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys 18:07:06.0482 9756 LSI_FC - ok 18:07:06.0505 9756 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys 18:07:06.0515 9756 LSI_SAS - ok 18:07:06.0552 9756 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys 18:07:06.0559 9756 LSI_SAS2 - ok 18:07:06.0585 9756 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys 18:07:06.0597 9756 LSI_SCSI - ok 18:07:06.0626 9756 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys 18:07:06.0660 9756 luafv - ok 18:07:06.0759 9756 [ F928E5E72BBA15DD0CE9A26E0413D236 ] McAfee SiteAdvisor Service C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 18:07:06.0896 9756 McAfee SiteAdvisor Service - ok 18:07:06.0923 9756 [ F928E5E72BBA15DD0CE9A26E0413D236 ] McMPFSvc C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 18:07:06.0928 9756 McMPFSvc - ok 18:07:06.0939 9756 [ F928E5E72BBA15DD0CE9A26E0413D236 ] mcmscsvc C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 18:07:06.0943 9756 mcmscsvc - ok 18:07:06.0970 9756 [ F928E5E72BBA15DD0CE9A26E0413D236 ] McNaiAnn C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 18:07:06.0975 9756 McNaiAnn - ok 18:07:06.0991 9756 [ F928E5E72BBA15DD0CE9A26E0413D236 ] McNASvc C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 18:07:06.0996 9756 McNASvc - ok 18:07:07.0077 9756 [ 1814532DB0404C5FB65AA3EB051B2BE5 ] McODS C:\Program Files\McAfee\VirusScan\mcods.exe 18:07:07.0222 9756 McODS - ok 18:07:07.0259 9756 [ F928E5E72BBA15DD0CE9A26E0413D236 ] McProxy C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 18:07:07.0264 9756 McProxy - ok 18:07:07.0357 9756 [ 21F81090A00932C5E96700EDF2977582 ] McShield C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe 18:07:07.0489 9756 McShield - ok 18:07:07.0539 9756 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll 18:07:07.0593 9756 Mcx2Svc - ok 18:07:07.0616 9756 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\drivers\megasas.sys 18:07:07.0629 9756 megasas - ok 18:07:07.0673 9756 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys 18:07:07.0692 9756 MegaSR - ok 18:07:07.0708 9756 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\Windows\system32\drivers\HECIx64.sys 18:07:07.0711 9756 MEIx64 - ok 18:07:07.0768 9756 [ B1720E97FABBDF7D30B36DAF19C3DEE8 ] mfeapfk C:\Windows\system32\drivers\mfeapfk.sys 18:07:07.0896 9756 mfeapfk - ok 18:07:07.0950 9756 [ 113F1534B80D65DFDCA660F19967A3B7 ] mfeavfk C:\Windows\system32\drivers\mfeavfk.sys 18:07:08.0090 9756 mfeavfk - ok 18:07:08.0125 9756 mfeavfk01 - ok 18:07:08.0167 9756 [ C4F521310E40327BBC8E8E71DA344F48 ] mfefire C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe 18:07:08.0299 9756 mfefire - ok 18:07:08.0361 9756 [ CECC9841D036EE008091825272D91331 ] mfefirek C:\Windows\system32\drivers\mfefirek.sys 18:07:08.0504 9756 mfefirek - ok 18:07:08.0556 9756 [ EF0F85EDBDF6C0AB467E88E0CEE2B346 ] mfehidk C:\Windows\system32\drivers\mfehidk.sys 18:07:08.0707 9756 mfehidk - ok 18:07:08.0748 9756 [ 6E3A46BF6CBB80450CC24F80FE03ED5A ] mferkdet C:\Windows\system32\drivers\mferkdet.sys 18:07:08.0875 9756 mferkdet - ok 18:07:08.0923 9756 [ 341BFCAA3A55C08E8C9ECB1654ACA905 ] mfevtp C:\Windows\system32\mfevtps.exe 18:07:09.0055 9756 mfevtp - ok 18:07:09.0095 9756 [ 2802D09F1B6ED502237539563F3C4992 ] mfewfpk C:\Windows\system32\drivers\mfewfpk.sys 18:07:09.0234 9756 mfewfpk - ok 18:07:09.0294 9756 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll 18:07:09.0298 9756 MMCSS - ok 18:07:09.0336 9756 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys 18:07:09.0382 9756 Modem - ok 18:07:09.0446 9756 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys 18:07:09.0448 9756 monitor - ok 18:07:09.0469 9756 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys 18:07:09.0472 9756 mouclass - ok 18:07:09.0500 9756 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys 18:07:09.0502 9756 mouhid - ok 18:07:09.0521 9756 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys 18:07:09.0525 9756 mountmgr - ok 18:07:09.0582 9756 [ F8A10560B35C66F9DE212F03DAD5BFA7 ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys 18:07:09.0718 9756 MpFilter - ok 18:07:09.0758 9756 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys 18:07:09.0897 9756 mpio - ok 18:07:09.0921 9756 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys 18:07:09.0948 9756 mpsdrv - ok 18:07:10.0005 9756 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll 18:07:10.0025 9756 MpsSvc - ok 18:07:10.0043 9756 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys 18:07:10.0079 9756 MRxDAV - ok 18:07:10.0127 9756 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys 18:07:10.0167 9756 mrxsmb - ok 18:07:10.0218 9756 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys 18:07:10.0258 9756 mrxsmb10 - ok 18:07:10.0290 9756 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys 18:07:10.0322 9756 mrxsmb20 - ok 18:07:10.0345 9756 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys 18:07:10.0488 9756 msahci - ok 18:07:10.0517 9756 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys 18:07:10.0674 9756 msdsm - ok 18:07:10.0692 9756 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe 18:07:10.0749 9756 MSDTC - ok 18:07:10.0783 9756 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys 18:07:10.0829 9756 Msfs - ok 18:07:10.0857 9756 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys 18:07:10.0876 9756 mshidkmdf - ok 18:07:10.0897 9756 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys 18:07:10.0905 9756 msisadrv - ok 18:07:10.0945 9756 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll 18:07:10.0997 9756 MSiSCSI - ok 18:07:11.0006 9756 msiserver - ok 18:07:11.0026 9756 [ F928E5E72BBA15DD0CE9A26E0413D236 ] MSK80Service C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 18:07:11.0030 9756 MSK80Service - ok 18:07:11.0057 9756 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys 18:07:11.0078 9756 MSKSSRV - ok 18:07:11.0220 9756 [ E07DEC52FF801841BA9B6878A60304FB ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe 18:07:11.0221 9756 MsMpSvc - ok 18:07:11.0251 9756 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys 18:07:11.0293 9756 MSPCLOCK - ok 18:07:11.0334 9756 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys 18:07:11.0358 9756 MSPQM - ok 18:07:11.0388 9756 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys 18:07:11.0489 9756 MsRPC - ok 18:07:11.0514 9756 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys 18:07:11.0524 9756 mssmbios - ok 18:07:11.0547 9756 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys 18:07:11.0567 9756 MSTEE - ok 18:07:11.0606 9756 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\drivers\MTConfig.sys 18:07:11.0626 9756 MTConfig - ok 18:07:11.0655 9756 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys 18:07:11.0667 9756 Mup - ok 18:07:11.0739 9756 [ 4BBB9D9C4DF259FAE2D172C5BB25DDD0 ] MyWiFiDHCPDNS C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe 18:07:11.0881 9756 MyWiFiDHCPDNS - ok 18:07:11.0928 9756 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll 18:07:11.0990 9756 napagent - ok 18:07:12.0035 9756 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys 18:07:12.0042 9756 NativeWifiP - ok 18:07:12.0098 9756 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys 18:07:12.0118 9756 NDIS - ok 18:07:12.0168 9756 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys 18:07:12.0192 9756 NdisCap - ok 18:07:12.0206 9756 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys 18:07:12.0234 9756 NdisTapi - ok 18:07:12.0246 9756 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys 18:07:12.0249 9756 Ndisuio - ok 18:07:12.0271 9756 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys 18:07:12.0307 9756 NdisWan - ok 18:07:12.0344 9756 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys 18:07:12.0374 9756 NDProxy - ok 18:07:12.0398 9756 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys 18:07:12.0426 9756 NetBIOS - ok 18:07:12.0450 9756 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys 18:07:12.0456 9756 NetBT - ok 18:07:12.0476 9756 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe 18:07:12.0480 9756 Netlogon - ok 18:07:12.0537 9756 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll 18:07:12.0591 9756 Netman - ok 18:07:12.0628 9756 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 18:07:12.0776 9756 NetMsmqActivator - ok 18:07:12.0785 9756 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 18:07:12.0789 9756 NetPipeActivator - ok 18:07:12.0839 9756 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll 18:07:12.0852 9756 netprofm - ok 18:07:12.0872 9756 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 18:07:12.0876 9756 NetTcpActivator - ok 18:07:12.0887 9756 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 18:07:12.0891 9756 NetTcpPortSharing - ok 18:07:13.0167 9756 [ AC69618DE5BCCE8747C9AB0AAE1003C1 ] NETwNs64 C:\Windows\system32\DRIVERS\NETwNs64.sys 18:07:13.0408 9756 NETwNs64 - ok 18:07:13.0458 9756 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys 18:07:13.0468 9756 nfrd960 - ok 18:07:13.0538 9756 [ 162100E0BC8377710F9D170631921C03 ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys 18:07:13.0675 9756 NisDrv - ok 18:07:13.0733 9756 [ C6E15F2F95F9C0A6098D43510B604E52 ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe 18:07:13.0868 9756 NisSrv - ok 18:07:13.0919 9756 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll 18:07:13.0979 9756 NlaSvc - ok 18:07:14.0021 9756 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys 18:07:14.0046 9756 Npfs - ok 18:07:14.0086 9756 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll 18:07:14.0131 9756 nsi - ok 18:07:14.0156 9756 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys 18:07:14.0159 9756 nsiproxy - ok 18:07:14.0224 9756 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys 18:07:14.0356 9756 Ntfs - ok 18:07:14.0410 9756 [ 317020D31F1696334679B9D0416EB62E ] NuidFltr C:\Windows\system32\DRIVERS\NuidFltr.sys 18:07:14.0412 9756 NuidFltr - ok 18:07:14.0425 9756 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys 18:07:14.0444 9756 Null - ok 18:07:14.0482 9756 [ A85B4F2EF3A7304A5399EF0526423040 ] NVENETFD C:\Windows\system32\DRIVERS\nvm62x64.sys 18:07:14.0523 9756 NVENETFD - ok 18:07:14.0554 9756 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys 18:07:14.0693 9756 nvraid - ok 18:07:14.0705 9756 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys 18:07:14.0844 9756 nvstor - ok 18:07:14.0861 9756 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys 18:07:14.0877 9756 nv_agp - ok 18:07:14.0897 9756 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys 18:07:14.0925 9756 ohci1394 - ok 18:07:15.0014 9756 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 18:07:15.0175 9756 ose - ok 18:07:15.0449 9756 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 18:07:15.0910 9756 osppsvc - ok 18:07:15.0988 9756 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll 18:07:16.0041 9756 p2pimsvc - ok 18:07:16.0066 9756 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll 18:07:16.0119 9756 p2psvc - ok 18:07:16.0154 9756 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\drivers\parport.sys 18:07:16.0203 9756 Parport - ok 18:07:16.0235 9756 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys 18:07:16.0373 9756 partmgr - ok 18:07:16.0416 9756 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll 18:07:16.0479 9756 PcaSvc - ok 18:07:16.0525 9756 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys 18:07:16.0672 9756 pci - ok 18:07:16.0694 9756 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys 18:07:16.0705 9756 pciide - ok 18:07:16.0727 9756 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\drivers\pcmcia.sys 18:07:16.0742 9756 pcmcia - ok 18:07:16.0760 9756 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys 18:07:16.0769 9756 pcw - ok 18:07:16.0829 9756 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys 18:07:16.0867 9756 PEAUTH - ok 18:07:16.0987 9756 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe 18:07:17.0031 9756 PerfHost - ok 18:07:17.0123 9756 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll 18:07:17.0236 9756 pla - ok 18:07:17.0329 9756 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll 18:07:17.0394 9756 PlugPlay - ok 18:07:17.0428 9756 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll 18:07:17.0478 9756 PNRPAutoReg - ok 18:07:17.0500 9756 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll 18:07:17.0508 9756 PNRPsvc - ok 18:07:17.0546 9756 [ 4F0878FD62D5F7444C5F1C4C66D9D293 ] Point64 C:\Windows\system32\DRIVERS\point64.sys 18:07:17.0550 9756 Point64 - ok 18:07:17.0607 9756 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll 18:07:17.0667 9756 PolicyAgent - ok 18:07:17.0691 9756 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll 18:07:17.0748 9756 Power - ok 18:07:17.0803 9756 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys 18:07:17.0833 9756 PptpMiniport - ok 18:07:17.0859 9756 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\drivers\processr.sys 18:07:17.0883 9756 Processor - ok 18:07:17.0934 9756 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll 18:07:18.0020 9756 ProfSvc - ok 18:07:18.0042 9756 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe 18:07:18.0047 9756 ProtectedStorage - ok 18:07:18.0072 9756 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys 18:07:18.0076 9756 Psched - ok 18:07:18.0124 9756 [ 87B04878A6D59D6C79251DC960C674C1 ] PxHlpa64 C:\Windows\system32\Drivers\PxHlpa64.sys 18:07:18.0262 9756 PxHlpa64 - ok 18:07:18.0323 9756 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\drivers\ql2300.sys 18:07:18.0379 9756 ql2300 - ok 18:07:18.0414 9756 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\drivers\ql40xx.sys 18:07:18.0424 9756 ql40xx - ok 18:07:18.0468 9756 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll 18:07:18.0531 9756 QWAVE - ok 18:07:18.0548 9756 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys 18:07:18.0597 9756 QWAVEdrv - ok 18:07:18.0629 9756 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys 18:07:18.0652 9756 RasAcd - ok 18:07:18.0680 9756 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys 18:07:18.0709 9756 RasAgileVpn - ok 18:07:18.0753 9756 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll 18:07:18.0831 9756 RasAuto - ok 18:07:18.0865 9756 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys 18:07:18.0896 9756 Rasl2tp - ok 18:07:18.0947 9756 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll 18:07:18.0958 9756 RasMan - ok 18:07:18.0986 9756 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys 18:07:19.0014 9756 RasPppoe - ok 18:07:19.0060 9756 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys 18:07:19.0114 9756 RasSstp - ok 18:07:19.0147 9756 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys 18:07:19.0270 9756 rdbss - ok 18:07:19.0298 9756 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\drivers\rdpbus.sys 18:07:19.0322 9756 rdpbus - ok 18:07:19.0353 9756 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys 18:07:19.0355 9756 RDPCDD - ok 18:07:19.0395 9756 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys 18:07:19.0407 9756 RDPENCDD - ok 18:07:19.0436 9756 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys 18:07:19.0438 9756 RDPREFMP - ok 18:07:19.0480 9756 [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys 18:07:19.0530 9756 RdpVideoMiniport - ok 18:07:19.0574 9756 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys 18:07:19.0608 9756 RDPWD - ok 18:07:19.0644 9756 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys 18:07:19.0787 9756 rdyboost - ok 18:07:19.0866 9756 [ A436F5E7D80BBDBB0826D0F176D5BEA8 ] RegSrvc C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe 18:07:20.0020 9756 RegSrvc - ok 18:07:20.0060 9756 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll 18:07:20.0110 9756 RemoteAccess - ok 18:07:20.0157 9756 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll 18:07:20.0211 9756 RemoteRegistry - ok 18:07:20.0240 9756 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll 18:07:20.0288 9756 RpcEptMapper - ok 18:07:20.0322 9756 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe 18:07:20.0353 9756 RpcLocator - ok 18:07:20.0410 9756 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll 18:07:20.0422 9756 RpcSs - ok 18:07:20.0500 9756 [ 9D21618E7A3B2C75CF1A2ECBBE723730 ] RSPCIESTOR C:\Windows\system32\DRIVERS\RtsPStor.sys 18:07:20.0507 9756 RSPCIESTOR - ok 18:07:20.0539 9756 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys 18:07:20.0543 9756 rspndr - ok 18:07:20.0564 9756 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe 18:07:20.0569 9756 SamSs - ok 18:07:20.0588 9756 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys 18:07:20.0723 9756 sbp2port - ok 18:07:20.0763 9756 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll 18:07:20.0826 9756 SCardSvr - ok 18:07:20.0840 9756 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys 18:07:20.0862 9756 scfilter - ok 18:07:20.0909 9756 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll 18:07:21.0030 9756 Schedule - ok 18:07:21.0069 9756 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll 18:07:21.0073 9756 SCPolicySvc - ok 18:07:21.0102 9756 [ 111E0EBC0AD79CB0FA014B907B231CF0 ] sdbus C:\Windows\system32\DRIVERS\sdbus.sys 18:07:21.0138 9756 sdbus - ok 18:07:21.0190 9756 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll 18:07:21.0289 9756 SDRSVC - ok 18:07:21.0371 9756 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys 18:07:21.0397 9756 secdrv - ok 18:07:21.0429 9756 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll 18:07:21.0479 9756 seclogon - ok 18:07:21.0505 9756 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll 18:07:21.0511 9756 SENS - ok 18:07:21.0579 9756 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll 18:07:21.0629 9756 SensrSvc - ok 18:07:21.0660 9756 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\drivers\serenum.sys 18:07:21.0681 9756 Serenum - ok 18:07:21.0725 9756 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\drivers\serial.sys 18:07:21.0751 9756 Serial - ok 18:07:21.0788 9756 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\drivers\sermouse.sys 18:07:21.0810 9756 sermouse - ok 18:07:21.0852 9756 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll 18:07:21.0906 9756 SessionEnv - ok 18:07:21.0946 9756 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys 18:07:21.0967 9756 sffdisk - ok 18:07:21.0981 9756 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys 18:07:22.0017 9756 sffp_mmc - ok 18:07:22.0048 9756 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys 18:07:22.0068 9756 sffp_sd - ok 18:07:22.0102 9756 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys 18:07:22.0123 9756 sfloppy - ok 18:07:22.0157 9756 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll 18:07:22.0247 9756 SharedAccess - ok 18:07:22.0295 9756 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll 18:07:22.0357 9756 ShellHWDetection - ok 18:07:22.0390 9756 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys 18:07:22.0401 9756 SiSRaid2 - ok 18:07:22.0425 9756 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys 18:07:22.0437 9756 SiSRaid4 - ok 18:07:22.0498 9756 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe 18:07:32.0048 9756 SkypeUpdate - ok 18:07:32.0084 9756 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys 18:07:32.0136 9756 Smb - ok 18:07:32.0207 9756 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe 18:07:32.0247 9756 SNMPTRAP - ok 18:07:32.0287 9756 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys 18:07:32.0297 9756 spldr - ok 18:07:32.0338 9756 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe 18:07:32.0351 9756 Spooler - ok 18:07:32.0462 9756 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe 18:07:32.0896 9756 sppsvc - ok 18:07:32.0981 9756 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll 18:07:33.0033 9756 sppuinotify - ok 18:07:33.0058 9756 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys 18:07:33.0106 9756 srv - ok 18:07:33.0133 9756 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys 18:07:33.0179 9756 srv2 - ok 18:07:33.0311 9756 [ 0C4540311E11664B245A263E1154CEF8 ] SrvHsfHDA C:\Windows\system32\DRIVERS\VSTAZL6.SYS 18:07:33.0372 9756 SrvHsfHDA - ok 18:07:33.0436 9756 [ 02071D207A9858FBE3A48CBFD59C4A04 ] SrvHsfV92 C:\Windows\system32\DRIVERS\VSTDPV6.SYS 18:07:33.0549 9756 SrvHsfV92 - ok 18:07:33.0588 9756 [ 18E40C245DBFAF36FD0134A7EF2DF396 ] SrvHsfWinac C:\Windows\system32\DRIVERS\VSTCNXT6.SYS 18:07:33.0644 9756 SrvHsfWinac - ok 18:07:33.0680 9756 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys 18:07:33.0725 9756 srvnet - ok 18:07:33.0775 9756 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll 18:07:33.0856 9756 SSDPSRV - ok 18:07:33.0891 9756 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll 18:07:33.0897 9756 SstpSvc - ok 18:07:33.0986 9756 [ A6B2EC3A2B6AD7C3F7B2F3495CADE4C0 ] STacSV C:\Program Files\IDT\WDM\STacSV64.exe 18:07:33.0992 9756 STacSV - ok 18:07:34.0063 9756 Steam Client Service - ok 18:07:34.0082 9756 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\drivers\stexstor.sys 18:07:34.0090 9756 stexstor - ok 18:07:34.0144 9756 [ EBA98394A7D58F7552C52192BD8FA7E6 ] STHDA C:\Windows\system32\DRIVERS\stwrt64.sys 18:07:34.0156 9756 STHDA - ok 18:07:34.0189 9756 [ DECACB6921DED1A38642642685D77DAC ] StillCam C:\Windows\system32\DRIVERS\serscan.sys 18:07:34.0210 9756 StillCam - ok 18:07:34.0269 9756 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll 18:07:34.0363 9756 stisvc - ok 18:07:34.0396 9756 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys 18:07:34.0407 9756 swenum - ok 18:07:34.0468 9756 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll 18:07:34.0483 9756 swprv - ok 18:07:34.0546 9756 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll 18:07:34.0584 9756 SysMain - ok 18:07:34.0624 9756 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll 18:07:34.0677 9756 TabletInputService - ok 18:07:34.0701 9756 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll 18:07:34.0712 9756 TapiSrv - ok 18:07:34.0730 9756 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll 18:07:34.0794 9756 TBS - ok 18:07:34.0906 9756 [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip C:\Windows\system32\drivers\tcpip.sys 18:07:35.0044 9756 Tcpip - ok 18:07:35.0116 9756 [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys 18:07:35.0145 9756 TCPIP6 - ok 18:07:35.0220 9756 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys 18:07:35.0248 9756 tcpipreg - ok 18:07:35.0299 9756 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys 18:07:35.0319 9756 TDPIPE - ok 18:07:35.0341 9756 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys 18:07:35.0362 9756 TDTCP - ok 18:07:35.0416 9756 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys 18:07:35.0448 9756 tdx - ok 18:07:35.0473 9756 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys 18:07:35.0572 9756 TermDD - ok 18:07:35.0627 9756 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll 18:07:35.0700 9756 TermService - ok 18:07:35.0721 9756 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll 18:07:35.0772 9756 Themes - ok 18:07:35.0828 9756 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll 18:07:35.0832 9756 THREADORDER - ok 18:07:35.0890 9756 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll 18:07:35.0944 9756 TrkWks - ok 18:07:36.0009 9756 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe 18:07:36.0014 9756 TrustedInstaller - ok 18:07:36.0038 9756 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys 18:07:36.0061 9756 tssecsrv - ok 18:07:36.0112 9756 [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys 18:07:36.0140 9756 TsUsbFlt - ok 18:07:36.0157 9756 [ AD64450A4ABE076F5CB34CC08EEACB07 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys 18:07:36.0183 9756 TsUsbGD - ok 18:07:36.0222 9756 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys 18:07:36.0226 9756 tunnel - ok 18:07:36.0253 9756 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\drivers\uagp35.sys 18:07:36.0264 9756 uagp35 - ok 18:07:36.0311 9756 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys 18:07:36.0358 9756 udfs - ok 18:07:36.0414 9756 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe 18:07:36.0457 9756 UI0Detect - ok 18:07:36.0486 9756 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys 18:07:36.0496 9756 uliagpkx - ok 18:07:36.0534 9756 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys 18:07:36.0558 9756 umbus - ok 18:07:36.0603 9756 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\drivers\umpass.sys 18:07:36.0625 9756 UmPass - ok 18:07:36.0796 9756 [ E91F8AFBD7FB96C94B266579D6BFA77A ] UNS C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe 18:07:37.0107 9756 UNS - ok 18:07:37.0194 9756 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll 18:07:37.0267 9756 upnphost - ok 18:07:37.0295 9756 [ AA33FC47ED58C34E6E9261E4F850B7EB ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys 18:07:37.0330 9756 USBAAPL64 - ok 18:07:37.0373 9756 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys 18:07:37.0399 9756 usbccgp - ok 18:07:37.0438 9756 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys 18:07:37.0499 9756 usbcir - ok 18:07:37.0531 9756 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\drivers\usbehci.sys 18:07:37.0534 9756 usbehci - ok 18:07:37.0579 9756 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys 18:07:37.0623 9756 usbhub - ok 18:07:37.0659 9756 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys 18:07:37.0680 9756 usbohci - ok 18:07:37.0704 9756 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\drivers\usbprint.sys 18:07:37.0724 9756 usbprint - ok 18:07:37.0744 9756 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS 18:07:37.0773 9756 USBSTOR - ok 18:07:37.0795 9756 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys 18:07:37.0815 9756 usbuhci - ok 18:07:37.0861 9756 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys 18:07:37.0896 9756 usbvideo - ok 18:07:37.0949 9756 [ 7B28E2FBE75115660FAB31079C0A9F29 ] usb_rndisx C:\Windows\system32\drivers\usb8023x.sys 18:07:37.0969 9756 usb_rndisx - ok 18:07:38.0012 9756 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll 18:07:38.0063 9756 UxSms - ok 18:07:38.0087 9756 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe 18:07:38.0090 9756 VaultSvc - ok 18:07:38.0106 9756 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys 18:07:38.0118 9756 vdrvroot - ok 18:07:38.0180 9756 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe 18:07:38.0287 9756 vds - ok 18:07:38.0317 9756 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys 18:07:38.0338 9756 vga - ok 18:07:38.0356 9756 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys 18:07:38.0398 9756 VgaSave - ok 18:07:38.0450 9756 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys 18:07:38.0591 9756 vhdmp - ok 18:07:38.0609 9756 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys 18:07:38.0620 9756 viaide - ok 18:07:38.0666 9756 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys 18:07:38.0802 9756 volmgr - ok 18:07:38.0828 9756 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys 18:07:38.0836 9756 volmgrx - ok 18:07:38.0861 9756 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys 18:07:39.0008 9756 volsnap - ok 18:07:39.0042 9756 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys 18:07:39.0059 9756 vsmraid - ok 18:07:39.0143 9756 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe 18:07:39.0179 9756 VSS - ok 18:07:39.0247 9756 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys 18:07:39.0270 9756 vwifibus - ok 18:07:39.0307 9756 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys 18:07:39.0310 9756 vwififlt - ok 18:07:39.0353 9756 [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys 18:07:39.0356 9756 vwifimp - ok 18:07:39.0401 9756 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll 18:07:39.0465 9756 W32Time - ok 18:07:39.0506 9756 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\drivers\wacompen.sys 18:07:39.0545 9756 WacomPen - ok 18:07:39.0587 9756 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys 18:07:39.0625 9756 WANARP - ok 18:07:39.0640 9756 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys 18:07:39.0643 9756 Wanarpv6 - ok 18:07:39.0731 9756 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe 18:07:39.0950 9756 WatAdminSvc - ok 18:07:40.0035 9756 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe 18:07:40.0193 9756 wbengine - ok 18:07:40.0228 9756 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll 18:07:40.0284 9756 WbioSrvc - ok 18:07:40.0316 9756 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll 18:07:40.0374 9756 wcncsvc - ok 18:07:40.0413 9756 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll 18:07:40.0465 9756 WcsPlugInService - ok 18:07:40.0482 9756 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\drivers\wd.sys 18:07:40.0495 9756 Wd - ok 18:07:40.0557 9756 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys 18:07:40.0714 9756 Wdf01000 - ok 18:07:40.0736 9756 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll 18:07:40.0790 9756 WdiServiceHost - ok 18:07:40.0801 9756 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll 18:07:40.0808 9756 WdiSystemHost - ok 18:07:40.0854 9756 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll 18:07:40.0916 9756 WebClient - ok 18:07:40.0953 9756 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll 18:07:41.0014 9756 Wecsvc - ok 18:07:41.0042 9756 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll 18:07:41.0095 9756 wercplsupport - ok 18:07:41.0140 9756 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll 18:07:41.0195 9756 WerSvc - ok 18:07:41.0225 9756 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys 18:07:41.0229 9756 WfpLwf - ok 18:07:41.0256 9756 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys 18:07:41.0263 9756 WIMMount - ok 18:07:41.0285 9756 WinDefend - ok 18:07:41.0311 9756 WinHttpAutoProxySvc - ok 18:07:41.0383 9756 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll 18:07:41.0461 9756 Winmgmt - ok 18:07:41.0544 9756 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll 18:07:41.0651 9756 WinRM - ok 18:07:41.0702 9756 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUSB.sys 18:07:41.0705 9756 WinUsb - ok 18:07:41.0762 9756 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll 18:07:41.0785 9756 Wlansvc - ok 18:07:41.0860 9756 [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe 18:07:41.0993 9756 wlcrasvc - ok 18:07:42.0133 9756 [ 2BACD71123F42CEA603F4E205E1AE337 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 18:07:42.0273 9756 wlidsvc - ok 18:07:42.0295 9756 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys 18:07:42.0315 9756 WmiAcpi - ok 18:07:42.0356 9756 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe 18:07:42.0407 9756 wmiApSrv - ok 18:07:42.0441 9756 WMPNetworkSvc - ok 18:07:42.0524 9756 [ 83B6CA03C846FCD47F9883D77D1EB27B ] WMZuneComm C:\Program Files\Zune\WMZuneComm.exe 18:07:42.0664 9756 WMZuneComm - ok 18:07:42.0697 9756 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll 18:07:42.0742 9756 WPCSvc - ok 18:07:42.0764 9756 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll 18:07:42.0820 9756 WPDBusEnum - ok 18:07:42.0839 9756 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys 18:07:42.0861 9756 ws2ifsl - ok 18:07:42.0903 9756 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll 18:07:42.0957 9756 wscsvc - ok 18:07:42.0968 9756 WSearch - ok 18:07:43.0061 9756 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll 18:07:43.0112 9756 wuauserv - ok 18:07:43.0164 9756 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys 18:07:43.0195 9756 WudfPf - ok 18:07:43.0254 9756 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys 18:07:43.0259 9756 WUDFRd - ok 18:07:43.0319 9756 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll 18:07:43.0370 9756 wudfsvc - ok 18:07:43.0395 9756 [ CE8CF9DE9CBFDAA318BD04D8BE3FCADA ] WwanSvc C:\Windows\System32\wwansvc.dll 18:07:43.0455 9756 WwanSvc - ok 18:07:43.0699 9756 [ 67B787C34FB2888D01B130AE007042D8 ] ZuneNetworkSvc C:\Program Files\Zune\ZuneNss.exe 18:07:44.0103 9756 ZuneNetworkSvc - ok 18:07:44.0170 9756 [ 4D89FC1C20CF655739EFAC5DA81A67BC ] ZuneWlanCfgSvc C:\Program Files\Zune\ZuneWlanCfgSvc.exe 18:07:44.0334 9756 ZuneWlanCfgSvc - ok 18:07:44.0379 9756 ================ Scan global =============================== 18:07:44.0417 9756 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll 18:07:44.0461 9756 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll 18:07:44.0479 9756 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll 18:07:44.0523 9756 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll 18:07:44.0555 9756 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe 18:07:44.0564 9756 [Global] - ok 18:07:44.0564 9756 ================ Scan MBR ================================== 18:07:44.0574 9756 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0 18:07:44.0854 9756 \Device\Harddisk0\DR0 - ok 18:07:44.0855 9756 ================ Scan VBR ================================== 18:07:44.0872 9756 [ 3500198D9DA93D967528745B6F4D5338 ] \Device\Harddisk0\DR0\Partition1 18:07:44.0876 9756 \Device\Harddisk0\DR0\Partition1 - ok 18:07:44.0891 9756 [ AD59012D9C56B75FEE2AFFF9EC43836F ] \Device\Harddisk0\DR0\Partition2 18:07:44.0894 9756 \Device\Harddisk0\DR0\Partition2 - ok 18:07:44.0928 9756 [ 7D111ACF4E4A5B4324E6B8D32ED10423 ] \Device\Harddisk0\DR0\Partition3 18:07:44.0931 9756 \Device\Harddisk0\DR0\Partition3 - ok 18:07:44.0949 9756 [ 673D047503099A9EA6D82EC855FE9B76 ] \Device\Harddisk0\DR0\Partition4 18:07:44.0951 9756 \Device\Harddisk0\DR0\Partition4 - ok 18:07:44.0952 9756 ============================================================ 18:07:44.0952 9756 Scan finished 18:07:44.0952 9756 ============================================================ 18:07:44.0973 1312 Detected object count: 0 18:07:44.0973 1312 Actual detected object count: 0 OTL stopped responding when it got to "Scanning FireFox settings…"

mowman

Post #4April 8, 2013, 9:45 AM UTC

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error

gino5555

Post #5April 9, 2013, 12:07 AM UTC

I loaded combofix. It noted that McAfee was still running. I was unable to disable it. I tried to uninstall it, but that failed also. Ran combofix anyway. It took about 20-30 minutes to run then froze at "Preparing Log Report". I will let it continue to run, but it's been there for about 10 minutes now.

gino5555

Post #6April 9, 2013, 2:50 AM UTC

I was finally able to uninstall McAfee and am running ComboFix again.

gino5555

Post #7April 9, 2013, 3:16 AM UTC

It got stuck again and I have the window that pops up that says "WARNING RegistryCLEANER has found 8 Errors" by UTILILAB - I'm going to try and find and uninstall that.

mowman

Post #8April 9, 2013, 12:55 PM UTC

See if there is a log located here C:\ComboFix.txt

gino5555

Post #9April 9, 2013, 1:07 PM UTC

Yes, it was there! I also deleted that other utility I noted previously. Reran and it still froze. ComboFix 13-04-08.04 - Admin 04/08/2013 20:19:08.4.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6092.4250 [GMT -7:00] Running from: C:\Users\[removed]\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5} SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ((((((((((((((((((((((((( Files Created from 2013-03-09 to 2013-04-09 ))))))))))))))))))))))))))))))) 2013-04-09 03:25:36 . 2013-04-09 03:25:36 ——– d—–w- C:\Users\Default\AppData\Local\temp 2013-04-09 03:25:36 . 2013-04-09 03:25:36 ——– d—–w- C:\Users\Brandon\AppData\Local\temp 2013-04-09 03:25:36 . 2013-04-09 03:25:36 ——– d—–w- C:\Users\ADMINI~1\AppData\Local\temp 2013-04-08 23:05:37 . 2013-03-15 06:28:52 9311288 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F3CA7574-3F3C-4428-8AB3-14BD92975190}\mpengine.dll 2013-04-08 14:20:22 . 2013-04-08 14:20:22 ——– d—–w- C:\Users\Admin\AppData\Local\ElevatedDiagnostics 2013-04-08 01:00:31 . 2013-04-08 15:55:28 ——– d—–w- C:\Users\NULL 2013-04-07 16:28:48 . 2013-03-15 06:28:52 9311288 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2013-03-21 00:32:37 . 2012-11-28 20:13:45 972264 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0599DBEE-28B3-425D-849E-98C089E7F4DC}\gapaengine.dll 2013-03-20 02:37:33 . 2013-03-26 03:07:21 ——– d—–w- C:\Users\Brandon\AppData\Roaming\.technic 2013-03-16 19:06:02 . 2013-03-16 19:06:02 ——– d—–w- C:\Users\Brandon\AppData\Roaming\Skyworxz 2013-03-14 15:59:01 . 2013-03-14 15:59:04 ——– d—–w- C:\Program Files\Microsoft Silverlight 2013-03-14 15:59:01 . 2013-03-14 15:59:04 ——– d—–w- C:\Program Files (x86)\Microsoft Silverlight 2013-03-14 15:56:59 . 2013-02-12 04:12:05 19968 —-a-w- C:\Windows\system32\drivers\usb8023.sys 2013-03-14 15:56:58 . 2013-02-12 04:12:06 19968 —-a-w- C:\Windows\system32\drivers\usb8023x.sys 2013-03-12 01:48:50 . 2013-03-12 01:48:50 ——– d—–w- C:\ProgramData\{9BF4D58B-C6D6-467B-BC5A-FD0C1278F4AF} . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2013-04-02 10:34:28 . 2010-11-21 03:27:21 282744 ——w- C:\Windows\system32\MpSigStub.exe 2013-03-14 16:05:28 . 2011-09-12 23:11:52 72013344 —-a-w- C:\Windows\system32\MRT.exe 2013-03-14 00:27:20 . 2012-04-12 13:35:27 693976 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2013-03-14 00:27:20 . 2011-07-09 00:23:47 73432 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2013-03-03 16:30:06 . 2013-03-03 16:30:16 95648 —-a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll 2013-03-03 16:30:02 . 2012-06-04 22:22:27 861088 —-a-w- C:\Windows\SysWow64\npDeployJava1.dll 2013-03-03 16:30:02 . 2012-01-12 14:52:23 782240 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2013-02-12 05:45:24 . 2013-03-13 16:18:17 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45:22 . 2013-03-13 16:18:18 308736 —-a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45:22 . 2013-03-13 16:18:17 350208 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 05:45:22 . 2013-03-13 16:18:17 111104 —-a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 04:48:31 . 2013-03-13 16:18:18 474112 —-a-w- C:\Windows\apppatch\AcSpecfc.dll 2013-02-12 04:48:26 . 2013-03-13 16:18:18 2176512 —-a-w- C:\Windows\apppatch\AcGenral.dll 2013-01-20 22:59:04 . 2013-01-20 22:59:04 230320 —-a-w- C:\Windows\system32\drivers\MpFilter.sys 2013-01-20 22:59:04 . 2011-04-27 22:25:24 130008 —-a-w- C:\Windows\system32\drivers\NisDrvWFP.sys 2013-01-13 21:17:03 . 2013-02-27 10:50:32 9728 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-01-13 21:17:02 . 2013-02-27 10:50:32 2560 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-01-13 21:16:42 . 2013-02-27 10:50:32 10752 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-01-13 21:12:46 . 2013-02-27 10:50:32 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-01-13 21:11:21 . 2013-02-27 10:50:30 4096 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll 2013-01-13 21:11:08 . 2013-02-27 10:50:30 5632 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-01-13 21:11:07 . 2013-02-27 10:50:30 5632 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-01-13 21:11:07 . 2013-02-27 10:50:30 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll 2013-01-13 21:11:07 . 2013-02-27 10:50:30 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-01-13 20:35:31 . 2013-02-27 10:50:32 9728 —ha-w- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-01-13 20:35:31 . 2013-02-27 10:50:31 2560 —ha-w- C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-01-13 20:35:18 . 2013-02-27 10:50:32 10752 —ha-w- C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-01-13 20:32:07 . 2013-02-27 10:50:32 3584 —ha-w- C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-01-13 20:31:48 . 2013-02-27 10:50:30 4096 —ha-w- C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2013-01-13 20:31:41 . 2013-02-27 10:50:30 5632 —ha-w- C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-01-13 20:31:40 . 2013-02-27 10:50:30 5632 —ha-w- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-01-13 20:31:40 . 2013-02-27 10:50:30 3072 —ha-w- C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2013-01-13 20:31:40 . 2013-02-27 10:50:30 3072 —ha-w- C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-01-13 20:31:00 . 2013-02-27 10:50:29 1247744 —-a-w- C:\Windows\SysWow64\DWrite.dll 2013-01-13 20:22:22 . 2013-02-27 10:50:31 1988096 —-a-w- C:\Windows\SysWow64\d3d10warp.dll 2013-01-13 20:20:31 . 2013-02-27 10:50:30 293376 —-a-w- C:\Windows\SysWow64\dxgi.dll 2013-01-13 20:09:00 . 2013-02-27 10:50:30 249856 —-a-w- C:\Windows\SysWow64\d3d10_1core.dll 2013-01-13 20:08:43 . 2013-02-27 10:50:30 220160 —-a-w- C:\Windows\SysWow64\d3d10core.dll 2013-01-13 20:08:35 . 2013-02-27 10:50:30 1504768 —-a-w- C:\Windows\SysWow64\d3d11.dll 2013-01-13 19:59:04 . 2013-02-27 10:50:29 1643520 —-a-w- C:\Windows\system32\DWrite.dll 2013-01-13 19:58:28 . 2013-02-27 10:50:29 1175552 —-a-w- C:\Windows\system32\FntCache.dll 2013-01-13 19:54:01 . 2013-02-27 10:50:30 604160 —-a-w- C:\Windows\SysWow64\d3d10level9.dll 2013-01-13 19:53:58 . 2013-02-27 10:50:29 207872 —-a-w- C:\Windows\SysWow64\WindowsCodecsExt.dll 2013-01-13 19:53:14 . 2013-02-27 10:50:37 187392 —-a-w- C:\Windows\SysWow64\UIAnimation.dll 2013-01-13 19:51:30 . 2013-02-27 10:50:31 2565120 —-a-w- C:\Windows\system32\d3d10warp.dll 2013-01-13 19:49:17 . 2013-02-27 10:50:30 363008 —-a-w- C:\Windows\system32\dxgi.dll 2013-01-13 19:48:47 . 2013-02-27 10:50:31 161792 —-a-w- C:\Windows\SysWow64\d3d10_1.dll 2013-01-13 19:46:25 . 2013-02-27 10:50:29 1080832 —-a-w- C:\Windows\SysWow64\d3d10.dll 2013-01-13 19:43:21 . 2013-02-27 10:50:29 1230336 —-a-w- C:\Windows\SysWow64\WindowsCodecs.dll 2013-01-13 19:38:39 . 2013-02-27 10:50:30 333312 —-a-w- C:\Windows\system32\d3d10_1core.dll 2013-01-13 19:38:32 . 2013-02-27 10:50:30 1887232 —-a-w- C:\Windows\system32\d3d11.dll 2013-01-13 19:38:21 . 2013-02-27 10:50:30 296960 —-a-w- C:\Windows\system32\d3d10core.dll 2013-01-13 19:37:57 . 2013-02-27 10:50:27 3419136 —-a-w- C:\Windows\SysWow64\d2d1.dll 2013-01-13 19:25:04 . 2013-02-27 10:50:29 245248 —-a-w- C:\Windows\system32\WindowsCodecsExt.dll 2013-01-13 19:24:33 . 2013-02-27 10:50:30 648192 —-a-w- C:\Windows\system32\d3d10level9.dll 2013-01-13 19:24:30 . 2013-02-27 10:50:37 221184 —-a-w- C:\Windows\system32\UIAnimation.dll 2013-01-13 19:20:42 . 2013-02-27 10:50:31 194560 —-a-w- C:\Windows\system32\d3d10_1.dll 2013-01-13 19:20:04 . 2013-02-27 10:50:29 1238528 —-a-w- C:\Windows\system32\d3d10.dll 2013-01-13 19:15:40 . 2013-02-27 10:50:29 1424384 —-a-w- C:\Windows\system32\WindowsCodecs.dll 2013-01-13 19:10:36 . 2013-02-27 10:50:28 3928064 —-a-w- C:\Windows\system32\d2d1.dll 2013-01-13 19:02:06 . 2013-02-27 10:50:34 417792 —-a-w- C:\Windows\SysWow64\WMPhoto.dll 2013-01-13 18:34:58 . 2013-02-27 10:50:30 364544 —-a-w- C:\Windows\SysWow64\XpsGdiConverter.dll 2013-01-13 18:32:43 . 2013-02-27 10:50:34 465920 —-a-w- C:\Windows\system32\WMPhoto.dll 2013-01-13 18:09:52 . 2013-02-27 10:50:31 522752 —-a-w- C:\Windows\system32\XpsGdiConverter.dll 2013-01-13 17:26:42 . 2013-02-27 10:50:29 1158144 —-a-w- C:\Windows\SysWow64\XpsPrint.dll 2013-01-13 17:05:09 . 2013-02-27 10:50:29 1682432 —-a-w- C:\Windows\system32\XpsPrint.dll 2013-01-12 21:51:01 . 2013-01-12 21:51:15 108008 —-a-w- C:\Windows\system32\WindowsAccessBridge-64.dll 2013-01-12 21:50:59 . 2013-01-12 21:51:52 308200 —-a-w- C:\Windows\system32\javaws.exe 2013-01-12 21:50:59 . 2013-01-12 21:51:15 188392 —-a-w- C:\Windows\system32\javaw.exe 2013-01-12 21:50:58 . 2013-01-12 21:51:15 188392 —-a-w- C:\Windows\system32\java.exe 2013-01-12 21:50:57 . 2013-01-12 21:51:52 959976 —-a-w- C:\Windows\system32\deployJava1.dll 2013-01-12 21:50:57 . 2013-01-12 21:51:52 1081320 —-a-w- C:\Windows\system32\npDeployJava1.dll 2012-07-11 18:33:39 . 2012-07-11 18:33:39 4024320 —-a-w- C:\Program Files (x86)\GUT58F0.tmp ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110011221158}] C:\Program Files (x86)\I Want This\I Want This.dll [BU] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}] 2012-05-11 21:59:40 194928 —-a-w- C:\Program Files (x86)\Yontoo\YontooIEClient.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="C:\Program Files (x86)\Steam\steam.exe" [2013-03-29 19:53:56 1631144] "DW6"="C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe" [BU] "DW7"="C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe" [BU] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "HP CoolSense"="C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe" [2012-11-05 23:14:34 1343904] "HPOSD"="C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 21:48:44 379960] "Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-24 03:43:34 926896] "SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 16:04:54 252848] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 21:27:14 138576] R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2012-09-27 18:55:16 86528] R2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-07-13 20:28:36 160944] R3 AMPPALP;Intel® Centrino® Bluetooth 3.0 + High Speed Protocol;C:\Windows\system32\DRIVERS\amppal.sys [2011-04-21 16:09:26 294912] R3 dc3d;MS Hardware Device Detection Driver (USB);C:\Windows\system32\DRIVERS\dc3d.sys [2011-07-29 02:37:10 52584] R3 intaud_WaveExtensible;Intel WiDi Audio Device;C:\Windows\system32\drivers\intelaud.sys [2011-05-17 16:27:50 34200] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2011-05-02 21:13:54 340240] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 22:59:04 130008] R3 NisSrv;Microsoft Network Inspection;c:\Program Files\Microsoft Security Client\NisSrv.exe [2013-01-27 18:34:32 379360] R3 Point64;Microsoft IntelliPoint Filter Driver;C:\Windows\system32\DRIVERS\point64.sys [2011-08-01 23:59:06 45416] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14:10:20 19456] R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\system32\DRIVERS\RtsPStor.sys [2011-03-25 00:20:36 337512] R3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 21:01:11 292864] R3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 21:01:11 1485312] R3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 21:01:11 740864] R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 14:07:35 57856] R3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 14:08:26 30208] R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys [2011-08-03 01:38:56 51712] R3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe [2011-09-12 23:42:30 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 01:10:10 57184] S0 PxHlpa64;PxHlpa64;C:\Windows\System32\Drivers\PxHlpa64.sys [2010-03-19 10:00:00 55856] S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-30 10:06:46 169408] S2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2009-03-03 10:42:58 89600] S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-04-21 16:34:16 1136640] S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-04-21 15:42:50 134928] S2 FPLService;TrueSuiteService;C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-05-06 06:06:46 263496] S2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 09:48:14 346168] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-11-05 23:14:34 197536] S2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe [2011-05-27 18:20:12 30520] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-04-30 08:32:54 13592] S2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-03-08 00:43:30 2375168] S2 jhi_service;Intel® Identity Protection Technology Host Interface Service;C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [2011-02-24 07:10:24 212944] S2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-02-22 20:19:12 2656280] S3 AMPPAL;Intel® Centrino® Bluetooth 3.0 + High Speed Virtual Adapter;C:\Windows\system32\DRIVERS\AMPPAL.sys [2011-04-21 16:09:26 294912] S3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\system32\DRIVERS\clwvd.sys [2010-07-28 16:13:50 31088] S3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 09:28:16 317440] S3 iwdbus;IWD Bus Enumerator;C:\Windows\system32\drivers\iwdbus.sys [2011-05-17 16:27:52 25496] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys [2011-03-23 18:20:58 77936] [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}] start [BU] [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-03-30 15:02:21 1642448 —-a-w- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\Installer\chrmstp.exe Contents of the 'Scheduled Tasks' folder 2013-04-09 C:\Windows\Tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 13:35:27 . 2013-03-14 00:27:20] 2013-04-09 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-12 21:26:44 . 2012-02-12 21:26:41] 2013-04-09 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-12 21:26:44 . 2012-02-12 21:26:41] 2013-03-12 C:\Windows\Tasks\HPCeeScheduleForAdmin.job - C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15:40 . 2010-09-14 05:15:40] 2013-03-18 C:\Windows\Tasks\HPCeeScheduleForBrandon.job - C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15:40 . 2010-09-14 05:15:40] ——— X64 Entries ———– [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2011-05-09 20:56:34 392472] "Persistence"="C:\Windows\system32\igfxpers.exe" [2011-05-09 20:56:40 416024] "IntelPAN"="C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 21:16:58 1935120] "SysTrayApp"="C:\Program Files\IDT\WDM\sttray64.exe" [2011-05-27 19:06:16 1128448] "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2011-02-19 01:32:02 569200] "IntelliPoint"="c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 23:59:06 2417032] "MSC"="c:\Program Files\Microsoft Security Client\msseces.exe" [2013-01-27 18:34:16 1281512] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache

mowman

Post #10April 9, 2013, 2:22 PM UTC

Is there any more to that log, some of it appears to be missing.

Please download AdwCleaner from here and save it to your desktop.

Right click on AdwCleaner.exe and click "Run as Administrator" to run the tool.
Click on Delete.

A logfile will automatically open after the scan has finished.

Please post the content of that logfile in your reply.

You can find the logfile at C:\AdwCleaner[Rn].txt as well - (n is the scan number.)

Please download Malwarebytes Free from Here or Here

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the log please

gino5555

Post #11April 9, 2013, 6:24 PM UTC

Worked great! # AdwCleaner v2.200 - Logfile created 04/09/2013 at 11:15:47 # Updated 02/04/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Admin - HPDM4 # Boot Mode : Normal # Running from : C:\Users\Admin\Downloads\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\fcmdSrch.xml File Deleted : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lw8v7d3t.default\searchplugins\Askcom.xml File Deleted : C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\c4jlsyfj.default\searchplugins\alot-search.xml File Deleted : C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\c4jlsyfj.default\searchplugins\funmoods.xml Folder Deleted : C:\Program Files (x86)\Free Offers from Freeze.com Folder Deleted : C:\Program Files (x86)\Yontoo Folder Deleted : C:\ProgramData\Babylon Folder Deleted : C:\ProgramData\InstallMate Folder Deleted : C:\ProgramData\Premium Folder Deleted : C:\ProgramData\Tarma Installer Folder Deleted : C:\ProgramData\WeCareReminder Folder Deleted : C:\Users\Admin\AppData\Local\APN Folder Deleted : C:\Users\Admin\AppData\Local\Babylon Folder Deleted : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_mpfapcdfbbledbojijcbcclmlieaoogk_0 Folder Deleted : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihflimipbcaljfnojhhknppphnnciiif Folder Deleted : C:\Users\Admin\AppData\Local\Ilivid Player Folder Deleted : C:\Users\Admin\AppData\LocalLow\AskToolbar Folder Deleted : C:\Users\Admin\AppData\Roaming\Babylon Folder Deleted : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lw8v7d3t.default\extensions\[removed] Folder Deleted : C:\Users\Brandon\AppData\Local\Conduit Folder Deleted : C:\Users\Brandon\AppData\Local\Ilivid Player Folder Deleted : C:\Users\Brandon\AppData\LocalLow\AVG Secure Search Folder Deleted : C:\Users\Brandon\AppData\LocalLow\facemoods.com Folder Deleted : C:\Users\Brandon\AppData\Roaming\Babylon Folder Deleted : C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Uncompressor Folder Deleted : C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\c4jlsyfj.default\extensions\[removed] Folder Deleted : C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\c4jlsyfj.default\extensions\[removed] Folder Deleted : C:\Users\Brandon\Uncompressor ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider Key Deleted : HKCU\Software\AppDataLow\Software\I Want This Key Deleted : HKCU\Software\IGearSettings Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKCU\Software\Softonic Key Deleted : HKCU\Software\wecarereminder Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416D-A838-AB665251703A} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKLM\Software\Babylon Key Deleted : HKLM\Software\BabylonToolbar Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0} Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0002258.BHO Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\I Want This_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\I Want This_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011221158} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110011221158} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220022222258} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{33333333-3333-3333-3333-330033223358} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{55555555-5555-5555-5555-550055225558} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66666666-6666-6666-6666-660066226658} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77777777-7777-7777-7777-770077227758} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\mpfapcdfbbledbojijcbcclmlieaoogk Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65BCD620-07DD-012F-819F-073CF1B8F7C6} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011221158} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\I Want This Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0923E315-2D8B-48CE-A37C-AE9A42F9711C} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1A1BBE49-C6F1-40EA-9D2F-262F0AF6DDE3} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2022154E-7E3E-4809-871E-1B45A6FC7058} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{292ECB89-350E-45D2-816F-52C15305B144} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{36CC2180-B6BF-4951-9578-6B0C40044AAA} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44A36944-22C6-4A08-BC7C-161F3E540DBF} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{542FA950-C57A-4E17-B3E1-D935DFE15DEE} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055225558} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5B035F86-41B5-40F1-AAAD-3D219F30244E} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6247DD2C-8CF9-4041-A235-93691D71B8B4} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6365AC7B-9920-4D8B-AF5D-3BDFEAC340A8} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066226658} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6A934270-717F-4BC3-BA59-BC9BED47A8D2} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{74C012C4-00FB-4F04-9AFB-4AD5449D2018} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077227758} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{78888F8B-D5E4-43CE-89F5-C8C18223AF64} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79B13431-CCAC-4097-8889-D0289E5E924F} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{835BED79-DF7E-4096-B355-ED43FA2EA87B} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8E863BD6-50DE-47D0-A6F1-3C1F6DB72451} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{981334CB-7B8B-431F-B86D-67B7426B125B} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9DD36F1E-5111-41C5-ADED-A2A11A2FF3E4} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A2FB8217-E320-434E-BA79-513E357AD54F} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A9CEBBF4-9129-479A-9231-E833ED3D3A8F} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AFD4D1F9-167C-4884-95AE-B5A9797B0D16} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B3EAD50C-ECB0-459A-9EDA-F505AB99675B} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C47788B1-9604-4D7A-A684-F4D450F2D7D2} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA3B41D0-D4C1-4808-B248-75DA27238828} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D4A2FF6C-087F-4D40-8DFE-92AAD484BFB8} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D88B9D5C-A9CF-4C69-906D-1CCA5D85A2EF} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F83AF01C-AA2F-469F-8BE7-D178FB15FD07} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B} Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com] ***** [Internet Browsers] ***** -\\ Internet Explorer v10.0.9200.16521 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.amazon.com/websearch/ref=bit_bds-amzn_serp_home?ie=UTF8&tagbase=bds-amzn&tbrId=v1_abb-channel-15_c9754ac8d3db483e80ff2dba545da6f7_15_15_20120513_US_ie_sp_W7 –> hxxp://www.google.com Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://start.facemoods.com/?a=adknlg&s={searchTerms}&f=4 –> hxxp://www.google.com -\\ Mozilla Firefox v10.0.2 (en-US) File : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lw8v7d3t.default\prefs.js C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lw8v7d3t.default\user.js … Deleted ! Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com"); Deleted : user_pref("browser.search.order.1", "Search the web (Babylon)"); Deleted : user_pref("browser.startup.homepage", "hxxp://www.amazon.com/websearch/ref=bit_bds-amzn_serp_home?ie[…] Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true); Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=109935&tt=29041[…] Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationThankYouPage", true); Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationTime", 1336191474); Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.searchUserConifr mation", false[…] Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setHomepage", false); Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setNewTab", false); Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setSearch", false); Deleted : user_pref("extensions.crossriderapp2258.2258.active", true); Deleted : user_pref("extensions.crossriderapp2258.2258.addressbar", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.addressbarenhanced", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.affid", "0"); Deleted : user_pref("extensions.crossriderapp2258.2258.backgroundjs", "\n\n//\n"); Deleted : user_pref("extensions.crossriderapp2258.2258.backgroundver", 47); Deleted : user_pref("extensions.crossriderapp2258.2258.can_run_bg_code", true); Deleted : user_pref("extensions.crossriderapp2258.2258.certdomaininstaller", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.changeprevious", false); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.value", "1336191474"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 […] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_aoi.value", "1336191474"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_arbitrary_code.expiration", "Tue Apr 09 201[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_arbitrary_code.value", "%22/**/%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_blocklist.expiration", "Tue Apr 09 2013 11:[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_blocklist.value", "%22nonexistantdomain.com[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_cf_bu1.expiration", "Fri Feb 01 2030 00:00:[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_cf_bu1.value", "1360081449"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_country_code.expiration", "Sat Apr 13 2013 […] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_country_code.value", "%22US%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 […] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_crr.value", "1364528404"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_currenttime.expiration", "Fri Feb 01 2030 0[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_currenttime.value", "%221364833175%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 […] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_hotfix20111102645.value", "%221%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_installer_params.expiration", "Fri Feb 01 2[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_installer_params.value", "%7B%22source_id%2[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_parent_zoneid.value", "%2214019%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 0[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_pc_20120828.value", "1346216194213"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_product_id.value", "%2221%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_zoneid.value", "%2234154%22"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GM[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.dbtest.value", "1346216193780"); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.lastrequest.expiration", "Fri Feb 01 2030 00:00:[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.lastrequest.value", "%7B%22path%22%3A%22/watch%2[…] Deleted : user_pref("extensions.crossriderapp2258.2258.description", "I Want This!"); Deleted : user_pref("extensions.crossriderapp2258.2258.domain", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.emailsig", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.enablesearch", false); Deleted : user_pref("extensions.crossriderapp2258.2258.exposesites", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.fbremoteurl", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.group", 0); Deleted : user_pref("extensions.crossriderapp2258.2258.homepage", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.iframe", false); Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.InstallerIdentifiers.expiratio n", "Fri Feb 0[…] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.InstallerIdentifiers.value", "%7B%22installe[…] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[…] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_appVer.value", "138"); Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_lastVersion.expirati on", "Fri Feb […] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_lastVersion.value", "0"); Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[…] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_meta.value", "%7B%7D"); Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_nextCheck.expiration", "Tue Apr 09[…] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_nextCheck.value", "true"); Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_queue.expiration", "Fri Feb 01 203[…] Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_queue.value", "%7B%7D"); Deleted : user_pref("extensions.crossriderapp2258.2258.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[…] Deleted : user_pref("extensions.crossriderapp2258.2258.manifesturl", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.name", "I Want This"); Deleted : user_pref("extensions.crossriderapp2258.2258.newtab", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.opensearch", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.code", "Array.prototype.indexOf|[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.name", "GPL Plugin (Loader)"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.ver", 15); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.code", "var a=appAPI.db.getList([…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.name", "GPL Background (BG)"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.ver", 35); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.code", "(function(a){a.selectedText=f[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.name", "CrossriderAppUtils"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.ver", 2); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.name", "CrossriderUtils"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.ver", 2); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.code", "if((typeof isBackground===\"u[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.name", "FFAppAPIWrapper"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.ver", 6); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.code", "if(typeof window!==\"undefine[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.name", "jQuery"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.ver", 3); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.code", "(function(){appAPI.ready=func[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.name", "resources_background"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.ver", 2); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_64.code", "(function(){var h=\"__CR_EMPT[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_64.name", "appApiMessage"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_64.ver", 1); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_72.code", "if(appAPI.__should_activate_v[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_72.name", "appApiValidation"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_72.ver", 2); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_78.code", "if(typeof jQuery!==\"undefine[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_78.name", "CrossriderInfo"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_78.ver", 2); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_98.code", "(function(){var b=\"cr_\"+app[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_98.name", "omniCommands"); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_98.ver", 1); Deleted : user_pref("extensions.crossriderapp2258.2258.plugins_lists.plugins_0", "14,78,16,64,47,72,98,1000015[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins_lists.plugins_1", "17,14,78,13,16,64,72,98,1000[…] Deleted : user_pref("extensions.crossriderapp2258.2258.plugins_lists.plugins_5", "14,78,13,16,64,47,72"); Deleted : user_pref("extensions.crossriderapp2258.2258.pluginsurl", "hxxps://w9u6a2p6.ssl.hwcdn.net/plugin/app[…] Deleted : user_pref("extensions.crossriderapp2258.2258.pluginsversion", 63); Deleted : user_pref("extensions.crossriderapp2258.2258.premium", true); Deleted : user_pref("extensions.crossriderapp2258.2258.publisher", "Innovative Apps"); Deleted : user_pref("extensions.crossriderapp2258.2258.searchstatus", 0); Deleted : user_pref("extensions.crossriderapp2258.2258.setnewtab", false); Deleted : user_pref("extensions.crossriderapp2258.2258.settingsurl", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.thankyou", "hxxp://iw.antthis.com/thankyou.html"); Deleted : user_pref("extensions.crossriderapp2258.2258.updateinterval", 360); Deleted : user_pref("extensions.crossriderapp2258.2258.ver", 138); Deleted : user_pref("extensions.crossriderapp2258.adsOldValue", 14); Deleted : user_pref("extensions.crossriderapp2258.apps", "2258"); Deleted : user_pref("extensions.crossriderapp2258.bic", "1374870e01efd03247ea6bf7aab2294f"); Deleted : user_pref("extensions.crossriderapp2258.cid", 2258); Deleted : user_pref("extensions.crossriderapp2258.firstrun", false); Deleted : user_pref("extensions.crossriderapp2258.hadappinstalled", true); Deleted : user_pref("extensions.crossriderapp2258.installationdate", 1336950186); Deleted : user_pref("extensions.crossriderapp2258.lastcheck", 22758853); Deleted : user_pref("extensions.crossriderapp2258.lastcheckitem", 22758855); Deleted : user_pref("extensions.crossriderapp2258.misc.lastBgWorkerTimer", "1342134967181"); Deleted : user_pref("extensions.crossriderapp2258.misc.lastDomWorkerTimer", "1342134967179"); Deleted : user_pref("extensions.crossriderapp2258.modetype", "production"); Deleted : user_pref("extensions.crossriderapp2258.statsDailyCounter", 5); Deleted : user_pref("extensions.enabledAddons", "[removed]:0.91.137,{972ce4c6-7e08-4474[…] Deleted : user_pref("extentions.y2layers.defaultEnableAppsList", "bestvideodownloader"); Deleted : user_pref("extentions.y2layers.installId", "a5ce1e85-f23e-49ef-b6eb-8ce3b79f3902"); Deleted : user_pref("extentions.y2layers.lastDnsTest", 371898); Deleted : user_pref("keyword.URL", "hxxp://www.amazon.com/websearch/ref=bit_bds-amzn_serp_ff_us_display?ie=UTF[…] File : C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\c4jlsyfj.default\prefs.js C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\c4jlsyfj.default\user.js … Deleted ! Deleted : user_pref("CT3220468_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[…] Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=1[…] Deleted : user_pref("Smartbar.ConduitSearchEngineList", "uTorrentControl_v2 Customized Web Search"); Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3220468[…] Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.alot.com/web?src_id=31154&client_i[…] Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3220468"); Deleted : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\11.1.0.12"); Deleted : user_pref("extensions.funmoods_i.aflt", "axl"); Deleted : user_pref("extensions.funmoods_i.dfltLng", ""); Deleted : user_pref("extensions.funmoods_i.dfltSrch", true); Deleted : user_pref("extensions.funmoods_i.dnsErr", true); Deleted : user_pref("extensions.funmoods_i.excTlbr", false); Deleted : user_pref("extensions.funmoods_i.hmpg", true); Deleted : user_pref("extensions.funmoods_i.hmpgUrl", "hxxp://start.funmoods.com/?f=1&a=axl"); Deleted : user_pref("extensions.funmoods_i.id", "3a71e7f100000000000074e50b0fa6c7"); Deleted : user_pref("extensions.funmoods_i.instlDay", "15414"); Deleted : user_pref("extensions.funmoods_i.instlRef", ""); Deleted : user_pref("extensions.funmoods_i.newTab", true); Deleted : user_pref("extensions.funmoods_i.newTabUrl", "hxxp://start.funmoods.com/?f=2&a=axl"); Deleted : user_pref("extensions.funmoods_i.prdct", "funmoods"); Deleted : user_pref("extensions.funmoods_i.prtnrId", "funmoods"); Deleted : user_pref("extensions.funmoods_i.smplGrp", "none"); Deleted : user_pref("extensions.funmoods_i.srchPrvdr", "Search"); Deleted : user_pref("extensions.funmoods_i.tlbrId", "base"); Deleted : user_pref("extensions.funmoods_i.tlbrSrchUrl", "hxxp://start.funmoods.com/results.php?f=3&a=axl&q=")[…] Deleted : user_pref("extensions.funmoods_i.vrsn", "1.5.11.16"); Deleted : user_pref("extensions.funmoods_i.vrsnTs", "1.5.11.1619:14:21"); Deleted : user_pref("extensions.funmoods_i.vrsni", "1.5.11.16"); -\\ Google Chrome v26.0.1410.43 File : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences Deleted [l.26] : search_url = "hxxp://www.amazon.com/websearch/ref=bit_bds-amzn_serp_cr_us_display?ie=UTF8&tag[…] Deleted [l.279] : homepage = "hxxp://www.amazon.com/websearch/ref=bit_bds-amzn_serp_home?ie=UTF8&tagbase=bds-amzn&[…] File : C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Preferences Deleted [l.9] : homepage = "hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=48", Deleted [l.13] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=48"[…] Deleted [l.37] : icon_url = "hxxp://search.conduit.com/fav.ico", Deleted [l.40] : keyword = "search.conduit.com", Deleted [l.43] : search_url = "hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&ctid=CT3[…] Deleted [l.745] : homepage = "hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=48", Deleted [l.1065] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=48" ] ************************* AdwCleaner[S1].txt - [30600 octets] - [09/04/2013 11:15:47] ########## EOF - C:\AdwCleaner[S1].txt - [30661 octets] ##########

mowman

Post #12April 10, 2013, 12:29 AM UTC

In my previous post there were two other logs that I asked for.

gino5555

Post #13April 10, 2013, 3:10 AM UTC

Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.04.10.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16521 Admin :: HPDM4 [administrator] 4/9/2013 7:58:35 PM mbam-log-2013-04-09 (19-58-35).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 250838 Time elapsed: 6 minute(s), 6 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

mowman

Post #14April 10, 2013, 9:00 AM UTC last edited April 10, 2013, 9:01 AM UTC

Next

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the Start button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is not checked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the Back button.
Push Finish

http://www.eset.com/onlinescan/

Also tell me how the computer is running now.

gino5555

Post #15April 12, 2013, 5:42 PM UTC

Apologies for the delay. Have not finished the scan, but wanted to give an update. Ran the file and the first time it came up with an unexpected error while loading the files. Backed up and ran it again and left it overnight. It crashed at 20%. I started to run it again, but had to leave for the day. Hopefully it will go through this time.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Default Programs Changed & McAfee Shut Down

✨ Ask AI

Ask AI