What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Numerous "Bad Image Errors" [Closed]

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Many different Bad Image Errors. Latest one while running Windows Update to download updates to net framework. Error reads something to this effect "*.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. I have run Malwarebytes and Eset Online Scanner with no reported problems. Running Vista 64bit. The following is my HiJackThis log. Thanks in advance for any help.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:02:28 PM, on 4/28/2013
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16476)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
C:\Program Files (x86)\PDF24\pdf24.exe
C:\Program Files (x86)\Control Center.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Wayne\Desktop\WhatTheTech\HiJack This\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us.yahoo.com?fr=fp-comodo
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;192.168.*.*
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {7aeb3efd-e564-43f1-b658-5058a7c5743b} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: ooVoo toolbar, powered by Ask.com - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [PDFPrint] "C:\Program Files (x86)\PDF24\pdf24.exe"
O4 - HKLM\..\Run: [TRENDnet UDS Control Center] C:\Program Files (x86)\Control Center.exe -mini
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-484623297-638050897-1438321867-1002\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'UpdatusUser')
O4 - Startup: Core Temp - Shortcut.lnk = C:\Users\Wayne\Desktop\System Tools\Core Temp.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {0F2AAAE3-7E9E-4B64-AB5D-1CA24C6ACB9C} (IBM Lotus iNotes 8.5 Control) - http://mail.garlandhq.com/dwa85W.cab
O16 - DPF: {CEF002D2-5A9F-4656-AA41-85DA2534ACBD} (IBM Lotus iNotes 8.5 Control) - http://mail.garlandhq.com/dwa85W.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASO3DiskOptimizer - Systweak Inc., (www.systweak.com) - C:\Program Files (x86)\Advanced System Optimizer 3\ASO3DefragSrv64.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Belkin Local Backup Service - Unknown owner - C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe
O23 - Service: Belkin Network USB Helper - Unknown owner - C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: @comres.dll,-947 (COMSysApp) - Unknown owner - C:\Windows\system32\dllhost.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Motorola Device Manager Service (Motorola Device Manager) - Unknown owner - C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NitroPDFDriverCreatorReadSpool (NitroDriverReadSpool) - Nitro PDF Software - C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe
O23 - Service: NLS Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\SysWOW64\NLSSRV32.EXE
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PST Service - Motorola - C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 10562 bytes
Post #2

**In any case where you happen to be busy or unable to give us a reply, we would be grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days. :)


Hello there, wem1965

:welcome:

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:
  • Read the entire procedure
  • It is important to perform ALL actions in sequence.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with me till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

IMPORTANT NOTE : Please do not delete anything unless instructed to. Remember to backup all your important data(if possible) before moving on.
Post #3
Hello there,

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.com
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
===================================================

Please download aswMBR.exe and save it to your desktop.
  • Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)
  • Allow it to update where necessary
  • Click Scan

  • Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
  • You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.
===================================================

Download TDSSKiller.exe and save it to your desktop

Execute TDSSKiller.exe by doubleclicking on it.
Press Start Scan
If Malicious objects are found, do NOT select Cure. Change the action to Skip, and save the log.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.log.txt

===================================================

On your next reply please post :
DDS log
aswMBR log
TDSSKiller log

Please STOP and let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!
Post #4
Thanks for the help Conspire. As you requested: DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16476 BrowserJavaVersion: 10.21.2 Run by [removed] at 9:36:15 on 2013-05-01 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4094.2478 [GMT -4:00] . AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: COMODO Defense+ *Enabled/Updated* {FEEA52D5-051E-08DD-07EF-2F009097607D} FW: COMODO Firewall *Enabled* {7DB03214-694B-060B-1600-BD4715C36DBB} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe C:\Windows\system32\svchost.exe -k rpcss C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\Advanced System Optimizer 3\ASO3DefragSrv64.exe C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe C:\Windows\SysWOW64\NLSSRV32.EXE C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\taskeng.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe C:\Windows\system32\taskeng.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Windows\system32\SearchIndexer.exe C:\Users\Wayne\Desktop\System Tools\Core Temp.exe C:\Program Files (x86)\PDF24\pdf24.exe C:\Program Files (x86)\Control Center.exe C:\Program Files\AVAST Software\Avast\AvastUI.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://us.yahoo.com?fr=fp-comodo uURLSearchHooks: {7aeb3efd-e564-43f1-b658-5058a7c5743b} - mWinlogon: Userinit = userinit.exe, BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll BHO: ooVoo toolbar, powered by Ask.com: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: ooVoo toolbar, powered by Ask.com: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" mRun: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe mRun: [PDFPrint] "C:\Program Files (x86)\PDF24\pdf24.exe" mRun: [TRENDnet UDS Control Center] C:\Program Files (x86)\Control Center.exe -mini mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" StartupFolder: C:\Users\Wayne\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\CORETE~1.LNK - C:\Users\Wayne\Desktop\System Tools\Core Temp.exe mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-System: EnableLUA = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} DPF: {0F2AAAE3-7E9E-4B64-AB5D-1CA24C6ACB9C} - hxxp://mail.garlandhq.com/dwa85W.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CEF002D2-5A9F-4656-AA41-85DA2534ACBD} - hxxp://mail.garlandhq.com/dwa85W.cab TCP: NameServer = 192.168.2.1 TCP: Interfaces\{62F93BAA-6DF5-4427-9C86-157275F1B160} : DHCPNameServer = 192.168.2.1 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll AppInit_DLLs= C:\Windows\SysWOW64\guard32.dll SEH: {03E3D45B-681C-481C-B6A3-0D08B12C4AB9} - SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll x64-BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll x64-Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s x64-mPolicies-Explorer: NoActiveDesktop = dword:1 x64-mPolicies-Explorer: NoActiveDesktopChanges = dword:1 x64-mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 x64-mPolicies-System: EnableLUA = dword:0 x64-mPolicies-System: EnableUIADesktopToggle = dword:0 x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab x64-DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - plugin: C:\PROGRA~2\Palm\PACKAG~1\NPInstal.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npq3plug.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll FF - plugin: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll FF - plugin: C:\Program Files (x86)\SumatraPDF\npPdfViewer.dll FF - plugin: C:\Users\Wayne\AppData\Local\Citrix\Plugins\92\npappdetector.dll FF - plugin: C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dll FF - plugin: C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]\plugins\npCoralIETab.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll FF - plugin: C:\Windows\SysWOW64\npmproxy.dll FF - ExtSQL: 2013-03-05 21:04; {ACAA314B-EEBA-48e4-AD47-84E31C44796C}; C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff FF - ExtSQL: 2013-03-11 22:05; [removed]; C:\Program Files\AVAST Software\Avast\WebRep\FF FF - ExtSQL: 2013-03-24 23:00; [removed]; C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed] FF - ExtSQL: 2013-04-05 19:30; [removed]; C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed] FF - ExtSQL: 2013-04-24 20:42; {20a82645-c095-46ed-80e3-08825760534b}; C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension . ============= SERVICES / DRIVERS =============== . R0 aswRvrt;aswRvrt;C:\Windows\System32\drivers\aswRvrt.sys [2013-3-11 65336] R0 hotcore3;hc3ServiceName;C:\Windows\System32\drivers\hotcore3.sys [2011-12-12 37456] R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2013-4-19 55952] R0 vididr;Acronis Virtual Disk;C:\Windows\System32\drivers\vididr.sys [2011-12-11 210016] R0 vidsflt53;Acronis Disk Storage Filter (53);C:\Windows\System32\drivers\vsflt53.sys [2011-12-11 141920] R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2013-3-11 824000] R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2013-3-11 339376] R1 cmdGuard;COMODO Internet Security Sandbox Driver;C:\Windows\System32\drivers\cmdGuard.sys [2011-12-19 584056] R1 cmdHlp;COMODO Internet Security Helper Driver;C:\Windows\System32\drivers\cmdhlp.sys [2011-12-19 45872] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2012-1-26 283200] R2 ASO3DiskOptimizer;ASO3DiskOptimizer;C:\Program Files (x86)\Advanced System Optimizer 3\ASO3DefragSrv64.exe [2013-4-24 263520] R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2013-3-11 24720] R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2013-3-11 70552] R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-3-11 44808] R2 Belkin Local Backup Service;Belkin Local Backup Service;C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [2011-12-6 181760] R2 Belkin Network USB Helper;Belkin Network USB Helper;C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [2011-12-6 55296] R2 FontCache;Windows Font Cache Service;C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648] R2 Motorola Device Manager;Motorola Device Manager Service;C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [2012-10-23 120728] R2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe [2011-9-24 341312] R2 nlsX86cc;NLS Service;C:\Windows\SysWOW64\NLSSRV32.EXE [2011-9-24 68928] R2 npf;NetGroup Packet Filter Driver;C:\Windows\System32\drivers\npf.sys [2011-2-11 35344] R2 PST Service;PST Service;C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [2013-2-8 65657] R2 RtNdPt60;Realtek NDIS Protocol Driver;C:\Windows\System32\drivers\RtNdPt60.sys [2011-12-23 25704] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-1-18 383264] R2 ubsbm;Unibrain 1394 SBM Driver;C:\Windows\System32\drivers\UBSBM.sys [2012-10-5 24064] R2 ubumapi;Unibrain 1394 FireAPI Driver;C:\Windows\System32\drivers\UBUMAPI.sys [2012-10-5 92160] R3 sxuptp;SXUPTP Driver;C:\Windows\System32\drivers\sxuptp.sys [2011-12-6 291352] R3 ubohci;Unibrain 1394 OHCI Driver;C:\Windows\System32\drivers\ubohci.sys [2012-10-5 132608] R3 VUSB3HUB;VIA USB 3 Root Hub Service;C:\Windows\System32\drivers\ViaHub3.sys [2013-1-12 203264] R3 xhcdrv;VIA USB eXtensible Host Controller Service;C:\Windows\System32\drivers\xhcdrv.sys [2012-11-27 225792] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 aswVmm;aswVmm;C:\Windows\System32\drivers\aswVmm.sys [2013-3-11 178624] S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2011-12-6 89920] S3 cpudrv64;cpudrv64;C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [2011-6-2 17864] S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-12-7 1030600] S3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;C:\Windows\System32\drivers\hidusbf.sys [2012-6-24 8064] S3 motandroidusb;Mot ADB Interface Driver;C:\Windows\System32\drivers\motoandroid.sys [2009-7-10 31744] S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968] S3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);C:\Windows\System32\drivers\RtTeam60.sys [2011-12-23 48416] S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.0);C:\Windows\System32\drivers\RtVlan60.sys [2011-12-23 32360] S3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);C:\Windows\System32\drivers\RtTeam60.sys [2011-12-23 48416] S3 ubsbp2;Unibrain SBP2 Bus Driver;C:\Windows\System32\drivers\ubsbp2.sys [2012-10-31 69632] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-9-28 53760] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768] . =============== File Associations =============== . FileExt: .scr: AutoCADScriptFile=C:\Windows\System32\notepad.exe "%1" FileExt: .js: JSFile=C:\Windows\SysWOW64\WScript.exe "%1" %* FileExt: .jse: JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %* . =============== Created Last 30 ================ . . ==================== Find3M ==================== . 2013-04-25 11:11:35 71048 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2013-04-25 11:11:35 691592 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2013-04-25 02:03:44 2032 —-a-w- C:\Windows\System32\ASOROSet.bin 2013-04-23 00:05:34 525792 —-a-w- C:\Windows\DIFxAPI.dll 2013-04-18 01:37:43 95648 —-a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll 2013-04-18 01:37:31 866720 —-a-w- C:\Windows\SysWow64\npDeployJava1.dll 2013-04-18 01:37:31 263584 —-a-w- C:\Windows\SysWow64\javaws.exe 2013-04-18 01:37:31 174496 —-a-w- C:\Windows\SysWow64\javaw.exe 2013-04-18 01:37:31 174496 —-a-w- C:\Windows\SysWow64\java.exe 2013-04-18 01:37:30 788896 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2013-04-18 01:19:04 72702784 —-a-w- C:\Windows\System32\mrt.exe 2013-04-09 00:43:21 181064 —-a-w- C:\Windows\PSEXESVC.EXE 2013-03-30 01:42:42 3379272 —-a-w- C:\Windows\System32\drivers\RTKVHD64.sys 2013-03-27 20:57:08 135240 —-a-w- C:\Windows\System32\RCoInstII64.dll 2013-03-26 21:06:30 2797128 —-a-w- C:\Windows\System32\RtPgEx64.dll 2013-03-26 21:04:40 2734624 —-a-w- C:\Windows\System32\FMAPO64.dll 2013-03-26 19:40:04 3693128 —-a-w- C:\Windows\System32\RtkAPO64.dll 2013-03-26 18:38:02 1659464 —-a-w- C:\Windows\System32\RTSnMg64.cpl 2013-03-23 07:43:22 208072 —-a-w- C:\Windows\System32\AERTAC64.dll 2013-03-20 17:16:56 2102040 —-a-w- C:\Windows\System32\WavesGUILib64.dll 2013-03-20 17:16:52 910104 —-a-w- C:\Windows\System32\MaxxAudioAPOShell64.dll 2013-03-12 22:16:20 613448 —-a-w- C:\Windows\System32\RtDataProc64.dll 2013-03-11 13:33:42 4691304 —-a-w- C:\Windows\System32\ntoskrnl.exe 2013-03-09 04:16:35 85504 —-a-w- C:\Windows\System32\csrsrv.dll 2013-03-09 01:48:36 75264 —-a-w- C:\Windows\System32\smss.exe 2013-03-08 04:18:52 451072 —-a-w- C:\Windows\System32\winsrv.dll 2013-03-08 04:17:12 2425344 —-a-w- C:\Windows\System32\mstscax.dll 2013-03-08 03:52:22 2067968 —-a-w- C:\Windows\SysWow64\mstscax.dll 2013-03-06 22:33:21 65336 —-a-w- C:\Windows\System32\drivers\aswRvrt.sys 2013-03-06 22:33:21 178624 —-a-w- C:\Windows\System32\drivers\aswVmm.sys 2013-03-06 05:00:40 40960 —-a-w- C:\Windows\System32\shimeng.dll 2013-03-06 05:00:40 286720 —-a-w- C:\Windows\System32\sti.dll 2013-03-06 05:00:39 2048 —-a-w- C:\Windows\SysWow64\msxml6r.dll 2013-03-06 05:00:24 190464 —-a-w- C:\Windows\System32\hdwwiz.cpl 2013-03-05 01:57:37 2774016 —-a-w- C:\Windows\System32\win32k.sys 2013-03-03 19:13:14 1513320 —-a-w- C:\Windows\System32\drivers\ntfs.sys 2013-02-28 17:10:32 2032408 —-a-w- C:\Windows\System32\MaxxAudioEQ64.dll 2013-02-22 06:57:13 17817088 —-a-w- C:\Windows\System32\mshtml.dll 2013-02-22 06:29:21 10925568 —-a-w- C:\Windows\System32\ieframe.dll 2013-02-22 06:27:49 2312704 —-a-w- C:\Windows\System32\jscript9.dll 2013-02-22 06:21:13 1346560 —-a-w- C:\Windows\System32\urlmon.dll 2013-02-22 06:20:51 1392128 —-a-w- C:\Windows\System32\wininet.dll 2013-02-22 06:19:37 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl 2013-02-22 06:18:42 237056 —-a-w- C:\Windows\System32\url.dll 2013-02-22 06:17:23 85504 —-a-w- C:\Windows\System32\jsproxy.dll 2013-02-22 06:15:48 173056 —-a-w- C:\Windows\System32\ieUnatt.exe 2013-02-22 06:15:23 599040 —-a-w- C:\Windows\System32\vbscript.dll 2013-02-22 06:15:22 816640 —-a-w- C:\Windows\System32\jscript.dll 2013-02-22 06:14:22 729088 —-a-w- C:\Windows\System32\msfeeds.dll 2013-02-22 06:13:40 2147840 —-a-w- C:\Windows\System32\iertutil.dll 2013-02-22 06:13:02 96768 —-a-w- C:\Windows\System32\mshtmled.dll 2013-02-22 06:12:41 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2013-02-22 06:09:21 248320 —-a-w- C:\Windows\System32\ieui.dll 2013-02-22 04:05:50 12324352 —-a-w- C:\Windows\SysWow64\mshtml.dll 2013-02-22 03:47:17 9738752 —-a-w- C:\Windows\SysWow64\ieframe.dll 2013-02-22 03:46:00 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll 2013-02-22 03:38:39 1104384 —-a-w- C:\Windows\SysWow64\urlmon.dll 2013-02-22 03:38:00 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll 2013-02-22 03:37:50 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2013-02-22 03:36:35 231936 —-a-w- C:\Windows\SysWow64\url.dll 2013-02-22 03:35:31 65024 —-a-w- C:\Windows\SysWow64\jsproxy.dll 2013-02-22 03:34:18 717824 —-a-w- C:\Windows\SysWow64\jscript.dll 2013-02-22 03:34:17 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe 2013-02-22 03:34:03 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll 2013-02-22 03:33:11 607744 —-a-w- C:\Windows\SysWow64\msfeeds.dll 2013-02-22 03:32:05 1796096 —-a-w- C:\Windows\SysWow64\iertutil.dll 2013-02-22 03:31:55 73216 —-a-w- C:\Windows\SysWow64\mshtmled.dll 2013-02-22 03:31:46 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2013-02-22 03:28:48 176640 —-a-w- C:\Windows\SysWow64\ieui.dll 2013-02-20 22:55:16 1284680 —-a-w- C:\Windows\System32\RTCOM64.dll 2013-02-19 22:52:38 991816 —-a-w- C:\Windows\System32\RtkApi64.dll 2013-02-12 02:18:19 19456 —-a-w- C:\Windows\System32\drivers\usb8023.sys 2011-10-06 14:42:00 4407296 —-a-w- C:\Program Files (x86)\Control Center.exe . ============= FINISH: 9:37:05.44 =============== aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software Run date: 2013-05-01 09:41:40 —————————– 09:41:40.834 OS Version: Windows x64 6.0.6002 Service Pack 2 09:41:40.834 Number of processors: 2 586 0x170A 09:41:40.834 ComputerName: WAYNE-PC UserName: Wayne 09:41:42.035 Initialize success 09:41:42.128 AVAST engine defs: 13050100 09:42:08.336 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 09:42:08.336 Disk 0 Vendor: WDC_WD5000AAKX-603CA0 16.01H16 Size: 476940MB BusType: 3 09:42:08.336 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-2 09:42:08.336 Disk 1 Vendor: SAMSUNG_HD103SJ 1AJ100E4 Size: 953868MB BusType: 3 09:42:08.336 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP1T1L0-6 09:42:08.336 Disk 2 Vendor: SAMSUNG_HD502IJ 1AA01112 Size: 476938MB BusType: 3 09:42:08.352 Disk 3 \Device\Harddisk3\DR3 -> \Device\Ide\IdeDeviceP3T0L0-4 09:42:08.352 Disk 3 Vendor: ST3160811AS 3.AAE Size: 152627MB BusType: 3 09:42:08.446 Disk 0 MBR read successfully 09:42:08.446 Disk 0 MBR scan 09:42:08.461 Disk 0 unknown MBR code 09:42:08.461 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 476938 MB offset 2048 09:42:08.461 Disk 0 scanning C:\Windows\system32\drivers 09:42:15.793 Service scanning 09:42:30.566 Modules scanning 09:42:30.566 Disk 0 trace - called modules: 09:42:30.582 ntoskrnl.exe CLASSPNP.SYS disk.sys vsflt53.sys acpi.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 09:42:30.582 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004993790] 09:42:30.582 3 CLASSPNP.SYS[fffffa6001198c33] -> nt!IofCallDriver -> [0xfffffa8004992d60] 09:42:30.598 5 vsflt53.sys[fffffa600097fcfd] -> nt!IofCallDriver -> [0xfffffa80047464d0] 09:42:30.598 7 acpi.sys[fffffa60008dffde] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004734060] 09:42:31.518 AVAST engine scan C:\Windows 09:42:36.370 AVAST engine scan C:\Windows\system32 09:44:26.123 AVAST engine scan C:\Windows\system32\drivers 09:44:36.138 AVAST engine scan C:\Users\Wayne 09:48:42.025 File: C:\Users\Wayne\Downloads\Don Ross - Passion Session [ogg@240kbps]_secure.exe **INFECTED** Win32:Adware-gen [Adw] 09:50:07.501 AVAST engine scan C:\ProgramData 09:50:56.626 Scan finished successfully 09:51:34.778 Disk 0 MBR has been saved successfully to "C:\Users\Wayne\Desktop\MBR.dat" 09:51:34.793 The log file has been saved successfully to "C:\Users\Wayne\Desktop\aswMBR.txt" —————————————————————————————————————————————— 09:53:21.0238 4564 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 09:53:21.0737 4564 ============================================================ 09:53:21.0737 4564 Current date / time: 2013/05/01 09:53:21.0737 09:53:21.0737 4564 SystemInfo: 09:53:21.0737 4564 09:53:21.0737 4564 OS Version: 6.0.6002 ServicePack: 2.0 09:53:21.0737 4564 Product type: Workstation 09:53:21.0737 4564 ComputerName: WAYNE-PC 09:53:21.0737 4564 UserName: Wayne 09:53:21.0737 4564 Windows directory: C:\Windows 09:53:21.0737 4564 System windows directory: C:\Windows 09:53:21.0737 4564 Running under WOW64 09:53:21.0737 4564 Processor architecture: Intel x64 09:53:21.0737 4564 Number of processors: 2 09:53:21.0737 4564 Page size: 0x1000 09:53:21.0737 4564 Boot type: Normal boot 09:53:21.0737 4564 ============================================================ 09:53:22.0876 4564 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 09:53:22.0892 4564 Drive \Device\Harddisk1\DR1 - Size: 0xE8E0CADE00 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 09:53:22.0907 4564 Drive \Device\Harddisk2\DR2 - Size: 0x7470AFDE00 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 09:53:22.0923 4564 Drive \Device\Harddisk3\DR3 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 09:53:22.0939 4564 ============================================================ 09:53:22.0939 4564 \Device\Harddisk0\DR0: 09:53:22.0939 4564 MBR partitions: 09:53:22.0939 4564 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x3A385000 09:53:22.0939 4564 \Device\Harddisk1\DR1: 09:53:22.0939 4564 MBR partitions: 09:53:22.0939 4564 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x3D090000 09:53:22.0939 4564 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x3D090800, BlocksNum 0x37675000 09:53:22.0939 4564 \Device\Harddisk2\DR2: 09:53:22.0939 4564 MBR partitions: 09:53:22.0939 4564 \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02 09:53:22.0939 4564 \Device\Harddisk3\DR3: 09:53:22.0954 4564 MBR partitions: 09:53:22.0954 4564 \Device\Harddisk3\DR3\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A14BC1 09:53:22.0954 4564 ============================================================ 09:53:22.0970 4564 C: <-> \Device\Harddisk0\DR0\Partition1 09:53:23.0001 4564 D: <-> \Device\Harddisk1\DR1\Partition1 09:53:23.0032 4564 E: <-> \Device\Harddisk2\DR2\Partition1 09:53:23.0079 4564 F: <-> \Device\Harddisk3\DR3\Partition1 09:53:23.0110 4564 G: <-> \Device\Harddisk1\DR1\Partition2 09:53:23.0110 4564 ============================================================ 09:53:23.0110 4564 Initialize success 09:53:23.0110 4564 ============================================================ 09:53:29.0927 4560 ============================================================ 09:53:29.0927 4560 Scan started 09:53:29.0927 4560 Mode: Manual; 09:53:29.0927 4560 ============================================================ 09:53:32.0033 4560 ================ Scan system memory ======================== 09:53:32.0033 4560 System memory - ok 09:53:32.0033 4560 ================ Scan services ============================= 09:53:32.0143 4560 [ 1965AAFFAB07E3FB03C77F81BEBA3547 ] ACPI C:\Windows\system32\drivers\acpi.sys 09:53:32.0143 4560 ACPI - ok 09:53:32.0299 4560 [ AD2596D8CF9D25CC38CD06F7347A5ED5 ] AcrSch2Svc C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe 09:53:32.0299 4560 AcrSch2Svc - ok 09:53:32.0423 4560 [ 479901C99FA62D1C3261B7ACB1228DAD ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 09:53:32.0423 4560 AdobeFlashPlayerUpdateSvc - ok 09:53:32.0486 4560 [ F14215E37CF124104575073F782111D2 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys 09:53:32.0486 4560 adp94xx - ok 09:53:32.0501 4560 [ 7D05A75E3066861A6610F7EE04FF085C ] adpahci C:\Windows\system32\drivers\adpahci.sys 09:53:32.0517 4560 adpahci - ok 09:53:32.0517 4560 [ 820A201FE08A0C345B3BEDBC30E1A77C ] adpu160m C:\Windows\system32\drivers\adpu160m.sys 09:53:32.0517 4560 adpu160m - ok 09:53:32.0533 4560 [ 9B4AB6854559DC168FBB4C24FC52E794 ] adpu320 C:\Windows\system32\drivers\adpu320.sys 09:53:32.0533 4560 adpu320 - ok 09:53:32.0579 4560 [ 0F421175574BFE0BF2F4D8E910A253BB ] AeLookupSvc C:\Windows\System32\aelupsvc.dll 09:53:32.0579 4560 AeLookupSvc - ok 09:53:32.0611 4560 [ C4F6CE6087760AD70960C9EB130E7943 ] AFD C:\Windows\system32\drivers\afd.sys 09:53:32.0611 4560 AFD - ok 09:53:32.0673 4560 [ 7F1130830B3BA85921519A5616E29803 ] AffinegyService C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe 09:53:32.0673 4560 AffinegyService - ok 09:53:32.0689 4560 [ F6F6793B7F17B550ECFDBD3B229173F7 ] agp440 C:\Windows\system32\drivers\agp440.sys 09:53:32.0689 4560 agp440 - ok 09:53:32.0704 4560 [ 222CB641B4B8A1D1126F8033F9FD6A00 ] aic78xx C:\Windows\system32\drivers\djsvs.sys 09:53:32.0704 4560 aic78xx - ok 09:53:32.0720 4560 [ 5922F4F59B7868F3D74BBBBEB7B825A3 ] ALG C:\Windows\System32\alg.exe 09:53:32.0720 4560 ALG - ok 09:53:32.0751 4560 [ 157D0898D4B73F075CE9FA26B482DF98 ] aliide C:\Windows\system32\drivers\aliide.sys 09:53:32.0751 4560 aliide - ok 09:53:32.0907 4560 ALSysIO - ok 09:53:32.0938 4560 [ 970FA5059E61E30D25307B99903E991E ] amdide C:\Windows\system32\drivers\amdide.sys 09:53:32.0938 4560 amdide - ok 09:53:32.0938 4560 [ CDC3632A3A5EA4DBB83E46076A3165A1 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys 09:53:32.0938 4560 AmdK8 - ok 09:53:32.0954 4560 [ 9C37B3FD5615477CB9A0CD116CF43F5C ] Appinfo C:\Windows\System32\appinfo.dll 09:53:32.0954 4560 Appinfo - ok 09:53:33.0047 4560 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 09:53:33.0047 4560 Apple Mobile Device - ok 09:53:33.0063 4560 [ BA8417D4765F3988FF921F30F630E303 ] arc C:\Windows\system32\drivers\arc.sys 09:53:33.0063 4560 arc - ok 09:53:33.0079 4560 [ 9D41C435619733B34CC16A511E644B11 ] arcsas C:\Windows\system32\drivers\arcsas.sys 09:53:33.0079 4560 arcsas - ok 09:53:33.0235 4560 [ DD09DA7F16575E5402D9891AD1C317CE ] ASO3DiskOptimizer C:\Program Files (x86)\Advanced System Optimizer 3\ASO3DefragSrv64.exe 09:53:33.0235 4560 ASO3DiskOptimizer - ok 09:53:33.0406 4560 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 09:53:33.0406 4560 aspnet_state - ok 09:53:33.0437 4560 [ 1D0C299F826122260FEDD506101BB68B ] aswFsBlk C:\Windows\system32\drivers\aswFsBlk.sys 09:53:33.0437 4560 aswFsBlk - ok 09:53:33.0484 4560 [ 12ECBC6F39AB995EABB20DD3D995F8F0 ] aswMonFlt C:\Windows\system32\drivers\aswMonFlt.sys 09:53:33.0484 4560 aswMonFlt - ok 09:53:33.0500 4560 [ 32C193DD547895C8AD775D39E9EAB373 ] AswRdr C:\Windows\system32\drivers\AswRdr.sys 09:53:33.0500 4560 AswRdr - ok 09:53:33.0500 4560 [ DE6759B8D8E62BF0FFF2B05F05AFCEE6 ] aswRvrt C:\Windows\system32\drivers\aswRvrt.sys 09:53:33.0500 4560 aswRvrt - ok 09:53:33.0531 4560 [ 5AD49C7E456231B69B398140253D9FCE ] aswSnx C:\Windows\system32\drivers\aswSnx.sys 09:53:33.0531 4560 aswSnx - ok 09:53:33.0547 4560 [ 1559E18B3EBD98E1F430BD55A5827B7D ] aswSP C:\Windows\system32\drivers\aswSP.sys 09:53:33.0547 4560 aswSP - ok 09:53:33.0578 4560 [ 860454645FFA9E012396EFB007FFF865 ] aswTdi C:\Windows\system32\drivers\aswTdi.sys 09:53:33.0578 4560 aswTdi - ok 09:53:33.0578 4560 [ 7E44C2684A6CA779B9D07CB4BD3F649D ] aswVmm C:\Windows\system32\drivers\aswVmm.sys 09:53:33.0578 4560 aswVmm - ok 09:53:33.0609 4560 [ 22D13FF3DAFEC2A80634752B1EAA2DE6 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys 09:53:33.0609 4560 AsyncMac - ok 09:53:33.0640 4560 [ E68D9B3A3905619732F7FE039466A623 ] atapi C:\Windows\system32\drivers\atapi.sys 09:53:33.0640 4560 atapi - ok 09:53:33.0671 4560 [ 79318C744693EC983D20E9337A2F8196 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll 09:53:33.0671 4560 AudioEndpointBuilder - ok 09:53:33.0671 4560 [ 79318C744693EC983D20E9337A2F8196 ] AudioSrv C:\Windows\System32\Audiosrv.dll 09:53:33.0671 4560 AudioSrv - ok 09:53:33.0796 4560 [ 01E80E1DE60650BC61E9A0A513B0DDD8 ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe 09:53:33.0796 4560 avast! Antivirus - ok 09:53:33.0827 4560 [ 299E54DB3638A18E47BD3A2D2EF499F7 ] Belkin Local Backup Service C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe 09:53:33.0827 4560 Belkin Local Backup Service - ok 09:53:33.0843 4560 [ E62A04D615A8CAC83601E1F07C010D3C ] Belkin Network USB Helper C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe 09:53:33.0843 4560 Belkin Network USB Helper - ok 09:53:33.0859 4560 [ FFB96C2589FFA60473EAD78B39FBDE29 ] BFE C:\Windows\System32\bfe.dll 09:53:33.0874 4560 BFE - ok 09:53:33.0890 4560 [ 6D316F4859634071CC25C4FD4589AD2C ] BITS C:\Windows\System32\qmgr.dll 09:53:33.0905 4560 BITS - ok 09:53:33.0937 4560 [ 79FEEB40056683F8F61398D81DDA65D2 ] blbdrive C:\Windows\system32\drivers\blbdrive.sys 09:53:33.0937 4560 blbdrive - ok 09:53:33.0968 4560 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 09:53:33.0968 4560 Bonjour Service - ok 09:53:33.0983 4560 [ 2348447A80920B2493A9B582A23E81E1 ] bowser C:\Windows\system32\DRIVERS\bowser.sys 09:53:33.0999 4560 bowser - ok 09:53:34.0015 4560 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys 09:53:34.0015 4560 BrFiltLo - ok 09:53:34.0030 4560 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys 09:53:34.0030 4560 BrFiltUp - ok 09:53:34.0061 4560 [ A1B39DE453433B115B4EA69EE0343816 ] Browser C:\Windows\System32\browser.dll 09:53:34.0061 4560 Browser - ok 09:53:34.0077 4560 [ F0F0BA4D815BE446AA6A4583CA3BCA9B ] Brserid C:\Windows\system32\drivers\brserid.sys 09:53:34.0077 4560 Brserid - ok 09:53:34.0093 4560 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys 09:53:34.0093 4560 BrSerWdm - ok 09:53:34.0108 4560 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys 09:53:34.0108 4560 BrUsbMdm - ok 09:53:34.0139 4560 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys 09:53:34.0139 4560 BrUsbSer - ok 09:53:34.0155 4560 [ E0777B34E05F8A82A21856EFC900C29F ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys 09:53:34.0155 4560 BTHMODEM - ok 09:53:34.0171 4560 [ B4D787DB8D30793A4D4DF9FEED18F136 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys 09:53:34.0171 4560 cdfs - ok 09:53:34.0186 4560 [ C025AA69BE3D0D25C7A2E746EF6F94FC ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys 09:53:34.0202 4560 cdrom - ok 09:53:34.0233 4560 [ 5A268127633C7EE2A7FB87F39D748D56 ] CertPropSvc C:\Windows\System32\certprop.dll 09:53:34.0233 4560 CertPropSvc - ok 09:53:34.0233 4560 [ 02EA568D498BBDD4BA55BF3FCE34D456 ] circlass C:\Windows\system32\drivers\circlass.sys 09:53:34.0249 4560 circlass - ok 09:53:34.0264 4560 [ 3DCA9A18B204939CFB24BEA53E31EB48 ] CLFS C:\Windows\system32\CLFS.sys 09:53:34.0280 4560 CLFS - ok 09:53:34.0327 4560 [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 09:53:34.0327 4560 clr_optimization_v2.0.50727_32 - ok 09:53:34.0327 4560 [ CE07A466201096F021CD09D631B21540 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 09:53:34.0342 4560 clr_optimization_v2.0.50727_64 - ok 09:53:34.0436 4560 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 09:53:34.0436 4560 clr_optimization_v4.0.30319_32 - ok 09:53:34.0451 4560 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 09:53:34.0451 4560 clr_optimization_v4.0.30319_64 - ok 09:53:34.0529 4560 [ 65FB5097D9EE7E3A99E932CFA0E4B344 ] cmdAgent C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe 09:53:34.0545 4560 cmdAgent - ok 09:53:34.0561 4560 [ A88003BD02EFEB4C0281897B32893CFC ] cmdGuard C:\Windows\system32\DRIVERS\cmdguard.sys 09:53:34.0561 4560 cmdGuard - ok 09:53:34.0576 4560 [ ED8442CDBB0186D1853ECEADB22DC1CC ] cmdHlp C:\Windows\system32\DRIVERS\cmdhlp.sys 09:53:34.0576 4560 cmdHlp - ok 09:53:34.0607 4560 [ E5D5499A1C50A54B5161296B6AFE6192 ] cmdide C:\Windows\system32\drivers\cmdide.sys 09:53:34.0607 4560 cmdide - ok 09:53:34.0639 4560 [ 7FB8AD01DB0EABE60C8A861531A8F431 ] Compbatt C:\Windows\system32\drivers\compbatt.sys 09:53:34.0639 4560 Compbatt - ok 09:53:34.0639 4560 COMSysApp - ok 09:53:34.0670 4560 [ 3CA734CE373E5675FBC15CA2C45228E5 ] cpudrv64 C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys 09:53:34.0670 4560 cpudrv64 - ok 09:53:34.0670 4560 cpuz135 - ok 09:53:34.0701 4560 [ A8585B6412253803CE8EFCBD6D6DC15C ] crcdisk C:\Windows\system32\drivers\crcdisk.sys 09:53:34.0701 4560 crcdisk - ok 09:53:34.0748 4560 [ CA78B312C44E4D52E842C2C8BD48E452 ] CryptSvc C:\Windows\system32\cryptsvc.dll 09:53:34.0748 4560 CryptSvc - ok 09:53:34.0779 4560 [ CF8B9A3A5E7DC57724A89D0C3E8CF9EF ] DcomLaunch C:\Windows\system32\rpcss.dll 09:53:34.0795 4560 DcomLaunch - ok 09:53:34.0810 4560 [ 8B722BA35205C71E7951CDC4CDBADE19 ] DfsC C:\Windows\system32\Drivers\dfsc.sys 09:53:34.0810 4560 DfsC - ok 09:53:34.0888 4560 [ C647F468F7DE343DF8C143655C5557D4 ] DFSR C:\Windows\system32\DFSR.exe 09:53:34.0919 4560 DFSR - ok 09:53:34.0951 4560 [ 3ED0321127CE70ACDAABBF77E157C2A7 ] Dhcp C:\Windows\System32\dhcpcsvc.dll 09:53:34.0951 4560 Dhcp - ok 09:53:34.0982 4560 [ B0107E40ECDB5FA692EBF832F295D905 ] disk C:\Windows\system32\drivers\disk.sys 09:53:34.0982 4560 disk - ok 09:53:34.0997 4560 [ 06230F1B721494A6DF8D47FD395BB1B0 ] Dnscache C:\Windows\System32\dnsrslvr.dll 09:53:35.0013 4560 Dnscache - ok 09:53:35.0013 4560 [ 1A7156DD1E850E9914E5E991E3225B94 ] dot3svc C:\Windows\System32\dot3svc.dll 09:53:35.0013 4560 dot3svc - ok 09:53:35.0060 4560 [ 74C02B1717740C3B8039539E23E4B53F ] Dot4 C:\Windows\system32\DRIVERS\Dot4.sys 09:53:35.0060 4560 Dot4 - ok 09:53:35.0075 4560 [ 08321D1860235BF42CF2854234337AEA ] Dot4Print C:\Windows\system32\DRIVERS\Dot4Prt.sys 09:53:35.0075 4560 Dot4Print - ok 09:53:35.0075 4560 [ 4ADCCF0124F2B6911D3786A5D0E779E5 ] dot4usb C:\Windows\system32\DRIVERS\dot4usb.sys 09:53:35.0075 4560 dot4usb - ok 09:53:35.0122 4560 [ 1583B39790DB3EAEC7EDB0CB0140C708 ] DPS C:\Windows\system32\dps.dll 09:53:35.0122 4560 DPS - ok 09:53:35.0138 4560 [ F1A78A98CFC2EE02144C6BEC945447E6 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys 09:53:35.0153 4560 drmkaud - ok 09:53:35.0153 4560 [ 46571ED73AE84469DCA53081D33CF3C8 ] dtsoftbus01 C:\Windows\system32\DRIVERS\dtsoftbus01.sys 09:53:35.0169 4560 dtsoftbus01 - ok 09:53:35.0216 4560 [ B8E554E502D5123BC111F99D6A2181B4 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys 09:53:35.0231 4560 DXGKrnl - ok 09:53:35.0263 4560 [ 264CEE7B031A9D6C827F3D0CB031F2FE ] E1G60 C:\Windows\system32\DRIVERS\E1G6032E.sys 09:53:35.0263 4560 E1G60 - ok 09:53:35.0278 4560 [ C2303883FD9BE49DC36A6400643002EA ] EapHost C:\Windows\System32\eapsvc.dll 09:53:35.0278 4560 EapHost - ok 09:53:35.0309 4560 [ 5F94962BE5A62DB6E447FF6470C4F48A ] Ecache C:\Windows\system32\drivers\ecache.sys 09:53:35.0309 4560 Ecache - ok 09:53:35.0372 4560 [ 14CE384D2E27B64C256BDA4DC39C312D ] ehRecvr C:\Windows\ehome\ehRecvr.exe 09:53:35.0372 4560 ehRecvr - ok 09:53:35.0419 4560 [ B93159C1313D66FDFBBE876F5189CD52 ] ehSched C:\Windows\ehome\ehsched.exe 09:53:35.0419 4560 ehSched - ok 09:53:35.0434 4560 [ F5EE2527D74449868E3C3227A59BCD28 ] ehstart C:\Windows\ehome\ehstart.dll 09:53:35.0434 4560 ehstart - ok 09:53:35.0481 4560 [ C4636D6E10469404AB5308D9FD45ED07 ] elxstor C:\Windows\system32\drivers\elxstor.sys 09:53:35.0481 4560 elxstor - ok 09:53:35.0512 4560 [ A9B18B63A4FD6BAAB83326706D857FAB ] EMDMgmt C:\Windows\system32\emdmgmt.dll 09:53:35.0528 4560 EMDMgmt - ok 09:53:35.0543 4560 [ BC3A58E938BB277E46BF4B3003B01ABD ] ErrDev C:\Windows\system32\drivers\errdev.sys 09:53:35.0543 4560 ErrDev - ok 09:53:35.0590 4560 [ E12F22B73F153DECE721CD45EC05B4AF ] EventSystem C:\Windows\system32\es.dll 09:53:35.0590 4560 EventSystem - ok 09:53:35.0621 4560 [ 486844F47B6636044A42454614ED4523 ] exfat C:\Windows\system32\drivers\exfat.sys 09:53:35.0621 4560 exfat - ok 09:53:35.0637 4560 [ 1A4BEE34277784619DDAF0422C0C6E23 ] fastfat C:\Windows\system32\drivers\fastfat.sys 09:53:35.0637 4560 fastfat - ok 09:53:35.0653 4560 [ 81B79B6DF71FA1D2C6D688D830616E39 ] fdc C:\Windows\system32\DRIVERS\fdc.sys 09:53:35.0653 4560 fdc - ok 09:53:35.0684 4560 [ BB9267ACACD8B7533DD936C34A0CBA5E ] fdPHost C:\Windows\system32\fdPHost.dll 09:53:35.0684 4560 fdPHost - ok 09:53:35.0699 4560 [ 300C80931EABBE1DB7591C516EFE8D0F ] FDResPub C:\Windows\system32\fdrespub.dll 09:53:35.0699 4560 FDResPub - ok 09:53:35.0715 4560 [ 457B7D1D533E4BD62A99AED9C7BB4C59 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys 09:53:35.0715 4560 FileInfo - ok 09:53:35.0731 4560 [ D421327FD6EFCCAF884A54C58E1B0D7F ] Filetrace C:\Windows\system32\drivers\filetrace.sys 09:53:35.0731 4560 Filetrace - ok 09:53:35.0793 4560 [ 259DC094E2D3F08654C8FB73D8ECC0F5 ] FLEXnet Licensing Service 64 C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe 09:53:35.0809 4560 FLEXnet Licensing Service 64 - ok 09:53:35.0809 4560 [ 230923EA2B80F79B0F88D90F87B87EBD ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys 09:53:35.0809 4560 flpydisk - ok 09:53:35.0824 4560 [ E3041BC26D6930D61F42AEDB79C91720 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys 09:53:35.0840 4560 FltMgr - ok 09:53:35.0871 4560 [ BE1C5BD1CA7ED015BC6FA1AE67E592C8 ] FontCache C:\Windows\system32\FntCache.dll 09:53:35.0887 4560 FontCache - ok 09:53:35.0933 4560 [ BC5B0BE5AF3510B0FD8C140EE42C6D3E ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 09:53:35.0949 4560 FontCache3.0.0.0 - ok 09:53:35.0980 4560 [ 5779B86CD8B32519FBECB136394D946A ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys 09:53:35.0980 4560 Fs_Rec - ok 09:53:36.0011 4560 [ C8E416668D3DC2BE3D4FE4C79224997F ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys 09:53:36.0011 4560 gagp30kx - ok 09:53:36.0058 4560 [ 6275303610285B57361F03A375062FBA ] gdrv C:\Windows\gdrv.sys 09:53:36.0058 4560 gdrv - ok 09:53:36.0089 4560 [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 09:53:36.0089 4560 GEARAspiWDM - ok 09:53:36.0121 4560 [ A0E1B575BA8F504968CD40C0FAEB2384 ] gpsvc C:\Windows\System32\gpsvc.dll 09:53:36.0121 4560 gpsvc - ok 09:53:36.0214 4560 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 09:53:36.0214 4560 gupdate - ok 09:53:36.0214 4560 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 09:53:36.0214 4560 gupdatem - ok 09:53:36.0245 4560 [ 68E732382B32417FF61FD663259B4B09 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys 09:53:36.0245 4560 HdAudAddService - ok 09:53:36.0292 4560 [ F942C5820205F2FB453243EDFEC82A3D ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys 09:53:36.0292 4560 HDAudBus - ok 09:53:36.0323 4560 [ B4881C84A180E75B8C25DC1D726C375F ] HidBth C:\Windows\system32\drivers\hidbth.sys 09:53:36.0323 4560 HidBth - ok 09:53:36.0339 4560 [ 4E77A77E2C986E8F88F996BB3E1AD829 ] HidIr C:\Windows\system32\drivers\hidir.sys 09:53:36.0339 4560 HidIr - ok 09:53:36.0370 4560 [ 59361D38A297755D46A540E450202B2A ] hidserv C:\Windows\system32\hidserv.dll 09:53:36.0401 4560 hidserv - ok 09:53:36.0433 4560 [ 443BDD2D30BB4F00795C797E2CF99EDF ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys 09:53:36.0433 4560 HidUsb - ok 09:53:36.0448 4560 [ 6417911BAAAADE0206969188F5B4565D ] hidusbf C:\Windows\system32\DRIVERS\hidusbf.sys 09:53:36.0448 4560 hidusbf - ok 09:53:36.0464 4560 [ B12F367EA39C0795FD57E31242CE1A5A ] hkmsvc C:\Windows\system32\kmsvc.dll 09:53:36.0464 4560 hkmsvc - ok 09:53:36.0511 4560 [ DDF58C2E16527073FEF370EDFE970745 ] hotcore3 C:\Windows\system32\DRIVERS\hotcore3.sys 09:53:36.0511 4560 hotcore3 - ok 09:53:36.0526 4560 [ D7109A1E6BD2DFDBCBA72A6BC626A13B ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys 09:53:36.0526 4560 HpCISSs - ok 09:53:36.0635 4560 [ AF81F7BA6A09119006FE041A2F2F3ECE ] hpqcxs08 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll 09:53:36.0635 4560 hpqcxs08 - ok 09:53:36.0667 4560 [ 7244F63DB8EA883B3DC8E730C645D073 ] hpqddsvc C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll 09:53:36.0667 4560 hpqddsvc - ok 09:53:36.0713 4560 [ 098F1E4E5C9CB5B0063A959063631610 ] HTTP C:\Windows\system32\drivers\HTTP.sys 09:53:36.0729 4560 HTTP - ok 09:53:36.0745 4560 [ DA94C854CEA5FAC549D4E1F6E88349E8 ] i2omp C:\Windows\system32\drivers\i2omp.sys 09:53:36.0745 4560 i2omp - ok 09:53:36.0760 4560 [ CBB597659A2713CE0C9CC20C88C7591F ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys 09:53:36.0760 4560 i8042prt - ok 09:53:36.0791 4560 [ 3E3BF3627D886736D0B4E90054F929F6 ] iaStorV C:\Windows\system32\drivers\iastorv.sys 09:53:36.0791 4560 iaStorV - ok 09:53:36.0932 4560 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe 09:53:36.0932 4560 IDriverT - ok 09:53:36.0963 4560 [ 749F5F8CEDCA70F2A512945325FC489D ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 09:53:36.0979 4560 idsvc - ok 09:53:36.0994 4560 [ 8C3951AD2FE886EF76C7B5027C3125D3 ] iirsp C:\Windows\system32\drivers\iirsp.sys 09:53:36.0994 4560 iirsp - ok 09:53:37.0025 4560 [ 0C9EA6E654E7B0471741E343A6C671AF ] IKEEXT C:\Windows\System32\ikeext.dll 09:53:37.0041 4560 IKEEXT - ok 09:53:37.0072 4560 [ C274D20CD2DBAB085C85A4170B5761EB ] inspect C:\Windows\system32\DRIVERS\inspect.sys 09:53:37.0072 4560 inspect - ok 09:53:37.0150 4560 [ CCEDD47ABD068C58C8513DEB785093BB ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys 09:53:37.0197 4560 IntcAzAudAddService - ok 09:53:37.0228 4560 [ DF797A12176F11B2D301C5B234BB200E ] intelide C:\Windows\system32\drivers\intelide.sys 09:53:37.0228 4560 intelide - ok 09:53:37.0259 4560 [ BFD84AF32FA1BAD6231C4585CB469630 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys 09:53:37.0259 4560 intelppm - ok 09:53:37.0275 4560 [ 5624BC1BC5EEB49C0AB76A8114F05EA3 ] IPBusEnum C:\Windows\system32\ipbusenum.dll 09:53:37.0275 4560 IPBusEnum - ok 09:53:37.0306 4560 [ D8AABC341311E4780D6FCE8C73C0AD81 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys 09:53:37.0306 4560 IpFilterDriver - ok 09:53:37.0337 4560 [ BF0DBFA9792C5C14FA00F61C75116C1B ] iphlpsvc C:\Windows\System32\iphlpsvc.dll 09:53:37.0337 4560 iphlpsvc - ok 09:53:37.0353 4560 IpInIp - ok 09:53:37.0369 4560 [ 9C2EE2E6E5A7203BFAE15C299475EC67 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys 09:53:37.0369 4560 IPMIDRV - ok 09:53:37.0369 4560 [ B7E6212F581EA5F6AB0C3A6CEEEB89BE ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys 09:53:37.0369 4560 IPNAT - ok 09:53:37.0431 4560 [ 0F261EC4F514926177C70C1832374231 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 09:53:37.0431 4560 iPod Service - ok 09:53:37.0447 4560 [ 8C42CA155343A2F11D29FECA67FAA88D ] IRENUM C:\Windows\system32\drivers\irenum.sys 09:53:37.0447 4560 IRENUM - ok 09:53:37.0478 4560 [ 0672BFCEDC6FC468A2B0500D81437F4F ] isapnp C:\Windows\system32\drivers\isapnp.sys 09:53:37.0478 4560 isapnp - ok 09:53:37.0493 4560 [ E4FDF99599F27EC25D2CF6D754243520 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys 09:53:37.0493 4560 iScsiPrt - ok 09:53:37.0509 4560 [ 63C766CDC609FF8206CB447A65ABBA4A ] iteatapi C:\Windows\system32\drivers\iteatapi.sys 09:53:37.0509 4560 iteatapi - ok 09:53:37.0525 4560 [ 1281FE73B17664631D12F643CBEA3F59 ] iteraid C:\Windows\system32\drivers\iteraid.sys 09:53:37.0525 4560 iteraid - ok 09:53:37.0556 4560 [ C0D9BA660A41EE8A269EF804E6CD0D7B ] JRAID C:\Windows\system32\DRIVERS\jraid.sys 09:53:37.0556 4560 JRAID - ok 09:53:37.0571 4560 [ 423696F3BA6472DD17699209B933BC26 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys 09:53:37.0571 4560 kbdclass - ok 09:53:37.0603 4560 [ DBDF75D51464FBC47D0104EC3D572C05 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys 09:53:37.0603 4560 kbdhid - ok 09:53:37.0618 4560 [ 260BF9C43EE12C6898A9F5AAB0FB0E5D ] KeyIso C:\Windows\system32\lsass.exe 09:53:37.0618 4560 KeyIso - ok 09:53:37.0665 4560 [ 88956AD9FA510848AD176777A6C6C1F5 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys 09:53:37.0681 4560 KSecDD - ok 09:53:37.0681 4560 [ 1D419CF43DB29396ECD7113D129D94EB ] ksthunk C:\Windows\system32\drivers\ksthunk.sys 09:53:37.0681 4560 ksthunk - ok 09:53:37.0712 4560 [ 1FAF6926F3416D3DA05C5B265491BDAE ] KtmRm C:\Windows\system32\msdtckrm.dll 09:53:37.0712 4560 KtmRm - ok 09:53:37.0743 4560 [ 50C7A3CB427E9BB5ED0708A669956AB5 ] LanmanServer C:\Windows\system32\srvsvc.dll 09:53:37.0743 4560 LanmanServer - ok 09:53:37.0759 4560 [ CAF86FC1388BE1E470F1A7B43E348ADB ] LanmanWorkstation C:\Windows\System32\wkssvc.dll 09:53:37.0759 4560 LanmanWorkstation - ok 09:53:37.0821 4560 [ EE963D96BFD97E54BA6CE6D2AC58DE35 ] LightScribeService C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe 09:53:37.0821 4560 LightScribeService - ok 09:53:37.0852 4560 [ 96ECE2659B6654C10A0C310AE3A6D02C ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys 09:53:37.0868 4560 lltdio - ok 09:53:37.0899 4560 [ 961CCBD0B1CCB5675D64976FAE37D092 ] lltdsvc C:\Windows\System32\lltdsvc.dll 09:53:37.0899 4560 lltdsvc - ok 09:53:37.0915 4560 [ A47F8080CACC23C91FE823AD19AA5612 ] lmhosts C:\Windows\System32\lmhsvc.dll 09:53:37.0930 4560 lmhosts - ok 09:53:37.0946 4560 [ ACBE1AF32D3123E330A07BFBC5EC4A9B ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys 09:53:37.0946 4560 LSI_FC - ok 09:53:37.0961 4560 [ 799FFB2FC4729FA46D2157C0065B3525 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys 09:53:37.0961 4560 LSI_SAS - ok 09:53:37.0977 4560 [ F445FF1DAAD8A226366BFAF42551226B ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys 09:53:37.0977 4560 LSI_SCSI - ok 09:53:38.0008 4560 [ 52F87B9CC8932C2A7375C3B2A9BE5E3E ] luafv C:\Windows\system32\drivers\luafv.sys 09:53:38.0008 4560 luafv - ok 09:53:38.0039 4560 [ 76A58DF02BD4EA29F189B82D0BEF17F8 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll 09:53:38.0039 4560 Mcx2Svc - ok 09:53:38.0039 4560 [ 5C5CD6AACED32FB26C3FB34B3DCF972F ] megasas C:\Windows\system32\drivers\megasas.sys 09:53:38.0039 4560 megasas - ok 09:53:38.0071 4560 [ 859BC2436B076C77C159ED694ACFE8F8 ] MegaSR C:\Windows\system32\drivers\megasr.sys 09:53:38.0071 4560 MegaSR - ok 09:53:38.0149 4560 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe 09:53:38.0149 4560 Microsoft Office Groove Audit Service - ok 09:53:38.0180 4560 [ 3CBE4995E80E13CCFBC42E5DCF3AC81A ] MMCSS C:\Windows\system32\mmcss.dll 09:53:38.0180 4560 MMCSS - ok 09:53:38.0180 4560 [ 59848D5CC74606F0EE7557983BB73C2E ] Modem C:\Windows\system32\drivers\modem.sys 09:53:38.0180 4560 Modem - ok 09:53:38.0195 4560 [ C247CC2A57E0A0C8C6DCCF7807B3E9E5 ] monitor C:\Windows\system32\DRIVERS\monitor.sys 09:53:38.0195 4560 monitor - ok 09:53:38.0227 4560 [ D69F1E9A944A5F46A494AF901ED41118 ] motandroidusb C:\Windows\system32\Drivers\motoandroid.sys 09:53:38.0227 4560 motandroidusb - ok 09:53:38.0273 4560 [ AC9D6E3629E4388A9EA9B4172493AAEE ] Motorola Device Manager C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe 09:53:38.0273 4560 Motorola Device Manager - ok 09:53:38.0273 4560 [ 9367304E5E412B120CF5F4EA14E4E4F1 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys 09:53:38.0273 4560 mouclass - ok 09:53:38.0289 4560 [ C2C2BD5C5CE5AAF786DDD74B75D2AC69 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys 09:53:38.0289 4560 mouhid - ok 09:53:38.0305 4560 [ 11BC9B1E8801B01F7F6ADB9EAD30019B ] MountMgr C:\Windows\system32\drivers\mountmgr.sys 09:53:38.0305 4560 MountMgr - ok 09:53:38.0351 4560 [ 9CE4C8A46B585EB5103EFE5FDEF3703F ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 09:53:38.0351 4560 MozillaMaintenance - ok 09:53:38.0367 4560 [ F8276EB8698142884498A528DFEA8478 ] mpio C:\Windows\system32\drivers\mpio.sys 09:53:38.0367 4560 mpio - ok 09:53:38.0383 4560 [ C92B9ABDB65A5991E00C28F13491DBA2 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys 09:53:38.0383 4560 mpsdrv - ok 09:53:38.0429 4560 [ 897E3BAF68BA406A61682AE39C83900C ] MpsSvc C:\Windows\system32\mpssvc.dll 09:53:38.0445 4560 MpsSvc - ok 09:53:38.0445 4560 [ 3C200630A89EF2C0864D515B7A75802E ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys 09:53:38.0445 4560 Mraid35x - ok 09:53:38.0461 4560 [ 7C1DE4AA96DC0C071611F9E7DE02A68D ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys 09:53:38.0476 4560 MRxDAV - ok 09:53:38.0476 4560 [ 1485811B320FF8C7EDAD1CAEBB1C6C2B ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys 09:53:38.0492 4560 mrxsmb - ok 09:53:38.0507 4560 [ 3B929A60C833FC615FD97FBA82BC7632 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys 09:53:38.0507 4560 mrxsmb10 - ok 09:53:38.0507 4560 [ C64AB3E1F53B4F5B5BB6D796B2D7BEC3 ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys 09:53:38.0507 4560 mrxsmb20 - ok 09:53:38.0523 4560 [ 1AC860612B85D8E85EE257D372E39F4D ] msahci C:\Windows\system32\drivers\msahci.sys 09:53:38.0523 4560 msahci - ok 09:53:38.0539 4560 [ 264BBB4AAF312A485F0E44B65A6B7202 ] msdsm C:\Windows\system32\drivers\msdsm.sys 09:53:38.0539 4560 msdsm - ok 09:53:38.0570 4560 [ 7EC02CE772F068ED0BEAFA3DA341A9BC ] MSDTC C:\Windows\System32\msdtc.exe 09:53:38.0585 4560 MSDTC - ok 09:53:38.0617 4560 [ 704F59BFC4512D2BB0146AEC31B10A7C ] Msfs C:\Windows\system32\drivers\Msfs.sys 09:53:38.0617 4560 Msfs - ok 09:53:38.0617 4560 [ 00EBC952961664780D43DCA157E79B27 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys 09:53:38.0617 4560 msisadrv - ok 09:53:38.0648 4560 [ 366B0C1F4478B519C181E37D43DCDA32 ] MSiSCSI C:\Windows\system32\iscsiexe.dll 09:53:38.0648 4560 MSiSCSI - ok 09:53:38.0648 4560 msiserver - ok 09:53:38.0679 4560 [ 0EA73E498F53B96D83DBFCA074AD4CF8 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys 09:53:38.0679 4560 MSKSSRV - ok 09:53:38.0710 4560 [ 52E59B7E992A58E740AA63F57EDBAE8B ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys 09:53:38.0710 4560 MSPCLOCK - ok 09:53:38.0710 4560 [ 49084A75BAE043AE02D5B44D02991BB2 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys 09:53:38.0726 4560 MSPQM - ok 09:53:38.0757 4560 [ DC6CCF440CDEDE4293DB41C37A5060A5 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys 09:53:38.0757 4560 MsRPC - ok 09:53:38.0757 4560 [ 855796E59DF77EA93AF46F20155BF55B ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys 09:53:38.0773 4560 mssmbios - ok 09:53:38.0788 4560 [ 86D632D75D05D5B7C7C043FA3564AE86 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys 09:53:38.0788 4560 MSTEE - ok 09:53:38.0819 4560 [ 0CC49F78D8ACA0877D885F149084E543 ] Mup C:\Windows\system32\Drivers\mup.sys 09:53:38.0819 4560 Mup - ok 09:53:38.0835 4560 [ A5B10C845E7538C60C0F5D87A57CB3F5 ] napagent C:\Windows\system32\qagentRT.dll 09:53:38.0835 4560 napagent - ok 09:53:38.0866 4560 [ 2007B826C4ACD94AE32232B41F0842B9 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys 09:53:38.0866 4560 NativeWifiP - ok 09:53:38.0882 4560 [ 65950E07329FCEE8E6516B17C8D0ABB6 ] NDIS C:\Windows\system32\drivers\ndis.sys 09:53:38.0897 4560 NDIS - ok 09:53:38.0897 4560 [ 64DF698A425478E321981431AC171334 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys 09:53:38.0897 4560 NdisTapi - ok 09:53:38.0913 4560 [ 8BAA43196D7B5BB972C9A6B2BBF61A19 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys 09:53:38.0913 4560 Ndisuio - ok 09:53:38.0929 4560 [ F8158771905260982CE724076419EF19 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys 09:53:38.0929 4560 NdisWan - ok 09:53:38.0944 4560 [ 9CB77ED7CB72850253E973A2D6AFDF49 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys 09:53:38.0944 4560 NDProxy - ok 09:53:38.0960 4560 [ 2334DC48997BA203B794DF3EE70521DB ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll 09:53:38.0975 4560 Net Driver HPZ12 - ok 09:53:38.0975 4560 [ A499294F5029A7862ADC115BDA7371CE ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys 09:53:38.0975 4560 NetBIOS - ok 09:53:38.0991 4560 [ FC2C792EBDDC8E28DF939D6A92C83D61 ] netbt C:\Windows\system32\DRIVERS\netbt.sys 09:53:38.0991 4560 netbt - ok 09:53:39.0038 4560 [ 260BF9C43EE12C6898A9F5AAB0FB0E5D ] Netlogon C:\Windows\system32\lsass.exe 09:53:39.0038 4560 Netlogon - ok 09:53:39.0053 4560 [ 9B63B29DEFC0F3115A559D2597BF5D75 ] Netman C:\Windows\System32\netman.dll 09:53:39.0069 4560 Netman - ok 09:53:39.0116 4560 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 09:53:39.0116 4560 NetMsmqActivator - ok 09:53:39.0131 4560 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 09:53:39.0131 4560 NetPipeActivator - ok 09:53:39.0163 4560 [ 7846D0136CC2B264926A73047BA7688A ] netprofm C:\Windows\System32\netprofm.dll 09:53:39.0163 4560 netprofm - ok 09:53:39.0163 4560 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 09:53:39.0163 4560 NetTcpActivator - ok 09:53:39.0178 4560 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 09:53:39.0178 4560 NetTcpPortSharing - ok 09:53:39.0194 4560 [ 4AC08BD6AF2DF42E0C3196D826C8AEA7 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys 09:53:39.0194 4560 nfrd960 - ok 09:53:39.0256 4560 [ 7F98566A311CEB1FE2994F8C2A05FBC1 ] NitroDriverReadSpool C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe 09:53:39.0256 4560 NitroDriverReadSpool - ok 09:53:39.0272 4560 [ F145BF4C4668E7E312069F81EF847CFC ] NlaSvc C:\Windows\System32\nlasvc.dll 09:53:39.0287 4560 NlaSvc - ok 09:53:39.0365 4560 [ 7BFA0C5D8A4A2F1C46A6A3A698BDE3E5 ] nlsX86cc C:\Windows\SysWOW64\NLSSRV32.EXE 09:53:39.0365 4560 nlsX86cc - ok 09:53:39.0412 4560 [ 351533ACC2A069B94E80BBFC177E8FDF ] npf C:\Windows\system32\drivers\npf.sys 09:53:39.0412 4560 npf - ok 09:53:39.0443 4560 [ B298874F8E0EA93F06EC40AA8D146478 ] Npfs C:\Windows\system32\drivers\Npfs.sys 09:53:39.0443 4560 Npfs - ok 09:53:39.0459 4560 [ ACB62BAA1C319B17752553DF3026EEEB ] nsi C:\Windows\system32\nsisvc.dll 09:53:39.0459 4560 nsi - ok 09:53:39.0459 4560 [ 1523AF19EE8B030BA682F7A53537EAEB ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys 09:53:39.0459 4560 nsiproxy - ok 09:53:39.0537 4560 [ 2ACCAA3C3C55370A32F17B3595E1A217 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys 09:53:39.0553 4560 Ntfs - ok 09:53:39.0568 4560 [ DD5D684975352B85B52E3FD5347C20CB ] Null C:\Windows\system32\drivers\Null.sys 09:53:39.0568 4560 Null - ok 09:53:39.0599 4560 [ 102806B360D0E6BC6E55BF47EF655D43 ] NVHDA C:\Windows\system32\drivers\nvhda64v.sys 09:53:39.0599 4560 NVHDA - ok 09:53:39.0771 4560 [ FCBA1C22727939E7CFF9EB08FE9692AB ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys 09:53:39.0911 4560 nvlddmkm - ok 09:53:39.0943 4560 [ 2C040B7ADA5B06F6FACADAC8514AA034 ] nvraid C:\Windows\system32\drivers\nvraid.sys 09:53:39.0943 4560 nvraid - ok 09:53:39.0958 4560 [ F7EA0FE82842D05EDA3EFDD376DBFDBA ] nvstor C:\Windows\system32\drivers\nvstor.sys 09:53:39.0958 4560 nvstor - ok 09:53:40.0005 4560 [ 10C232F6CFFD51D2332898AE7AE0FF23 ] nvsvc C:\Windows\system32\nvvsvc.exe 09:53:40.0005 4560 nvsvc - ok 09:53:40.0114 4560 [ 4789E020D2617046862D1790FC235FF6 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe 09:53:40.0114 4560 nvUpdatusService - ok 09:53:40.0145 4560 [ 19067CA93075EF4823E3938A686F532F ] nv_agp C:\Windows\system32\drivers\nv_agp.sys 09:53:40.0145 4560 nv_agp - ok 09:53:40.0145 4560 NwlnkFlt - ok 09:53:40.0145 4560 NwlnkFwd - ok 09:53:40.0208 4560 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 09:53:40.0223 4560 odserv - ok 09:53:40.0255 4560 [ B5B1CE65AC15BBD11C0619E3EF7CFC28 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys 09:53:40.0255 4560 ohci1394 - ok 09:53:40.0286 4560 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 09:53:40.0301 4560 ose - ok 09:53:40.0348 4560 [ 9AE31D2E1D15C10D91318E0EC149CEAC ] p2pimsvc C:\Windows\system32\p2psvc.dll 09:53:40.0364 4560 p2pimsvc - ok 09:53:40.0364 4560 [ 9AE31D2E1D15C10D91318E0EC149CEAC ] p2psvc C:\Windows\system32\p2psvc.dll 09:53:40.0364 4560 p2psvc - ok 09:53:40.0426 4560 [ 4C6A7FD04DDF4DB88791048382E3EDB1 ] Parport C:\Windows\system32\DRIVERS\parport.sys 09:53:40.0426 4560 Parport - ok 09:53:40.0473 4560 [ B43751085E2ABE389DA466BC62A4B987 ] partmgr C:\Windows\system32\drivers\partmgr.sys 09:53:40.0473 4560 partmgr - ok 09:53:40.0504 4560 [ 9AB157B374192FF276C1628FBDBA2B0E ] PcaSvc C:\Windows\System32\pcasvc.dll 09:53:40.0504 4560 PcaSvc - ok 09:53:40.0520 4560 [ 47AB1E0FC9D0E12BB53BA246E3A0906D ] pci C:\Windows\system32\drivers\pci.sys 09:53:40.0520 4560 pci - ok 09:53:40.0535 4560 [ 2657F6C0B78C36D95034BE109336E382 ] pciide C:\Windows\system32\drivers\pciide.sys 09:53:40.0535 4560 pciide - ok 09:53:40.0567 4560 [ 037661F3D7C507C9993B7010CEEE6288 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys 09:53:40.0567 4560 pcmcia - ok 09:53:40.0598 4560 [ 58865916F53592A61549B04941BFD80D ] PEAUTH C:\Windows\system32\drivers\peauth.sys 09:53:40.0598 4560 PEAUTH - ok 09:53:40.0613 4560 [ 0ED8727EA0172860F47258456C06CAEA ] PerfHost C:\Windows\SysWow64\perfhost.exe 09:53:40.0613 4560 PerfHost - ok 09:53:40.0660 4560 [ E9E68C1A0F25CF4A7AC966EEA74EE89E ] pla C:\Windows\system32\pla.dll 09:53:40.0676 4560 pla - ok 09:53:40.0723 4560 [ FE6B0F59215C9FD9F9D26539C58C8B82 ] PlugPlay C:\Windows\system32\umpnpmgr.dll 09:53:40.0738 4560 PlugPlay - ok 09:53:40.0769 4560 [ AC78DF349F0E4CFB8B667C0CFFF83CCE ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll 09:53:40.0769 4560 Pml Driver HPZ12 - ok 09:53:40.0785 4560 [ 9AE31D2E1D15C10D91318E0EC149CEAC ] PNRPAutoReg C:\Windows\system32\p2psvc.dll 09:53:40.0785 4560 PNRPAutoReg - ok 09:53:40.0816 4560 [ 9AE31D2E1D15C10D91318E0EC149CEAC ] PNRPsvc C:\Windows\system32\p2psvc.dll 09:53:40.0816 4560 PNRPsvc - ok 09:53:40.0832 4560 [ 89A5560671C2D8B4A4B51F3E1AA069D8 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll 09:53:40.0847 4560 PolicyAgent - ok 09:53:40.0863 4560 [ 23386E9952025F5F21C368971E2E7301 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys 09:53:40.0863 4560 PptpMiniport - ok 09:53:40.0910 4560 [ 5080E59ECEE0BC923F14018803AA7A01 ] Processor C:\Windows\system32\drivers\processr.sys 09:53:40.0910 4560 Processor - ok 09:53:40.0941 4560 [ E058CE4FC2449D8BFA14739C83B7FF2A ] ProfSvc C:\Windows\system32\profsvc.dll 09:53:40.0941 4560 ProfSvc - ok 09:53:40.0941 4560 [ 260BF9C43EE12C6898A9F5AAB0FB0E5D ] ProtectedStorage C:\Windows\system32\lsass.exe 09:53:40.0941 4560 ProtectedStorage - ok 09:53:40.0957 4560 [ C5AB7F0809392D0DA027F4A2A81BFA31 ] PSched C:\Windows\system32\DRIVERS\pacer.sys 09:53:40.0957 4560 PSched - ok 09:53:41.0035 4560 [ EA735BF6DF13A857A83C99BF27A422AD ] PST Service C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe 09:53:41.0050 4560 PST Service - ok 09:53:41.0066 4560 [ F2EECF8977BD3FE4E38743DDCFBECD20 ] PxHlpa64 C:\Windows\system32\Drivers\PxHlpa64.sys 09:53:41.0066 4560 PxHlpa64 - ok 09:53:41.0097 4560 [ 0B83F4E681062F3839BE2EC1D98FD94A ] ql2300 C:\Windows\system32\drivers\ql2300.sys 09:53:41.0113 4560 ql2300 - ok 09:53:41.0128 4560 [ E1C80F8D4D1E39EF9595809C1369BF2A ] ql40xx C:\Windows\system32\drivers\ql40xx.sys 09:53:41.0128 4560 ql40xx - ok 09:53:41.0159 4560 [ 90574842C3DA781E279061A3EFF91F07 ] QWAVE C:\Windows\system32\qwave.dll 09:53:41.0175 4560 QWAVE - ok 09:53:41.0175 4560 [ E8D76EDAB77EC9C634C27B8EAC33ADC5 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys 09:53:41.0175 4560 QWAVEdrv - ok 09:53:41.0191 4560 [ 1013B3B663A56D3DDD784F581C1BD005 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys 09:53:41.0191 4560 RasAcd - ok 09:53:41.0191 4560 [ B2AE18F847D07F0044404DDF7CB04497 ] RasAuto C:\Windows\System32\rasauto.dll 09:53:41.0206 4560 RasAuto - ok 09:53:41.0206 4560 [ AC7BC4D42A7E558718DFDEC599BBFC2C ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys 09:53:41.0206 4560 Rasl2tp - ok 09:53:41.0222 4560 [ 3AD83E4046C43BE510DE681588ACB8AF ] RasMan C:\Windows\System32\rasmans.dll 09:53:41.0222 4560 RasMan - ok 09:53:41.0237 4560 [ 4517FBF8B42524AFE4EDE1DE102AAE3E ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys 09:53:41.0237 4560 RasPppoe - ok 09:53:41.0253 4560 [ C6A593B51F34C33E5474539544072527 ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys 09:53:41.0253 4560 RasSstp - ok 09:53:41.0253 4560 [ 322DB5C6B55E8D8EE8D6F358B2AAABB1 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys 09:53:41.0269 4560 rdbss - ok 09:53:41.0269 4560 [ 603900CC05F6BE65CCBF373800AF3716 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys 09:53:41.0269 4560 RDPCDD - ok 09:53:41.0300 4560 [ C045D1FB111C28DF0D1BE8D4BDA22C06 ] rdpdr C:\Windows\system32\drivers\rdpdr.sys 09:53:41.0300 4560 rdpdr - ok 09:53:41.0300 4560 [ CAB9421DAF3D97B33D0D055858E2C3AB ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys 09:53:41.0300 4560 RDPENCDD - ok 09:53:41.0347 4560 [ AE4BD9E1C33D351D8E607FC81F15160C ] RDPWD C:\Windows\system32\drivers\RDPWD.sys 09:53:41.0347 4560 RDPWD - ok 09:53:41.0409 4560 [ C612B9557DA73F70D41F8A6FBC8E5344 ] RemoteAccess C:\Windows\System32\mprdim.dll 09:53:41.0409 4560 RemoteAccess - ok 09:53:41.0425 4560 [ 44B9D8EC2F3EF3A0EFB00857AF70D861 ] RemoteRegistry C:\Windows\system32\regsvc.dll 09:53:41.0425 4560 RemoteRegistry - ok 09:53:41.0471 4560 [ AD42432D22940B4215177BE113E4919C ] RimUsb C:\Windows\system32\Drivers\RimUsb_AMD64.sys 09:53:41.0471 4560 RimUsb - ok 09:53:41.0503 4560 [ 4AAFFFA67AC4DFA3D9985D78573887E2 ] RimVSerPort C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys 09:53:41.0503 4560 RimVSerPort - ok 09:53:41.0518 4560 [ 6A0CF73B019CBC9255E23C9192EC3702 ] ROOTMODEM C:\Windows\system32\Drivers\RootMdm.sys 09:53:41.0518 4560 ROOTMODEM - ok 09:53:41.0534 4560 [ F46C457840D4B7A4DAAFEE739CE04102 ] RpcLocator C:\Windows\system32\locator.exe 09:53:41.0534 4560 RpcLocator - ok 09:53:41.0565 4560 [ CF8B9A3A5E7DC57724A89D0C3E8CF9EF ] RpcSs C:\Windows\system32\rpcss.dll 09:53:41.0565 4560 RpcSs - ok 09:53:41.0581 4560 [ 22A9CB08B1A6707C1550C6BF099AAE73 ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys 09:53:41.0581 4560 rspndr - ok 09:53:41.0596 4560 [ FAEEED5A8949E6BA611A7B738AD28CEE ] RTL8169 C:\Windows\system32\DRIVERS\Rtlh64.sys 09:53:41.0596 4560 RTL8169 - ok 09:53:41.0627 4560 [ 24D933C6C903CB9D076E59AF78B88A75 ] RtNdPt60 C:\Windows\system32\DRIVERS\RtNdPt60.sys 09:53:41.0627 4560 RtNdPt60 - ok 09:53:41.0643 4560 [ BC7943DEE7A51E74AFDE04C4163490B3 ] RTTEAMPT C:\Windows\system32\DRIVERS\RtTeam60.sys 09:53:41.0643 4560 RTTEAMPT - ok 09:53:41.0659 4560 [ 5D0C984A22FCB80C35860C1D93B12D46 ] RTVLANPT C:\Windows\system32\DRIVERS\RtVlan60.sys 09:53:41.0659 4560 RTVLANPT - ok 09:53:41.0674 4560 [ 260BF9C43EE12C6898A9F5AAB0FB0E5D ] SamSs C:\Windows\system32\lsass.exe 09:53:41.0674 4560 SamSs - ok 09:53:41.0721 4560 [ 8C8862DC7417D89B375492C981C491F7 ] sbp2port C:\Windows\system32\DRIVERS\sbp2port.sys 09:53:41.0721 4560 sbp2port - ok 09:53:41.0737 4560 [ FD1CDCF108D5EF3366F00D18B70FB89B ] SCardSvr C:\Windows\System32\SCardSvr.dll 09:53:41.0752 4560 SCardSvr - ok 09:53:41.0783 4560 [ 0F838C811AD295D2A4489B9993096C63 ] Schedule C:\Windows\system32\schedsvc.dll 09:53:41.0799 4560 Schedule - ok 09:53:41.0830 4560 [ 5A268127633C7EE2A7FB87F39D748D56 ] SCPolicySvc C:\Windows\System32\certprop.dll 09:53:41.0830 4560 SCPolicySvc - ok 09:53:41.0861 4560 [ 4FF71B076A7760FE75EA5AE2D0EE0018 ] SDRSVC C:\Windows\System32\SDRSVC.dll 09:53:41.0861 4560 SDRSVC - ok 09:53:41.0877 4560 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys 09:53:41.0877 4560 secdrv - ok 09:53:41.0893 4560 [ 5ACDCBC67FCF894A1815B9F96D704490 ] seclogon C:\Windows\system32\seclogon.dll 09:53:41.0893 4560 seclogon - ok 09:53:41.0908 4560 [ 90973A64B96CD647FF81C79443618EED ] SENS C:\Windows\System32\sens.dll 09:53:41.0908 4560 SENS - ok 09:53:41.0939 4560 [ 2449316316411D65BD2C761A6FFB2CE2 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys 09:53:41.0939 4560 Serenum - ok 09:53:41.0939 4560 [ 4B438170BE2FC8E0BD35EE87A960F84F ] Serial C:\Windows\system32\DRIVERS\serial.sys 09:53:41.0939 4560 Serial - ok 09:53:41.0971 4560 [ A842F04833684BCEEA7336211BE478DF ] sermouse C:\Windows\system32\drivers\sermouse.sys 09:53:41.0971 4560 sermouse - ok 09:53:42.0017 4560 [ A8E4A4407A09F35DCCC3771AF590B0C4 ] SessionEnv C:\Windows\system32\sessenv.dll 09:53:42.0017 4560 SessionEnv - ok 09:53:42.0049 4560 [ 14D4B4465193A87C127933978E8C4106 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys 09:53:42.0049 4560 sffdisk - ok 09:53:42.0064 4560 [ 7073AEE3F82F3D598E3825962AA98AB2 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys 09:53:42.0064 4560 sffp_mmc - ok 09:53:42.0080 4560 [ 35E59EBE4A01A0532ED67975161C7B82 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys 09:53:42.0080 4560 sffp_sd - ok 09:53:42.0080 4560 [ 6B7838C94135768BD455CBDC23E39E5F ] sfloppy C:\Windows\system32\drivers\sfloppy.sys 09:53:42.0080 4560 sfloppy - ok 09:53:42.0111 4560 [ 4C5AEE179DA7E1EE9A9CCB9DA289AF34 ] SharedAccess C:\Windows\System32\ipnathlp.dll 09:53:42.0127 4560 SharedAccess - ok 09:53:42.0158 4560 [ 56793271ECDEDD350C5ADD305603E963 ] ShellHWDetection C:\Windows\System32\shsvcs.dll 09:53:42.0158 4560 ShellHWDetection - ok 09:53:42.0173 4560 [ 7A5DE502AEB719D4594C6471060A78B3 ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys 09:53:42.0173 4560 SiSRaid2 - ok 09:53:42.0189 4560 [ 3A2F769FAB9582BC720E11EA1DFB184D ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys 09:53:42.0189 4560 SiSRaid4 - ok 09:53:42.0251 4560 [ A9A27A8E257B45A604FDAD4F26FE7241 ] slsvc C:\Windows\system32\SLsvc.exe 09:53:42.0267 4560 slsvc - ok 09:53:42.0267 4560 [ FD74B4B7C2088E390A30C85A896FC3AF ] SLUINotify C:\Windows\system32\SLUINotify.dll 09:53:42.0267 4560 SLUINotify - ok 09:53:42.0298 4560 [ 290B6F6A0EC4FCDFC90F5CB6D7020473 ] Smb C:\Windows\system32\DRIVERS\smb.sys 09:53:42.0298 4560 Smb - ok 09:53:42.0345 4560 [ 32CDE417100C530964E79C53B4E994CA ] snapman C:\Windows\system32\DRIVERS\snapman.sys 09:53:42.0345 4560 snapman - ok 09:53:42.0376 4560 [ F8F47F38909823B1AF28D60B96340CFF ] SNMPTRAP C:\Windows\System32\snmptrap.exe 09:53:42.0376 4560 SNMPTRAP - ok 09:53:42.0392 4560 [ 386C3C63F00A7040C7EC5E384217E89D ] spldr C:\Windows\system32\drivers\spldr.sys 09:53:42.0392 4560 spldr - ok 09:53:42.0423 4560 [ F66FF751E7EFC816D266977939EF5DC3 ] Spooler C:\Windows\System32\spoolsv.exe 09:53:42.0423 4560 Spooler - ok 09:53:42.0454 4560 [ 880A57FCCB571EBD063D4DD50E93E46D ] srv C:\Windows\system32\DRIVERS\srv.sys 09:53:42.0454 4560 srv - ok 09:53:42.0485 4560 [ A1AD14A6D7A37891FFFECA35EBBB0730 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys 09:53:42.0485 4560 srv2 - ok 09:53:42.0501 4560 [ 4BED62F4FA4D8300973F1151F4C4D8A7 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys 09:53:42.0501 4560 srvnet - ok 09:53:42.0517 4560 [ 192C74646EC5725AEF3F80D19FF75F6A ] SSDPSRV C:\Windows\System32\ssdpsrv.dll 09:53:42.0517 4560 SSDPSRV - ok 09:53:42.0532 4560 [ 2EE3FA0308E6185BA64A9A7F2E74332B ] SstpSvc C:\Windows\system32\sstpsvc.dll 09:53:42.0532 4560 SstpSvc - ok 09:53:42.0595 4560 [ 5A19667A580B1CE886EAF968B9743F45 ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe 09:53:42.0595 4560 Stereo Service - ok 09:53:42.0626 4560 [ 15825C1FBFB8779992CB65087F316AF5 ] stisvc C:\Windows\System32\wiaservc.dll 09:53:42.0641 4560 stisvc - ok 09:53:42.0673 4560 [ 8A851CA908B8B974F89C50D2E18D4F0C ] swenum C:\Windows\system32\DRIVERS\swenum.sys 09:53:42.0673 4560 swenum - ok 09:53:42.0688 4560 [ 6DE37F4DE19D4EFD9C48C43ADDBC949A ] swprv C:\Windows\System32\swprv.dll 09:53:42.0688 4560 swprv - ok 09:53:42.0719 4560 [ 52EB25BD8AB4E331028C48B178441B36 ] sxuptp C:\Windows\system32\DRIVERS\sxuptp.sys 09:53:42.0719 4560 sxuptp - ok 09:53:42.0735 4560 [ 2F26A2C6FC96B29BEFF5D8ED74E6625B ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys 09:53:42.0735 4560 Symc8xx - ok 09:53:42.0751 4560 [ A909667976D3BCCD1DF813FED517D837 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys 09:53:42.0751 4560 Sym_hi - ok 09:53:42.0766 4560 [ 36887B56EC2D98B9C362F6AE4DE5B7B0 ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys 09:53:42.0766 4560 Sym_u3 - ok 09:53:42.0797 4560 [ 92D7A8B0F87B036F17D25885937897A6 ] SysMain C:\Windows\system32\sysmain.dll 09:53:42.0797 4560 SysMain - ok 09:53:42.0844 4560 [ 005CE42567F9113A3BCCB3B20073B029 ] TabletInputService C:\Windows\System32\TabSvc.dll 09:53:42.0844 4560 TabletInputService - ok 09:53:42.0860 4560 [ CC2562B4D55E0B6A4758C65407F63B79 ] TapiSrv C:\Windows\System32\tapisrv.dll 09:53:42.0860 4560 TapiSrv - ok 09:53:42.0875 4560 [ CDBE8D7C1E201B911CDC346D06617FB5 ] TBS C:\Windows\System32\tbssvc.dll 09:53:42.0875 4560 TBS - ok 09:53:42.0938 4560 [ 0E970F59D7FBB838316176B19A2ADB82 ] Tcpip C:\Windows\system32\drivers\tcpip.sys 09:53:42.0953 4560 Tcpip - ok 09:53:42.0969 4560 [ 0E970F59D7FBB838316176B19A2ADB82 ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys 09:53:42.0985 4560 Tcpip6 - ok 09:53:43.0000 4560 [ C7E72A4071EE0200E3C075DACFB2B334 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys 09:53:43.0000 4560 tcpipreg - ok 09:53:43.0047 4560 [ 1D8BF4AAA5FB7A2761475781DC1195BC ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys 09:53:43.0047 4560 TDPIPE - ok 09:53:43.0047 4560 [ 7F7E00CDF609DF657F4CDA02DD1C9BB1 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys 09:53:43.0047 4560 TDTCP - ok 09:53:43.0078 4560 [ 458919C8C42E398DC4802178D5FFEE27 ] tdx C:\Windows\system32\DRIVERS\tdx.sys 09:53:43.0078 4560 tdx - ok 09:53:43.0109 4560 [ BC7943DEE7A51E74AFDE04C4163490B3 ] TEAM C:\Windows\system32\DRIVERS\RtTeam60.sys 09:53:43.0109 4560 TEAM - ok 09:53:43.0141 4560 [ 8C19678D22649EC002EF2282EAE92F98 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys 09:53:43.0141 4560 TermDD - ok 09:53:43.0156 4560 [ 5CDD30BC217082DAC71A9878D9BFD566 ] TermService C:\Windows\System32\termsrv.dll 09:53:43.0156 4560 TermService - ok 09:53:43.0172 4560 [ 56793271ECDEDD350C5ADD305603E963 ] Themes C:\Windows\system32\shsvcs.dll 09:53:43.0172 4560 Themes - ok 09:53:43.0187 4560 [ 3CBE4995E80E13CCFBC42E5DCF3AC81A ] THREADORDER C:\Windows\system32\mmcss.dll 09:53:43.0203 4560 THREADORDER - ok 09:53:43.0250 4560 [ 6ADC063FD51F03EF0CAB3E716A725BD2 ] timounter C:\Windows\system32\DRIVERS\timntr.sys 09:53:43.0265 4560 timounter - ok 09:53:43.0328 4560 [ 67543A2749BA72E1E2D2E20CE0DAA31B ] TRENDnetUdsMBus C:\Windows\syswow64\Drivers\TRENDnetUdsMBus.sys 09:53:43.0328 4560 TRENDnetUdsMBus - ok 09:53:43.0375 4560 [ D251798891C85797C6A3A181A79FB640 ] TRENDnetUdsTcpBus C:\Windows\syswow64\Drivers\TrendNetUDSTcpBus.sys 09:53:43.0375 4560 TRENDnetUdsTcpBus - ok 09:53:43.0390 4560 [ F4689F05AF472A651A7B1B7B02D200E7 ] TrkWks C:\Windows\System32\trkwks.dll 09:53:43.0390 4560 TrkWks - ok 09:53:43.0437 4560 [ 66328B08EF5A9305D8EDE36B93930369 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe 09:53:43.0437 4560 TrustedInstaller - ok 09:53:43.0468 4560 [ 9E5409CD17C8BEF193AAD498F3BC2CB8 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys 09:53:43.0468 4560 tssecsrv - ok 09:53:43.0484 4560 [ 89EC74A9E602D16A75A4170511029B3C ] tunmp C:\Windows\system32\DRIVERS\tunmp.sys 09:53:43.0484 4560 tunmp - ok 09:53:43.0531 4560 [ 30A9B3F45AD081BFFC3BCAA9C812B609 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys 09:53:43.0531 4560 tunnel - ok 09:53:43.0546 4560 [ FEC266EF401966311744BD0F359F7F56 ] uagp35 C:\Windows\system32\drivers\uagp35.sys 09:53:43.0546 4560 uagp35 - ok 09:53:43.0577 4560 [ 632AA439691CF71F544567C3D6458A2A ] ubohci C:\Windows\system32\DRIVERS\ubohci.sys 09:53:43.0577 4560 ubohci - ok 09:53:43.0593 4560 [ E1AFED5E72113D552B2E2ADEFC8A7CE9 ] ubsbm C:\Windows\system32\DRIVERS\ubsbm.sys 09:53:43.0593 4560 ubsbm - ok 09:53:43.0624 4560 [ B249179936BF297186A074A8E8588965 ] ubsbp2 C:\Windows\system32\DRIVERS\ubsbp2.sys 09:53:43.0624 4560 ubsbp2 - ok 09:53:43.0655 4560 [ F188ECC28D9685F32A0286D66B94B01A ] ubumapi C:\Windows\system32\DRIVERS\ubumapi.sys 09:53:43.0655 4560 ubumapi - ok 09:53:43.0671 4560 [ FAF2640A2A76ED03D449E443194C4C34 ] udfs C:\Windows\system32\DRIVERS\udfs.sys 09:53:43.0671 4560 udfs - ok 09:53:43.0702 4560 [ 060507C4113391394478F6953A79EEDC ] UI0Detect C:\Windows\system32\UI0Detect.exe 09:53:43.0702 4560 UI0Detect - ok 09:53:43.0733 4560 [ 49B13845F0DBE39B47FC91DC46B2170A ] UimBus C:\Windows\system32\DRIVERS\uimx64.sys 09:53:43.0733 4560 UimBus - ok 09:53:43.0749 4560 [ DD46BEC773C011EAA5E502C43A73A1CC ] Uim_IM C:\Windows\system32\Drivers\Uim_IMx64.sys 09:53:43.0749 4560 Uim_IM - ok 09:53:43.0780 4560 [ 4EC9447AC3AB462647F60E547208CA00 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys 09:53:43.0780 4560 uliagpkx - ok 09:53:43.0796 4560 [ 697F0446134CDC8F99E69306184FBBB4 ] uliahci C:\Windows\system32\drivers\uliahci.sys 09:53:43.0811 4560 uliahci - ok 09:53:43.0827 4560 [ 31707F09846056651EA2C37858F5DDB0 ] UlSata C:\Windows\system32\drivers\ulsata.sys 09:53:43.0827 4560 UlSata - ok 09:53:43.0843 4560 [ 85E5E43ED5B48C8376281BAB519271B7 ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys 09:53:43.0843 4560 ulsata2 - ok 09:53:43.0858 4560 [ 46E9A994C4FED537DD951F60B86AD3F4 ] umbus C:\Windows\system32\DRIVERS\umbus.sys 09:53:43.0858 4560 umbus - ok 09:53:43.0874 4560 [ 01ABE05C401E70795B43A8933B44831E ] UMPass C:\Windows\system32\DRIVERS\umpass.sys 09:53:43.0874 4560 UMPass - ok 09:53:43.0889 4560 [ 7093799FF80E9DECA0680D2E3535BE60 ] upnphost C:\Windows\System32\upnphost.dll 09:53:43.0905 4560 upnphost - ok 09:53:43.0952 4560 [ 137561C0346A9409E13BF58C2BC609DB ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys 09:53:43.0952 4560 USBAAPL64 - ok 09:53:43.0983 4560 [ 07E3498FC60834219D2356293DA0FECC ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys 09:53:43.0983 4560 usbccgp - ok 09:53:43.0999 4560 [ 9247F7E0B65852C1F6631480984D6ED2 ] usbcir C:\Windows\system32\drivers\usbcir.sys 09:53:43.0999 4560 usbcir - ok 09:53:44.0014 4560 [ 827E44DE934A736EA31E91D353EB126F ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys 09:53:44.0014 4560 usbehci - ok 09:53:44.0030 4560 [ BB35CD80A2ECECFADC73569B3D70C7D1 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys 09:53:44.0030 4560 usbhub - ok 09:53:44.0045 4560 [ EBA14EF0C07CEC233F1529C698D0D154 ] usbohci C:\Windows\system32\drivers\usbohci.sys 09:53:44.0045 4560 usbohci - ok 09:53:44.0061 4560 [ 28B693B6D31E7B9332C1BDCEFEF228C1 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys 09:53:44.0061 4560 usbprint - ok 09:53:44.0108 4560 [ EA0BF666868964FBE8CB10E50C97B9F1 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys 09:53:44.0108 4560 usbscan - ok 09:53:44.0155 4560 [ B854C1558FCA0C269A38663E8B59B581 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS 09:53:44.0155 4560 USBSTOR - ok 09:53:44.0170 4560 [ B2872CBF9F47316ABD0E0C74A1ABA507 ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys 09:53:44.0170 4560 usbuhci - ok 09:53:44.0186 4560 [ D76E231E4850BB3F88A3D9A78DF191E3 ] UxSms C:\Windows\System32\uxsms.dll 09:53:44.0201 4560 UxSms - ok 09:53:44.0201 4560 [ 294945381DFA7CE58CECF0A9896AF327 ] vds C:\Windows\System32\vds.exe 09:53:44.0217 4560 vds - ok 09:53:44.0233 4560 [ 916B94BCF1E09873FFF2D5FB11767BBC ] vga C:\Windows\system32\DRIVERS\vgapnp.sys 09:53:44.0233 4560 vga - ok 09:53:44.0264 4560 [ B83AB16B51FEDA65DD81B8C59D114D63 ] VgaSave C:\Windows\System32\drivers\vga.sys 09:53:44.0264 4560 VgaSave - ok 09:53:44.0279 4560 [ 8294B6C3FDB6C33F24E150DE647ECDAA ] viaide C:\Windows\system32\drivers\viaide.sys 09:53:44.0279 4560 viaide - ok 09:53:44.0326 4560 [ 96A4F56CBBA3DCF5D90CDA1BC218D040 ] vididr C:\Windows\system32\DRIVERS\vididr.sys 09:53:44.0326 4560 vididr - ok 09:53:44.0342 4560 [ C69A784BEC737CD7460EBF3C3834D65E ] vidsflt53 C:\Windows\system32\DRIVERS\vsflt53.sys 09:53:44.0342 4560 vidsflt53 - ok 09:53:44.0342 4560 [ 2B7E885ED951519A12C450D24535DFCA ] volmgr C:\Windows\system32\drivers\volmgr.sys 09:53:44.0342 4560 volmgr - ok 09:53:44.0357 4560 [ CEC5AC15277D75D9E5DEC2E1C6EAF877 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys 09:53:44.0357 4560 volmgrx - ok 09:53:44.0404 4560 [ 582F710097B46140F5A89A19A6573D4B ] volsnap C:\Windows\system32\drivers\volsnap.sys 09:53:44.0404 4560 volsnap - ok 09:53:44.0435 4560 [ A68F455ED2673835209318DD61BFBB0E ] vsmraid C:\Windows\system32\drivers\vsmraid.sys 09:53:44.0435 4560 vsmraid - ok 09:53:44.0467 4560 [ B75232DAD33BFD95BF6F0A3E6BFF51E1 ] VSS C:\Windows\system32\vssvc.exe 09:53:44.0482 4560 VSS - ok 09:53:44.0498 4560 [ 370B45CB73987367FCD18762D2DD4714 ] VUSB3HUB C:\Windows\system32\DRIVERS\ViaHub3.sys 09:53:44.0498 4560 VUSB3HUB - ok 09:53:44.0498 4560 [ F14A7DE2EA41883E250892E1E5230A9A ] W32Time C:\Windows\system32\w32time.dll 09:53:44.0513 4560 W32Time - ok 09:53:44.0529 4560 [ FEF8FE5923FEAD2CEE4DFABFCE3393A7 ] WacomPen C:\Windows\system32\drivers\wacompen.sys 09:53:44.0529 4560 WacomPen - ok 09:53:44.0529 4560 [ B8E7049622300D20BA6D8BE0C47C0CFD ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys 09:53:44.0529 4560 Wanarp - ok 09:53:44.0545 4560 [ B8E7049622300D20BA6D8BE0C47C0CFD ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys 09:53:44.0545 4560 Wanarpv6 - ok 09:53:44.0545 4560 [ B4E4C37D0AA6100090A53213EE2BF1C1 ] wcncsvc C:\Windows\System32\wcncsvc.dll 09:53:44.0560 4560 wcncsvc - ok 09:53:44.0576 4560 [ EA4B369560E986F19D93F45A881484AC ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll 09:53:44.0576 4560 WcsPlugInService - ok 09:53:44.0607 4560 [ 0C17A0816F65B89E362E682AD5E7266E ] Wd C:\Windows\system32\drivers\wd.sys 09:53:44.0607 4560 Wd - ok 09:53:44.0654 4560 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys 09:53:44.0669 4560 Wdf01000 - ok 09:53:44.0685 4560 [ C5EFDA73EBFCA8B02A094898DE0A9276 ] WdiServiceHost C:\Windows\system32\wdi.dll 09:53:44.0685 4560 WdiServiceHost - ok 09:53:44.0701 4560 [ C5EFDA73EBFCA8B02A094898DE0A9276 ] WdiSystemHost C:\Windows\system32\wdi.dll 09:53:44.0701 4560 WdiSystemHost - ok 09:53:44.0747 4560 [ 3E6D05381CF35F75EBB055544A8ED9AC ] WebClient C:\Windows\System32\webclnt.dll 09:53:44.0763 4560 WebClient - ok 09:53:44.0794 4560 [ 8D40BC587993F876658BF9FB0F7D3462 ] Wecsvc C:\Windows\system32\wecsvc.dll 09:53:44.0794 4560 Wecsvc - ok 09:53:44.0810 4560 [ 9C980351D7E96288EA0C23AE232BD065 ] wercplsupport C:\Windows\System32\wercplsupport.dll 09:53:44.0810 4560 wercplsupport - ok 09:53:44.0825 4560 [ 66B9ECEBC46683F47EDC06333C075FEF ] WerSvc C:\Windows\System32\WerSvc.dll 09:53:44.0825 4560 WerSvc - ok 09:53:44.0841 4560 WinDefend - ok 09:53:44.0857 4560 WinHttpAutoProxySvc - ok 09:53:44.0888 4560 [ D2E7296ED1BD26D8DB2799770C077A02 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll 09:53:44.0888 4560 Winmgmt - ok 09:53:44.0935 4560 [ 6CBB0C68F13B9C2EC1B16F5FA5E7C869 ] WinRM C:\Windows\system32\WsmSvc.dll 09:53:44.0966 4560 WinRM - ok 09:53:45.0013 4560 [ EC339C8115E91BAED835957E9A677F16 ] Wlansvc C:\Windows\System32\wlansvc.dll 09:53:45.0013 4560 Wlansvc - ok 09:53:45.0044 4560 [ E18AEBAAA5A773FE11AA2C70F65320F5 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys 09:53:45.0044 4560 WmiAcpi - ok 09:53:45.0075 4560 [ 21FA389E65A852698B6A1341F36EE02D ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe 09:53:45.0091 4560 wmiApSrv - ok 09:53:45.0106 4560 WMPNetworkSvc - ok 09:53:45.0122 4560 [ CBC156C913F099E6680D1DF9307DB7A8 ] WPCSvc C:\Windows\System32\wpcsvc.dll 09:53:45.0137 4560 WPCSvc - ok 09:53:45.0153 4560 [ 490A18B4E4D53DC10879DEAA8E8B70D9 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll 09:53:45.0153 4560 WPDBusEnum - ok 09:53:45.0200 4560 [ 5E2401B3FC1089C90E081291357371A9 ] WpdUsb C:\Windows\system32\DRIVERS\wpdusb.sys 09:53:45.0200 4560 WpdUsb - ok 09:53:45.0371 4560 [ 991E2C2CF3BC204C2BB2EE1476149E4E ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe 09:53:45.0387 4560 WPFFontCache_v0400 - ok 09:53:45.0403 4560 [ 8A900348370E359B6BFF6A550E4649E1 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys 09:53:45.0403 4560 ws2ifsl - ok 09:53:45.0418 4560 [ 9EA3E6D0EF7A5C2B9181961052A4B01A ] wscsvc C:\Windows\System32\wscsvc.dll 09:53:45.0434 4560 wscsvc - ok 09:53:45.0434 4560 WSearch - ok 09:53:45.0496 4560 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll 09:53:45.0527 4560 wuauserv - ok 09:53:45.0590 4560 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys 09:53:45.0590 4560 WudfPf - ok 09:53:45.0605 4560 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys 09:53:45.0605 4560 WUDFRd - ok 09:53:45.0652 4560 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll 09:53:45.0652 4560 wudfsvc - ok 09:53:45.0683 4560 [ A34D42EBF760392EECB1EE6523D552CA ] xhcdrv C:\Windows\system32\DRIVERS\xhcdrv.sys 09:53:45.0683 4560 xhcdrv - ok 09:53:45.0683 4560 ================ Scan global =============================== 09:53:45.0746 4560 [ 060DC3A7A9A2626031EB23D90151428D ] C:\Windows\system32\basesrv.dll 09:53:45.0793 4560 [ D665D594B7E11133D29D726BDDC7A5B0 ] C:\Windows\system32\winsrv.dll 09:53:45.0793 4560 [ D665D594B7E11133D29D726BDDC7A5B0 ] C:\Windows\system32\winsrv.dll 09:53:45.0839 4560 [ 934E0B7D77FF78C18D9F8891221B6DE3 ] C:\Windows\system32\services.exe 09:53:45.0839 4560 [Global] - ok 09:53:45.0839 4560 ================ Scan MBR ================================== 09:53:45.0855 4560 [ F46767AE2998EA7510CA3750ADFC1357 ] \Device\Harddisk0\DR0 09:53:46.0058 4560 \Device\Harddisk0\DR0 - ok 09:53:46.0058 4560 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk1\DR1 09:53:46.0214 4560 \Device\Harddisk1\DR1 - ok 09:53:46.0214 4560 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk2\DR2 09:53:46.0214 4560 \Device\Harddisk2\DR2 - ok 09:53:46.0229 4560 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk3\DR3 09:53:46.0526 4560 \Device\Harddisk3\DR3 - ok 09:53:46.0526 4560 ================ Scan VBR ================================== 09:53:46.0541 4560 [ D74B22E99468793CE6D67D8EFF654957 ] \Device\Harddisk0\DR0\Partition1 09:53:46.0541 4560 \Device\Harddisk0\DR0\Partition1 - ok 09:53:46.0541 4560 [ 53F8E7912B617604FDEA68FE14F2436B ] \Device\Harddisk1\DR1\Partition1 09:53:46.0541 4560 \Device\Harddisk1\DR1\Partition1 - ok 09:53:46.0541 4560 [ 98F8365F925D56DDC0BA38ABC5AEA7CD ] \Device\Harddisk1\DR1\Partition2 09:53:46.0541 4560 \Device\Harddisk1\DR1\Partition2 - ok 09:53:46.0541 4560 [ FB305DBDED8B478CFDBA20A5F453C86D ] \Device\Harddisk2\DR2\Partition1 09:53:46.0541 4560 \Device\Harddisk2\DR2\Partition1 - ok 09:53:46.0541 4560 [ 99C44B87465F5B8E1D07FE55C4EA3A62 ] \Device\Harddisk3\DR3\Partition1 09:53:46.0557 4560 \Device\Harddisk3\DR3\Partition1 - ok 09:53:46.0557 4560 ============================================================ 09:53:46.0557 4560 Scan finished 09:53:46.0557 4560 ============================================================ 09:53:46.0557 4708 Detected object count: 0 09:53:46.0557 4708 Actual detected object count: 0

Attachments:

Post #5
Please read through these instructions to familiarize yourself with what to expect when this tool runs

Refer to the ComboFix User's Guide


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================


Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs


====================================================


Double click on combofix.exe & follow the prompts.


When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.
Post #6
ComboFix 13-05-01.03 - Wayne 05/01/2013 11:14:55.1.2 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4094.2297 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} FW: COMODO Firewall *Disabled* {7DB03214-694B-060B-1600-BD4715C36DBB} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: COMODO Defense+ *Disabled/Updated* {FEEA52D5-051E-08DD-07EF-2F009097607D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Wayne\AppData\Roaming\Microsoft\Windows\Recent\Google Planimeter.url c:\users\Wayne\g2mdlhlpx.exe c:\windows\security\Database\tmp.edb c:\windows\SysWow64\Packet.dll c:\windows\SysWow64\pthreadVC.dll c:\windows\SysWow64\wpcap.dll . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Legacy_NPF ——-\Service_npf . . ((((((((((((((((((((((((( Files Created from 2013-04-01 to 2013-05-01 ))))))))))))))))))))))))))))))) . . 2013-05-01 15:22 . 2013-05-01 15:35 ——– d—–w- c:\users\Wayne\AppData\Local\temp 2013-05-01 15:22 . 2013-05-01 15:31 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp 2013-05-01 15:22 . 2013-05-01 15:22 ——– d—–w- c:\users\Guest\AppData\Local\temp 2013-04-25 11:14 . 2013-03-03 19:13 1513320 —-a-w- c:\windows\system32\drivers\ntfs.sys 2013-04-25 01:59 . 2013-04-25 02:03 2032 —-a-w- c:\windows\system32\ASOROSet.bin 2013-04-25 01:30 . 2013-04-25 01:30 ——– d—–w- c:\users\Wayne\AppData\Roaming\Systweak 2013-04-25 01:29 . 2012-09-07 23:22 18784 —-a-w- c:\windows\system32\roboot64.exe 2013-04-25 01:29 . 2008-11-21 04:08 16896 —-a-w- c:\windows\system32\sasnative64.exe 2013-04-25 01:28 . 2013-04-25 01:44 ——– d—–w- c:\program files (x86)\Advanced System Optimizer 3 2013-04-25 01:28 . 2013-04-25 01:30 ——– d—–w- c:\programdata\Systweak 2013-04-25 01:10 . 2013-04-25 01:10 ——– d—–w- c:\program files (x86)\DLLSuite 2013-04-25 01:06 . 2004-05-14 00:11 303104 —-a-w- c:\windows\system32\mscorjit.dll 2013-04-23 01:04 . 2013-04-23 01:27 ——– d—–w- c:\program files (x86)\Winamp 2013-04-23 00:06 . 2013-04-23 00:06 ——– d—–w- c:\windows\SysWow64\RTCOM 2013-04-23 00:06 . 2013-04-23 00:06 ——– d—–w- c:\program files\Realtek 2013-04-23 00:04 . 2013-03-26 21:04 2734624 —-a-w- c:\windows\system32\FMAPO64.dll 2013-04-23 00:04 . 2012-06-20 21:26 110592 —-a-w- c:\windows\system32\CONEQMSAPOGUILibrary.dll 2013-04-23 00:04 . 2013-03-23 07:43 208072 —-a-w- c:\windows\system32\AERTAC64.dll 2013-04-23 00:04 . 2012-03-08 15:47 108640 —-a-w- c:\windows\system32\AERTAR64.dll 2013-04-23 00:04 . 2005-11-14 03:19 5632 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe 2013-04-22 22:14 . 2013-04-22 22:15 ——– d—–w- c:\program files (x86)\Driver Cleaner Pro 2013-04-20 02:19 . 2013-04-28 19:48 ——– d—–w- c:\users\Wayne\AppData\Roaming\Roxio 2013-04-20 01:25 . 2013-04-20 01:25 ——– d—–w- c:\programdata\eSellerate 2013-04-20 01:18 . 2013-04-20 01:18 ——– d—–w- c:\programdata\Sonic 2013-04-20 01:18 . 2013-04-20 01:18 ——– d—–w- c:\users\Wayne\AppData\Roaming\DivX 2013-04-20 01:17 . 2013-04-28 19:33 ——– d—–w- c:\program files\DivX 2013-04-20 01:14 . 2013-04-28 19:33 ——– d—–w- c:\program files (x86)\DivX 2013-04-20 01:14 . 2013-04-28 19:33 ——– d—–w- c:\programdata\DivX 2013-04-20 01:02 . 2013-04-28 19:46 ——– d—–w- c:\programdata\Roxio 2013-04-20 01:01 . 2013-04-20 01:01 ——– d—–w- c:\programdata\Macrovision 2013-04-20 00:51 . 2011-05-24 07:00 55952 ——w- c:\windows\system32\drivers\PxHlpa64.sys 2013-04-20 00:51 . 2011-05-12 07:00 10224 ——w- c:\windows\system32\drivers\cdralw2k.sys 2013-04-20 00:51 . 2011-05-12 07:00 10224 ——w- c:\windows\system32\drivers\cdr4_xp.sys 2013-04-20 00:51 . 2013-04-20 01:25 ——– d—–w- c:\program files (x86)\SmartSound Software 2013-04-20 00:51 . 2013-04-20 01:26 ——– d—–w- c:\programdata\SmartSound Software Inc 2013-04-20 00:50 . 2008-10-15 10:22 519000 —-a-w- c:\windows\system32\d3dx10_40.dll 2013-04-20 00:50 . 2008-10-15 10:22 452440 —-a-w- c:\windows\SysWow64\d3dx10_40.dll 2013-04-20 00:50 . 2008-10-15 10:22 2605920 —-a-w- c:\windows\system32\D3DCompiler_40.dll 2013-04-20 00:50 . 2008-10-15 10:22 2036576 —-a-w- c:\windows\SysWow64\D3DCompiler_40.dll 2013-04-20 00:50 . 2008-10-15 10:22 5631312 —-a-w- c:\windows\system32\D3DX9_40.dll 2013-04-20 00:50 . 2008-10-15 10:22 4379984 —-a-w- c:\windows\SysWow64\D3DX9_40.dll 2013-04-20 00:45 . 2013-04-20 03:05 ——– d—–w- c:\users\Wayne\AppData\Roaming\Roxio Log Files 2013-04-19 23:27 . 2013-04-19 23:27 ——– d—–w- c:\users\Wayne\AppData\Roaming\MP3 LisTaGo 2013-04-19 23:27 . 2013-04-19 23:27 ——– d—–w- c:\program files (x86)\MP3 LisTaGo 2013-04-18 10:39 . 2012-07-04 14:18 201392 —-a-w- c:\windows\SysWow64\aswBoot.exe 2013-04-18 02:46 . 2013-02-22 06:22 887808 —-a-w- c:\program files\Internet Explorer\iedvtool.dll 2013-04-18 02:46 . 2013-02-22 06:57 17817088 —-a-w- c:\windows\system32\mshtml.dll 2013-04-18 02:46 . 2013-02-22 06:29 10925568 —-a-w- c:\windows\system32\ieframe.dll 2013-04-18 01:38 . 2013-04-18 01:38 ——– d—–w- c:\program files (x86)\Common Files\Java 2013-04-18 01:38 . 2013-04-18 01:37 95648 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-04-18 01:27 . 2013-03-11 13:33 4691304 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-04-18 01:27 . 2013-03-09 04:16 85504 —-a-w- c:\windows\system32\csrsrv.dll 2013-04-18 01:27 . 2013-03-09 01:48 75264 —-a-w- c:\windows\system32\smss.exe 2013-04-18 01:27 . 2013-03-05 01:57 2774016 —-a-w- c:\windows\system32\win32k.sys 2013-04-18 01:27 . 2013-03-08 04:18 451072 —-a-w- c:\windows\system32\winsrv.dll 2013-04-18 01:27 . 2013-03-08 04:17 2425344 —-a-w- c:\windows\system32\mstscax.dll 2013-04-18 01:27 . 2013-03-08 03:52 2067968 —-a-w- c:\windows\SysWow64\mstscax.dll 2013-04-17 02:16 . 2013-04-17 02:16 ——– d—–w- c:\program files (x86)\Xirrus 2013-04-17 01:15 . 2013-04-17 01:15 ——– d—–w- c:\users\Wayne\AppData\Roaming\Xirrus 2013-04-15 22:30 . 2013-04-15 22:49 ——– d—–w- c:\program files (x86)\Acoustica MP3 CD Burner 2013-04-15 01:44 . 2013-04-15 01:44 ——– d—–w- c:\programdata\Package Cache 2013-04-13 22:47 . 2013-04-13 22:47 ——– d—–w- c:\program files\Microsoft ATS 2013-04-12 11:15 . 2013-04-12 11:15 ——– d—–w- c:\program files (x86)\MSECACHE 2013-04-12 05:58 . 2013-04-12 05:58 ——– d—–w- c:\users\Wayne\AppData\Local\ElevatedDiagnostics 2013-04-12 04:18 . 2013-04-12 04:18 ——– d—–w- c:\program files (x86)\VS Revo Group 2013-04-12 04:04 . 2013-04-12 04:04 ——– d—–w- c:\program files\btscanner 2013-04-09 02:05 . 2013-04-11 13:28 ——– d—–w- c:\windows\system32\catroot2(818) 2013-04-09 01:29 . 2013-04-09 01:29 ——– d—–w- C:\RegBackup 2013-04-09 00:43 . 2013-04-09 00:43 181064 —-a-w- c:\windows\PSEXESVC.EXE 2013-04-07 00:38 . 2013-04-20 01:18 ——– d—–w- c:\program files (x86)\Mozilla Thunderbird 2013-04-06 15:33 . 2013-04-06 15:33 ——– d—–w- c:\users\Wayne\AppData\Local\FlvtoYoutubeDownloader 2013-04-06 15:32 . 2013-04-06 15:35 ——– d—–w- c:\users\Wayne\AppData\Roaming\FlvtoConverter 2013-04-06 15:32 . 2013-04-06 18:07 ——– d—–w- c:\program files (x86)\Flvto Youtube Downloader 2013-04-01 19:42 . 2013-04-01 19:42 ——– d—–w- c:\program files (x86)\BurnAware Free . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-04-25 11:11 . 2012-04-03 22:31 691592 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-04-25 11:11 . 2011-12-06 00:07 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-04-23 00:05 . 2011-12-05 23:31 525792 —-a-w- c:\windows\DIFxAPI.dll 2013-04-18 01:37 . 2012-05-25 16:21 866720 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-04-18 01:37 . 2011-12-24 15:18 788896 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-04-18 01:19 . 2006-11-02 12:35 72702784 —-a-w- c:\windows\system32\mrt.exe 2013-03-06 22:33 . 2013-03-12 02:05 65336 —-a-w- c:\windows\system32\drivers\aswRvrt.sys 2013-03-06 22:33 . 2013-03-12 02:05 178624 —-a-w- c:\windows\system32\drivers\aswVmm.sys 2013-03-06 05:00 . 2008-01-21 02:48 40960 —-a-w- c:\windows\system32\shimeng.dll 2013-03-06 05:00 . 2008-01-21 02:47 286720 —-a-w- c:\windows\system32\sti.dll 2013-03-06 05:00 . 2006-11-02 12:18 2048 —-a-w- c:\windows\SysWow64\msxml6r.dll 2013-03-06 05:00 . 2006-11-02 09:05 190464 —-a-w- c:\windows\system32\hdwwiz.cpl 2013-02-26 04:32 . 2013-02-26 04:32 25256224 —-a-w- c:\windows\system32\nvcompiler.dll 2013-02-26 04:32 . 2013-02-26 04:32 2505144 —-a-w- c:\windows\SysWow64\nvapi.dll 2013-02-26 04:32 . 2013-02-26 04:32 15129960 —-a-w- c:\windows\SysWow64\nvd3dum.dll 2013-02-26 04:32 . 2013-02-26 04:32 6262608 —-a-w- c:\windows\SysWow64\nvopencl.dll 2013-02-26 04:32 . 2011-12-06 00:14 2826040 —-a-w- c:\windows\system32\nvapi64.dll 2013-02-26 04:32 . 2013-02-26 04:32 18055184 —-a-w- c:\windows\system32\nvd3dumx.dll 2013-02-26 04:32 . 2011-12-06 00:14 1814304 —-a-w- c:\windows\system32\nvdispco64.dll 2013-02-26 04:32 . 2013-02-26 04:32 2720544 —-a-w- c:\windows\SysWow64\nvcuvid.dll 2013-02-26 04:32 . 2013-02-26 04:32 26929440 —-a-w- c:\windows\system32\nvoglv64.dll 2013-02-26 04:32 . 2013-02-26 04:32 7932256 —-a-w- c:\windows\SysWow64\nvcuda.dll 2013-02-26 04:32 . 2013-02-26 04:32 2346784 —-a-w- c:\windows\system32\nvcuvenc.dll 2013-02-26 04:32 . 2013-02-26 04:32 11036448 —-a-w- c:\windows\system32\drivers\nvlddmkm.sys 2013-02-26 04:32 . 2012-10-11 02:23 1510176 —-a-w- c:\windows\system32\nvdispgenco64.dll 2013-02-26 04:32 . 2013-02-26 04:32 2904352 —-a-w- c:\windows\system32\nvcuvid.dll 2013-02-26 04:32 . 2013-02-26 04:32 20449056 —-a-w- c:\windows\SysWow64\nvoglv32.dll 2013-02-26 04:32 . 2013-02-26 04:32 15053264 —-a-w- c:\windows\system32\nvwgf2umx.dll 2013-02-26 04:32 . 2013-02-26 04:32 17560352 —-a-w- c:\windows\SysWow64\nvcompiler.dll 2013-02-26 04:32 . 2013-02-26 04:32 7564040 —-a-w- c:\windows\system32\nvopencl.dll 2013-02-26 04:32 . 2013-02-26 04:32 1985824 —-a-w- c:\windows\SysWow64\nvcuvenc.dll 2013-02-26 04:32 . 2013-02-26 04:32 12641992 —-a-w- c:\windows\SysWow64\nvwgf2um.dll 2013-02-26 04:32 . 2013-02-26 04:32 9390760 —-a-w- c:\windows\system32\nvcuda.dll 2013-02-12 02:18 . 2013-03-21 17:50 19456 —-a-w- c:\windows\system32\drivers\usb8023.sys 2011-10-06 14:42 . 2011-10-06 14:42 4407296 —-a-w- c:\program files (x86)\Control Center.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2012-08-08 22:15 1527496 —-a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-08-08 1527496] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-09-07 43608] "PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-12-12 163000] "TRENDnet UDS Control Center"="c:\program files (x86)\Control Center.exe" [2011-10-06 4407296] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-04 4251328] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] . c:\users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Core Temp - Shortcut.lnk - c:\users\Wayne\Desktop\System Tools\Core Temp.exe [2011-12-13 826832] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:\windows\SysWOW64\guard32.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . — Other Services/Drivers In Memory — . *NewlyCreated* - ALSYSIO *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2012-07-02 19:40 453736 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-04-18 10:46 1642448 —-a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-05-01 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 11:11] . 2013-04-25 c:\windows\Tasks\ASO-AutoCheckUpdate7Days.job - c:\program files (x86)\Advanced System Optimizer 3\CheckUpdate.exe [2013-04-25 23:22] . 2013-04-26 c:\windows\Tasks\ASO-OneClickCare.job - c:\program files (x86)\Advanced System Optimizer 3\ASO3.exe [2013-04-25 23:22] . 2013-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-11 02:41] . 2013-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-11 02:41] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2012-07-04 14:18 135448 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2012-11-07 9577680] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-03-29 13513288] "combofix"="c:\combofix\CF27185.3XE" [2008-01-21 363008] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=c:\windows\System32\guard64.dll . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://us.yahoo.com?fr=fp-comodo mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local;192.168.*.* IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.2.1 DPF: {0F2AAAE3-7E9E-4B64-AB5D-1CA24C6ACB9C} - hxxp://mail.garlandhq.com/dwa85W.cab DPF: {CEF002D2-5A9F-4656-AA41-85DA2534ACBD} - hxxp://mail.garlandhq.com/dwa85W.cab FF - ProfilePath - c:\users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - ExtSQL: 2013-03-05 21:04; {ACAA314B-EEBA-48e4-AD47-84E31C44796C}; c:\program files (x86)\Common Files\DVDVideoSoft\plugins\ff FF - ExtSQL: 2013-03-11 22:05; [removed]; c:\program files\AVAST Software\Avast\WebRep\FF FF - ExtSQL: 2013-03-24 23:00; [removed]; c:\users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed] FF - ExtSQL: 2013-04-05 19:30; [removed]; c:\users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed] FF - ExtSQL: 2013-04-24 20:42; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{7aeb3efd-e564-43f1-b658-5058a7c5743b} - (no file) ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellExecuteHooks-{03E3D45B-681C-481C-B6A3-0D08B12C4AB9} - (no file) SafeBoot-WudfPf SafeBoot-WudfRd ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}"=hex:51,66,7a,6c,4c,1d,38,12,3a,25,4d, 8a,1f,e3,d1,0d,d3,3b,92,3f,05,d7,c9,12 "{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4, 91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27 "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96, 76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47, 2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85 "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:f0,e7,a3,96,9c,0e,cd,01 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ———————— Other Running Processes ———————— . c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe c:\program files\AVAST Software\Avast\AvastSvc.exe c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe c:\windows\SysWOW64\NLSSRV32.EXE c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe c:\program files\AVAST Software\Avast\setup\avast.setup . ************************************************************************** . Completion time: 2013-05-01 11:37:57 - machine was rebooted ComboFix-quarantined-files.txt 2013-05-01 15:37 . Pre-Run: 308,048,715,776 bytes free Post-Run: 307,377,360,896 bytes free . - - End Of File - - 28627B27FE018836981AFBB2FE94DBCB
Post #7
Follow these steps to display hidden files and folders.

  • Open Folder Options by clicking the Start button [external image: Posted Image], clicking Control Panel, clicking Appearance and Personalization, and then clicking Folder Options.
  • Click the View tab.
  • Under Advanced settings, click Show hidden files and folders
  • Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:
Virus Total (Recommended)
jotti.org
VirScan


click on Browse, and upload the following file for analysis:
c:\windows\PSEXESVC.EXE
c:\program files (x86)\Control Center.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results link here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

===================================================

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
===================================================

Please download Junkware Removal Tool to your desktop.
  • Shutdown your antivirus to avoid any conflicts.
  • Right-mouse click JRT.exe and select Run as administrator
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message
===================================================

On your next reply please post :
File scanner log
Adwcleaner log
JRT log
Report on system behaviour


Please STOP and let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!
Post #8
As you requested see information below. FYI, Psexesvc.exe is a file in the Sysinternals Utilities Suite for trouble shooting a computer. ControlCenter.exe is the control center utility for my Trendnet print server. Also after I have done everything here, I still get the attached error message when I try to compress a picture and save in Microsoft Picture Manager. When I click OK, on the error though (to close it out), the file does compress and is saved fine. Why do I still get this error message?


Virus Total Results Link for c:\windows\PSEXESVC.EXE: https://www.virustotal.com/en/file/1d4d7870…sis/1367433257/
Virus Total Results Link for c:\program files (x86)\Control Center.exe: https://www.virustotal.com/en/file/8cf6757b…sis/1367433740/

# AdwCleaner v2.300 - Logfile created 05/01/2013 at 14:53:35
# Updated 28/04/2013 by Xplode
# Operating system : Windows ™ Vista Home Premium Service Pack 2 (64 bits)
# User : Wayne - WAYNE-PC
# Boot Mode : Normal
# Running from : C:\Users\Wayne\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\Ask.com
Deleted on reboot : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Deleted on reboot : C:\Program Files (x86)\Conduit
Deleted on reboot : C:\Users\Wayne\AppData\Local\APN
Deleted on reboot : C:\Users\Wayne\AppData\Local\Conduit
Deleted on reboot : C:\Users\Wayne\AppData\LocalLow\AskToolbar
Deleted on reboot : C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
Deleted on reboot : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****

Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{D08D9F98-1C78-4704-87E6-368B0023D831}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\StartSearch
Key Deleted : HKLM\Software\APN
Key Deleted : HKLM\Software\AskToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{acaa314b-eeba-48e4-ad47-84e31c44796c}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16476

[OK] Registry is clean.

-\\ Mozilla Firefox v16.0.2 (en-US)

File : C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v26.0.1410.64

File : C:\Users\Wayne\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [5427 octets] - [01/05/2013 14:51:31]
AdwCleaner[S1].txt - [4916 octets] - [01/05/2013 14:53:35]

########## EOF - C:\AdwCleaner[S1].txt - [4976 octets] ##########


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.3 (04.29.2013:2)
OS: Windows ™ Vista Home Premium x64
Ran by [removed] on Wed 05/01/2013 at 15:02:52.92
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\systweak
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak



~~~ Files

Successfully deleted: [File] C:\Windows\syswow64\RENA7A2.tmp
Successfully deleted: [File] C:\Windows\syswow64\RENA7A3.tmp
Successfully deleted: [File] C:\Windows\syswow64\RENA8F9.tmp
Successfully deleted: [File] C:\Windows\syswow64\RENA8FA.tmp



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\systweak"
Successfully deleted: [Folder] "C:\Users\Wayne\AppData\Roaming\systweak"
Successfully deleted: [Folder] "C:\Program Files (x86)\driver-soft"



~~~ FireFox

Successfully deleted the following from C:\Users\Wayne\AppData\Roaming\mozilla\firefox\profiles\q1upm1b9.default\prefs.js

user_pref("extensions.ghostery.blockingLog", "Blocked type: 3 content location: hxxp://b.scorecardresearch.com/p?c1=2&c2=7241469&c4=hxxp%253A%252F%252Fwww.yahoo.com&c5=2023538
Emptied folder: C:\Users\Wayne\AppData\Roaming\mozilla\firefox\profiles\q1upm1b9.default\minidumps [26 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 05/01/2013 at 15:08:19.16
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Attachments:

Post #9
Have you tried reinstalling it? Just checking.

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
Post #10
Actually I tried repairing Microsoft Picture Manager without any luck. Same error popup. Here is the OTL.text, however, I am not getting an Extras.txt file. I even did a search and also looked in OTL folder on C Drive which I did not find.


OTL logfile created on: 5/3/2013 12:46:06 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Wayne\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.33 Gb Available Physical Memory | 58.29% Memory free
8.22 Gb Paging File | 6.38 Gb Available in Paging File | 77.64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.76 Gb Total Space | 287.47 Gb Free Space | 61.72% Space Free | Partition Type: NTFS
Drive D: | 488.28 Gb Total Space | 299.47 Gb Free Space | 61.33% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 322.07 Gb Free Space | 69.15% Space Free | Partition Type: NTFS
Drive F: | 149.04 Gb Total Space | 19.67 Gb Free Space | 13.20% Space Free | Partition Type: NTFS
Drive G: | 443.23 Gb Total Space | 144.60 Gb Free Space | 32.62% Space Free | Partition Type: NTFS

Computer Name: WAYNE-PC | User Name: Wayne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Wayne\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
PRC - C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe ()
PRC - C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe ()
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\Control Center.exe ()
PRC - C:\Windows\SysWOW64\NLSSRV32.EXE (Nalpeiron Ltd.)
PRC - C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe (Motorola)
PRC - C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe (Affinegy, Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe ()
MOD - C:\Program Files (x86)\Control Center.exe ()


========== Services (SafeList) ==========

SRV:64bit: - (cmdAgent) – C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV:64bit: - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV:64bit: - (FLEXnet Licensing Service 64) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Macrovision Europe Ltd.)
SRV:64bit: - (NitroDriverReadSpool) – C:\Program Files\Common Files\Nitro PDF\Professional\6.0\NitroPDFDriverServicex64.exe (Nitro PDF Software)
SRV:64bit: - (Belkin Local Backup Service) – C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe ()
SRV:64bit: - (Belkin Network USB Helper) – C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe ()
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (Motorola Device Manager) – C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe ()
SRV - (ASO3DiskOptimizer) – C:\Program Files (x86)\Advanced System Optimizer 3\ASO3DefragSrv64.exe (Systweak Inc., (www.systweak.com))
SRV - (nlsX86cc) – C:\Windows\SysWOW64\NLSSRV32.EXE (Nalpeiron Ltd.)
SRV - (PST Service) – C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe (Motorola)
SRV - (AcrSch2Svc) – C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (AffinegyService) – C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe (Affinegy, Inc.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (COMSysApp) – C:\Windows\SysWow64\dllhost.exe ()


========== Driver Services (SafeList) ==========

DRV:64bit: - (aswVmm) – C:\Windows\SysNative\drivers\aswVmm.sys ()
DRV:64bit: - (aswRvrt) – C:\Windows\SysNative\drivers\aswRvrt.sys ()
DRV:64bit: - (ubsbp2) – C:\Windows\SysNative\DRIVERS\ubsbp2.sys (Unibrain)
DRV:64bit: - (VUSB3HUB) – C:\Windows\SysNative\DRIVERS\ViaHub3.sys (VIA Technologies, Inc.)
DRV:64bit: - (ubohci) – C:\Windows\SysNative\DRIVERS\ubohci.sys (Unibrain)
DRV:64bit: - (ubumapi) – C:\Windows\SysNative\DRIVERS\ubumapi.sys (Unibrain)
DRV:64bit: - (ubsbm) – C:\Windows\SysNative\DRIVERS\ubsbm.sys (Unibrain)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\Drivers\usbaapl64.sys ()
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (aswSnx) – C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) – C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswTdi) – C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (AswRdr) – C:\Windows\SysNative\drivers\aswRdr.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) – C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) – C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (hidusbf) – C:\Windows\SysNative\DRIVERS\hidusbf.sys (SweetLow)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (dtsoftbus01) – C:\Windows\SysNative\DRIVERS\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (timounter) – C:\Windows\SysNative\DRIVERS\timntr.sys (Acronis)
DRV:64bit: - (vididr) – C:\Windows\SysNative\DRIVERS\vididr.sys (Acronis)
DRV:64bit: - (vidsflt53) – C:\Windows\SysNative\DRIVERS\vsflt53.sys (Acronis)
DRV:64bit: - (snapman) – C:\Windows\SysNative\DRIVERS\snapman.sys (Acronis)
DRV:64bit: - (RTVLANPT) – C:\Windows\SysNative\DRIVERS\RtVlan60.sys (Realtek Corporation)
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\Drivers\RimUsb_AMD64.sys (Research In Motion Limited)
DRV:64bit: - (RimVSerPort) – C:\Windows\SysNative\DRIVERS\RimSerial_AMD64.sys (Research in Motion Ltd)
DRV:64bit: - (TEAM) – C:\Windows\SysNative\DRIVERS\RtTeam60.sys (Realtek Corporation)
DRV:64bit: - (RTTEAMPT) – C:\Windows\SysNative\DRIVERS\RtTeam60.sys (Realtek Corporation)
DRV:64bit: - (RtNdPt60) – C:\Windows\SysNative\DRIVERS\RtNdPt60.sys (Realtek )
DRV:64bit: - (xhcdrv) – C:\Windows\SysNative\DRIVERS\xhcdrv.sys (VIA Technologies, Inc.)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\Drivers\PxHlpa64.sys (Rovi Corporation)
DRV:64bit: - (JRAID) – C:\Windows\SysNative\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV:64bit: - (Uim_IM) – C:\Windows\SysNative\Drivers\Uim_IMx64.sys (Paragon)
DRV:64bit: - (UimBus) – C:\Windows\SysNative\DRIVERS\uimx64.sys (Windows ® 2000 DDK provider)
DRV:64bit: - (hotcore3) – C:\Windows\SysNative\DRIVERS\hotcore3.sys (Paragon Software Group)
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (motandroidusb) – C:\Windows\SysNative\Drivers\motoandroid.sys (Motorola)
DRV:64bit: - (sxuptp) – C:\Windows\SysNative\DRIVERS\sxuptp.sys (silex technology, Inc.)
DRV:64bit: - (ROOTMODEM) – C:\Windows\SysNative\Drivers\RootMdm.sys (Microsoft Corporation)
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV - (hidusbf) – C:\Windows\SysWOW64\drivers\hidusbf.sys (SweetLow)
DRV - (gdrv) – C:\Windows\gdrv.sys (Windows ® Server 2003 DDK provider)
DRV - (cpudrv64) – C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://us.yahoo.com?fr=fp-comodo
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{8EEAC88A-079B-4b2c-80C1-7836F79EB40A}: "URL" = http://us.search.yahoo.com/search?p={searc…p;fr=chr-comodo
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledAddons: [removed]:1.1.5
FF - prefs.js..extensions.enabledAddons: [removed]:2.04.20110724
FF - prefs.js..extensions.enabledAddons: [removed]:1.2.7
FF - prefs.js..extensions.enabledAddons: [removed]:0.9.9.6
FF - prefs.js..extensions.enabledAddons: [removed]:2.2.3
FF - prefs.js..extensions.enabledAddons: {03B08592-E5B4-45ff-A0BE-C1D975458688}:1.0
FF - prefs.js..extensions.enabledAddons: {4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}:1.2
FF - prefs.js..extensions.enabledAddons: [removed]:2.0.6
FF - prefs.js..extensions.enabledAddons: [removed]:1.1.3
FF - prefs.js..extensions.enabledAddons: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:4.0.4
FF - prefs.js..extensions.enabledAddons: Noia4Options@ArisT2:1.7.7
FF - prefs.js..extensions.enabledAddons: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.90
FF - prefs.js..extensions.enabledAddons: [removed]:1.5.5
FF - prefs.js..extensions.enabledAddons: [removed]:1.14.10
FF - prefs.js..extensions.enabledAddons: [removed]:1.0.4
FF - prefs.js..extensions.enabledAddons: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.3.2
FF - prefs.js..extensions.enabledAddons: [removed]:2.9.4
FF - prefs.js..extensions.enabledAddons: {faf13420-5e24-11e0-80e3-0800200c9a66}:1.7.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: [removed]:0.0.5.5
FF - prefs.js..extensions.enabledItems: [removed]:0.9.9.6
FF - prefs.js..extensions.enabledItems: [removed]:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 3
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: [removed]:2.2.3
FF - prefs.js..extensions.enabledItems: [removed]:3.76
FF - prefs.js..extensions.enabledItems: {FBF6D7FB-F305-4445-BB3D-FEF66579A033}:5.0.1
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {03B08592-E5B4-45ff-A0BE-C1D975458688}:1.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10
FF - prefs.js..extensions.enabledItems: {FBFB7597-9E32-46b4-A500-8B6B0412777F}:0.9
FF - prefs.js..extensions.enabledItems: [removed]:1.1.5
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4.4
FF - prefs.js..extensions.enabledItems: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.87
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.1.7
FF - prefs.js..extensions.enabledItems: [removed]:0.6.728
FF - prefs.js..extensions.enabledItems: {9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}:3.76
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@mozilla.zeniko.ch/SumatraPDF_Browser_Plugin: C:\Program Files (x86)\SumatraPDF\npPdfViewer.dll (Simon Bünzli)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@palmsource.com/installer,version=1.0: C:\PROGRA~2\Palm\PACKAG~1\NPInstal.dll ()
FF - HKLM\Software\MozillaPlugins\@rim.com/npappworld: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll ()
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@citrixonline.com/appdetectorplugin: C:\Users\Wayne\AppData\Local\Citrix\Plugins\92\npappdetector.dll (Citrix Online)
FF - HKCU\Software\MozillaPlugins\@mozilla.zeniko.ch/SumatraPDF_Browser_Plugin: C:\Program Files (x86)\SumatraPDF\npPdfViewer.dll (Simon Bünzli)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/04/18 06:39:17 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/02/10 22:12:45 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/05/02 00:18:52 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013/04/06 20:38:54 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2013/05/02 00:18:52 | 000,000,000 | —D | M]

[2011/12/05 19:44:28 | 000,000,000 | —D | M] (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Extensions
[2013/05/01 15:00:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions
[2011/12/05 22:13:00 | 000,000,000 | —D | M] (Toolbar Buttons) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}
[2013/04/16 07:30:52 | 000,000,000 | —D | M] (Flagfox) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}(141)
[2012/11/29 22:32:59 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2013/02/10 20:02:09 | 000,000,000 | —D | M] (ChatZilla) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2011/12/05 19:48:51 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(2)
[2011/12/05 19:48:51 | 000,000,000 | —D | M] (IE Tab +) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2013/04/17 21:52:32 | 000,000,000 | —D | M] (Ghostery) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2011/12/05 19:48:51 | 000,000,000 | —D | M] (NewTabURL) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2011/12/05 22:11:22 | 000,027,831 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2012/05/23 12:01:52 | 000,053,803 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2011/12/05 22:10:22 | 000,003,835 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2013/03/24 23:00:21 | 000,089,261 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2013/04/05 19:30:05 | 000,006,796 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2012/12/02 13:07:40 | 000,106,259 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2012/10/29 09:07:46 | 000,065,957 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2012/10/29 09:07:46 | 000,053,130 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2013/02/10 20:11:30 | 003,429,211 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2013/02/10 22:30:29 | 000,059,637 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\[removed]
[2013/04/17 21:52:32 | 000,282,569 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
[2012/03/26 07:05:23 | 000,049,303 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\{4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi
[2012/10/28 19:27:42 | 002,278,298 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\{7b90e860-5d61-11e0-80e3-0800200c9a66}.xpi
[2013/02/14 21:14:50 | 000,817,280 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/12/02 13:07:40 | 001,527,378 | —- | M] () (No name found) – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\extensions\{faf13420-5e24-11e0-80e3-0800200c9a66}.xpi
[2008/01/27 23:49:04 | 000,001,878 | —- | M] () – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\searchplugins\aolsearch.xml
[2012/07/12 13:29:00 | 000,000,828 | —- | M] () – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\searchplugins\black-box—google.xml
[2012/07/12 13:29:00 | 000,000,813 | —- | M] () – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\searchplugins\black-box—msn.xml
[2012/07/12 13:29:00 | 000,000,820 | —- | M] () – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\searchplugins\blackbox-yahoo.xml
[2008/01/31 11:09:40 | 000,003,963 | —- | M] () – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\searchplugins\botw-search.xml
[2013/04/26 15:34:44 | 000,002,005 | —- | M] () – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\searchplugins\excite—audio.xml
[2013/04/26 15:34:44 | 000,002,008 | —- | M] () – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\searchplugins\excite—images.xml
[2013/04/26 15:34:44 | 000,002,025 | —- | M] () – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\searchplugins\excite—video.xml
[2013/04/19 14:43:04 | 000,001,959 | —- | M] () – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\searchplugins\excite.xml
[2009/01/15 17:39:48 | 000,005,232 | —- | M] () – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\searchplugins\leos-lyrics-database.xml
[2012/07/12 13:29:00 | 000,000,797 | —- | M] () – C:\Users\Wayne\AppData\Roaming\Mozilla\Firefox\Profiles\q1upm1b9.default\searchplugins\technorati.xml
[2012/10/26 21:15:21 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/10/26 21:15:25 | 000,261,600 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2003/03/30 14:04:42 | 000,094,208 | —- | M] () – C:\Program Files (x86)\mozilla firefox\plugins\npq3plug.dll
[2010/06/29 00:01:22 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012/09/05 21:26:22 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/10/26 21:15:24 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Yahoo! Search (Enabled)
CHR - default_search_provider: search_url = http://us.search.yahoo.com/search?fr=chrc-…p={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - plugin: registryAccess (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: Oovoo Toolbar = C:\Users\Wayne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaanijiojpcccpkjdjjmjghddcgcbfj\7.17.0.33368_0\
CHR - Extension: avast! WebRep = C:\Users\Wayne\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\8.0.1483_0\
CHR - Extension: http://www.yahoo.com/ = C:\Users\Wayne\AppData\Local\Google\Chrome\User Data\Default\Extensions\inhalmiddnkoaejbelacfdaellglafkk\2013.1.17.15090_0\
CHR - Extension: DvdVideoSoft Free Youtube Download = C:\Users\Wayne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\

O1 HOSTS File: ([2013/05/01 11:34:52 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4:64bit: - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [TRENDnet UDS Control Center] C:\Program Files (x86)\Control Center.exe ()
O4 - Startup: C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp - Shortcut.lnk = C:\Users\Wayne\Desktop\System Tools\Core Temp.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {0F2AAAE3-7E9E-4B64-AB5D-1CA24C6ACB9C} http://mail.garlandhq.com/dwa85W.cab (IBM Lotus iNotes 8.5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {CEF002D2-5A9F-4656-AA41-85DA2534ACBD} http://mail.garlandhq.com/dwa85W.cab (IBM Lotus iNotes 8.5 Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{62F93BAA-6DF5-4427-9C86-157275F1B160}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O20:64bit: - AppInit_DLLs: (C:\Windows\System32\guard64.dll) - C:\Windows\SysNative\guard64.dll (COMODO)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\guard32.dll) - C:\Windows\SysWOW64\guard32.dll (COMODO)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Wayne\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Wayne\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {03E3D45B-681C-481C-B6A3-0D08B12C4AB9} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/12/07 00:53:16 | 000,000,000 | —D | M] - C:\Autodesk – [ NTFS ]
O32 - AutoRun File - [2011/10/11 18:31:33 | 000,000,000 | —D | M] - E:\AutoCad files backup – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/03 12:45:12 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Wayne\Desktop\OTL.exe
[2013/05/01 15:02:44 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/05/01 15:02:38 | 000,000,000 | —D | C] – C:\JRT
[2013/05/01 11:38:00 | 000,000,000 | —D | C] – C:\Users\Wayne\AppData\Local\temp
[2013/05/01 11:34:54 | 000,000,000 | —D | C] – C:\$RECYCLE.BIN
[2013/05/01 11:22:47 | 000,000,000 | —D | C] – C:\Windows\temp
[2013/05/01 11:13:25 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2013/05/01 11:13:25 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2013/05/01 11:13:25 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2013/05/01 11:06:19 | 000,000,000 | —D | C] – C:\Qoobox
[2013/05/01 11:05:44 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2013/04/29 16:19:47 | 000,000,000 | —D | C] – C:\Users\Wayne\Desktop\FSU-TCC Docs
[2013/04/28 16:26:24 | 000,000,000 | —D | C] – C:\Users\Wayne\Desktop\WhatTheTech
[2013/04/24 21:29:07 | 000,018,784 | —- | C] (Systweak Inc., (www.systweak.com)) – C:\Windows\SysNative\roboot64.exe
[2013/04/24 21:29:05 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Optimizer 3
[2013/04/24 21:28:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Advanced System Optimizer 3
[2013/04/24 21:10:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\DLLSuite
[2013/04/24 21:06:11 | 000,303,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mscorjit.dll
[2013/04/24 21:04:00 | 000,303,104 | —- | C] (Microsoft Corporation) – C:\Users\Wayne\Desktop\mscorjit.dll
[2013/04/24 20:32:27 | 000,000,000 | —D | C] – C:\Config.Msi
[2013/04/22 21:04:09 | 000,000,000 | —D | C] – C:\Users\Wayne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Winamp
[2013/04/22 21:04:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Winamp
[2013/04/22 20:06:19 | 000,000,000 | —D | C] – C:\Windows\SysWow64\RTCOM
[2013/04/22 20:06:19 | 000,000,000 | —D | C] – C:\Program Files\Realtek
[2013/04/22 20:05:31 | 002,102,040 | —- | C] (Waves Audio Ltd.) – C:\Windows\SysNative\WavesGUILib64.dll
[2013/04/22 20:05:30 | 000,518,896 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSTSX64.dll
[2013/04/22 20:05:30 | 000,211,184 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSTSH64.dll
[2013/04/22 20:05:30 | 000,198,896 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSHP64.dll
[2013/04/22 20:05:30 | 000,155,888 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSWOW64.dll
[2013/04/22 20:05:27 | 002,797,128 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtPgEx64.dll
[2013/04/22 20:05:27 | 001,659,464 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RTSnMg64.cpl
[2013/04/22 20:05:27 | 000,331,880 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtlCPAPI64.dll
[2013/04/22 20:05:26 | 003,693,128 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtkAPO64.dll
[2013/04/22 20:05:26 | 000,149,608 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtkCfg64.dll
[2013/04/22 20:05:26 | 000,014,952 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtkCoLDR64.dll
[2013/04/22 20:05:25 | 001,284,680 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RTCOM64.dll
[2013/04/22 20:05:25 | 000,991,816 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtkApi64.dll
[2013/04/22 20:05:25 | 000,613,448 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RtDataProc64.dll
[2013/04/22 20:05:25 | 000,375,128 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEEP64A.dll
[2013/04/22 20:05:25 | 000,204,120 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEED64A.dll
[2013/04/22 20:05:25 | 000,101,208 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEEL64A.dll
[2013/04/22 20:05:25 | 000,078,680 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEEG64A.dll
[2013/04/22 20:05:24 | 000,310,104 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RP3DHT64.dll
[2013/04/22 20:05:24 | 000,310,104 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RP3DAA64.dll
[2013/04/22 20:05:23 | 000,135,240 | —- | C] (Realtek Semiconductor Corp.) – C:\Windows\SysNative\RCoInstII64.dll
[2013/04/22 20:05:14 | 000,083,072 | —- | C] (Creative Technology Ltd.) – C:\Windows\SysNative\MBWrp64.dll
[2013/04/22 20:05:13 | 000,897,152 | —- | C] (Creative Technology Ltd.) – C:\Windows\SysNative\MBAPO64.dll
[2013/04/22 20:05:13 | 000,753,280 | —- | C] (Creative Technology Ltd.) – C:\Windows\SysWow64\MBAPO32.dll
[2013/04/22 20:05:13 | 000,065,112 | —- | C] (Creative Technology Ltd.) – C:\Windows\SysNative\MBppld64.dll
[2013/04/22 20:05:13 | 000,060,504 | —- | C] (Creative Technology Ltd.) – C:\Windows\SysNative\MBPPCn64.dll
[2013/04/22 20:05:09 | 002,032,408 | —- | C] (Waves Audio Ltd.) – C:\Windows\SysNative\MaxxAudioEQ64.dll
[2013/04/22 20:05:08 | 000,910,104 | —- | C] (Waves Audio Ltd.) – C:\Windows\SysNative\MaxxAudioAPOShell64.dll
[2013/04/22 20:05:08 | 000,318,808 | —- | C] (Waves Audio Ltd.) – C:\Windows\SysNative\MaxxAudioAPO20.dll
[2013/04/22 20:04:59 | 002,734,624 | —- | C] (Fortemedia Corporation) – C:\Windows\SysNative\FMAPO64.dll
[2013/04/22 20:04:57 | 000,110,592 | —- | C] (Real Sound Lab SIA) – C:\Windows\SysNative\CONEQMSAPOGUILibrary.dll
[2013/04/22 20:04:56 | 000,208,072 | —- | C] (Andrea Electronics Corporation) – C:\Windows\SysNative\AERTAC64.dll
[2013/04/22 20:04:56 | 000,108,640 | —- | C] (Andrea Electronics Corporation) – C:\Windows\SysNative\AERTAR64.dll
[2013/04/22 18:14:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Driver Cleaner Pro
[2013/04/19 23:41:27 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JMicron Technology Corp
[2013/04/19 22:19:21 | 000,000,000 | —D | C] – C:\Users\Wayne\AppData\Roaming\Roxio
[2013/04/19 21:25:49 | 000,000,000 | —D | C] – C:\ProgramData\eSellerate
[2013/04/19 21:18:48 | 000,000,000 | —D | C] – C:\ProgramData\Sonic
[2013/04/19 21:18:09 | 000,000,000 | —D | C] – C:\Users\Wayne\AppData\Roaming\DivX
[2013/04/19 21:17:21 | 000,000,000 | —D | C] – C:\Program Files\DivX
[2013/04/19 21:14:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\DivX
[2013/04/19 21:14:51 | 000,000,000 | —D | C] – C:\ProgramData\DivX
[2013/04/19 21:02:28 | 000,000,000 | —D | C] – C:\ProgramData\Roxio
[2013/04/19 21:01:55 | 000,000,000 | —D | C] – C:\ProgramData\Macrovision
[2013/04/19 20:51:52 | 000,055,952 | —- | C] (Rovi Corporation) – C:\Windows\SysNative\drivers\PxHlpa64.sys
[2013/04/19 20:51:52 | 000,010,224 | —- | C] (Sonic Solutions) – C:\Windows\SysNative\drivers\cdralw2k.sys
[2013/04/19 20:51:52 | 000,010,224 | —- | C] (Sonic Solutions) – C:\Windows\SysNative\drivers\cdr4_xp.sys
[2013/04/19 20:51:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\SmartSound Software
[2013/04/19 20:51:23 | 000,000,000 | —D | C] – C:\ProgramData\SmartSound Software Inc
[2013/04/19 20:50:17 | 002,605,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_40.dll
[2013/04/19 20:50:17 | 002,036,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_40.dll
[2013/04/19 20:50:17 | 000,519,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_40.dll
[2013/04/19 20:50:17 | 000,452,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_40.dll
[2013/04/19 20:50:13 | 005,631,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_40.dll
[2013/04/19 20:50:13 | 004,379,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_40.dll
[2013/04/19 20:46:45 | 000,000,000 | —D | C] – C:\Users\Wayne\Desktop\MAGNiTUDE
[2013/04/19 20:45:57 | 000,000,000 | —D | C] – C:\Users\Wayne\AppData\Roaming\Roxio Log Files
[2013/04/19 19:27:28 | 000,000,000 | —D | C] – C:\Users\Wayne\AppData\Roaming\MP3 LisTaGo
[2013/04/19 19:27:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MP3 LisTaGo
[2013/04/19 19:27:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\MP3 LisTaGo
[2013/04/18 06:39:16 | 000,201,392 | —- | C] (AVAST Software) – C:\Windows\SysWow64\aswBoot.exe
[2013/04/17 22:47:06 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2013/04/17 22:47:05 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2013/04/17 22:47:04 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013/04/17 22:47:04 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2013/04/17 22:47:04 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2013/04/17 22:47:04 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013/04/17 22:47:04 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2013/04/17 22:47:04 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2013/04/17 22:47:03 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013/04/17 22:47:03 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2013/04/17 22:47:03 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2013/04/17 22:47:02 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013/04/17 22:47:01 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013/04/17 22:47:01 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013/04/17 22:47:01 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2013/04/17 21:38:58 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013/04/17 21:38:30 | 000,263,584 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/04/17 21:38:16 | 000,174,496 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/04/17 21:38:16 | 000,174,496 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/04/17 21:38:16 | 000,095,648 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/04/17 21:27:59 | 004,691,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2013/04/17 21:27:58 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\csrsrv.dll
[2013/04/17 21:27:58 | 000,075,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\smss.exe
[2013/04/17 21:27:41 | 000,451,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2013/04/17 21:27:14 | 002,425,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2013/04/17 21:27:13 | 002,067,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2013/04/16 22:16:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Xirrus
[2013/04/16 21:15:28 | 000,000,000 | —D | C] – C:\Users\Wayne\AppData\Roaming\Xirrus
[2013/04/16 19:53:05 | 000,000,000 | —D | C] – C:\Users\Wayne\Desktop\Process Explorer
[2013/04/15 18:30:27 | 000,000,000 | —D | C] – C:\Program Files (x86)\Acoustica MP3 CD Burner
[2013/04/14 21:44:37 | 000,000,000 | —D | C] – C:\ProgramData\Package Cache
[2013/04/13 18:47:32 | 000,000,000 | —D | C] – C:\Program Files\Microsoft ATS
[2013/04/12 07:15:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSECACHE
[2013/04/12 01:58:07 | 000,000,000 | —D | C] – C:\Users\Wayne\AppData\Local\ElevatedDiagnostics
[2013/04/12 00:18:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\VS Revo Group
[2013/04/12 00:04:38 | 000,000,000 | —D | C] – C:\Program Files\btscanner
[2013/04/08 22:14:31 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2013/04/08 22:05:31 | 000,000,000 | —D | C] – C:\Windows\SysNative\catroot2(818)
[2013/04/08 21:29:00 | 000,000,000 | —D | C] – C:\RegBackup
[2013/04/08 20:43:21 | 000,181,064 | —- | C] (Sysinternals) – C:\Windows\PSEXESVC.EXE
[2013/04/06 20:38:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Thunderbird
[2013/04/06 11:33:33 | 000,000,000 | —D | C] – C:\Users\Wayne\AppData\Local\FlvtoYoutubeDownloader
[2013/04/06 11:32:48 | 000,000,000 | —D | C] – C:\Users\Wayne\Documents\YouTubeDownloads
[2013/04/06 11:32:46 | 000,000,000 | —D | C] – C:\Users\Wayne\AppData\Roaming\FlvtoConverter
[2013/04/06 11:32:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Flvto Youtube Downloader
[2013/04/06 11:32:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\Flvto Youtube Downloader
[2013/04/03 22:37:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickBurn MP3
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/03 12:46:02 | 000,000,896 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/03 12:46:00 | 000,000,892 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/03 12:45:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/03 11:31:05 | 000,003,712 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/03 11:31:05 | 000,003,712 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/03 07:30:53 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/05/01 11:34:52 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2013/04/29 11:03:21 | 000,749,722 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/04/29 11:03:21 | 000,636,470 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/04/29 11:03:21 | 000,116,920 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/04/29 10:19:10 | 001,175,096 | —- | M] () – C:\Users\Wayne\Desktop\exhibitorkitFINAL(3).pdf
[2013/04/28 16:27:11 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Wayne\Desktop\OTL.exe
[2013/04/28 16:09:14 | 000,744,636 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2013/04/28 15:57:33 | 000,000,770 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2013/04/28 15:52:14 | 000,496,288 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/04/28 15:32:24 | 000,004,998 | —- | M] () – C:\Users\Wayne\Documents\cc_20130428_153218.reg
[2013/04/25 08:50:14 | 000,020,379 | —- | M] () – C:\Users\Wayne\Desktop\Scopes of Work - Suntrust Bank repairs _3_ - 7455 Chancellor Drive Orl FL _2_.pdf
[2013/04/25 07:11:35 | 000,691,592 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/04/25 07:11:35 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/04/24 22:03:44 | 000,002,032 | —- | M] () – C:\Windows\SysNative\ASOROSet.bin
[2013/04/24 21:29:05 | 000,002,123 | —- | M] () – C:\Users\Wayne\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced System Optimizer.lnk
[2013/04/24 21:29:05 | 000,002,105 | —- | M] () – C:\Users\Public\Desktop\Smart PC Care.lnk
[2013/04/24 21:29:05 | 000,002,099 | —- | M] () – C:\Users\Public\Desktop\Advanced System Optimizer.lnk
[2013/04/24 20:34:39 | 000,003,782 | —- | M] () – C:\Users\Wayne\Documents\cc_20130424_203432.reg
[2013/04/23 20:24:13 | 000,031,744 | —- | M] () – C:\Users\Wayne\Documents\Backup of PLEASE READ THIS 2.wbk
[2013/04/22 21:06:59 | 000,000,818 | —- | M] () – C:\Users\Public\Desktop\Winamp.lnk
[2013/04/22 21:06:14 | 000,001,125 | —- | M] () – C:\Windows\winamp.ini
[2013/04/22 21:04:09 | 000,000,842 | —- | M] () – C:\Users\Wayne\Application Data\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk
[2013/04/22 20:30:09 | 000,188,662 | —- | M] () – C:\Users\Wayne\Documents\cc_20130422_202959.reg
[2013/04/22 20:05:34 | 000,525,792 | —- | M] (Microsoft Corporation) – C:\Windows\DIFxAPI.dll
[2013/04/22 20:02:19 | 000,165,558 | —- | M] () – C:\Users\Wayne\Documents\cc_20130422_200206.reg
[2013/04/21 18:25:26 | 000,012,204 | —- | M] () – C:\Users\Wayne\Documents\cc_20130421_182522.reg
[2013/04/19 23:16:25 | 000,013,268 | —- | M] () – C:\Users\Wayne\Documents\cc_20130419_231621.reg
[2013/04/19 20:19:01 | 000,253,197 | —- | M] () – C:\Users\Wayne\Desktop\Refund Request - Highster Mobile.jpg
[2013/04/19 19:34:04 | 000,000,205 | —- | M] () – C:\Users\Wayne\AppData\Roaming\burnaware.ini
[2013/04/19 15:37:22 | 000,145,420 | —- | M] () – C:\Users\Wayne\Desktop\Data Sheet - Eraguard 1000 Acrylic Coating.pdf
[2013/04/18 20:49:00 | 000,001,370 | —- | M] () – C:\Users\Wayne\Documents\cc_20130418_204855.reg
[2013/04/18 17:50:32 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\config.nt
[2013/04/18 07:19:34 | 000,002,651 | —- | M] () – C:\Users\Wayne\Desktop\Microsoft Office Word 2007 (2).lnk
[2013/04/18 06:46:39 | 000,002,025 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2013/04/17 21:37:43 | 000,095,648 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/04/17 21:37:31 | 000,866,720 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\npDeployJava1.dll
[2013/04/17 21:37:31 | 000,263,584 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/04/17 21:37:31 | 000,174,496 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/04/17 21:37:31 | 000,174,496 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/04/17 21:37:30 | 000,788,896 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2013/04/17 21:15:56 | 000,001,785 | —- | M] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013/04/08 20:43:21 | 000,181,064 | —- | M] (Sysinternals) – C:\Windows\PSEXESVC.EXE
[2013/04/07 01:12:20 | 000,022,234 | —- | M] () – C:\Users\Wayne\Documents\cc_20130407_011216.reg
[2013/04/06 13:41:23 | 000,074,786 | —- | M] () – C:\Users\Wayne\Documents\cc_20130406_134119.reg
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/01 11:13:25 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/05/01 11:13:25 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/05/01 11:13:25 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/05/01 11:13:25 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/05/01 11:13:25 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2013/04/29 10:19:10 | 001,175,096 | —- | C] () – C:\Users\Wayne\Desktop\exhibitorkitFINAL(3).pdf
[2013/04/28 15:32:21 | 000,004,998 | —- | C] () – C:\Users\Wayne\Documents\cc_20130428_153218.reg
[2013/04/25 08:50:14 | 000,020,379 | —- | C] () – C:\Users\Wayne\Desktop\Scopes of Work - Suntrust Bank repairs _3_ - 7455 Chancellor Drive Orl FL _2_.pdf
[2013/04/24 21:59:37 | 000,002,032 | —- | C] () – C:\Windows\SysNative\ASOROSet.bin
[2013/04/24 21:29:06 | 000,016,896 | —- | C] () – C:\Windows\SysNative\sasnative64.exe
[2013/04/24 21:29:05 | 000,002,123 | —- | C] () – C:\Users\Wayne\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced System Optimizer.lnk
[2013/04/24 21:29:05 | 000,002,105 | —- | C] () – C:\Users\Public\Desktop\Smart PC Care.lnk
[2013/04/24 21:29:05 | 000,002,099 | —- | C] () – C:\Users\Public\Desktop\Advanced System Optimizer.lnk
[2013/04/24 20:34:37 | 000,003,782 | —- | C] () – C:\Users\Wayne\Documents\cc_20130424_203432.reg
[2013/04/23 20:20:21 | 000,031,744 | —- | C] () – C:\Users\Wayne\Documents\Backup of PLEASE READ THIS 2.wbk
[2013/04/22 21:06:59 | 000,000,818 | —- | C] () – C:\Users\Public\Desktop\Winamp.lnk
[2013/04/22 21:04:09 | 000,000,842 | —- | C] () – C:\Users\Wayne\Application Data\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk
[2013/04/22 20:30:02 | 000,188,662 | —- | C] () – C:\Users\Wayne\Documents\cc_20130422_202959.reg
[2013/04/22 20:05:25 | 000,449,481 | —- | C] () – C:\Windows\SysNative\drivers\RTAIODAT.DAT
[2013/04/22 20:02:10 | 000,165,558 | —- | C] () – C:\Users\Wayne\Documents\cc_20130422_200206.reg
[2013/04/21 18:25:25 | 000,012,204 | —- | C] () – C:\Users\Wayne\Documents\cc_20130421_182522.reg
[2013/04/19 23:16:24 | 000,013,268 | —- | C] () – C:\Users\Wayne\Documents\cc_20130419_231621.reg
[2013/04/19 20:19:01 | 000,253,197 | —- | C] () – C:\Users\Wayne\Desktop\Refund Request - Highster Mobile.jpg
[2013/04/19 15:37:22 | 000,145,420 | —- | C] () – C:\Users\Wayne\Desktop\Data Sheet - Eraguard 1000 Acrylic Coating.pdf
[2013/04/18 20:48:59 | 000,001,370 | —- | C] () – C:\Users\Wayne\Documents\cc_20130418_204855.reg
[2013/04/07 01:12:19 | 000,022,234 | —- | C] () – C:\Users\Wayne\Documents\cc_20130407_011216.reg
[2013/04/06 13:41:21 | 000,074,786 | —- | C] () – C:\Users\Wayne\Documents\cc_20130406_134119.reg
[2013/04/01 15:43:12 | 000,000,205 | —- | C] () – C:\Users\Wayne\AppData\Roaming\burnaware.ini
[2012/11/28 18:01:03 | 000,014,188 | —- | C] () – C:\Users\Wayne\.recently-used.xbel
[2012/09/17 21:22:12 | 000,000,034 | —- | C] () – C:\Windows\cdplayer.ini
[2012/03/04 22:48:22 | 000,744,636 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/01/30 17:39:23 | 000,000,057 | —- | C] () – C:\Windows\SysWow64\lbj.ini
[2012/01/03 14:56:38 | 000,175,616 | —- | C] () – C:\Windows\SysWow64\unrar.dll
[2012/01/03 14:48:53 | 000,007,680 | —- | C] () – C:\Users\Wayne\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/19 17:49:45 | 000,134,189 | —- | C] () – C:\Windows\hpwins10.dat.temp
[2011/12/19 17:49:45 | 000,001,042 | —- | C] () – C:\Windows\hpwmdl10.dat.temp
[2011/12/19 17:48:30 | 000,103,839 | —- | C] () – C:\Windows\hpqins07.dat
[2011/12/19 17:47:22 | 000,103,862 | —- | C] () – C:\Windows\hpqins05.dat
[2011/12/19 17:46:22 | 000,103,838 | —- | C] () – C:\Windows\hpqins11.dat
[2011/12/19 17:45:00 | 000,104,027 | —- | C] () – C:\Windows\hpqins01.dat
[2011/12/11 14:28:39 | 000,000,028 | —- | C] () – C:\Windows\ODBC.INI
[2011/12/10 22:00:54 | 000,136,415 | —- | C] () – C:\Windows\hpwins10.dat
[2011/12/10 22:00:54 | 000,001,042 | —- | C] () – C:\Windows\hpwmdl10.dat
[2011/12/10 22:00:43 | 000,010,385 | —- | C] () – C:\Windows\hpwscr10.dat
[2011/12/08 18:16:50 | 000,001,125 | —- | C] () – C:\Windows\winamp.ini
[2011/12/06 03:03:34 | 000,189,440 | —- | C] () – C:\Windows\SysWow64\WindowsCodecsExt.dll
[2011/12/06 03:03:33 | 000,321,024 | —- | C] () – C:\Windows\SysWow64\PhotoMetadataHandler.dll
[2011/12/06 01:14:46 | 000,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2011/12/06 01:14:21 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2011/12/06 01:13:47 | 000,107,612 | —- | C] () – C:\Windows\SysWow64\StructuredQuerySchema.bin
[2011/12/06 01:13:47 | 000,018,904 | —- | C] () – C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2011/12/06 01:13:28 | 000,083,456 | —- | C] () – C:\Windows\SysWow64\wlgpclnt.dll
[2011/12/05 19:29:28 | 000,000,010 | —- | C] () – C:\Windows\GSetup.ini
[2011/12/05 18:56:52 | 000,000,732 | —- | C] () – C:\Users\Wayne\AppData\Local\d3d9caps64.dat
[2011/10/06 10:42:00 | 004,407,296 | —- | C] () – C:\Program Files (x86)\Control Center.exe
[2011/07/26 12:34:00 | 000,000,521 | —- | C] () – C:\Program Files (x86)\AFPrinter.ini

========== ZeroAccess Check ==========

[2006/11/02 11:30:40 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 13:59:03 | 012,899,840 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 13:47:00 | 011,586,048 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/04/11 01:11:16 | 000,891,392 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\fastprox.dll – [2009/04/11 00:28:20 | 000,614,912 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2008/01/20 22:50:58 | 000,513,024 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\wbemess.dll

========== LOP Check ==========

[2013/04/15 18:30:27 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Acoustica
[2011/12/11 23:32:11 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Acronis
[2012/09/14 21:51:38 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\AnvSoft
[2012/09/21 17:40:21 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Audacity
[2011/12/09 09:39:43 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Autodesk
[2012/01/09 18:00:23 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Blackberry Desktop
[2012/01/20 16:00:46 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Canneverbe Limited
[2013/04/23 10:25:17 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\DAEMON Tools Lite
[2011/12/14 10:43:24 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Downloaded Installations
[2012/12/11 22:14:56 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Dropbox
[2013/03/05 22:06:33 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\DVDVideoSoft
[2013/01/04 21:39:33 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\FastCopy
[2013/04/06 11:35:37 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\FlvtoConverter
[2013/01/25 15:03:46 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\FreemakeVideoDownloader
[2013/03/05 22:25:50 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\FreeYoutubeToMP3TURBOConverter
[2012/08/21 20:01:43 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Garmin
[2012/11/28 18:01:03 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\gtk-2.0
[2013/01/04 15:02:22 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\HotSync
[2013/04/01 16:33:54 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\ImgBurn
[2012/09/14 20:47:11 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\ImTOO
[2012/01/30 17:27:22 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\IrfanView
[2012/09/14 22:57:45 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Leawo
[2013/02/08 00:16:39 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Motorola
[2013/02/08 00:18:42 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Motorola Mobility
[2013/04/19 19:27:28 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\MP3 LisTaGo
[2013/04/25 21:31:56 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Nitro PDF
[2012/11/01 16:38:01 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\ooVoo Details
[2011/12/10 22:46:52 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\PhotoScape
[2011/12/12 00:09:05 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Research In Motion
[2011/12/11 19:08:44 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\StreamTorrent
[2012/01/30 18:14:53 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\SumatraPDF
[2011/12/24 13:38:11 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\SystemRequirementsLab
[2011/12/07 12:09:00 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Thunderbird
[2013/04/29 00:40:23 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\uTorrent
[2013/04/16 21:15:28 | 000,000,000 | —D | M] – C:\Users\Wayne\AppData\Roaming\Xirrus

========== Purity Check ==========



< End of report >
Post #11
Please download Windows Repair (all in one) from here

Install the program then run it
  • Go to step 2 and allow it to run Disk check
  • Once that is done then go to step 3 and allow it to run SFC
  • On the the Start Repairs tab => Click the Start
  • Click on the select all check box and then click on Start

    Select the following :
    • Reset Registry Permissions
    • Reset File Permissions
    • Register System Files
  • Hit the Start button
  • DON'T use the computer while each scan is in progress.
  • Restart may be needed to finish the repair procedure.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI