Spyware / Malware / Virus Removal

Redirect insanity [Solved]

12 min read

Looking for the outcome? Ask AI

computerwannabe Topic Starter

Post #1May 29, 2013, 5:44 PM UTC last edited May 29, 2013, 5:47 PM UTC

My subscription to Norton ran out a month or so ago. Instead of paying I activated Windows defender. It didn't take long to get infected. I have run MBAM scans, I have run Norton Power Eraser, I have downloaded and installed avast and run their scan, but nothing has found any infection or removed the problem. I have also run JRT and ATF cleaner. I also manually emptied out cookies, but as soon as I refresh the home page or restart firefox the same batch of cookies are right back again.

The problem: Redirecting when I click on any link. Those annoying lines in every page I go to that pop up a window when I mouse over them. And an annoying popup in the lower left corner of the screen every time I go to any page. Oh, and a constant reminder to update flash player. It happens when I am on random pages and will take me away from the page I have been on for a minute or so to a site to 'take care of the problem'.

Here is the OTL logfile:

OTL logfile created on: 5/29/2013 12:16:25 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\jtmeserole\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.76 Gb Available Physical Memory | 61.10% Memory free
5.96 Gb Paging File | 4.87 Gb Available in Paging File | 81.77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286.80 Gb Total Space | 135.71 Gb Free Space | 47.32% Space Free | Partition Type: NTFS
Drive D: | 11.28 Gb Total Space | 1.59 Gb Free Space | 14.09% Space Free | Partition Type: NTFS
Drive E: | 1.12 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: JTMESEROLE-PC | User Name: jtmeserole | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 14 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
PRC - C:\Users\jtmeserole\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
PRC - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files\Windstream\Diagnostic Tools\HsdService.exe (Windstream)
PRC - C:\Program Files\Windstream\Diagnostic Tools\DiagnosticTools.exe (Windstream)
PRC - C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe (Rosetta Stone Ltd.)
PRC - C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\wpcumi.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\NCH Software\ExpressZip\ezcm.dll ()

========== Services (SafeList) ==========

SRV - (sftlist) – C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe File not found
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (vsmon) – C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
SRV - (NSM) – C:\Program Files\Norton Family\Engine\2.6.0.43\ccSvcHst.exe (Symantec Corporation)
SRV - (Norton PC Checkup Application Launcher) – C:\Program Files\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe (Symantec Corporation)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (ServicepointService) – C:\Program Files\Windstream\Service Agent\ServicepointService.exe (Radialpoint SafeCare Inc.)
SRV - (sftvsa) – C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (UMVPFSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (PCCUJobMgr) – C:\Program Files\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe (Symantec Corporation)
SRV - (HsdService) – C:\Program Files\Windstream\Diagnostic Tools\HsdService.exe (Windstream)
SRV - (RosettaStoneDaemon) – C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe (Rosetta Stone Ltd.)
SRV - (GamesAppService) – C:\Program Files\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (AgereModemAudio) – C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – system32\DRIVERS\ipinip.sys File not found
DRV - (catchme) – C:\Users\JTMESE~1\AppData\Local\Temp\catchme.sys File not found
DRV - (aswSnx) – C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\Windows\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\Windows\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (AswRdr) – C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Vsdatant) – C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (ccSet_NSM) – C:\Windows\System32\drivers\NSM\0206000.02B\ccSetx86.sys (Symantec Corporation)
DRV - (SCDEmu) – C:\Windows\System32\drivers\scdemu.sys (Power Software Ltd)
DRV - (Sftvol) – C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation)
DRV - (Sftredir) – C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV - (Sftplay) – C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV - (Sftfs) – C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation)
DRV - (LVUVC) – C:\Windows\System32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.)
DRV - (speedfan) – C:\Windows\System32\speedfan.sys (Almico Software)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corporation)
DRV - (USBCCID) – C:\Windows\System32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (ElRawDisk) – C:\Windows\System32\drivers\rsdrv.sys (EldoS Corporation)
DRV - (nvrd32) – C:\Windows\System32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) – C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (MHIKEY10) – C:\Windows\System32\drivers\MHIKEY10.sys (Generic USB smartcard reader)
DRV - (nvsmu) – C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (irsir) – C:\Windows\System32\drivers\irsir.sys (Microsoft Corporation)
DRV - (dsiarhwprog) – C:\Windows\System32\drivers\dsiarhwprog.sys (Thesycon GmbH, Germany)
DRV - (sscdserd) – C:\Windows\System32\drivers\sscdserd.sys (MCCI)
DRV - (sscdmdm) – C:\Windows\System32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) – C:\Windows\System32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) – C:\Windows\System32\drivers\sscdbus.sys (MCCI)
DRV - (giveio) – C:\Windows\System32\giveio.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKLM\..\SearchScopes\{7EC2F961-F9C4-4F23-8885-C882FF51F8B2}: "URL" = http://search.live.com/results.aspx?q={sea…amp;FORM=HPDTDF

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 98 7D 03 02 CE 6E E2 4D 9F 26 81 EE 65 AF 76 3D [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {C4E9144D-8269-4F50-B1BE-371B8170CF5A}
IE - HKCU\..\SearchScopes\{7EC2F961-F9C4-4F23-8885-C882FF51F8B2}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{9B97950D-482C-1D79-568F-FC7B9D40C785}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{C4E9144D-8269-4F50-B1BE-371B8170CF5A}: "URL" = http://www.google.com/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: "www.google.com"
FF - prefs.js..browser.search.defaulturl: "Bing"
FF - prefs.js..browser.search.order.1: "Search By ZoneAlarm"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.ldsscripturemastery.net/en/"
FF - prefs.js..extensions.enabledAddons: %7Be001c731-5e37-4538-a5cb-8168736a2360%7D:0.9.9.119
FF - prefs.js..extensions.enabledAddons: hOUiT7au%40i0ixSKgctyasBk.com:11
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: [removed]:5.0.1
FF - prefs.js..extensions.enabledItems: [removed]:2.3
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {000F1EA4-5E08-4564-A29B-29076F63A37A}:[removed]
FF - prefs.js..extensions.enabledItems: {6D5C8FC4-DE46-41bf-9092-93F0F78E9115}:2.1.0.51
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MI1933~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MI1933~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Musicnotes.com/Musicnotes Viewer,version=1.18.9: C:\Program Files\Musicnotes\npmusicn.dll (Musicnotes, Inc.)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\Windstream\Service Agent\nprpspa.dll (Windstream)
FF - HKLM\Software\MozillaPlugins\@Sibelius.com/Scorch Plugin,version=6.2.0.88: C:\Program Files\Musicnotes\npsibelius.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll ()
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\jtmeserole\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6D5C8FC4-DE46-41bf-9092-93F0F78E9115}: C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.6.0.43\coFFFw\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/03/28 10:30:49 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/25 22:30:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2013/05/25 23:04:46 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/24 14:07:05 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/24 14:06:57 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/03/28 10:30:49 | 000,000,000 | —D | M]

[2011/11/09 11:14:59 | 000,000,000 | —D | M] (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Extensions
[2013/05/25 23:21:11 | 000,000,000 | —D | M] (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions
[2012/09/11 13:55:36 | 000,000,000 | —D | M] () – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}
[2010/09/27 21:35:19 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/06/27 15:16:06 | 000,000,000 | —D | M] (Bitdefender QuickScan) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2013/03/24 13:46:03 | 000,000,000 | —D | M] (United States English Spellchecker) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2013/05/25 23:21:06 | 000,000,000 | —D | M] (zonealarm.com) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2010/09/20 15:59:14 | 000,000,000 | —D | M] (KidZui) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2012/04/23 18:38:59 | 000,234,665 | —- | M] () (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2011/08/23 22:57:12 | 000,074,961 | —- | M] () (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2013/04/30 10:10:31 | 000,003,259 | —- | M] () (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2011/07/19 20:56:57 | 000,310,942 | —- | M] () (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2012/12/17 12:34:28 | 000,222,578 | —- | M] () (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{4176DFF4-4698-11DE-BEEB-45DA55D89593}.xpi
[2013/02/19 19:19:26 | 000,685,671 | —- | M] () (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi
[2013/01/23 05:46:58 | 000,007,919 | —- | M] () (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]\content\Abine\chrome\content\ff\view_expiry.js
[2011/05/03 11:52:57 | 000,002,469 | —- | M] () – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\safesearch.xml
[2013/05/25 22:58:46 | 000,001,488 | —- | M] () – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\zonealarm.xml
[2013/05/24 14:07:05 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/24 14:07:05 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2012/08/14 10:09:55 | 000,466,944 | —- | M] (Catalina Marketing Corporation) – C:\Program Files\mozilla firefox\plugins\NPcol400.dll
[2010/03/31 11:09:22 | 010,437,264 | —- | M] (PDFTron Systems Inc.) – C:\Program Files\mozilla firefox\plugins\PDFNetC.dll
[2010/04/08 13:36:02 | 000,107,760 | —- | M] () – C:\Program Files\mozilla firefox\plugins\ScorchPDFWrapper.dll
[2012/06/18 17:44:09 | 000,003,749 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:in
s
tantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://isearch.avg.com/?cid={9BC737C8-EB9C…mp;d=2012-06-18 17:44:13&v;=11.1.0.7&sap;=hp
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Disabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Norton Identity Safe (Enabled) = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.2.1.36_0\npcoplgn.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Disabled) = C:\Program Files\Google\Chrome\Application\plugins\npMozCouponPrinter.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: CouponNetwork Coupon Activator Netscape Plugin v. 5.0.0.0 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPcol400.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: ScorchPlugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPSibelius.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MI1933~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MI1933~1\Office14\NPSPWRAP.DLL
CHR - plugin: Google Earth Plugin (Disabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U11 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Musicnotes (Enabled) = C:\Program Files\Musicnotes\npmusicn.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Windstream Service Agent (Enabled) = C:\Program Files\Windstream\Service Agent\nprpspa.dll
CHR - plugin: iTunes Application Detector (Disabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\jtmeserole\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: SOE Web Installer (Disabled) = C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll
CHR - plugin: Java Deployment Toolkit 7.0.110.21 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Bejeweled = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\adpkifcfcacgmnggcbpbjbkdijciiigm\2_0\
CHR - Extension: YouTube = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: WebFilter Pro - The best filtering addon! = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejgfoklefkbjadjcgjmnhfbdfjolojnn\0.19.6.12_0\
CHR - Extension: Stylish = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe\1.1_0\
CHR - Extension: XKit = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpfgeeomkfdefkckijiabdbogjkdaecd\7.0.2_0\
CHR - Extension: avast! Online Security = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\8.0.6_0\
CHR - Extension: The Great Grass Sea Theme = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpghdlkjginnphhfpdccobkbncldkgmc\1.0_0\
CHR - Extension: Love Smoke = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgibfhhccaknggplelmbaepoikkcnllb\1_0\
CHR - Extension: Typing Test - KeyHero = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkcieoaeooeidmpaopkpjpjfakidlabm\1.4.0_0\
CHR - Extension: Sketchpad = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkllajgbhondgjjnhmmgbjndmogapinp\1.0.0.4_0\
CHR - Extension: Radialpoint SPD Extension = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmmhpfbhngkongobaoibpmnijjokabmj\1.0_0\
CHR - Extension: TumTaster = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\nanfbkacbckngfcklahdgfagjlghfbgm\0.4.9_0\
CHR - Extension: Tumblr Savior = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\oefddkjnflmjbclpnnoegglmmdfkidip\0.4.5_0\
CHR - Extension: Gmail = C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2013/01/17 22:07:58 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DiagnosticTools.exe] C:\Program Files\Windstream\Diagnostic Tools\DiagnosticTools.exe (Windstream)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [Windstream Service Agent.exe] C:\Program Files\Windstream\Service Agent\Windstream Service Agent.exe (Windstream)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Download all with Free Download Manager - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - C:\Program Files\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd; to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bitdefender.com/qsax/qsax.cab (BitDefender QuickScan Control)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/…can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DC2E7865-5ADB-466A-9527-0EFA9B7FF184}: DhcpNameServer = 192.168.254.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\jtmeserole\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\jtmeserole\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2010/03/30 14:43:00 | 002,843,492 | R— | M] (Teaching Textbooks ) - E:\Autorun.exe – [ CDFS ]
O32 - AutoRun File - [2010/04/01 23:21:00 | 000,000,031 | R— | M] () - E:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 14 Days ==========

[2013/05/25 23:04:57 | 000,000,000 | —D | C] – C:\Users\jtmeserole\Documents\ForceField Shared Files
[2013/05/25 23:04:52 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Roaming\CheckPoint
[2013/05/25 23:02:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
[2013/05/25 23:00:54 | 000,221,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\netio.sys
[2013/05/25 22:58:43 | 000,000,000 | —D | C] – C:\Program Files\Check Point Software Technologies LTD
[2013/05/25 22:58:37 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Roaming\Check Point Software Technologies LTD
[2013/05/25 22:58:33 | 000,000,000 | —D | C] – C:\Program Files\CheckPoint
[2013/05/25 22:57:34 | 000,000,000 | —D | C] – C:\ProgramData\CheckPoint
[2013/05/25 22:30:36 | 000,029,816 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2013/05/25 22:30:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2013/05/25 22:30:35 | 000,765,736 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSnx.sys
[2013/05/25 22:30:35 | 000,368,944 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSP.sys
[2013/05/25 22:30:35 | 000,056,080 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswTdi.sys
[2013/05/25 22:30:35 | 000,049,760 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswRdr.sys
[2013/05/25 22:30:34 | 000,229,648 | —- | C] (AVAST Software) – C:\Windows\System32\aswBoot.exe
[2013/05/25 22:30:34 | 000,066,336 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2013/05/25 22:29:52 | 000,041,664 | —- | C] (AVAST Software) – C:\Windows\avastSS.scr
[2013/05/25 22:28:58 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2013/05/25 20:11:04 | 000,000,000 | —D | C] – C:\ProgramData\AVAST Software
[2013/05/25 19:31:11 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2013/05/25 19:30:56 | 000,174,496 | —- | C] (Oracle Corporation) – C:\Windows\System32\javaw.exe
[2013/05/25 19:30:56 | 000,174,496 | —- | C] (Oracle Corporation) – C:\Windows\System32\java.exe
[2013/05/25 19:30:56 | 000,094,112 | —- | C] (Oracle Corporation) – C:\Windows\System32\WindowsAccessBridge.dll
[2013/05/24 14:06:55 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/05/20 08:13:58 | 000,000,000 | —D | C] – C:\ProgramData\Wild Tangent
[2013/05/20 08:00:19 | 000,000,000 | —D | C] – C:\Program Files\WildTangent Games
[2013/05/16 01:15:29 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2013/05/16 01:00:46 | 000,607,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2013/05/16 01:00:46 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2013/05/16 01:00:46 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2013/05/16 01:00:46 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2013/05/16 01:00:45 | 001,800,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2013/05/16 01:00:45 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2013/05/16 01:00:44 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2012/03/26 10:22:17 | 035,113,704 | —- | C] (Microsoft Corporation) – C:\Program Files\Common Files\directx_9c_redist.exe

========== Files - Modified Within 14 Days ==========

[2013/05/29 12:17:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/29 12:08:15 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/29 11:52:35 | 000,003,616 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/29 11:52:35 | 000,003,616 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/29 11:16:40 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/28 13:53:32 | 000,065,536 | —- | M] () – C:\Windows\System32\Ikeext.etl
[2013/05/28 13:52:33 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/05/26 18:56:46 | 000,604,946 | —- | M] () – C:\Windows\System32\perfh009.dat
[2013/05/26 18:56:46 | 000,104,388 | —- | M] () – C:\Windows\System32\perfc009.dat
[2013/05/25 23:07:43 | 000,417,507 | —- | M] () – C:\Windows\System32\drivers\vsconfig.xml
[2013/05/25 23:02:40 | 000,000,639 | —- | M] () – C:\Users\Public\Desktop\ZoneAlarm Security.lnk
[2013/05/25 22:30:36 | 000,001,795 | —- | M] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013/05/25 22:30:34 | 000,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2013/05/22 11:29:50 | 000,001,853 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2013/05/20 10:44:48 | 000,070,144 | —- | M] () – C:\Users\jtmeserole\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/05/20 08:00:35 | 000,002,274 | —- | M] () – C:\Users\jtmeserole\Application Data\Microsoft\Internet Explorer\Quick Launch\WildTangent Games App - hp.lnk
[2013/05/20 08:00:34 | 000,002,242 | —- | M] () – C:\Users\Public\Desktop\WildTangent Games App - hp.lnk
[2013/05/16 08:38:16 | 000,381,240 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2013/05/25 23:05:00 | 000,417,507 | —- | C] () – C:\Windows\System32\drivers\vsconfig.xml
[2013/05/25 23:02:40 | 000,000,639 | —- | C] () – C:\Users\Public\Desktop\ZoneAlarm Security.lnk
[2013/05/25 22:30:36 | 000,001,795 | —- | C] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013/05/25 22:30:35 | 000,174,664 | —- | C] () – C:\Windows\System32\drivers\aswVmm.sys
[2013/05/25 22:30:35 | 000,049,376 | —- | C] () – C:\Windows\System32\drivers\aswRvrt.sys
[2013/05/20 08:00:32 | 000,002,274 | —- | C] () – C:\Users\jtmeserole\Application Data\Microsoft\Internet Explorer\Quick Launch\WildTangent Games App - hp.lnk
[2013/05/20 08:00:32 | 000,002,242 | —- | C] () – C:\Users\Public\Desktop\WildTangent Games App - hp.lnk
[2013/03/27 11:33:33 | 000,069,632 | —- | C] () – C:\Windows\System32\MobOlExt.dll
[2013/01/17 21:54:27 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/01/17 21:54:27 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/01/17 21:54:27 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/01/17 21:54:27 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/01/17 21:54:27 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/12/29 15:48:10 | 000,035,328 | —- | C] () – C:\Users\jtmeserole\01074461.XLT
[2012/09/04 20:29:20 | 000,019,456 | —- | C] () – C:\Users\jtmeserole\01026644.xlt
[2012/08/28 08:43:51 | 000,003,632 | —- | C] () – C:\Users\jtmeserole\profiles.xml
[2012/02/29 10:51:38 | 000,000,022 | —- | C] () – C:\Windows\WinInit.Ini
[2012/02/29 10:51:28 | 000,168,207 | —- | C] () – C:\Windows\System32\Unstall.exe
[2012/01/25 14:38:22 | 000,000,043 | —- | C] () – C:\Users\jtmeserole\Food Storage Planner-Path
[2011/08/20 16:04:22 | 000,150,004 | —- | C] () – C:\Windows\System32\mlfcache.dat
[2011/08/19 04:26:20 | 010,898,456 | —- | C] () – C:\Windows\System32\LogiDPP.dll
[2011/08/19 04:26:20 | 000,336,408 | —- | C] () – C:\Windows\System32\DevManagerCore.dll
[2011/08/19 04:26:20 | 000,104,472 | —- | C] () – C:\Windows\System32\LogiDPPApp.exe
[2011/08/17 18:30:51 | 000,000,115 | —- | C] () – C:\Users\jtmeserole\webct_upload_applet.properties
[2011/08/12 13:20:14 | 000,015,896 | —- | C] () – C:\Windows\System32\drivers\iKeyLFT2.dll
[2011/07/26 01:48:54 | 000,028,418 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2011/02/12 22:26:46 | 000,000,048 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/10/14 10:35:04 | 000,000,632 | RHS- | C] () – C:\Users\jtmeserole\ntuser.pol
[2010/09/25 19:46:40 | 000,070,144 | —- | C] () – C:\Users\jtmeserole\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/22 23:41:23 | 000,029,262 | —- | C] () – C:\Users\jtmeserole\AppData\Roaming\wklnhst.dat
[2010/09/20 13:18:13 | 000,001,356 | —- | C] () – C:\Users\jtmeserole\AppData\Local\d3d9caps.dat

========== ZeroAccess Check ==========

[2006/11/02 07:54:22 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 12:47:00 | 011,586,048 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/04/11 01:28:19 | 000,614,912 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/04/11 01:28:25 | 000,347,648 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/04/29 13:56:06 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\.minecraft
[2011/09/23 11:48:03 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\.t4k_common
[2011/03/02 20:50:37 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\2monkeys
[2012/09/01 19:32:54 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Anuman
[2012/09/22 21:08:08 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Audacity
[2012/08/08 09:16:53 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Boolat Games
[2011/09/29 16:30:47 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Catalina Marketing Corp
[2013/05/25 22:58:37 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Check Point Software Technologies LTD
[2013/05/25 23:04:53 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\CheckPoint
[2011/05/30 17:30:34 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Chessmaster Challenge
[2012/08/13 21:26:06 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\EuroTalk
[2011/04/10 14:35:53 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Farm Mania 2.1
[2013/02/06 18:04:41 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Free Download Manager
[2011/01/24 21:48:39 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\freshgames
[2011/09/07 18:15:19 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Guitar Pro 6
[2013/03/12 13:35:30 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\KidZui
[2011/12/11 17:31:28 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Leadertech
[2011/03/03 13:06:46 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Mean Hamster
[2013/01/13 22:14:05 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Meridian93
[2011/03/01 11:52:31 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\MSNInstaller
[2010/10/15 17:58:10 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\MusE
[2010/11/05 18:54:16 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\MusicNet
[2011/02/12 12:24:20 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\NCH Swift Sound
[2010/12/15 14:38:17 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Oberon Games
[2012/08/18 08:56:49 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Peace Craft
[2012/05/03 20:05:53 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\PlayFirst
[2013/01/14 16:43:26 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Playrix Entertainment
[2013/05/25 18:09:40 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\QuickScan
[2012/11/21 14:53:54 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Radialpoint
[2012/10/06 18:04:46 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\redsn0w
[2012/08/22 20:19:52 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Sandlot Games
[2012/02/27 16:38:58 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\School Zone Preferences
[2010/10/19 11:23:24 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Skunk Studios
[2012/02/28 11:30:52 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\SoftGrid Client
[2013/04/10 14:24:59 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Stellarium
[2012/08/22 20:06:25 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\SulusGames
[2012/03/08 13:16:04 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Super-Cow
[2011/01/25 21:26:00 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Supermarket Mania 2
[2010/09/22 23:41:24 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Template
[2011/09/30 18:21:20 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Tific
[2012/03/01 18:12:26 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\TP
[2012/10/01 13:19:09 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\tuxmath
[2010/09/27 15:17:15 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Unity
[2013/05/20 08:00:52 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\WildTangent
[2012/01/17 21:37:53 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Windstream
[2010/10/15 20:20:28 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\YoudaGames

========== Purity Check ==========

========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EXE >
[1995/04/25 02:00:00 | 000,969,792 | —- | M] () MD5=182749693EF4B3BE232EAC23BC68A448 – C:\HISTORY\EXPLORER.EXE
[2009/05/18 15:45:17 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2009/05/18 15:45:16 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2009/05/18 15:45:16 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/04/11 01:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\ERDNT\cache\explorer.exe
[2009/04/11 01:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\explorer.exe
[2009/04/11 01:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009/05/18 15:45:16 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/20 21:24:24 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: EXPLORER.EXE.3164.DMP >
[2013/01/17 21:48:36 | 003,469,158 | —- | M] () MD5=922F306FBA3C8D838F683FB1C74F171C – C:\Users\jtmeserole\AppData\Local\CrashDumps\explorer.exe.3164.dmp

< MD5 for: EXPLORER.EXE.MUI >
[2006/11/02 07:41:18 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\en-US\explorer.exe.mui
[2006/11/02 07:41:18 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\winsxs\x86_microsoft-windows-explorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_03bbc52176b6ba20\explorer.exe.mui

< MD5 for: EXPLORER.EXE-7A3328DA.PF >
[2013/05/28 14:01:41 | 000,169,548 | —- | M] () MD5=8AFDBD786D27AB62500E213E26EA90E5 – C:\Windows\Prefetch\EXPLORER.EXE-7A3328DA.pf

< MD5 for: EXPLORER.HLP >
[1995/04/25 02:00:00 | 000,571,344 | —- | M] () MD5=78B5A9803EBA4EA7CE1CCEEE76F5543E – C:\HISTORY\EXPLORER.HLP

< MD5 for: EXPLORER.INI >
[2012/03/09 12:21:51 | 000,000,467 | —- | M] () MD5=05C10B448D97CCD55D08AD8583583DEA – C:\HISTORY\EXPLORER.INI

< MD5 for: IEXPLORE.BAT >
[2013/01/04 15:58:30 | 000,031,067 | —- | M] () MD5=709A62B22C7BA09D875F765341E0FFFC – C:\JRT\iexplore.bat

< MD5 for: IEXPLORE.EXE >
[2012/05/17 18:21:54 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=0129BB16161C2FD9A6B19111AB047198 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16446_none_5898f8e3ebb5c47b\iexplore.exe
[2011/07/23 06:02:27 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=04D1DC458C723B291179F8449ACC281D – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19120_none_12355fcb2fdc2111\iexplore.exe
[2009/05/18 15:30:20 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=07ED775D6DB4BFA96D7CFB09EB228418 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16681_none_2d26424d1d17e8b7\iexplore.exe
[2009/05/18 15:49:59 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=0844F5B9CB3BB85A917D347EF1565B6C – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16809_none_2d84c7c91ccfce35\iexplore.exe
[2012/11/13 21:56:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=0D286C0FE561D1A7EB30E83A0FF305B2 – C:\Windows\ERDNT\cache\iexplore.exe
[2012/11/13 21:56:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=0D286C0FE561D1A7EB30E83A0FF305B2 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16457_none_588f2941ebbcf9c3\iexplore.exe
[2011/09/30 18:49:11 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=0E1695AD4C30E72D68170F01B4818A80 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23250_none_129e8cd2491214ae\iexplore.exe
[2009/05/18 15:35:44 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=157F8DE991396C536820D7FA5C8DCF7D – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16711_none_2d71f3a71cdf2247\iexplore.exe
[2009/05/18 15:29:17 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=182CAF7403705ACCB51211A761080B8F – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20777_none_2dc0b0c03628049a\iexplore.exe
[2009/05/18 15:40:03 | 000,633,632 | —- | M] (Microsoft Corporation) MD5=19403B64906C9EAC627E3C10847B0FDA – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16757_none_2d4cb5b31cfa2a15\iexplore.exe
[2012/08/24 02:34:41 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=22CC6CDBA678790046693654C3B212E4 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16450_none_5888273bebc34862\iexplore.exe
[2012/05/17 17:59:46 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=268982F1FD671A077C6A2AF41E351436 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20551_none_5912c45104e00183\iexplore.exe
[2012/10/08 03:37:24 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=270A1342BD5AF95CA25A586B4C2F1522 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16455_none_588d28adebbec715\iexplore.exe
[2011/11/03 02:33:09 | 000,638,240 | —- | M] (Microsoft Corporation) MD5=2A268DF89913A0E927091077878EDB3E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23266_none_1299bea24914c8a9\iexplore.exe
[2009/04/11 01:27:44 | 000,636,080 | —- | M] (Microsoft Corporation) MD5=2C5168C856455CC43C4B4E1CC1920001 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6002.18005_none_314d791517204c15\iexplore.exe
[2013/02/21 23:10:00 | 000,757,376 | —- | M] (Microsoft Corporation) MD5=32732CEDE2A1106B736EF3D84054EE04 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16476_none_5878891febce184e\iexplore.exe
[2012/06/02 04:08:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=34B01BBD8F00B6B9C9248DC4F1E3CD01 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16447_none_5899f92debb4ddd2\iexplore.exe
[2013/04/04 17:47:49 | 000,757,360 | —- | M] (Microsoft Corporation) MD5=3F00BE80B9CEA20B7FE7363D15EDDB94 – C:\Program Files\Internet Explorer\iexplore.exe
[2013/04/04 17:47:49 | 000,757,360 | —- | M] (Microsoft Corporation) MD5=3F00BE80B9CEA20B7FE7363D15EDDB94 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16483_none_586ab855ebd8e83a\iexplore.exe
[2013/02/21 23:10:31 | 000,757,360 | —- | M] (Microsoft Corporation) MD5=4145E2B5663F6FACC08EFDB17B658BB2 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20586_none_58f755ff04f3d409\iexplore.exe
[2010/09/08 01:26:34 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=4A719476A6393B1DCACFEB4F3AC6599C – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23067_none_129abb204913e7b2\iexplore.exe
[2009/05/18 15:43:57 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=4CBA2F58668F2D5F3259CBE73E227F25 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20937_none_2debf43c36078f24\iexplore.exe
[2011/07/23 06:42:34 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=4D08A4234D645EFCB30605CC0BFA87F4 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23216_none_12cfce3e48ec3cf4\iexplore.exe
[2009/05/18 15:35:44 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=4DBD95312B1C96C5285D38F1D748CD4D – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20868_none_2dcc82dc361eff27\iexplore.exe
[2011/12/15 02:36:29 | 000,638,240 | —- | M] (Microsoft Corporation) MD5=54EF418BD99720658CCE24210799BD1A – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23286_none_12841eca4925008b\iexplore.exe
[2010/11/02 01:03:13 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=5AB037B17F8A87D052F5A88E0D29A3C8 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18999_none_11f2d8e9300c984e\iexplore.exe
[2008/01/20 21:23:50 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=5B92133D3E7FB2644677686305E29E81 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18000_none_2f62000919fe80c9\iexplore.exe
[2012/08/24 02:49:25 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=62188720CE27B982B4285C03163C9FB3 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20557_none_5918c60d04da998d\iexplore.exe
[2009/05/18 15:40:03 | 000,633,632 | —- | M] (Microsoft Corporation) MD5=6655B851D9EEF7C83395EE52D551B448 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20927_none_2df6c42835ff7333\iexplore.exe
[2013/01/08 17:42:06 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=698EB1E5F8C66344D97C00B5699E871D – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16464_none_58815877ebc7c9af\iexplore.exe
[2010/06/26 01:06:48 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7420BE0E7D3D1320054F7ACA0594953D – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18943_none_1222e6c92fe9748f\iexplore.exe
[2010/12/18 02:19:44 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7852371DA9EFBC17B645558E23780EAC – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23111_none_12cacae648f0c11a\iexplore.exe
[2011/09/30 18:07:49 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=7ACBBC85FCE4989B533220FC3B291633 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19154_none_1218f12f2ff0da40\iexplore.exe
[2011/05/28 02:09:20 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7EE10C5413AD7ED1AF9E8FAE1B58FC3E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23181_none_127f1b72492984b1\iexplore.exe
[2010/06/28 11:33:13 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=867D06F3C473F65921F5EDF35866FF14 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22720_none_2fd60860332c475f\iexplore.exe
[2012/02/20 04:02:12 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16421_none_58a99749ebaa0de6\iexplore.exe
[2010/11/02 02:13:47 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=92A17B0A89D14815AACC62CD190B6CE3 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23091_none_127449a04931a37b\iexplore.exe
[2012/06/28 20:00:47 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=93569D46D79F9756ED077156496AFE23 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16448_none_589af977ebb3f729\iexplore.exe
[2009/05/18 15:29:17 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=9437CA21CD48C9B6BFD6F5AC0143D251 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16643_none_2d5382911cf5aba1\iexplore.exe
[2011/02/22 02:18:28 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=9CE5543464432CA73134F170FA2BF823 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23143_none_12ac5bb64907479b\iexplore.exe
[2009/05/18 15:30:20 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=9F1427F203CA078005C9943800929640 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20823_none_2df2c11a360310b0\iexplore.exe
[2013/02/01 23:19:03 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=A285E1965C115031DA02B777EE9D7689 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20580_none_58f1544304f93bff\iexplore.exe
[2011/12/15 01:22:33 | 000,638,240 | —- | M] (Microsoft Corporation) MD5=AB18B8902C06954F8DFBAC5C6DC7E1E8 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19190_none_11e9b0573014e4a8\iexplore.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2009/03/08 16:09:24 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18702_none_124d22632fc9f126\iexplore.exe
[2010/06/28 11:19:40 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B6D7D54B736056991109F169737592C7 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18498_none_2f08baa51a403b96\iexplore.exe
[2010/12/18 01:28:35 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=B988D7F127B94BD5BF8356FE81B985C4 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19019_none_1249306b2fcbec08\iexplore.exe
[2012/06/02 03:51:58 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=BE967C74B89577B78FB57C061E12B04C – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20553_none_5914c4e504de3431\iexplore.exe
[2013/04/04 16:55:02 | 000,757,360 | —- | M] (Microsoft Corporation) MD5=C036AB1ED8BAC04FE4A349BA263077BB – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20593_none_58e9853504fea3f5\iexplore.exe
[2011/02/22 01:21:12 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=C1D36A2CBE0CEC4DF593DB1288CF586E – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19048_none_1227c05d2fe52684\iexplore.exe
[2011/11/03 01:23:19 | 000,638,240 | —- | M] (Microsoft Corporation) MD5=CCDB0B2D1F2E016966B1DB1097E24842 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19170_none_11ff502f3004acc6\iexplore.exe
[2012/10/08 03:22:05 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=CECB15F834FC2B4B150449717ADE18DD – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20562_none_5908f4af04e736cb\iexplore.exe
[2010/09/08 01:02:42 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=D5A730DFDEAE005373E62BC2A866E3BB – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18975_none_120477992ffffb10\iexplore.exe
[2009/05/18 15:43:57 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=D762642A109433EEDCD332B0A9511137 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16764_none_2d3ee4e91d04fa01\iexplore.exe
[2013/02/01 23:19:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=DDE5A0DFAF7C6370FB36402D7A746ED3 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16470_none_58728763ebd38044\iexplore.exe
[2012/06/28 18:35:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=EB4105348272018D096FEB655CD1608C – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20554_none_5915c52f04dd4d88\iexplore.exe
[2011/05/28 01:09:21 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=ED65737D70FDEAC29F738E77D2496EE5 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19088_none_11fc80ad30059648\iexplore.exe
[2013/01/08 16:32:42 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=F05982E56ABD835AA8DF260EEC873E5B – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20573_none_58ff250d04ee6c13\iexplore.exe
[2010/06/26 01:52:42 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=F05B3A2C6CB319DD1377AD566CF5ECE5 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23040_none_12a958f24909fe6f\iexplore.exe
[2009/05/18 15:49:59 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=F0B1CA517977BA2FF6DA33F1B966C488 – C:\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20996_none_2daa146a36391d73\iexplore.exe
[2012/11/13 21:19:28 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=F691418EE9A6344AEB5C1B0518FBF8AE – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20565_none_590bf58d04e482d0\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2006/11/02 07:41:15 | 000,016,384 | —- | M] (Microsoft Corporation) MD5=3CCDDDBC49DEACA370F39A9F0E146A1B – C:\Windows\winsxs\x86_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_3b55b11a57da5590\iexplore.exe.mui
[2012/02/20 04:02:13 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2012/02/20 04:02:13 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.1.8112.16421_en-us_52562cc123574ecd\iexplore.exe.mui
[2009/03/08 16:27:11 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Windows\winsxs\x86_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_8.0.6001.18702_en-us_207795706a90d6c1\iexplore.exe.mui

< MD5 for: SERVICES >
[2006/09/18 16:41:30 | 000,017,244 | —- | M] () MD5=9F534244B7F8F55D5C0BB498D8D481E7 – C:\Windows\System32\drivers\etc\services
[2006/09/18 16:41:30 | 000,017,244 | —- | M] () MD5=9F534244B7F8F55D5C0BB498D8D481E7 – C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.0.6000.16386_none_024e4071fa6fea95\services

< MD5 for: SERVICES.DAT >
[2013/01/23 17:22:39 | 000,001,494 | —- | M] () MD5=82F6D657C1FF1C56102204E254445825 – C:\JRT\services.dat

< MD5 for: SERVICES.EXE >
[2008/01/20 21:24:48 | 000,279,040 | —- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2009/04/11 01:27:59 | 000,279,552 | —- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B – C:\Windows\ERDNT\cache\services.exe
[2009/04/11 01:27:59 | 000,279,552 | —- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B – C:\Windows\System32\services.exe
[2009/04/11 01:27:59 | 000,279,552 | —- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2006/11/02 07:40:53 | 000,017,920 | —- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C – C:\Windows\System32\en-US\services.exe.mui
[2006/11/02 07:40:53 | 000,017,920 | —- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C – C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.0.6000.16386_en-us_67c6851b290a1ced\services.exe.mui

< MD5 for: SERVICES.LNK >
[2008/01/20 21:42:58 | 000,001,688 | —- | M] () MD5=C50AE46E57C3F3FB61A3B3A1E5D9C412 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2008/01/20 21:42:58 | 000,001,688 | —- | M] () MD5=C50AE46E57C3F3FB61A3B3A1E5D9C412 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOF >
[2006/09/18 16:46:11 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\System32\wbem\services.mof
[2006/09/18 16:46:11 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.mof
[2006/09/18 16:46:11 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.mof

< MD5 for: SERVICES.MSC >
[2006/11/02 07:41:29 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\System32\en-US\services.msc
[2006/09/18 16:29:40 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\System32\services.msc
[2006/11/02 07:41:29 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a2085506ff73b6e0\services.msc
[2006/09/18 16:29:40 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6001.18000_none_cf63e2a445bae4e3\services.msc

< MD5 for: WINLOGON.EXE >
[2009/04/11 01:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\ERDNT\cache\winlogon.exe
[2009/04/11 01:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\System32\winlogon.exe
[2009/04/11 01:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/20 21:24:49 | 000,314,880 | —- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2008/01/20 21:25:40 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\Windows\System32\en-US\winlogon.exe.mui
[2008/01/20 21:25:40 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6001.18000_en-us_caf8918b0416723a\winlogon.exe.mui
[2006/11/02 07:40:50 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=A1D2856F3EC3C86EBBF1442B0245A8B3 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c8c1cf8f072b6166\winlogon.exe.mui

< MD5 for: WINLOGON.EXE-8163EECC.PF >
[2013/05/29 12:02:51 | 000,035,160 | —- | M] () MD5=0D36FE4A17D0C601487A8393A31106C8 – C:\Windows\Prefetch\WINLOGON.EXE-8163EECC.pf

< MD5 for: WINLOGON.MOF >
[2006/09/18 16:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\System32\wbem\winlogon.mof
[2006/09/18 16:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.0.6000.16386_none_7e0207d478fccc94\winlogon.mof

< %SYSTEMDRIVE%\*.* >
[2006/09/18 16:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 01:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2009/05/18 15:28:11 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2013/01/25 11:35:49 | 000,013,623 | —- | M] () – C:\ComboFix.txt
[2006/09/18 16:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2011/09/07 12:57:44 | 000,000,000 | —- | M] () – C:\FileRecovery.log
[2012/02/28 13:03:39 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2012/02/28 13:03:39 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2013/05/28 13:52:26 | 3399,237,632 | -HS- | M] () – C:\pagefile.sys
[2012/09/04 07:55:42 | 000,000,414 | —- | M] () – C:\TDSSKiller.2.5.15.0_04.09.2012_07.55.37_log.txt
[2012/09/11 15:51:23 | 000,000,414 | —- | M] () – C:\TDSSKiller.2.5.15.0_11.09.2012_15.51.20_log.txt
[2013/05/25 18:43:38 | 000,069,442 | —- | M] () – C:\TDSSKiller.2.5.15.0_25.05.2013_18.43.05_log.txt
[2013/05/25 18:44:12 | 000,069,442 | —- | M] () – C:\TDSSKiller.2.5.15.0_25.05.2013_18.43.48_log.txt
[2013/01/14 14:06:33 | 000,259,570 | —- | M] () – C:\TDSSKiller.2.8.15.0_14.01.2013_13.01.19_log.txt
[2013/05/25 18:46:35 | 000,133,342 | —- | M] () – C:\TDSSKiller.2.8.15.0_25.05.2013_18.46.05_log.txt
[2012/09/04 07:57:29 | 000,132,120 | —- | M] () – C:\TDSSKiller.2.8.8.0_04.09.2012_07.56.29_log.txt
[2012/09/11 15:53:29 | 000,132,458 | —- | M] () – C:\TDSSKiller.2.8.8.0_11.09.2012_15.52.06_log.txt
[2009/05/18 15:31:49 | 000,000,349 | —- | M] () – C:\updatedatfix.log
[2008/08/26 07:37:52 | 000,000,458 | —- | M] () – C:\Windows Sidebar

< %systemroot%\Fonts\*.com >
[2006/11/02 07:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 07:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 07:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2010/12/21 12:24:56 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 16:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/04/20 12:23:48 | 000,315,904 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\hpfpp70w.dll
[2008/01/20 21:23:14 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 07:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2013/05/09 03:58:37 | 000,041,664 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr
[2010/11/10 02:28:46 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 21:43:21 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/20 22:14:18 | 016,846,848 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 22:14:08 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 22:14:18 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2013/05/20 08:00:33 | 000,000,434 | -HS- | M] () – C:\Users\jtmeserole\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/08/20 15:55:47 | 000,050,688 | —- | M] (Atribune.org) – C:\Users\jtmeserole\Desktop\ATF_Cleaner.exe
[2013/01/25 11:19:27 | 005,026,656 | R— | M] (Swearware) – C:\Users\jtmeserole\Desktop\ComboFix.exe
[2012/11/22 13:09:15 | 000,866,592 | —- | M] () – C:\Users\jtmeserole\Desktop\Norton_Removal_Tool.exe
[2013/01/22 22:22:25 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\jtmeserole\Desktop\OTL.exe
[2013/01/14 14:00:32 | 002,213,976 | —- | M] (Kaspersky Lab ZAO) – C:\Users\jtmeserole\Desktop\TDSSKiller.exe

< %PROGRAMFILES%\Common Files\*.* >
[2012/03/26 10:22:17 | 035,113,704 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\directx_9c_redist.exe

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2013-05-28 13:23:35

========== Alternate Data Streams ==========

@Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:10D98D98
@Alternate Data Stream - 206 bytes -> C:\ProgramData\Temp:A1D3FEF0
@Alternate Data Stream - 206 bytes -> C:\ProgramData\Temp:1663E41B
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:9CF728A6

< End of report >

jeffce

Post #2June 3, 2013, 10:11 PM UTC

Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

The fixes are specific to your problem and should only be used for the issues on this machine.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
Please be sure to subscribe to the topic if you have not already done so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your operating system and losing all your programs and data.

Having said that…. [external image: Posted Image] Let's get going!!
———-

Sorry for any delay….do you still need help?

computerwannabe

Post #3June 4, 2013, 2:31 AM UTC

Yes. My system is still redirecting and having popups in the corner of the screen. Thank you for being willing to help!

jeffce

Post #4June 4, 2013, 11:25 AM UTC

Hi,

Ok…since it has been a few days since the OTL log you posted was ran, let's get some updated information before we begin.

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any antivirus programs during the scan (If you have difficulty properly disabling your protective programs, refer to this link here )
Double click dds to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

[external image: Posted Image] Please download aswMBR to your desktop.

Double click the aswMBR icon to run it.
Click the Scan button to start scan.
If you are asked to update the Avast Virus database please allow it to do so.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

computerwannabe

Post #5June 4, 2013, 6:31 PM UTC last edited June 4, 2013, 6:34 PM UTC

DDS (Ver_2012-11-20.01) - NTFS_x86 Internet Explorer: 9.0.8112.16483 BrowserJavaVersion: 10.21.2 Run by [removed] at 13:24:41 on 2013-06-04 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1781 [GMT -5:00] . AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\SLsvc.exe C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\Windows\System32\spoolsv.exe C:\Program Files\LSI SoftModem\agrsmsvc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Windstream\Diagnostic Tools\HsdService.exe C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\taskeng.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Windows\System32\rundll32.exe C:\Windows\System32\wpcumi.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Windstream\Diagnostic Tools\DiagnosticTools.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\AVAST Software\Avast\AvastUI.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\ctfmon.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\System32\svchost.exe -k secsvcs . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll BHO: ZoneAlarm Security Engine Registrar: {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll TB: ZoneAlarm Security Engine: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [WPCUMI] c:\windows\system32\WpcUmi.exe mRun: [Windstream Service Agent.exe] "c:\program files\windstream\service agent\Windstream Service Agent.exe" /AUTORUN mRun: [DiagnosticTools.exe] "c:\program files\windstream\diagnostic tools\DiagnosticTools.exe" /AUTORUN mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui mRun: [ISW] uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-Explorer: NoDrives = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: Download all with Free Download Manager - c:\program files\free download manager\dlall.htm IE: Download selected with Free Download Manager - c:\program files\free download manager\dlselected.htm IE: Download video with Free Download Manager - c:\program files\free download manager\dlfvideo.htm IE: Download with Free Download Manager - c:\program files\free download manager\dllink.htm IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\mi1933~1\office14\ONBttnIE.dll/105 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll LSP: c:\windows\system32\wpclsp.dll Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab TCP: NameServer = 192.168.254.254 TCP: Interfaces\{DC2E7865-5ADB-466A-9527-0EFA9B7FF184} : DHCPNameServer = 192.168.254.254 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\27.0.1453.94\installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome . ================= FIREFOX =================== . FF - ProfilePath - c:\users\jtmeserole\appdata\roaming\mozilla\firefox\profiles\tkucy2ap.default\ FF - prefs.js: browser.search.defaulturl - Bing FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.ldsscripturemastery.net/en/ FF - prefs.js: network.proxy.type - 0 FF - plugin: c:\progra~1\mi1933~1\office14\NPAUTHZ.DLL FF - plugin: c:\progra~1\mi1933~1\office14\NPSPWRAP.DLL FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.145\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll FF - plugin: c:\program files\musicnotes\npmusicn.dll FF - plugin: c:\program files\musicnotes\NPSibelius.dll FF - plugin: c:\program files\wildtangent games\app\browserintegration\registered\0\NP_wtapp.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - plugin: c:\program files\windstream\service agent\nprpspa.dll FF - plugin: c:\users\jtmeserole\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll FF - plugin: c:\users\jtmeserole\appdata\roaming\mozilla\firefox\profiles\tkucy2ap.default\extensions\{000f1ea4-5e08-4564-a29b-29076f63a37a}\plugins\npsoe.dll FF - plugin: c:\users\jtmeserole\appdata\roaming\mozilla\firefox\profiles\tkucy2ap.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll FF - plugin: c:\windows\system32\adobe\director\np32dsw_1200112.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_202.dll FF - ExtSQL: 2013-04-30 10:09; [removed]; c:\users\jtmeserole\appdata\roaming\mozilla\firefox\profiles\tkucy2ap.default\extensions\[removed] FF - ExtSQL: 2013-05-25 22:30; [removed]; c:\program files\avast software\avast\webrep\FF FF - ExtSQL: 2013-05-25 23:04; {FFB96CC1-7EB3-449D-B827-DB661701C6BB}; c:\program files\checkpoint\zaforcefield\TrustChecker FF - ExtSQL: 2013-05-25 23:21; [removed]; c:\users\jtmeserole\appdata\roaming\mozilla\firefox\profiles\tkucy2ap.default\extensions\[removed] FF - ExtSQL: 2049-12-31 15:00; {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}; c:\users\jtmeserole\appdata\roaming\mozilla\firefox\profiles\tkucy2ap.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi FF - ExtSQL: !HIDDEN! 2010-09-23 05:02; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension FF - ExtSQL: !HIDDEN! 2011-03-28 10:30; [removed]; c:\program files\hp\digital imaging\smart web printing\MozillaAddOn3 . —- FIREFOX POLICIES —- FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?src=tb&tbid=base2013&Lan={dfltLng}&gu=4c9dcc0878344241ae325fc0935316fc&tu=10G90008F2B0008&sku=&tstsId=&ver=&&q= FF - user.js: extensions.zonealarm.id - 00eb19d50000000000000026184acf44 FF - user.js: extensions.zonealarm.appId - {C56C48A0-DA4E-46F6-9859-1553DC865F84} FF - user.js: extensions.zonealarm.instlDay - 15851 FF - user.js: extensions.zonealarm.vrsn - [removed] FF - user.js: extensions.zonealarm.vrsni - [removed] FF - user.js: extensions.zonealarm.vrsnTs - 1.8.11.1122:58:45 FF - user.js: extensions.zonealarm.prtnrId - checkpoint FF - user.js: extensions.zonealarm.prdct - zonealarm FF - user.js: extensions.zonealarm.aflt - 1001 FF - user.js: extensions.zonealarm.smplGrp - none FF - user.js: extensions.zonealarm.tlbrId - base2013 FF - user.js: extensions.zonealarm.instlRef - ZLN118211524287604-1001 FF - user.js: extensions.zonealarm.dfltLng - en FF - user.js: extensions.zonealarm.excTlbr - false FF - user.js: extensions.zonealarm.ffxUnstlRst - false FF - user.js: extensions.zonealarm.admin - false FF - user.js: extensions.zonealarm.autoRvrt - false FF - user.js: extensions.zonealarm.rvrt - true FF - user.js: extensions.zonealarm.dfltSrch - true FF - user.js: extensions.zonealarm.srchPrvdr - Search By ZoneAlarm FF - user.js: extensions.zonealarm.kw_url - hxxp://search.zonealarm.com/search?src=sp&tbid=base2013&Lan=en&gu=4c9dcc0878344241ae325fc0935316fc&tu=10G90008F2B0008&sku=&tstsId=&ver=&&q= FF - user.js: extensions.zonealarm.dnsErr - true FF - user.js: extensions.zonealarm.newTab - false . ============= SERVICES / DRIVERS =============== . R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [2013-5-25 49376] R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [2013-5-25 174664] R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-5-25 765736] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2013-5-25 368944] R1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\rsdrv.sys [2011-9-7 22312] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2013-5-25 29816] R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-5-25 66336] R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2013-5-25 46808] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] R2 HsdService;HsdService;c:\program files\windstream\diagnostic tools\HsdService.exe [2012-1-17 1393976] R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2012-11-22 27056] R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2012-11-22 497320] R2 RosettaStoneDaemon;RosettaStoneDaemon;c:\program files\rosettastoneltdservices\RosettaStoneDaemon.exe [2011-4-15 1646056] R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfslh.sys [2011-10-1 579944] R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplaylh.sys [2011-10-1 194408] R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvollh.sys [2011-10-1 19304] R3 sftvsa;Application Virtualization Service Agent;c:\program files\microsoft application virtualization client\sftvsa.exe [2011-10-1 219496] S1 ccSet_NSM;Norton Family Settings Manager;c:\windows\system32\drivers\nsm\0206000.02b\ccSetx86.sys [2012-11-11 134304] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 cvhsvc;Client Virtualization Handler;c:\program files\common files\microsoft shared\virtualization handler\CVHSVC.EXE [2012-1-4 822624] S2 NSM;Norton Family;c:\program files\norton family\engine\2.6.0.43\ccSvcHst.exe [2012-11-11 143928] S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files\norton pc checkup\engine\2.0.12.27\ccSvcHst.exe [2011-9-30 126392] S2 sftlist;Application Virtualization Client;"c:\program files\microsoft application virtualization client\sftlist.exe" –> c:\program files\microsoft application virtualization client\sftlist.exe [?] S3 dsiarhwprog;dsiarhwprog;c:\windows\system32\drivers\dsiarhwprog.sys [2011-8-14 29184] S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2011-1-26 39272] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352] S3 GamesAppService;GamesAppService;c:\program files\wildtangent games\app\GamesAppService.exe [2010-10-12 206072] S3 MHIKEY10;MHIKEY10;c:\windows\system32\drivers\MHIKEY10.sys [2008-5-27 50560] S3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirlh.sys [2011-10-1 21864] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S4 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files\norton pc checkup 3.0\SymcPCCULaunchSvc.exe [2012-9-22 132056] S4 ServicepointService;ServicepointService;c:\program files\windstream\service agent\ServicepointService.exe [2012-1-17 10315064] S4 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944] S4 UMVPFSrv;UMVPFSrv;c:\program files\common files\logishrd\lvmvfm\UMVPFSrv.exe [2011-8-19 450848] . =============== Created Last 30 ================ . 2013-06-04 17:05:13 60872 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{792e4558-f0f5-4475-a6d0-12240819cffd}\offreg.dll 2013-06-04 16:43:25 7016152 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{792e4558-f0f5-4475-a6d0-12240819cffd}\mpengine.dll 2013-05-26 04:04:52 ——– d—–w- c:\users\jtmeserole\appdata\roaming\CheckPoint 2013-05-26 04:00:54 221568 —-a-w- c:\windows\system32\drivers\netio.sys 2013-05-26 03:58:43 ——– d—–w- c:\program files\Check Point Software Technologies LTD 2013-05-26 03:58:37 ——– d—–w- c:\users\jtmeserole\appdata\roaming\Check Point Software Technologies LTD 2013-05-26 03:58:33 ——– d—–w- c:\program files\CheckPoint 2013-05-26 03:57:34 ——– d—–w- c:\programdata\CheckPoint 2013-05-26 03:30:35 765736 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2013-05-26 03:30:35 49376 —-a-w- c:\windows\system32\drivers\aswRvrt.sys 2013-05-26 03:30:35 174664 —-a-w- c:\windows\system32\drivers\aswVmm.sys 2013-05-26 03:30:34 66336 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2013-05-26 03:29:52 41664 —-a-w- c:\windows\avastSS.scr 2013-05-26 03:28:58 ——– d—–w- c:\program files\AVAST Software 2013-05-26 01:11:04 ——– d—–w- c:\programdata\AVAST Software 2013-05-26 00:30:56 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-05-24 19:07:05 262552 —-a-w- c:\program files\mozilla firefox\browser\components\browsercomps.dll 2013-05-20 13:13:58 ——– d—–w- c:\programdata\Wild Tangent 2013-05-20 13:00:19 ——– d—–w- c:\program files\WildTangent Games 2013-05-16 06:15:29 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2013-05-15 11:40:48 638328 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys 2013-05-15 11:40:48 37376 —-a-w- c:\windows\system32\cdd.dll 2013-05-15 11:40:44 2049024 —-a-w- c:\windows\system32\win32k.sys 2013-05-08 08:12:56 106088 —-a-w- c:\program files\internet explorer\plugins\nppdf32.dll . ==================== Find3M ==================== . 2013-05-15 12:08:14 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-05-15 12:08:14 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2013-05-02 07:06:08 238872 ——w- c:\windows\system32\MpSigStub.exe 2013-04-04 22:11:34 1800704 —-a-w- c:\windows\system32\jscript9.dll 2013-04-04 22:02:59 1427968 —-a-w- c:\windows\system32\inetcpl.cpl 2013-04-04 22:02:17 1129472 —-a-w- c:\windows\system32\wininet.dll 2013-04-04 21:58:51 142848 —-a-w- c:\windows\system32\ieUnatt.exe 2013-04-04 21:57:45 420864 —-a-w- c:\windows\system32\vbscript.dll 2013-04-04 19:50:32 22856 —-a-w- c:\windows\system32\drivers\mbam.sys 2013-03-11 13:25:50 3603816 —-a-w- c:\windows\system32\ntkrnlpa.exe 2013-03-11 13:25:50 3551080 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-03-09 03:45:04 49152 —-a-w- c:\windows\system32\csrsrv.dll 2013-03-09 01:28:08 64000 —-a-w- c:\windows\system32\smss.exe 2013-03-08 13:40:07 861088 —-a-w- c:\windows\system32\npDeployJava1.dll 2013-03-08 13:40:07 782240 —-a-w- c:\windows\system32\deployJava1.dll 2013-03-08 03:53:50 376320 —-a-w- c:\windows\system32\winsrv.dll 2013-03-08 03:52:22 2067968 —-a-w- c:\windows\system32\mstscax.dll 2012-03-26 15:22:17 35113704 —-a-w- c:\program files\common files\directx_9c_redist.exe . ============= FINISH: 13:25:14.93 ===============

Attachments:

📎attach.txt

computerwannabe

Post #6June 4, 2013, 7:16 PM UTC

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-05-10 12:34:37 —————————– 12:34:37.199 OS Version: Windows 6.0.6002 Service Pack 2 12:34:37.199 Number of processors: 2 586 0x203 12:34:37.200 ComputerName: JTMESEROLE-PC UserName: jtmeserole 12:34:38.753 Initialize success 12:34:48.966 AVAST engine defs: 12051000 12:37:40.842 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000063 12:37:40.844 Disk 0 Vendor: WDC_WD32 01.0 Size: 305245MB BusType: 3 12:37:40.860 Disk 0 MBR read successfully 12:37:40.862 Disk 0 MBR scan 12:37:40.866 Disk 0 unknown MBR code 12:37:40.868 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 293688 MB offset 63 12:37:40.899 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 11554 MB offset 601473600 12:37:40.907 Disk 0 scanning sectors +625137345 12:37:40.969 Disk 0 scanning C:\Windows\system32\drivers 12:37:50.179 Service scanning 12:38:12.324 Modules scanning 12:38:17.095 Disk 0 trace - called modules: 12:38:17.108 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys tcpip.sys NETIO.SYS 12:38:17.437 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85ddc2a0] 12:38:17.441 3 CLASSPNP.SYS[807268b3] -> nt!IofCallDriver -> [0x85840700] 12:38:17.444 5 acpi.sys[806176bc] -> nt!IofCallDriver -> \Device\00000063[0x85446710] 12:38:18.582 AVAST engine scan C:\Windows 12:38:21.482 AVAST engine scan C:\Windows\system32 12:41:21.612 AVAST engine scan C:\Windows\system32\drivers 12:41:32.953 AVAST engine scan C:\Users\jtmeserole 12:54:31.682 AVAST engine scan C:\ProgramData 13:02:34.101 Scan finished successfully 13:36:56.274 Disk 0 MBR has been saved successfully to "C:\Users\jtmeserole\Documents\MBR.dat" 13:36:56.282 The log file has been saved successfully to "C:\Users\jtmeserole\Documents\aswMBR.txt" aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software Run date: 2013-06-04 13:38:03 —————————– 13:38:03.220 OS Version: Windows 6.0.6002 Service Pack 2 13:38:03.220 Number of processors: 2 586 0x203 13:38:03.221 ComputerName: JTMESEROLE-PC UserName: jtmeserole 13:38:04.366 Initialize success 13:38:05.386 AVAST engine defs: 13060400 13:38:39.460 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005e 13:38:39.460 Disk 0 Vendor: WDC_WD32 01.0 Size: 305245MB BusType: 3 13:38:39.663 Disk 0 MBR read successfully 13:38:39.663 Disk 0 MBR scan 13:38:39.663 Disk 0 unknown MBR code 13:38:39.663 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 293688 MB offset 63 13:38:39.710 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 11554 MB offset 601473600 13:38:39.710 Disk 0 scanning sectors +625137345 13:38:39.819 Disk 0 scanning C:\Windows\system32\drivers 13:38:55.325 Service scanning 13:39:14.560 Modules scanning 13:39:31.143 Disk 0 trace - called modules: 13:39:31.159 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys 13:39:31.174 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86200ac8] 13:39:31.174 3 CLASSPNP.SYS[807248b3] -> nt!IofCallDriver -> [0x844757e8] 13:39:31.174 5 acpi.sys[806156bc] -> nt!IofCallDriver -> \Device\0000005e[0x84472958] 13:39:31.907 AVAST engine scan C:\Windows 13:39:40.253 AVAST engine scan C:\Windows\system32 13:41:40.470 AVAST engine scan C:\Windows\system32\drivers 13:41:51.998 AVAST engine scan C:\Users\jtmeserole 14:10:15.455 AVAST engine scan C:\ProgramData 14:14:11.602 Disk 0 MBR has been saved successfully to "C:\Users\jtmeserole\Documents\MBR.dat" 14:14:11.602 The log file has been saved successfully to "C:\Users\jtmeserole\Documents\aswMBR.txt"

jeffce

Post #7June 4, 2013, 7:36 PM UTC

[external image: Posted Image] AdwCleaner

Please download AdwCleaner by Xplode onto your desktop.

Double click on AdwCleaner.exe to run the tool.
Click on Search.
A logfile will automatically open after the scan has finished.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[R1].txt as well.

———-

computerwannabe

Post #8June 4, 2013, 11:37 PM UTC

# AdwCleaner v2.301 - Logfile created 06/04/2013 at 18:36:47 # Updated 16/05/2013 by Xplode # Operating system : Windows Vista ™ Home Premium Service Pack 2 (32 bits) # User : jtmeserole - JTMESEROLE-PC # Boot Mode : Normal # Running from : C:\Users\jtmeserole\Downloads\AdwCleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** File Found : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml File Found : C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\safesearch.xml File Found : C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\zonealarm.xml File Found : C:\Users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\searchplugins\safesearch.xml File Found : C:\Users\s\AppData\Roaming\Mozilla\Firefox\Profiles\ls5qf5ym.default\searchplugins\safesearch.xml File Found : C:\Users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\searchplugins\safesearch.xml Folder Found : C:\ProgramData\ParetoLogic Folder Found : C:\Users\jtmeserole\AppData\Local\PackageAware Folder Found : C:\Users\jtmeserole\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar Folder Found : C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\jetpack Folder Found : C:\Users\Nice\AppData\LocalLow\Conduit Folder Found : C:\Users\Nice\AppData\LocalLow\ConduitEngine Folder Found : C:\Users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\[removed] Folder Found : C:\Users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\[removed] Folder Found : C:\Users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\[removed] Folder Found : C:\Users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\[removed] Folder Found : C:\Users\s\AppData\LocalLow\Conduit Folder Found : C:\Users\s\AppData\LocalLow\ConduitEngine Folder Found : C:\Users\s\AppData\Roaming\Mozilla\Firefox\Profiles\ls5qf5ym.default\extensions\[removed] Folder Found : C:\Users\s\AppData\Roaming\Mozilla\Firefox\Profiles\ls5qf5ym.default\extensions\[removed] Folder Found : C:\Users\s\AppData\Roaming\Mozilla\Firefox\Profiles\ls5qf5ym.default\extensions\[removed] Folder Found : C:\Users\s\AppData\Roaming\Mozilla\Firefox\Profiles\ls5qf5ym.default\extensions\[removed] Folder Found : C:\Users\safe kids\AppData\LocalLow\Conduit Folder Found : C:\Users\safe kids\AppData\LocalLow\ConduitEngine Folder Found : C:\Users\safe kids\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar Folder Found : C:\Users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\[removed] Folder Found : C:\Users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\[removed] Folder Found : C:\Users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\[removed] Folder Found : C:\Users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\[removed] Folder Found : C:\Users\school acct\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar Folder Found : C:\Users\What\AppData\LocalLow\Conduit Folder Found : C:\Users\What\AppData\LocalLow\ConduitEngine Folder Found : C:\Users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\[removed] Folder Found : C:\Users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\[removed] Folder Found : C:\Users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\[removed] Folder Found : C:\Users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\[removed] ***** [Registry] ***** Key Found : HKCU\Software\AppDataLow\Software\NCH_EN Key Found : HKCU\Software\AppDataLow\Toolbar Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\IGearSettings Key Found : HKCU\Software\InstallCore Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{889DF117-14D1-44EE-9F31-C5FB5D47F68B} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\NCH_EN Toolbar Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB69577-088B-4004-9ED8-FF5BCC83A039} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC99A798-FD3D-4AB4-969E-6071612524F9} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Found : HKCU\Software\YahooPartnerToolbar Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Key Found : HKLM\SOFTWARE\Classes\AppID\{1FC41815-FA4C-4F8B-B143-2C045C8EA2FC} Key Found : HKLM\SOFTWARE\Classes\AppID\{21493C1F-D071-496A-9C27-450578888291} Key Found : HKLM\SOFTWARE\Classes\AppID\{403A885F-CB00-40C1-BDC1-EB09053194F7} Key Found : HKLM\SOFTWARE\Classes\AppID\{55C1727F-5535-4C2A-9601-8C2458608B48} Key Found : HKLM\SOFTWARE\Classes\AppID\{A7DDCBDE-5C86-415C-8A37-763AE183E7E4} Key Found : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D} Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Found : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0} Key Found : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL Key Found : HKLM\SOFTWARE\Classes\AppID\esrv.EXE Key Found : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr Key Found : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1 Key Found : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Found : HKLM\SOFTWARE\Classes\CLSID\{125B7A09-B405-46FB-95FB-96CF6B72992D} Key Found : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2} Key Found : HKLM\SOFTWARE\Classes\CLSID\{2656B92B-0207-4AFB-BEBF-F5FD231ECD39} Key Found : HKLM\SOFTWARE\Classes\CLSID\{27BF8F8D-58B8-D41C-F913-B7EEB57EF6F6} Key Found : HKLM\SOFTWARE\Classes\CLSID\{34CB0620-E343-4772-BBA8-D3074BC47516} Key Found : HKLM\SOFTWARE\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581} Key Found : HKLM\SOFTWARE\Classes\CLSID\{412CD209-DDA4-4275-8C79-55F1C93FBD47} Key Found : HKLM\SOFTWARE\Classes\CLSID\{59570C1F-B692-48C9-91B4-7809E6945287} Key Found : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4} Key Found : HKLM\SOFTWARE\Classes\CLSID\{63A0F7FA-2C95-4D7E-AF25-EFCC303D20A1} Key Found : HKLM\SOFTWARE\Classes\CLSID\{6559E502-6EE1-46B8-A83C-F3A45BDA23EE} Key Found : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36} Key Found : HKLM\SOFTWARE\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839} Key Found : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4} Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D} Key Found : HKLM\SOFTWARE\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F} Key Found : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323} Key Found : HKLM\SOFTWARE\Classes\CLSID\{A2858A72-758F-4486-B6A1-7F1DCC0924FA} Key Found : HKLM\SOFTWARE\Classes\CLSID\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD} Key Found : HKLM\SOFTWARE\Classes\CLSID\{C63CA8A4-AB4E-49E5-A6C0-33FC86D80205} Key Found : HKLM\SOFTWARE\Classes\CLSID\{C6A7847E-8931-4A9A-B4EF-72A91E3CCF4D} Key Found : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B} Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC99A798-FD3D-4AB4-969E-6071612524F9} Key Found : HKLM\SOFTWARE\Classes\CLSID\{DD0F1D24-E250-4E93-966C-65615720AEFB} Key Found : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Found : HKLM\SOFTWARE\Classes\CLSID\{EC1277BB-1C71-4C0D-BA6D-BFEA16E773A6} Key Found : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA} Key Found : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93} Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5} Key Found : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93} Key Found : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B} Key Found : HKLM\SOFTWARE\Classes\Interface\{5E8CD073-21DF-4117-9BBD-D03C45D36CAE} Key Found : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982} Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3} Key Found : HKLM\SOFTWARE\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA} Key Found : HKLM\SOFTWARE\Classes\Interface\{CA1CE38C-F04C-471F-B9F3-083C58165C10} Key Found : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377} Key Found : HKLM\SOFTWARE\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2} Key Found : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB} Key Found : HKLM\SOFTWARE\Classes\ScriptHost.Tool Key Found : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1 Key Found : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{252C2315-CCE0-4446-8DA7-C00292A690BA} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{403A885F-CB00-40C1-BDC1-EB09053194F7} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{55C1727F-5535-4C2A-9601-8C2458608B48} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Found : HKLM\Software\Conduit Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2C385B13-1BC5-4BBD-A98D-6BF82FEE0D6C} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C08BE7B3-3D10-4DDE-AFB2-C65EC5661FC5} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{125B7A09-B405-46FB-95FB-96CF6B72992D} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{872F3C0B-4462-424C-BB9F-74C6899B9F92} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB69577-088B-4004-9ED8-FF5BCC83A039} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966 Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar Key Found : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi Key Found : HKLM\Software\NCH_EN Key Found : HKLM\SOFTWARE\Software ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16483 [OK] Registry is clean. -\\ Mozilla Firefox v21.0 (en-US) File : C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\prefs.js Found : user_pref("browser.search.defaultenginename", "AVG Secure Search"); Found : user_pref("extensions.crossriderapp498.498.js", "\n\nvar _GPL_PID = 18;\n\n(function($) { \n\n $.[…] File : C:\Users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\prefs.js Found : user_pref("extensions.crossriderapp2258.2258.InstallationTime", 1340820306); Found : user_pref("extensions.crossriderapp2258.2258.active", true); Found : user_pref("extensions.crossriderapp2258.2258.addressbar", ""); Found : user_pref("extensions.crossriderapp2258.2258.affid", "0"); Found : user_pref("extensions.crossriderapp2258.2258.certdomaininstaller", ""); Found : user_pref("extensions.crossriderapp2258.2258.changeprevious", false); Found : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[…] Found : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.value", "1340820306"); Found : user_pref("extensions.crossriderapp2258.2258.description", "I Want This!"); Found : user_pref("extensions.crossriderapp2258.2258.domain", ""); Found : user_pref("extensions.crossriderapp2258.2258.emailsig", ""); Found : user_pref("extensions.crossriderapp2258.2258.enablesearch", false); Found : user_pref("extensions.crossriderapp2258.2258.exposesites", ""); Found : user_pref("extensions.crossriderapp2258.2258.fbremoteurl", ""); Found : user_pref("extensions.crossriderapp2258.2258.group", 0); Found : user_pref("extensions.crossriderapp2258.2258.homepage", ""); Found : user_pref("extensions.crossriderapp2258.2258.iframe", false); Found : user_pref("extensions.crossriderapp2258.2258.manifesturl", ""); Found : user_pref("extensions.crossriderapp2258.2258.name", "I Want This"); Found : user_pref("extensions.crossriderapp2258.2258.newtab", ""); Found : user_pref("extensions.crossriderapp2258.2258.opensearch", ""); Found : user_pref("extensions.crossriderapp2258.2258.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[…] Found : user_pref("extensions.crossriderapp2258.2258.premium", true); Found : user_pref("extensions.crossriderapp2258.2258.publisher", "215 Apps"); Found : user_pref("extensions.crossriderapp2258.2258.searchstatus", 0); Found : user_pref("extensions.crossriderapp2258.2258.setnewtab", false); Found : user_pref("extensions.crossriderapp2258.2258.settingsurl", ""); Found : user_pref("extensions.crossriderapp2258.2258.thankyou", ""); Found : user_pref("extensions.crossriderapp2258.2258.updateinterval", 360); Found : user_pref("extensions.crossriderapp2258.2258.ver", 0); Found : user_pref("extensions.crossriderapp2258.73407340.InstallationTime", 1340820306); Found : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.expiration", "Fri Feb 01 20[…] Found : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.value", "1340820306"); Found : user_pref("extensions.crossriderapp2258.adsOldValue", -1); Found : user_pref("extensions.crossriderapp2258.bic", "1382f1e3915108738249eec7de40af8b"); Found : user_pref("extensions.crossriderapp2258.firstrun", false); Found : user_pref("extensions.crossriderapp2258.installationdate", 1340820306); Found : user_pref("extensions.crossriderapp2258.lastcheck", 22837858); Found : user_pref("extensions.crossriderapp2258.lastcheckitem", 22837858); Found : user_pref("extensions.crossriderapp2258.modetype", "production"); Found : user_pref("extensions.crossriderapp2258.statsDailyCounter", 12); Found : user_pref("extensions.enabledAddons", "crossriderapp2258%40crossrider.com:0.91.143,%7B972ce4c6-7e08-[…] File : C:\Users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\prefs.js Found : user_pref("extensions.crossriderapp2258.adsOldValue", -1); File : C:\Users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\prefs.js Found : user_pref("extensions.crossriderapp2258.adsOldValue", -1); File : C:\Users\s\AppData\Roaming\Mozilla\Firefox\Profiles\ls5qf5ym.default\prefs.js Found : user_pref("extensions.crossriderapp2258.adsOldValue", -1); File : C:\Users\school acct\AppData\Roaming\Mozilla\Firefox\Profiles\aoc0pg2k.default\prefs.js [OK] File is clean. -\\ Google Chrome v27.0.1453.94 File : C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Preferences Found [l.2678] : homepage = "hxxp://isearch.avg.com/?cid={9BC737C8-EB9C-41CA-854D-94C8D408C410}&mid=a0c880af8f7247d0bea3d16f5eae26b7-4b869c74173af2f9aa392fa149498c5861dbbba5&lang=en&ds=ft011&pr=sa&d=2012-06-18 17:44:13&v=11.1.0.7&sap=hp", File : C:\Users\safe kids\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. File : C:\Users\school acct\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [17279 octets] - [04/06/2013 18:36:47] ########## EOF - C:\AdwCleaner[R1].txt - [17340 octets] ##########

jeffce

Post #9June 4, 2013, 11:58 PM UTC

Hi,

Good job!

[external image: Posted Image] AdwCleaner

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
You will be prompted to restart your computer. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

———-

Once finished with this, please let me know how your system is running now?

computerwannabe

Post #10June 5, 2013, 6:06 AM UTC

The box in the corner still shows up and the redirecting still happens, but less often. (When I clicked on the button to reply to your post it sent me to a Norton ad instead of opening a reply box the first time.) # AdwCleaner v2.301 - Logfile created 06/05/2013 at 00:44:59 # Updated 16/05/2013 by Xplode # Operating system : Windows Vista ™ Home Premium Service Pack 2 (32 bits) # User : jtmeserole - JTMESEROLE-PC # Boot Mode : Normal # Running from : C:\Users\jtmeserole\Downloads\AdwCleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\Users\school acct\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml File Deleted : C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\safesearch.xml File Deleted : C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\zonealarm.xml File Deleted : C:\Users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\searchplugins\safesearch.xml File Deleted : C:\Users\s\AppData\Roaming\Mozilla\Firefox\Profiles\ls5qf5ym.default\searchplugins\safesearch.xml File Deleted : C:\Users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\searchplugins\safesearch.xml Folder Deleted : C:\ProgramData\ParetoLogic Folder Deleted : C:\Users\jtmeserole\AppData\Local\PackageAware Folder Deleted : C:\Users\jtmeserole\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar Folder Deleted : C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\jetpack Folder Deleted : C:\Users\Nice\AppData\LocalLow\Conduit Folder Deleted : C:\Users\Nice\AppData\LocalLow\ConduitEngine Folder Deleted : C:\Users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\[removed] Folder Deleted : C:\Users\s\AppData\LocalLow\Conduit Folder Deleted : C:\Users\s\AppData\LocalLow\ConduitEngine Folder Deleted : C:\Users\s\AppData\Roaming\Mozilla\Firefox\Profiles\ls5qf5ym.default\extensions\[removed] Folder Deleted : C:\Users\safe kids\AppData\LocalLow\Conduit Folder Deleted : C:\Users\safe kids\AppData\LocalLow\ConduitEngine Folder Deleted : C:\Users\safe kids\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar Folder Deleted : C:\Users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\[removed] Folder Deleted : C:\Users\What\AppData\LocalLow\Conduit Folder Deleted : C:\Users\What\AppData\LocalLow\ConduitEngine Folder Deleted : C:\Users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\[removed] ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\NCH_EN Key Deleted : HKCU\Software\AppDataLow\Toolbar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\IGearSettings Key Deleted : HKCU\Software\InstallCore Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{889DF117-14D1-44EE-9F31-C5FB5D47F68B} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\NCH_EN Toolbar Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB69577-088B-4004-9ED8-FF5BCC83A039} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC99A798-FD3D-4AB4-969E-6071612524F9} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Deleted : HKCU\Software\YahooPartnerToolbar Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FC41815-FA4C-4F8B-B143-2C045C8EA2FC} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{21493C1F-D071-496A-9C27-450578888291} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{403A885F-CB00-40C1-BDC1-EB09053194F7} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{55C1727F-5535-4C2A-9601-8C2458608B48} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{A7DDCBDE-5C86-415C-8A37-763AE183E7E4} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0} Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1 Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{125B7A09-B405-46FB-95FB-96CF6B72992D} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2656B92B-0207-4AFB-BEBF-F5FD231ECD39} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{27BF8F8D-58B8-D41C-F913-B7EEB57EF6F6} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{34CB0620-E343-4772-BBA8-D3074BC47516} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{412CD209-DDA4-4275-8C79-55F1C93FBD47} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{59570C1F-B692-48C9-91B4-7809E6945287} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{63A0F7FA-2C95-4D7E-AF25-EFCC303D20A1} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6559E502-6EE1-46B8-A83C-F3A45BDA23EE} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A2858A72-758F-4486-B6A1-7F1DCC0924FA} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C63CA8A4-AB4E-49E5-A6C0-33FC86D80205} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C6A7847E-8931-4A9A-B4EF-72A91E3CCF4D} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC99A798-FD3D-4AB4-969E-6071612524F9} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DD0F1D24-E250-4E93-966C-65615720AEFB} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EC1277BB-1C71-4C0D-BA6D-BFEA16E773A6} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5E8CD073-21DF-4117-9BBD-D03C45D36CAE} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA1CE38C-F04C-471F-B9F3-083C58165C10} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB} Key Deleted : HKLM\SOFTWARE\Classes\ScriptHost.Tool Key Deleted : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{252C2315-CCE0-4446-8DA7-C00292A690BA} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{403A885F-CB00-40C1-BDC1-EB09053194F7} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{55C1727F-5535-4C2A-9601-8C2458608B48} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2C385B13-1BC5-4BBD-A98D-6BF82FEE0D6C} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C08BE7B3-3D10-4DDE-AFB2-C65EC5661FC5} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{125B7A09-B405-46FB-95FB-96CF6B72992D} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{872F3C0B-4462-424C-BB9F-74C6899B9F92} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB69577-088B-4004-9ED8-FF5BCC83A039} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966 Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi Key Deleted : HKLM\Software\NCH_EN Key Deleted : HKLM\SOFTWARE\Software ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16483 [OK] Registry is clean. -\\ Mozilla Firefox v21.0 (en-US) File : C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\prefs.js C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\user.js … Deleted ! Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search"); Deleted : user_pref("extensions.crossriderapp498.498.js", "\n\nvar _GPL_PID = 18;\n\n(function($) { \n\n $.[…] File : C:\Users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\prefs.js Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationTime", 1340820306); Deleted : user_pref("extensions.crossriderapp2258.2258.active", true); Deleted : user_pref("extensions.crossriderapp2258.2258.addressbar", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.affid", "0"); Deleted : user_pref("extensions.crossriderapp2258.2258.certdomaininstaller", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.changeprevious", false); Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[…] Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.value", "1340820306"); Deleted : user_pref("extensions.crossriderapp2258.2258.description", "I Want This!"); Deleted : user_pref("extensions.crossriderapp2258.2258.domain", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.emailsig", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.enablesearch", false); Deleted : user_pref("extensions.crossriderapp2258.2258.exposesites", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.fbremoteurl", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.group", 0); Deleted : user_pref("extensions.crossriderapp2258.2258.homepage", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.iframe", false); Deleted : user_pref("extensions.crossriderapp2258.2258.manifesturl", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.name", "I Want This"); Deleted : user_pref("extensions.crossriderapp2258.2258.newtab", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.opensearch", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[…] Deleted : user_pref("extensions.crossriderapp2258.2258.premium", true); Deleted : user_pref("extensions.crossriderapp2258.2258.publisher", "215 Apps"); Deleted : user_pref("extensions.crossriderapp2258.2258.searchstatus", 0); Deleted : user_pref("extensions.crossriderapp2258.2258.setnewtab", false); Deleted : user_pref("extensions.crossriderapp2258.2258.settingsurl", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.thankyou", ""); Deleted : user_pref("extensions.crossriderapp2258.2258.updateinterval", 360); Deleted : user_pref("extensions.crossriderapp2258.2258.ver", 0); Deleted : user_pref("extensions.crossriderapp2258.73407340.InstallationTime", 1340820306); Deleted : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.expiration", "Fri Feb 01 20[…] Deleted : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.value", "1340820306"); Deleted : user_pref("extensions.crossriderapp2258.adsOldValue", -1); Deleted : user_pref("extensions.crossriderapp2258.bic", "1382f1e3915108738249eec7de40af8b"); Deleted : user_pref("extensions.crossriderapp2258.firstrun", false); Deleted : user_pref("extensions.crossriderapp2258.installationdate", 1340820306); Deleted : user_pref("extensions.crossriderapp2258.lastcheck", 22837858); Deleted : user_pref("extensions.crossriderapp2258.lastcheckitem", 22837858); Deleted : user_pref("extensions.crossriderapp2258.modetype", "production"); Deleted : user_pref("extensions.crossriderapp2258.statsDailyCounter", 12); Deleted : user_pref("extensions.enabledAddons", "crossriderapp2258%40crossrider.com:0.91.143,%7B972ce4c6-7e08-[…] File : C:\Users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\prefs.js Deleted : user_pref("extensions.crossriderapp2258.adsOldValue", -1); File : C:\Users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\prefs.js Deleted : user_pref("extensions.crossriderapp2258.adsOldValue", -1); File : C:\Users\s\AppData\Roaming\Mozilla\Firefox\Profiles\ls5qf5ym.default\prefs.js Deleted : user_pref("extensions.crossriderapp2258.adsOldValue", -1); File : C:\Users\school acct\AppData\Roaming\Mozilla\Firefox\Profiles\aoc0pg2k.default\prefs.js [OK] File is clean. -\\ Google Chrome v27.0.1453.94 File : C:\Users\jtmeserole\AppData\Local\Google\Chrome\User Data\Default\Preferences Deleted [l.2678] : homepage = "hxxp://isearch.avg.com/?cid={9BC737C8-EB9C-41CA-854D-94C8D408C410}&mid=a0c880af8f724[…] File : C:\Users\safe kids\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. File : C:\Users\school acct\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [17410 octets] - [04/06/2013 18:36:47] AdwCleaner[S1].txt - [16076 octets] - [05/06/2013 00:44:59] ########## EOF - C:\AdwCleaner[S1].txt - [16137 octets] ##########

jeffce

Post #11June 5, 2013, 11:32 AM UTC

ComboFix

Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**
If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

computerwannabe

Post #12June 5, 2013, 7:47 PM UTC

I accidentally ran it from the download folder and so I reran it from the desktop. The second report is from the first run.

Sorry.

ComboFix 13-06-05.04 - jtmeserole 06/05/2013 14:00:38.8.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1469 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-05-05 to 2013-06-05 )))))))))))))))))))))))))))))))
.
.
2013-06-05 19:08 . 2013-06-05 19:08 ——– d—–w- c:\users\What\AppData\Local\temp
2013-06-05 19:08 . 2013-06-05 19:08 ——– d—–w- c:\users\school acct\AppData\Local\temp
2013-06-05 19:08 . 2013-06-05 19:08 ——– d—–w- c:\users\safe kids\AppData\Local\temp
2013-06-05 19:08 . 2013-06-05 19:08 ——– d—–w- c:\users\s\AppData\Local\temp
2013-06-05 19:08 . 2013-06-05 19:08 ——– d—–w- c:\users\Public\AppData\Local\temp
2013-06-05 19:08 . 2013-06-05 19:08 ——– d—–w- c:\users\Nice\AppData\Local\temp
2013-06-05 19:08 . 2013-06-05 19:08 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-06-05 05:45 . 2013-06-05 05:45 137 —-a-w- c:\windows\DeleteOnReboot.bat
2013-06-04 16:43 . 2013-05-13 06:19 7016152 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{792E4558-F0F5-4475-A6D0-12240819CFFD}\mpengine.dll
2013-06-02 03:41 . 2013-06-02 03:41 ——– d—–w- c:\users\school acct\AppData\Local\Microsoft Games
2013-06-01 14:03 . 2013-06-01 14:03 ——– d—–w- c:\users\school acct\AppData\Roaming\CheckPoint
2013-05-28 14:16 . 2013-06-05 05:45 ——– d—–w- c:\users\safe kids\AppData\Roaming\CheckPoint
2013-05-26 04:04 . 2013-06-05 05:47 ——– d—–w- c:\users\jtmeserole\AppData\Roaming\CheckPoint
2013-05-26 04:00 . 2010-04-05 20:00 221568 —-a-w- c:\windows\system32\drivers\netio.sys
2013-05-26 03:58 . 2013-05-26 03:58 ——– d—–w- c:\program files\Check Point Software Technologies LTD
2013-05-26 03:58 . 2013-05-26 03:58 ——– d—–w- c:\users\jtmeserole\AppData\Roaming\Check Point Software Technologies LTD
2013-05-26 03:58 . 2013-05-26 04:03 ——– d—–w- c:\program files\CheckPoint
2013-05-26 03:57 . 2013-05-26 03:57 ——– d—–w- c:\programdata\CheckPoint
2013-05-26 03:30 . 2013-05-09 08:59 29816 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-05-26 03:30 . 2013-05-09 08:59 765736 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2013-05-26 03:30 . 2013-05-09 08:59 56080 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2013-05-26 03:30 . 2013-05-09 08:59 49376 —-a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-05-26 03:30 . 2013-05-09 08:59 368944 —-a-w- c:\windows\system32\drivers\aswSP.sys
2013-05-26 03:30 . 2013-05-09 08:59 174664 —-a-w- c:\windows\system32\drivers\aswVmm.sys
2013-05-26 03:30 . 2013-05-09 08:59 49760 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2013-05-26 03:30 . 2013-05-09 08:59 66336 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-26 03:30 . 2013-05-09 08:58 229648 —-a-w- c:\windows\system32\aswBoot.exe
2013-05-26 03:29 . 2013-05-09 08:58 41664 —-a-w- c:\windows\avastSS.scr
2013-05-26 03:28 . 2013-05-26 03:28 ——– d—–w- c:\program files\AVAST Software
2013-05-26 01:11 . 2013-05-26 03:28 ——– d—–w- c:\programdata\AVAST Software
2013-05-26 00:31 . 2013-05-26 00:31 ——– d—–w- c:\program files\Common Files\Java
2013-05-26 00:30 . 2013-04-04 10:35 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-05-20 13:13 . 2013-05-20 13:13 ——– d—–w- c:\programdata\Wild Tangent
2013-05-20 13:00 . 2013-05-20 13:00 ——– d—–w- c:\program files\WildTangent Games
2013-05-16 06:15 . 2013-05-05 19:12 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2013-05-15 11:40 . 2013-04-15 14:20 638328 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 11:40 . 2013-04-13 10:56 37376 —-a-w- c:\windows\system32\cdd.dll
2013-05-15 11:40 . 2013-04-09 01:36 2049024 —-a-w- c:\windows\system32\win32k.sys
2013-05-08 08:12 . 2013-05-08 08:12 106088 —-a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-15 12:08 . 2012-06-14 13:07 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-15 12:08 . 2011-06-30 17:17 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-02 07:06 . 2012-09-26 12:21 238872 ——w- c:\windows\system32\MpSigStub.exe
2013-04-04 19:50 . 2010-11-26 20:52 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2013-03-11 13:25 . 2013-04-09 17:40 3603816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-11 13:25 . 2013-04-09 17:40 3551080 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-03-09 03:45 . 2013-04-09 17:40 49152 —-a-w- c:\windows\system32\csrsrv.dll
2013-03-09 01:28 . 2013-04-09 17:40 64000 —-a-w- c:\windows\system32\smss.exe
2013-03-08 13:40 . 2013-01-18 03:28 861088 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-03-08 13:40 . 2010-09-20 21:21 782240 —-a-w- c:\windows\system32\deployJava1.dll
2013-03-08 03:53 . 2013-04-09 17:40 376320 —-a-w- c:\windows\system32\winsrv.dll
2013-03-08 03:52 . 2013-04-09 17:40 2067968 —-a-w- c:\windows\system32\mstscax.dll
2012-03-26 15:22 . 2012-03-26 15:22 35113704 —-a-w- c:\program files\Common Files\directx_9c_redist.exe
2010-03-31 16:09 . 2013-05-24 19:06 10437264 —-a-w- c:\program files\mozilla firefox\plugins\PDFNetC.dll
2010-04-08 18:36 . 2013-05-24 19:06 107760 —-a-w- c:\program files\mozilla firefox\plugins\ScorchPDFWrapper.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 121968 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-08 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-08 92704]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"Windstream Service Agent.exe"="c:\program files\Windstream\Service Agent\Windstream Service Agent.exe" [2011-10-14 10204472]
"DiagnosticTools.exe"="c:\program files\Windstream\Diagnostic Tools\DiagnosticTools.exe" [2011-04-25 2037048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-12-12 152544]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2013-03-27 73832]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\prwntdrv]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06 958576 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2013-05-08 21:20 41056 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2008-12-04 15:14 75016 —-a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-08 22:34 54576 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPADVISOR]
2009-04-04 00:25 1644088 —-a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2008-11-20 17:47 62768 —-a-w- c:\program files\Hewlett-Packard\HP Odometer\hpsysdrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2013-04-04 19:50 887432 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateLBPShortCut]
2008-12-04 05:15 218408 —-a-w- c:\program files\Cyberlink\LabelPrint\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateP2GoShortCut]
2008-12-04 05:15 218408 —-a-w- c:\program files\Cyberlink\Power2Go\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePDIRShortCut]
2008-12-04 05:15 218408 —-a-w- c:\program files\Cyberlink\PowerDirector\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePSTShortCut]
2009-02-02 21:05 210216 —-a-w- c:\program files\Cyberlink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-05-25 23:17 1165776 —-a-w- c:\program files\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-14 12:08]
.
2013-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-11 01:23]
.
2013-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-11 01:23]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\Office14\EXCEL.EXE/3000
IE: Se&nd; to OneNote - c:\progra~1\MI1933~1\Office14\ONBttnIE.dll/105
LSP: c:\windows\system32\wpclsp.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.254.254
FF - ProfilePath - c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\
FF - prefs.js: browser.search.defaulturl - Bing
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.ldsscripturemastery.net/en/
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-04-30 10:09; [removed]; c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
FF - ExtSQL: 2013-05-25 22:30; [removed]; c:\program files\AVAST Software\Avast\WebRep\FF
FF - ExtSQL: 2013-05-25 23:04; {FFB96CC1-7EB3-449D-B827-DB661701C6BB}; c:\program files\CheckPoint\ZAForceField\TrustChecker
FF - ExtSQL: 2013-05-25 23:21; [removed]; c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
FF - ExtSQL: 2049-12-31 15:00; {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}; c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi
FF - ExtSQL: !HIDDEN! 2010-09-23 05:02; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - ExtSQL: !HIDDEN! 2011-03-28 10:30; [removed]; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-05 14:08
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NSM]
"ImagePath"="\"c:\program files\Norton Family\Engine\2.6.0.43\ccSvcHst.exe\" /s \"NSM\" /m \"c:\program files\Norton Family\Engine\2.6.0.43\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCCUJobMgr]
"ImagePath"="\"c:\program files\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files\Norton PC Checkup\Engine\2.0.12.27\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(3756)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(844)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'Explorer.exe'(6772)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Completion time: 2013-06-05 14:09:53
ComboFix-quarantined-files.txt 2013-06-05 19:09
ComboFix2.txt 2013-06-05 18:49
ComboFix3.txt 2013-01-25 16:35
ComboFix4.txt 2013-01-19 03:19
ComboFix5.txt 2013-06-05 18:59
.
Pre-Run: 147,023,937,536 bytes free
Post-Run: 147,373,420,544 bytes free
.
- - End Of File - - 0624E8D6FB77B854CAB67F310A9448EB

ComboFix 13-06-05.04 - jtmeserole 06/05/2013 13:37:20.7.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1724 [GMT -5:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\school acct\AppData\Local\Microsoft\Windows\Temporary Internet Files\{986EE4A7-A16D-445B-AA1F-BF8DAD2D5214}.xps
.
.
((((((((((((((((((((((((( Files Created from 2013-05-05 to 2013-06-05 )))))))))))))))))))))))))))))))
.
.
2013-06-05 18:47 . 2013-06-05 18:47 ——– d—–w- c:\users\school acct\AppData\Local\temp
2013-06-05 18:47 . 2013-06-05 18:47 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-06-05 18:47 . 2013-06-05 18:47 ——– d—–w- c:\users\What\AppData\Local\temp
2013-06-05 18:47 . 2013-06-05 18:47 ——– d—–w- c:\users\safe kids\AppData\Local\temp
2013-06-05 18:47 . 2013-06-05 18:47 ——– d—–w- c:\users\s\AppData\Local\temp
2013-06-05 18:47 . 2013-06-05 18:47 ——– d—–w- c:\users\Nice\AppData\Local\temp
2013-06-05 05:45 . 2013-06-05 05:45 137 —-a-w- c:\windows\DeleteOnReboot.bat
2013-06-04 16:43 . 2013-05-13 06:19 7016152 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{792E4558-F0F5-4475-A6D0-12240819CFFD}\mpengine.dll
2013-06-02 03:41 . 2013-06-02 03:41 ——– d—–w- c:\users\school acct\AppData\Local\Microsoft Games
2013-06-01 14:03 . 2013-06-01 14:03 ——– d—–w- c:\users\school acct\AppData\Roaming\CheckPoint
2013-05-28 14:16 . 2013-06-05 05:45 ——– d—–w- c:\users\safe kids\AppData\Roaming\CheckPoint
2013-05-26 04:04 . 2013-06-05 05:47 ——– d—–w- c:\users\jtmeserole\AppData\Roaming\CheckPoint
2013-05-26 04:00 . 2010-04-05 20:00 221568 —-a-w- c:\windows\system32\drivers\netio.sys
2013-05-26 03:58 . 2013-05-26 03:58 ——– d—–w- c:\program files\Check Point Software Technologies LTD
2013-05-26 03:58 . 2013-05-26 03:58 ——– d—–w- c:\users\jtmeserole\AppData\Roaming\Check Point Software Technologies LTD
2013-05-26 03:58 . 2013-05-26 04:03 ——– d—–w- c:\program files\CheckPoint
2013-05-26 03:57 . 2013-05-26 03:57 ——– d—–w- c:\programdata\CheckPoint
2013-05-26 03:30 . 2013-05-09 08:59 29816 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-05-26 03:30 . 2013-05-09 08:59 765736 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2013-05-26 03:30 . 2013-05-09 08:59 56080 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2013-05-26 03:30 . 2013-05-09 08:59 49376 —-a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-05-26 03:30 . 2013-05-09 08:59 368944 —-a-w- c:\windows\system32\drivers\aswSP.sys
2013-05-26 03:30 . 2013-05-09 08:59 174664 —-a-w- c:\windows\system32\drivers\aswVmm.sys
2013-05-26 03:30 . 2013-05-09 08:59 49760 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2013-05-26 03:30 . 2013-05-09 08:59 66336 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-26 03:30 . 2013-05-09 08:58 229648 —-a-w- c:\windows\system32\aswBoot.exe
2013-05-26 03:29 . 2013-05-09 08:58 41664 —-a-w- c:\windows\avastSS.scr
2013-05-26 03:28 . 2013-05-26 03:28 ——– d—–w- c:\program files\AVAST Software
2013-05-26 01:11 . 2013-05-26 03:28 ——– d—–w- c:\programdata\AVAST Software
2013-05-26 00:31 . 2013-05-26 00:31 ——– d—–w- c:\program files\Common Files\Java
2013-05-26 00:30 . 2013-04-04 10:35 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-05-20 13:13 . 2013-05-20 13:13 ——– d—–w- c:\programdata\Wild Tangent
2013-05-20 13:00 . 2013-05-20 13:00 ——– d—–w- c:\program files\WildTangent Games
2013-05-16 06:15 . 2013-05-05 19:12 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2013-05-15 11:40 . 2013-04-15 14:20 638328 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 11:40 . 2013-04-13 10:56 37376 —-a-w- c:\windows\system32\cdd.dll
2013-05-15 11:40 . 2013-04-09 01:36 2049024 —-a-w- c:\windows\system32\win32k.sys
2013-05-08 08:12 . 2013-05-08 08:12 106088 —-a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-15 12:08 . 2012-06-14 13:07 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-15 12:08 . 2011-06-30 17:17 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-02 07:06 . 2012-09-26 12:21 238872 ——w- c:\windows\system32\MpSigStub.exe
2013-04-04 19:50 . 2010-11-26 20:52 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2013-03-11 13:25 . 2013-04-09 17:40 3603816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-11 13:25 . 2013-04-09 17:40 3551080 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-03-09 03:45 . 2013-04-09 17:40 49152 —-a-w- c:\windows\system32\csrsrv.dll
2013-03-09 01:28 . 2013-04-09 17:40 64000 —-a-w- c:\windows\system32\smss.exe
2013-03-08 13:40 . 2013-01-18 03:28 861088 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-03-08 13:40 . 2010-09-20 21:21 782240 —-a-w- c:\windows\system32\deployJava1.dll
2013-03-08 03:53 . 2013-04-09 17:40 376320 —-a-w- c:\windows\system32\winsrv.dll
2013-03-08 03:52 . 2013-04-09 17:40 2067968 —-a-w- c:\windows\system32\mstscax.dll
2012-03-26 15:22 . 2012-03-26 15:22 35113704 —-a-w- c:\program files\Common Files\directx_9c_redist.exe
2010-03-31 16:09 . 2013-05-24 19:06 10437264 —-a-w- c:\program files\mozilla firefox\plugins\PDFNetC.dll
2010-04-08 18:36 . 2013-05-24 19:06 107760 —-a-w- c:\program files\mozilla firefox\plugins\ScorchPDFWrapper.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 121968 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-08 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-08 92704]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"Windstream Service Agent.exe"="c:\program files\Windstream\Service Agent\Windstream Service Agent.exe" [2011-10-14 10204472]
"DiagnosticTools.exe"="c:\program files\Windstream\Diagnostic Tools\DiagnosticTools.exe" [2011-04-25 2037048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-12-12 152544]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2013-03-27 73832]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\prwntdrv]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06 958576 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2013-05-08 21:20 41056 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2008-12-04 15:14 75016 —-a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-08 22:34 54576 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPADVISOR]
2009-04-04 00:25 1644088 —-a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2008-11-20 17:47 62768 —-a-w- c:\program files\Hewlett-Packard\HP Odometer\hpsysdrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2013-04-04 19:50 887432 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateLBPShortCut]
2008-12-04 05:15 218408 —-a-w- c:\program files\Cyberlink\LabelPrint\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateP2GoShortCut]
2008-12-04 05:15 218408 —-a-w- c:\program files\Cyberlink\Power2Go\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePDIRShortCut]
2008-12-04 05:15 218408 —-a-w- c:\program files\Cyberlink\PowerDirector\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePSTShortCut]
2009-02-02 21:05 210216 —-a-w- c:\program files\Cyberlink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-05-25 23:17 1165776 —-a-w- c:\program files\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-14 12:08]
.
2013-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-11 01:23]
.
2013-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-11 01:23]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\Office14\EXCEL.EXE/3000
IE: Se&nd; to OneNote - c:\progra~1\MI1933~1\Office14\ONBttnIE.dll/105
LSP: c:\windows\system32\wpclsp.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.254.254
FF - ProfilePath - c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\
FF - prefs.js: browser.search.defaulturl - Bing
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.ldsscripturemastery.net/en/
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-04-30 10:09; [removed]; c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
FF - ExtSQL: 2013-05-25 22:30; [removed]; c:\program files\AVAST Software\Avast\WebRep\FF
FF - ExtSQL: 2013-05-25 23:04; {FFB96CC1-7EB3-449D-B827-DB661701C6BB}; c:\program files\CheckPoint\ZAForceField\TrustChecker
FF - ExtSQL: 2013-05-25 23:21; [removed]; c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
FF - ExtSQL: 2049-12-31 15:00; {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}; c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi
FF - ExtSQL: !HIDDEN! 2010-09-23 05:02; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - ExtSQL: !HIDDEN! 2011-03-28 10:30; [removed]; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-ISW - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-05 13:47
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NSM]
"ImagePath"="\"c:\program files\Norton Family\Engine\2.6.0.43\ccSvcHst.exe\" /s \"NSM\" /m \"c:\program files\Norton Family\Engine\2.6.0.43\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCCUJobMgr]
"ImagePath"="\"c:\program files\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files\Norton PC Checkup\Engine\2.0.12.27\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(3756)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(844)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Completion time: 2013-06-05 13:49:29
ComboFix-quarantined-files.txt 2013-06-05 18:49
ComboFix2.txt 2013-01-25 16:35
ComboFix3.txt 2013-01-19 03:19
ComboFix4.txt 2013-01-18 03:10
.
Pre-Run: 146,607,013,888 bytes free
Post-Run: 146,993,819,648 bytes free
.
- - End Of File - - DC83D5036A78B1642B97DA2679CEA2BB

jeffce

Post #13June 5, 2013, 11:38 PM UTC

You say you are still getting the redirects? In what browser(s)?

[external image: Posted Image] Please download TDSSKiller

Double click TDSSKiller.exe
Press Start Scan but do nothing else as we are just looking for what is there.
If Malicious objects are found, select Skip by changing the Cure dropdown in the upper right.
Attach the log in your next reply
A copy of the log will be saved automatically to the root of the drive (typically C:\)

computerwannabe

Post #14June 6, 2013, 4:53 AM UTC last edited June 6, 2013, 4:54 AM UTC

I am using firefox, and yes I am still getting redirects, as well as the box in the corner.

23:48:20.0735 2232 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
23:48:21.0813 2232 ============================================================
23:48:21.0813 2232 Current date / time: 2013/06/05 23:48:21.0813
23:48:21.0813 2232 SystemInfo:
23:48:21.0813 2232
23:48:21.0813 2232 OS Version: 6.0.6002 ServicePack: 2.0
23:48:21.0813 2232 Product type: Workstation
23:48:21.0813 2232 ComputerName: JTMESEROLE-PC
23:48:21.0814 2232 UserName: jtmeserole
23:48:21.0814 2232 Windows directory: C:\Windows
23:48:21.0814 2232 System windows directory: C:\Windows
23:48:21.0814 2232 Processor architecture: Intel x86
23:48:21.0814 2232 Number of processors: 2
23:48:21.0814 2232 Page size: 0x1000
23:48:21.0814 2232 Boot type: Normal boot
23:48:21.0814 2232 ============================================================
23:48:25.0233 2232 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
23:48:25.0280 2232 ============================================================
23:48:25.0280 2232 \Device\Harddisk0\DR0:
23:48:25.0305 2232 MBR partitions:
23:48:25.0305 2232 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x23D9C201
23:48:25.0305 2232 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x23D9C240, BlocksNum 0x1691481
23:48:25.0305 2232 ============================================================
23:48:25.0364 2232 C: <-> \Device\Harddisk0\DR0\Partition1
23:48:25.0562 2232 D: <-> \Device\Harddisk0\DR0\Partition2
23:48:25.0562 2232 ============================================================
23:48:25.0562 2232 Initialize success
23:48:25.0562 2232 ============================================================
23:48:43.0676 5624 ============================================================
23:48:43.0676 5624 Scan started
23:48:43.0676 5624 Mode: Manual;
23:48:43.0676 5624 ============================================================
23:48:47.0311 5624 ================ Scan system memory ========================
23:48:47.0311 5624 System memory - ok
23:48:47.0311 5624 ================ Scan services =============================
23:48:51.0257 5624 [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI C:\Windows\system32\drivers\acpi.sys
23:48:51.0304 5624 ACPI - ok
23:48:51.0538 5624 [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
23:48:51.0538 5624 AdobeFlashPlayerUpdateSvc - ok
23:48:51.0725 5624 [ 04F0FCAC69C7C71A3AC4EB97FAFC8303 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
23:48:51.0928 5624 adp94xx - ok
23:48:52.0006 5624 [ 60505E0041F7751BDBB80F88BF45C2CE ] adpahci C:\Windows\system32\drivers\adpahci.sys
23:48:52.0053 5624 adpahci - ok
23:48:52.0069 5624 [ 8A42779B02AEC986EAB64ECFC98F8BD7 ] adpu160m C:\Windows\system32\drivers\adpu160m.sys
23:48:52.0100 5624 adpu160m - ok
23:48:52.0131 5624 [ 241C9E37F8CE45EF51C3DE27515CA4E5 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
23:48:52.0147 5624 adpu320 - ok
23:48:52.0240 5624 [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
23:48:52.0256 5624 AeLookupSvc - ok
23:48:52.0677 5624 [ 3911B972B55FEA0478476B2E777B29FA ] AFD C:\Windows\system32\drivers\afd.sys
23:48:52.0802 5624 AFD - ok
23:48:53.0426 5624 [ 48091A2374A69F473273C44951195452 ] AgereModemAudio C:\Program Files\LSI SoftModem\agrsmsvc.exe
23:48:53.0426 5624 AgereModemAudio - ok
23:48:53.0785 5624 [ C6FA08A8CCA9001F3197525B07331715 ] AgereSoftModem C:\Windows\system32\DRIVERS\AGRSM.sys
23:48:53.0863 5624 AgereSoftModem - ok
23:48:54.0003 5624 [ 13F9E33747E6B41A3FF305C37DB0D360 ] agp440 C:\Windows\system32\drivers\agp440.sys
23:48:54.0034 5624 agp440 - ok
23:48:54.0143 5624 [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx C:\Windows\system32\drivers\djsvs.sys
23:48:54.0175 5624 aic78xx - ok
23:48:54.0253 5624 [ A1545B731579895D8CC44FC0481C1192 ] ALG C:\Windows\System32\alg.exe
23:48:54.0268 5624 ALG - ok
23:48:54.0331 5624 [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91 ] aliide C:\Windows\system32\drivers\aliide.sys
23:48:54.0377 5624 aliide - ok
23:48:54.0455 5624 [ C47344BC706E5F0B9DCE369516661578 ] amdagp C:\Windows\system32\drivers\amdagp.sys
23:48:54.0455 5624 amdagp - ok
23:48:54.0518 5624 [ 9B78A39A4C173FDBC1321E0DD659B34C ] amdide C:\Windows\system32\drivers\amdide.sys
23:48:54.0533 5624 amdide - ok
23:48:54.0658 5624 [ 18F29B49AD23ECEE3D2A826C725C8D48 ] AmdK7 C:\Windows\system32\drivers\amdk7.sys
23:48:54.0705 5624 AmdK7 - ok
23:48:54.0752 5624 [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
23:48:54.0814 5624 AmdK8 - ok
23:48:54.0955 5624 [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo C:\Windows\System32\appinfo.dll
23:48:54.0986 5624 Appinfo - ok
23:48:55.0532 5624 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
23:48:55.0547 5624 Apple Mobile Device - ok
23:48:55.0781 5624 [ 5D2888182FB46632511ACEE92FDAD522 ] arc C:\Windows\system32\drivers\arc.sys
23:48:55.0828 5624 arc - ok
23:48:56.0093 5624 [ 5E2A321BD7C8B3624E41FDEC3E244945 ] arcsas C:\Windows\system32\drivers\arcsas.sys
23:48:56.0171 5624 arcsas - ok
23:48:56.0327 5624 [ 4AF5F360BA1E8794D32B366E45A64A0A ] aswFsBlk C:\Windows\system32\drivers\aswFsBlk.sys
23:48:56.0327 5624 aswFsBlk - ok
23:48:56.0499 5624 [ 1F7094D4268D46F718C51286DC189791 ] aswMonFlt C:\Windows\system32\drivers\aswMonFlt.sys
23:48:56.0499 5624 aswMonFlt - ok
23:48:56.0577 5624 [ 7B43265F92257A21CBFD88E7A651044C ] AswRdr C:\Windows\system32\drivers\AswRdr.sys
23:48:56.0577 5624 AswRdr - ok
23:48:56.0639 5624 [ B680134BA1813B78B47FDD1DFF223CA5 ] aswRvrt C:\Windows\system32\drivers\aswRvrt.sys
23:48:56.0655 5624 aswRvrt - ok
23:48:56.0889 5624 [ 6CAB0A5991C5C0FC63F5E66593E71D7E ] aswSnx C:\Windows\system32\drivers\aswSnx.sys
23:48:56.0889 5624 aswSnx - ok
23:48:57.0045 5624 [ 99102F60F344BEBAF4F6114514FD28D3 ] aswSP C:\Windows\system32\drivers\aswSP.sys
23:48:57.0045 5624 aswSP - ok
23:48:57.0107 5624 [ 1F71F170D90E42EFDE9633D81D5E12DC ] aswTdi C:\Windows\system32\drivers\aswTdi.sys
23:48:57.0107 5624 aswTdi - ok
23:48:57.0201 5624 [ 16B8E3CD50A460EC32CA680C8210A0A9 ] aswVmm C:\Windows\system32\drivers\aswVmm.sys
23:48:57.0263 5624 aswVmm - ok
23:48:57.0419 5624 [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
23:48:57.0435 5624 AsyncMac - ok
23:48:57.0544 5624 [ 2D9C903DC76A66813D350A562DE40ED9 ] atapi C:\Windows\system32\drivers\atapi.sys
23:48:57.0560 5624 atapi - ok
23:48:57.0731 5624 [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
23:48:57.0887 5624 AudioEndpointBuilder - ok
23:48:57.0950 5624 [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv C:\Windows\System32\Audiosrv.dll
23:48:57.0950 5624 Audiosrv - ok
23:48:58.0199 5624 [ 28D6701C710AD7BA3CB95E75F8F1A9AA ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
23:48:58.0199 5624 avast! Antivirus - ok
23:48:58.0355 5624 [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep C:\Windows\system32\drivers\Beep.sys
23:48:58.0371 5624 Beep - ok
23:48:58.0543 5624 [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE C:\Windows\System32\bfe.dll
23:48:58.0636 5624 BFE - ok
23:48:59.0151 5624 [ 93952506C6D67330367F7E7934B6A02F ] BITS C:\Windows\system32\qmgr.dll
23:49:00.0025 5624 BITS - ok
23:49:00.0087 5624 [ D4DF28447741FD3D953526E33A617397 ] blbdrive C:\Windows\system32\drivers\blbdrive.sys
23:49:00.0165 5624 blbdrive - ok
23:49:00.0633 5624 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
23:49:00.0805 5624 Bonjour Service - ok
23:49:00.0898 5624 [ 35F376253F687BDE63976CCB3F2108CA ] bowser C:\Windows\system32\DRIVERS\bowser.sys
23:49:00.0976 5624 bowser - ok
23:49:01.0179 5624 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys
23:49:01.0179 5624 BrFiltLo - ok
23:49:01.0241 5624 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys
23:49:01.0241 5624 BrFiltUp - ok
23:49:01.0351 5624 [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser C:\Windows\System32\browser.dll
23:49:01.0382 5624 Browser - ok
23:49:01.0538 5624 [ B304E75CFF293029EDDF094246747113 ] Brserid C:\Windows\system32\drivers\brserid.sys
23:49:01.0569 5624 Brserid - ok
23:49:01.0616 5624 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys
23:49:01.0631 5624 BrSerWdm - ok
23:49:01.0678 5624 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys
23:49:01.0694 5624 BrUsbMdm - ok
23:49:01.0725 5624 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys
23:49:01.0741 5624 BrUsbSer - ok
23:49:01.0819 5624 [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
23:49:01.0834 5624 BTHMODEM - ok
23:49:02.0708 5624 catchme - ok
23:49:02.0973 5624 [ 41CD31307E054F878EA3FD7F7D2C2922 ] ccSet_NSM C:\Windows\system32\drivers\NSM\0206000.02B\ccSetx86.sys
23:49:02.0989 5624 ccSet_NSM - ok
23:49:03.0035 5624 [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
23:49:03.0082 5624 cdfs - ok
23:49:03.0176 5624 [ 6B4BFFB9BECD728097024276430DB314 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
23:49:03.0223 5624 cdrom - ok
23:49:03.0316 5624 [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc C:\Windows\System32\certprop.dll
23:49:03.0332 5624 CertPropSvc - ok
23:49:03.0379 5624 [ E5D4133F37219DBCFE102BC61072589D ] circlass C:\Windows\system32\DRIVERS\circlass.sys
23:49:03.0394 5624 circlass - ok
23:49:03.0472 5624 [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS C:\Windows\system32\CLFS.sys
23:49:03.0488 5624 CLFS - ok
23:49:03.0847 5624 [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
23:49:03.0893 5624 clr_optimization_v2.0.50727_32 - ok
23:49:04.0361 5624 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
23:49:04.0393 5624 clr_optimization_v4.0.30319_32 - ok
23:49:04.0486 5624 [ 0CA25E686A4928484E9FDABD168AB629 ] cmdide C:\Windows\system32\drivers\cmdide.sys
23:49:04.0502 5624 cmdide - ok
23:49:04.0533 5624 [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt C:\Windows\system32\drivers\compbatt.sys
23:49:04.0564 5624 Compbatt - ok
23:49:04.0564 5624 COMSysApp - ok
23:49:04.0580 5624 [ 741E9DFF4F42D2D8477D0FC1DC0DF871 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
23:49:04.0580 5624 crcdisk - ok
23:49:04.0642 5624 [ 1F07BECDCA750766A96CDA811BA86410 ] Crusoe C:\Windows\system32\drivers\crusoe.sys
23:49:04.0673 5624 Crusoe - ok
23:49:04.0798 5624 [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc C:\Windows\system32\cryptsvc.dll
23:49:04.0861 5624 CryptSvc - ok
23:49:05.0531 5624 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
23:49:06.0015 5624 cvhsvc - ok
23:49:06.0343 5624 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch C:\Windows\system32\rpcss.dll
23:49:06.0608 5624 DcomLaunch - ok
23:49:06.0701 5624 [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC C:\Windows\system32\Drivers\dfsc.sys
23:49:06.0717 5624 DfsC - ok
23:49:07.0544 5624 [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR C:\Windows\system32\DFSR.exe
23:49:09.0010 5624 DFSR - ok
23:49:09.0260 5624 [ 9028559C132146FB75EB7ACF384B086A ] Dhcp C:\Windows\System32\dhcpcsvc.dll
23:49:09.0353 5624 Dhcp - ok
23:49:09.0478 5624 [ 5D4AEFC3386920236A548271F8F1AF6A ] disk C:\Windows\system32\drivers\disk.sys
23:49:09.0509 5624 disk - ok
23:49:09.0681 5624 [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache C:\Windows\System32\dnsrslvr.dll
23:49:09.0743 5624 Dnscache - ok
23:49:09.0853 5624 [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc C:\Windows\System32\dot3svc.dll
23:49:09.0868 5624 dot3svc - ok
23:49:09.0993 5624 [ 4F59C172C094E1A1D46463A8DC061CBD ] Dot4 C:\Windows\system32\DRIVERS\Dot4.sys
23:49:10.0040 5624 Dot4 - ok
23:49:10.0055 5624 [ 80BF3BA09F6F2523C8F6B7CC6DBF7BD5 ] Dot4Print C:\Windows\system32\DRIVERS\Dot4Prt.sys
23:49:10.0055 5624 Dot4Print - ok
23:49:10.0102 5624 [ C55004CA6B419B6695970DFE849B122F ] dot4usb C:\Windows\system32\DRIVERS\dot4usb.sys
23:49:10.0102 5624 dot4usb - ok
23:49:10.0165 5624 [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS C:\Windows\system32\dps.dll
23:49:10.0180 5624 DPS - ok
23:49:10.0243 5624 [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
23:49:10.0258 5624 drmkaud - ok
23:49:10.0352 5624 [ F35B5D0CC142B87E687FC504BAA69D82 ] dsiarhwprog C:\Windows\system32\Drivers\dsiarhwprog.sys
23:49:10.0367 5624 dsiarhwprog - ok
23:49:10.0523 5624 [ 5DE0FAEC9E5D1AAE74F8568897891A01 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
23:49:10.0539 5624 DXGKrnl - ok
23:49:10.0586 5624 [ 5425F74AC0C1DBD96A1E04F17D63F94C ] E1G60 C:\Windows\system32\DRIVERS\E1G60I32.sys
23:49:10.0586 5624 E1G60 - ok
23:49:10.0664 5624 [ C0B95E40D85CD807D614E264248A45B9 ] EapHost C:\Windows\System32\eapsvc.dll
23:49:10.0664 5624 EapHost - ok
23:49:10.0726 5624 [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache C:\Windows\system32\drivers\ecache.sys
23:49:10.0742 5624 Ecache - ok
23:49:10.0851 5624 [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
23:49:10.0898 5624 ehRecvr - ok
23:49:10.0945 5624 [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched C:\Windows\ehome\ehsched.exe
23:49:10.0945 5624 ehSched - ok
23:49:10.0960 5624 [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart C:\Windows\ehome\ehstart.dll
23:49:10.0960 5624 ehstart - ok
23:49:11.0038 5624 [ B8EAC99B14772BDC36CA963AED109FA2 ] ElRawDisk C:\Windows\system32\drivers\rsdrv.sys
23:49:11.0038 5624 ElRawDisk - ok
23:49:11.0116 5624 [ 23B62471681A124889978F6295B3F4C6 ] elxstor C:\Windows\system32\drivers\elxstor.sys
23:49:11.0116 5624 elxstor - ok
23:49:11.0179 5624 [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt C:\Windows\system32\emdmgmt.dll
23:49:11.0210 5624 EMDMgmt - ok
23:49:11.0272 5624 [ 3DB974F3935483555D7148663F726C61 ] ErrDev C:\Windows\system32\drivers\errdev.sys
23:49:11.0272 5624 ErrDev - ok
23:49:11.0366 5624 [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem C:\Windows\system32\es.dll
23:49:11.0366 5624 EventSystem - ok
23:49:11.0522 5624 [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat C:\Windows\system32\drivers\exfat.sys
23:49:11.0522 5624 exfat - ok
23:49:11.0569 5624 [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat C:\Windows\system32\drivers\fastfat.sys
23:49:11.0569 5624 fastfat - ok
23:49:11.0647 5624 [ AFE1E8B9782A0DD7FB46BBD88E43F89A ] fdc C:\Windows\system32\DRIVERS\fdc.sys
23:49:11.0647 5624 fdc - ok
23:49:11.0662 5624 [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost C:\Windows\system32\fdPHost.dll
23:49:11.0678 5624 fdPHost - ok
23:49:11.0693 5624 [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub C:\Windows\system32\fdrespub.dll
23:49:11.0693 5624 FDResPub - ok
23:49:11.0740 5624 [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
23:49:11.0771 5624 FileInfo - ok
23:49:11.0818 5624 [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace C:\Windows\system32\drivers\filetrace.sys
23:49:11.0834 5624 Filetrace - ok
23:49:11.0849 5624 [ 85B7CF99D532820495D68D747FDA9EBD ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
23:49:11.0865 5624 flpydisk - ok
23:49:11.0896 5624 [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
23:49:11.0912 5624 FltMgr - ok
23:49:12.0224 5624 [ 8CE364388C8ECA59B14B539179276D44 ] FontCache C:\Windows\system32\FntCache.dll
23:49:12.0271 5624 FontCache - ok
23:49:12.0317 5624 [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
23:49:12.0317 5624 FontCache3.0.0.0 - ok
23:49:12.0442 5624 [ D909075FA72C090F27AA926C32CB4612 ] fssfltr C:\Windows\system32\DRIVERS\fssfltr.sys
23:49:12.0442 5624 fssfltr - ok
23:49:12.0723 5624 [ 4CE9DAC1518FF7E77BD213E6394B9D77 ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe
23:49:12.0848 5624 fsssvc - ok
23:49:12.0879 5624 [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
23:49:12.0895 5624 Fs_Rec - ok
23:49:12.0910 5624 [ 34582A6E6573D54A07ECE5FE24A126B5 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
23:49:12.0926 5624 gagp30kx - ok
23:49:13.0144 5624 [ C403C5DB49A0F9AAF4F2128EDC0106D8 ] GamesAppService C:\Program Files\WildTangent Games\App\GamesAppService.exe
23:49:13.0144 5624 GamesAppService - ok
23:49:13.0222 5624 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
23:49:13.0222 5624 GEARAspiWDM - ok
23:49:13.0425 5624 [ 77EBF3E9386DAA51551AF429052D88D0 ] giveio C:\Windows\system32\giveio.sys
23:49:13.0425 5624 giveio - ok
23:49:13.0487 5624 [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc C:\Windows\System32\gpsvc.dll
23:49:13.0519 5624 gpsvc - ok
23:49:13.0597 5624 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
23:49:13.0597 5624 gupdate - ok
23:49:13.0597 5624 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
23:49:13.0597 5624 gupdatem - ok
23:49:13.0643 5624 [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
23:49:13.0659 5624 HDAudBus - ok
23:49:13.0690 5624 [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth C:\Windows\system32\drivers\hidbth.sys
23:49:13.0690 5624 HidBth - ok
23:49:13.0706 5624 [ D8DF3722D5E961BAA1292AA2F12827E2 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
23:49:13.0706 5624 HidIr - ok
23:49:13.0737 5624 [ 84067081F3318162797385E11A8F0582 ] hidserv C:\Windows\System32\hidserv.dll
23:49:13.0753 5624 hidserv - ok
23:49:13.0784 5624 [ CCA4B519B17E23A00B826C55716809CC ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
23:49:13.0784 5624 HidUsb - ok
23:49:13.0815 5624 [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc C:\Windows\system32\kmsvc.dll
23:49:13.0831 5624 hkmsvc - ok
23:49:13.0940 5624 [ AA9EF0B395097F24D289F64445B2FD2E ] HP Health Check Service c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
23:49:13.0940 5624 HP Health Check Service - ok
23:49:13.0971 5624 [ 16EE7B23A009E00D835CDB79574A91A6 ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys
23:49:13.0971 5624 HpCISSs - ok
23:49:14.0189 5624 [ 0A3C6AA4A9FC38C20BA4EAC2C3351C05 ] hpqcxs08 C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
23:49:14.0221 5624 hpqcxs08 - ok
23:49:14.0252 5624 [ F3F72A2A86C22610BCA5439FA789DD52 ] hpqddsvc C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
23:49:14.0267 5624 hpqddsvc - ok
23:49:14.0517 5624 [ E82871D75565219A7E28C6B14572EF63 ] HsdService C:\Program Files\Windstream\Diagnostic Tools\HsdService.exe
23:49:14.0517 5624 HsdService - ok
23:49:14.0564 5624 [ F870AA3E254628EBEAFE754108D664DE ] HTTP C:\Windows\system32\drivers\HTTP.sys
23:49:14.0579 5624 HTTP - ok
23:49:14.0595 5624 [ C6B032D69650985468160FC9937CF5B4 ] i2omp C:\Windows\system32\drivers\i2omp.sys
23:49:14.0595 5624 i2omp - ok
23:49:14.0720 5624 [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
23:49:14.0735 5624 i8042prt - ok
23:49:14.0751 5624 [ 54155EA1B0DF185878E0FC9EC3AC3A14 ] iaStorV C:\Windows\system32\drivers\iastorv.sys
23:49:14.0798 5624 iaStorV - ok
23:49:14.0923 5624 [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
23:49:14.0969 5624 idsvc - ok
23:49:15.0016 5624 [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp C:\Windows\system32\drivers\iirsp.sys
23:49:15.0016 5624 iirsp - ok
23:49:15.0094 5624 [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT C:\Windows\System32\ikeext.dll
23:49:15.0110 5624 IKEEXT - ok
23:49:15.0469 5624 [ 84ED2154239F9D013BBD3220755ADA8B ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
23:49:15.0469 5624 IntcAzAudAddService - ok
23:49:15.0531 5624 [ 83AA759F3189E6370C30DE5DC5590718 ] intelide C:\Windows\system32\drivers\intelide.sys
23:49:15.0547 5624 intelide - ok
23:49:15.0609 5624 [ 224191001E78C89DFA78924C3EA595FF ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
23:49:15.0625 5624 intelppm - ok
23:49:15.0656 5624 [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
23:49:15.0656 5624 IPBusEnum - ok
23:49:15.0671 5624 [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:49:15.0687 5624 IpFilterDriver - ok
23:49:15.0734 5624 [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
23:49:15.0734 5624 iphlpsvc - ok
23:49:15.0749 5624 IpInIp - ok
23:49:15.0781 5624 [ B25AAF203552B7B3491139D582B39AD1 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys
23:49:15.0781 5624 IPMIDRV - ok
23:49:15.0812 5624 [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys
23:49:15.0812 5624 IPNAT - ok
23:49:16.0030 5624 [ E8A39D41474BE42FD8830CED32932D6C ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
23:49:16.0030 5624 iPod Service - ok
23:49:16.0124 5624 [ E50A95179211B12946F7E035D60AF560 ] irda C:\Windows\system32\DRIVERS\irda.sys
23:49:16.0139 5624 irda - ok
23:49:16.0139 5624 [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
23:49:16.0139 5624 IRENUM - ok
23:49:16.0171 5624 [ CBB0D940221A281BCFEAEA695BD1CDA5 ] Irmon C:\Windows\System32\irmon.dll
23:49:16.0186 5624 Irmon - ok
23:49:16.0202 5624 [ 5896B5FF6332AB2BE1582523E9656A67 ] irsir C:\Windows\system32\DRIVERS\irsir.sys
23:49:16.0202 5624 irsir - ok
23:49:16.0233 5624 [ 6C70698A3E5C4376C6AB5C7C17FB0614 ] isapnp C:\Windows\system32\drivers\isapnp.sys
23:49:16.0233 5624 isapnp - ok
23:49:16.0295 5624 [ 232FA340531D940AAC623B121A595034 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
23:49:16.0295 5624 iScsiPrt - ok
23:49:16.0436 5624 [ 724A6A9AB5E1807665C5DB71C30BFC5F ] ISWKL C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys
23:49:16.0436 5624 ISWKL - ok
23:49:16.0810 5624 [ 57FE873B8246DEF1372503CBC57A7499 ] IswSvc C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
23:49:16.0810 5624 IswSvc - ok
23:49:16.0841 5624 [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi C:\Windows\system32\drivers\iteatapi.sys
23:49:16.0841 5624 iteatapi - ok
23:49:16.0904 5624 [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid C:\Windows\system32\drivers\iteraid.sys
23:49:16.0919 5624 iteraid - ok
23:49:16.0935 5624 [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
23:49:16.0935 5624 kbdclass - ok
23:49:16.0966 5624 [ EDE59EC70E25C24581ADD1FBEC7325F7 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
23:49:16.0982 5624 kbdhid - ok
23:49:17.0013 5624 [ A3E186B4B935905B829219502557314E ] KeyIso C:\Windows\system32\lsass.exe
23:49:17.0013 5624 KeyIso - ok
23:49:17.0091 5624 [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
23:49:17.0138 5624 KSecDD - ok
23:49:17.0216 5624 [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm C:\Windows\system32\msdtckrm.dll
23:49:17.0231 5624 KtmRm - ok
23:49:17.0278 5624 [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer C:\Windows\System32\srvsvc.dll
23:49:17.0294 5624 LanmanServer - ok
23:49:17.0341 5624 [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
23:49:17.0356 5624 LanmanWorkstation - ok
23:49:17.0434 5624 [ DFEFF67508D3A9AEB1A85D7B0F513B24 ] LightScribeService c:\Program Files\Common Files\LightScribe\LSSrvc.exe
23:49:17.0434 5624 LightScribeService - ok
23:49:17.0481 5624 [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
23:49:17.0481 5624 lltdio - ok
23:49:17.0543 5624 [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc C:\Windows\System32\lltdsvc.dll
23:49:17.0559 5624 lltdsvc - ok
23:49:17.0590 5624 [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts C:\Windows\System32\lmhsvc.dll
23:49:17.0590 5624 lmhosts - ok
23:49:17.0606 5624 [ C7E15E82879BF3235B559563D4185365 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
23:49:17.0621 5624 LSI_FC - ok
23:49:17.0637 5624 [ EE01EBAE8C9BF0FA072E0FF68718920A ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
23:49:17.0668 5624 LSI_SAS - ok
23:49:17.0684 5624 [ 912A04696E9CA30146A62AFA1463DD5C ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
23:49:17.0715 5624 LSI_SCSI - ok
23:49:17.0731 5624 [ 8F5C7426567798E62A3B3614965D62CC ] luafv C:\Windows\system32\drivers\luafv.sys
23:49:17.0731 5624 luafv - ok
23:49:17.0980 5624 [ 7521C0C58EE91BE90B6CC33E792D10C7 ] LVRS C:\Windows\system32\DRIVERS\lvrs.sys
23:49:17.0996 5624 LVRS - ok
23:49:18.0979 5624 [ 37E57C48AF530DF01CDD4E8A2AD77B51 ] LVUVC C:\Windows\system32\DRIVERS\lvuvc.sys
23:49:19.0119 5624 LVUVC - ok
23:49:19.0353 5624 [ E6CB119EF2E148EAA1A247343550756E ] McciCMService C:\Program Files\Common Files\Motive\McciCMService.exe
23:49:19.0384 5624 McciCMService - ok
23:49:19.0415 5624 [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
23:49:19.0415 5624 Mcx2Svc - ok
23:49:19.0493 5624 [ 0001CE609D66632FA17B84705F658879 ] megasas C:\Windows\system32\drivers\megasas.sys
23:49:19.0525 5624 megasas - ok
23:49:19.0665 5624 [ C252F32CD9A49DBFC25ECF26EBD51A99 ] MegaSR C:\Windows\system32\drivers\megasr.sys
23:49:19.0681 5624 MegaSR - ok
23:49:19.0774 5624 [ 3412A454FDF9F68341AB80F3EE79EDAB ] MHIKEY10 C:\Windows\system32\Drivers\MHIKEY10.sys
23:49:19.0790 5624 MHIKEY10 - ok
23:49:19.0837 5624 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS C:\Windows\system32\mmcss.dll
23:49:19.0852 5624 MMCSS - ok
23:49:19.0868 5624 [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem C:\Windows\system32\drivers\modem.sys
23:49:19.0883 5624 Modem - ok
23:49:19.0961 5624 [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
23:49:19.0961 5624 monitor - ok
23:49:20.0008 5624 [ 5BF6A1326A335C5298477754A506D263 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
23:49:20.0008 5624 mouclass - ok
23:49:20.0055 5624 [ 93B8D4869E12CFBE663915502900876F ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
23:49:20.0071 5624 mouhid - ok
23:49:20.0086 5624 [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr C:\Windows\system32\drivers\mountmgr.sys
23:49:20.0117 5624 MountMgr - ok
23:49:20.0211 5624 [ 825BF0E46B4470A463AEB641480C5FCA ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
23:49:20.0227 5624 MozillaMaintenance - ok
23:49:20.0336 5624 [ 511D011289755DD9F9A7579FB0B064E6 ] mpio C:\Windows\system32\drivers\mpio.sys
23:49:20.0351 5624 mpio - ok
23:49:20.0351 5624 [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
23:49:20.0367 5624 mpsdrv - ok
23:49:20.0476 5624 [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc C:\Windows\system32\mpssvc.dll
23:49:20.0570 5624 MpsSvc - ok
23:49:20.0632 5624 [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys
23:49:20.0648 5624 Mraid35x - ok
23:49:20.0710 5624 [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
23:49:20.0726 5624 MRxDAV - ok
23:49:20.0773 5624 [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
23:49:20.0773 5624 mrxsmb - ok
23:49:20.0882 5624 [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:49:20.0913 5624 mrxsmb10 - ok
23:49:20.0929 5624 [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:49:20.0944 5624 mrxsmb20 - ok
23:49:20.0975 5624 [ 28023E86F17001F7CD9B15A5BC9AE07D ] msahci C:\Windows\system32\drivers\msahci.sys
23:49:20.0991 5624 msahci - ok
23:49:21.0007 5624 [ 4468B0F385A86ECDDAF8D3CA662EC0E7 ] msdsm C:\Windows\system32\drivers\msdsm.sys
23:49:21.0022 5624 msdsm - ok
23:49:21.0038 5624 [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC C:\Windows\System32\msdtc.exe
23:49:21.0053 5624 MSDTC - ok
23:49:21.0069 5624 [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs C:\Windows\system32\drivers\Msfs.sys
23:49:21.0100 5624 Msfs - ok
23:49:21.0163 5624 [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
23:49:21.0163 5624 msisadrv - ok
23:49:21.0209 5624 [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
23:49:21.0241 5624 MSiSCSI - ok
23:49:21.0241 5624 msiserver - ok
23:49:21.0303 5624 [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
23:49:21.0303 5624 MSKSSRV - ok
23:49:21.0350 5624 [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
23:49:21.0350 5624 MSPCLOCK - ok
23:49:21.0365 5624 [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
23:49:21.0365 5624 MSPQM - ok
23:49:21.0397 5624 [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
23:49:21.0412 5624 MsRPC - ok
23:49:21.0412 5624 [ E384487CB84BE41D09711C30CA79646C ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
23:49:21.0428 5624 mssmbios - ok
23:49:21.0428 5624 [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
23:49:21.0443 5624 MSTEE - ok
23:49:21.0459 5624 [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup C:\Windows\system32\Drivers\mup.sys
23:49:21.0475 5624 Mup - ok
23:49:21.0521 5624 [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent C:\Windows\system32\qagentRT.dll
23:49:21.0537 5624 napagent - ok
23:49:21.0631 5624 [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
23:49:21.0631 5624 NativeWifiP - ok
23:49:21.0693 5624 [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS C:\Windows\system32\drivers\ndis.sys
23:49:21.0709 5624 NDIS - ok
23:49:21.0724 5624 [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
23:49:21.0740 5624 NdisTapi - ok
23:49:21.0755 5624 [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
23:49:21.0755 5624 Ndisuio - ok
23:49:21.0802 5624 [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
23:49:21.0849 5624 NdisWan - ok
23:49:21.0880 5624 [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
23:49:21.0880 5624 NDProxy - ok
23:49:21.0927 5624 [ 510C138564486FF926A3F773205C63D1 ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
23:49:21.0927 5624 Net Driver HPZ12 - ok
23:49:21.0974 5624 [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
23:49:21.0974 5624 NetBIOS - ok
23:49:22.0005 5624 [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt C:\Windows\system32\DRIVERS\netbt.sys
23:49:22.0005 5624 netbt - ok
23:49:22.0021 5624 [ A3E186B4B935905B829219502557314E ] Netlogon C:\Windows\system32\lsass.exe
23:49:22.0036 5624 Netlogon - ok
23:49:22.0067 5624 [ C8052711DAECC48B982434C5116CA401 ] Netman C:\Windows\System32\netman.dll
23:49:22.0067 5624 Netman - ok
23:49:22.0114 5624 [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm C:\Windows\System32\netprofm.dll
23:49:22.0114 5624 netprofm - ok
23:49:22.0145 5624 [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
23:49:22.0145 5624 NetTcpPortSharing - ok
23:49:22.0177 5624 [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
23:49:22.0177 5624 nfrd960 - ok
23:49:22.0208 5624 [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc C:\Windows\System32\nlasvc.dll
23:49:22.0239 5624 NlaSvc - ok
23:49:22.0270 5624 Norton PC Checkup Application Launcher - ok
23:49:22.0301 5624 [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs C:\Windows\system32\drivers\Npfs.sys
23:49:22.0301 5624 Npfs - ok
23:49:22.0333 5624 [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi C:\Windows\system32\nsisvc.dll
23:49:22.0333 5624 nsi - ok
23:49:22.0364 5624 [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
23:49:22.0364 5624 nsiproxy - ok
23:49:22.0504 5624 [ 8D11DA92F83D8C8281689739BEF05FD5 ] NSM C:\Program Files\Norton Family\Engine\2.6.0.43\ccSvcHst.exe
23:49:22.0504 5624 NSM - ok
23:49:22.0691 5624 [ 2C1121F2B87E9A6B12485DF53CD848C7 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
23:49:22.0723 5624 Ntfs - ok
23:49:22.0738 5624 [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi C:\Windows\system32\drivers\ntrigdigi.sys
23:49:22.0754 5624 ntrigdigi - ok
23:49:22.0754 5624 [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null C:\Windows\system32\drivers\Null.sys
23:49:22.0769 5624 Null - ok
23:49:22.0847 5624 [ D958A2B5F6AD5C3B8CCDC4D7DA62466C ] NVENETFD C:\Windows\system32\DRIVERS\nvmfdx32.sys
23:49:22.0863 5624 NVENETFD - ok
23:49:23.0347 5624 [ 09F5E33F91E186037262355B0BA72913 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
23:49:23.0471 5624 nvlddmkm - ok
23:49:23.0503 5624 [ 2EDF9E7751554B42CBB60116DE727101 ] nvraid C:\Windows\system32\drivers\nvraid.sys
23:49:23.0503 5624 nvraid - ok
23:49:23.0534 5624 [ 5DD1242CABC1EF8DCE4438D72D72A436 ] nvrd32 C:\Windows\system32\drivers\nvrd32.sys
23:49:23.0534 5624 nvrd32 - ok
23:49:23.0581 5624 [ 62754E376185EACBB73D06FEA0FFC54A ] nvsmu C:\Windows\system32\drivers\nvsmu.sys
23:49:23.0581 5624 nvsmu - ok
23:49:23.0596 5624 [ ABED0C09758D1D97DB0042DBB2688177 ] nvstor C:\Windows\system32\drivers\nvstor.sys
23:49:23.0612 5624 nvstor - ok
23:49:23.0659 5624 [ BB4DD678706510D9249EED1DA0219900 ] nvstor32 C:\Windows\system32\drivers\nvstor32.sys
23:49:23.0659 5624 nvstor32 - ok
23:49:23.0737 5624 [ F531F9B76E3E2595049F145160D280DE ] nvsvc C:\Windows\system32\nvvsvc.exe
23:49:23.0737 5624 nvsvc - ok
23:49:23.0752 5624 [ 18BBDF913916B71BD54575BDB6EEAC0B ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
23:49:23.0752 5624 nv_agp - ok
23:49:23.0768 5624 NwlnkFlt - ok
23:49:23.0768 5624 NwlnkFwd - ok
23:49:23.0846 5624 [ BE32DA025A0BE1878F0EE8D6D9386CD5 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
23:49:23.0846 5624 ohci1394 - ok
23:49:23.0924 5624 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
23:49:23.0939 5624 ose - ok
23:49:24.0189 5624 [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
23:49:24.0314 5624 osppsvc - ok
23:49:24.0345 5624 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc C:\Windows\system32\p2psvc.dll
23:49:24.0376 5624 p2pimsvc - ok
23:49:24.0392 5624 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc C:\Windows\system32\p2psvc.dll
23:49:24.0407 5624 p2psvc - ok
23:49:24.0470 5624 [ 0FA9B5055484649D63C303FE404E5F4D ] Parport C:\Windows\system32\drivers\parport.sys
23:49:24.0501 5624 Parport - ok
23:49:24.0548 5624 [ B9C2B89F08670E159F7181891E449CD9 ] partmgr C:\Windows\system32\drivers\partmgr.sys
23:49:24.0548 5624 partmgr - ok
23:49:24.0548 5624 [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm C:\Windows\system32\drivers\parvdm.sys
23:49:24.0563 5624 Parvdm - ok
23:49:24.0579 5624 [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc C:\Windows\System32\pcasvc.dll
23:49:24.0579 5624 PcaSvc - ok
23:49:24.0673 5624 [ 2F86BE1818C2D7AC90478E3323EE7FCB ] PCCUJobMgr C:\Program Files\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe
23:49:24.0673 5624 PCCUJobMgr - ok
23:49:24.0704 5624 [ 941DC1D19E7E8620F40BBC206981EFDB ] pci C:\Windows\system32\drivers\pci.sys
23:49:24.0719 5624 pci - ok
23:49:24.0735 5624 [ FC175F5DDAB666D7F4D17449A547626F ] pciide C:\Windows\system32\drivers\pciide.sys
23:49:24.0751 5624 pciide - ok
23:49:24.0751 5624 [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
23:49:24.0751 5624 pcmcia - ok
23:49:24.0829 5624 [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
23:49:24.0860 5624 PEAUTH - ok
23:49:24.0922 5624 [ B1689DF169143F57053F795390C99DB3 ] pla C:\Windows\system32\pla.dll
23:49:24.0953 5624 pla - ok
23:49:25.0000 5624 [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay C:\Windows\system32\umpnpmgr.dll
23:49:25.0016 5624 PlugPlay - ok
23:49:25.0047 5624 [ 37E5E8FFBAD35605DAEEC3224EA0E465 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
23:49:25.0047 5624 Pml Driver HPZ12 - ok
23:49:25.0125 5624 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg C:\Windows\system32\p2psvc.dll
23:49:25.0141 5624 PNRPAutoReg - ok
23:49:25.0172 5624 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc C:\Windows\system32\p2psvc.dll
23:49:25.0172 5624 PNRPsvc - ok
23:49:25.0234 5624 [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
23:49:25.0265 5624 PolicyAgent - ok
23:49:25.0297 5624 [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
23:49:25.0297 5624 PptpMiniport - ok
23:49:25.0312 5624 [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor C:\Windows\system32\DRIVERS\processr.sys
23:49:25.0312 5624 Processor - ok
23:49:25.0343 5624 [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc C:\Windows\system32\profsvc.dll
23:49:25.0343 5624 ProfSvc - ok
23:49:25.0390 5624 [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
23:49:25.0390 5624 ProtectedStorage - ok
23:49:25.0421 5624 [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched C:\Windows\system32\DRIVERS\pacer.sys
23:49:25.0421 5624 PSched - ok
23:49:25.0484 5624 [ 0A6DB55AFB7820C99AA1F3A1D270F4F6 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
23:49:25.0515 5624 ql2300 - ok
23:49:25.0546 5624 [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
23:49:25.0546 5624 ql40xx - ok
23:49:25.0577 5624 [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE C:\Windows\system32\qwave.dll
23:49:25.0593 5624 QWAVE - ok
23:49:25.0640 5624 [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
23:49:25.0640 5624 QWAVEdrv - ok
23:49:25.0671 5624 [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
23:49:25.0671 5624 RasAcd - ok
23:49:25.0671 5624 [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto C:\Windows\System32\rasauto.dll
23:49:25.0687 5624 RasAuto - ok
23:49:25.0718 5624 [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
23:49:25.0718 5624 Rasl2tp - ok
23:49:25.0749 5624 [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan C:\Windows\System32\rasmans.dll
23:49:25.0765 5624 RasMan - ok
23:49:25.0811 5624 [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
23:49:25.0811 5624 RasPppoe - ok
23:49:25.0843 5624 [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
23:49:25.0843 5624 RasSstp - ok
23:49:25.0874 5624 [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
23:49:25.0874 5624 rdbss - ok
23:49:25.0889 5624 [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
23:49:25.0889 5624 RDPCDD - ok
23:49:25.0921 5624 [ FBC0BACD9C3D7F6956853F64A66E252D ] rdpdr C:\Windows\system32\drivers\rdpdr.sys
23:49:25.0921 5624 rdpdr - ok
23:49:25.0921 5624 [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
23:49:25.0921 5624 RDPENCDD - ok
23:49:26.0030 5624 [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
23:49:26.0030 5624 RDPWD - ok
23:49:26.0092 5624 [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess C:\Windows\System32\mprdim.dll
23:49:26.0092 5624 RemoteAccess - ok
23:49:26.0108 5624 [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry C:\Windows\system32\regsvc.dll
23:49:26.0123 5624 RemoteRegistry - ok
23:49:26.0139 5624 [ 75E8A6BFA7374ABA833AE92BF41AE4E6 ] ROOTMODEM C:\Windows\system32\Drivers\RootMdm.sys
23:49:26.0139 5624 ROOTMODEM - ok
23:49:26.0248 5624 [ E7062DBD907E0C5CEEB5ABDAF07E6B32 ] RosettaStoneDaemon C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe
23:49:26.0264 5624 RosettaStoneDaemon - ok
23:49:26.0326 5624 [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator C:\Windows\system32\locator.exe
23:49:26.0326 5624 RpcLocator - ok
23:49:26.0357 5624 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs C:\Windows\System32\rpcss.dll
23:49:26.0357 5624 RpcSs - ok
23:49:26.0404 5624 [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
23:49:26.0420 5624 rspndr - ok
23:49:26.0451 5624 [ A3E186B4B935905B829219502557314E ] SamSs C:\Windows\system32\lsass.exe
23:49:26.0451 5624 SamSs - ok
23:49:26.0451 5624 [ 3CE8F073A557E172B330109436984E30 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
23:49:26.0467 5624 sbp2port - ok
23:49:26.0482 5624 [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr C:\Windows\System32\SCardSvr.dll
23:49:26.0498 5624 SCardSvr - ok
23:49:26.0545 5624 [ BB68443901FF680C799E8F4A464ECE39 ] SCDEmu C:\Windows\system32\drivers\SCDEmu.sys
23:49:26.0560 5624 SCDEmu - ok
23:49:26.0607 5624 [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule C:\Windows\system32\schedsvc.dll
23:49:26.0623 5624 Schedule - ok
23:49:26.0701 5624 [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc C:\Windows\System32\certprop.dll
23:49:26.0701 5624 SCPolicySvc - ok
23:49:26.0747 5624 [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC C:\Windows\System32\SDRSVC.dll
23:49:26.0763 5624 SDRSVC - ok
23:49:26.0779 5624 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
23:49:26.0779 5624 secdrv - ok
23:49:26.0794 5624 [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon C:\Windows\system32\seclogon.dll
23:49:26.0794 5624 seclogon - ok
23:49:26.0810 5624 [ A9BBAB5759771E523F55563D6CBE140F ] SENS C:\Windows\system32\sens.dll
23:49:26.0810 5624 SENS - ok
23:49:26.0857 5624 [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum C:\Windows\system32\drivers\serenum.sys
23:49:26.0857 5624 Serenum - ok
23:49:26.0872 5624 [ C70D69A918B178D3C3B06339B40C2E1B ] Serial C:\Windows\system32\drivers\serial.sys
23:49:26.0872 5624 Serial - ok
23:49:26.0888 5624 [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse C:\Windows\system32\drivers\sermouse.sys
23:49:26.0888 5624 sermouse - ok
23:49:27.0169 5624 [ 9910F4097EECBF561B257D614ADEF09A ] ServicepointService C:\Program Files\Windstream\Service Agent\ServicepointService.exe
23:49:27.0356 5624 ServicepointService - ok
23:49:27.0371 5624 [ D2193326F729B163125610DBF3E17D57 ] SessionEnv C:\Windows\system32\sessenv.dll
23:49:27.0387 5624 SessionEnv - ok
23:49:27.0403 5624 [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
23:49:27.0403 5624 sffdisk - ok
23:49:27.0418 5624 [ E95D451F7EA3E583AEC75F3B3EE42DC5 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
23:49:27.0418 5624 sffp_mmc - ok
23:49:27.0434 5624 [ 3D0EA348784B7AC9EA9BD9F317980979 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
23:49:27.0434 5624 sffp_sd - ok
23:49:27.0449 5624 [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
23:49:27.0449 5624 sfloppy - ok
23:49:27.0481 5624 [ D9B734638DD8DBA9D59AAD3189CD0FAD ] Sftfs C:\Windows\system32\DRIVERS\Sftfslh.sys
23:49:27.0496 5624 Sftfs - ok
23:49:27.0512 5624 sftlist - ok
23:49:27.0574 5624 [ 2F61BD46C0BFF4EB36E1E359CA17BFC5 ] Sftplay C:\Windows\system32\DRIVERS\Sftplaylh.sys
23:49:27.0574 5624 Sftplay - ok
23:49:27.0590 5624 [ 518BAC0179F94304F422696B47C0EC12 ] Sftredir C:\Windows\system32\DRIVERS\Sftredirlh.sys
23:49:27.0590 5624 Sftredir - ok
23:49:27.0605 5624 [ 747325236D88B3F05FFD27FF9EC711C5 ] Sftvol C:\Windows\system32\DRIVERS\Sftvollh.sys
23:49:27.0605 5624 Sftvol - ok
23:49:27.0637 5624 [ A5812F0281CA5081BF696626F9BF324D ] sftvsa C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
23:49:27.0637 5624 sftvsa - ok
23:49:27.0715 5624 [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess C:\Windows\System32\ipnathlp.dll
23:49:27.0730 5624 SharedAccess - ok
23:49:27.0761 5624 [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
23:49:27.0761 5624 ShellHWDetection - ok
23:49:27.0793 5624 [ 1D76624A09A054F682D746B924E2DBC3 ] sisagp C:\Windows\system32\drivers\sisagp.sys
23:49:27.0793 5624 sisagp - ok
23:49:27.0808 5624 [ 43CB7AA756C7DB280D01DA9B676CFDE2 ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys
23:49:27.0808 5624 SiSRaid2 - ok
23:49:27.0824 5624 [ A99C6C8B0BAA970D8AA59DDC50B57F94 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
23:49:27.0824 5624 SiSRaid4 - ok
23:49:27.0839 5624 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
23:49:27.0855 5624 SkypeUpdate - ok
23:49:27.0995 5624 [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc C:\Windows\system32\SLsvc.exe
23:49:28.0058 5624 slsvc - ok
23:49:28.0120 5624 [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify C:\Windows\system32\SLUINotify.dll
23:49:28.0120 5624 SLUINotify - ok
23:49:28.0151 5624 [ 7B75299A4D201D6A6533603D6914AB04 ] Smb C:\Windows\system32\DRIVERS\smb.sys
23:49:28.0151 5624 Smb - ok
23:49:28.0183 5624 [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
23:49:28.0183 5624 SNMPTRAP - ok
23:49:28.0214 5624 [ 3FA2E254BFBCE52B3C6F1BF23AAB6911 ] speedfan C:\Windows\system32\speedfan.sys
23:49:28.0214 5624 speedfan - ok
23:49:28.0261 5624 [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr C:\Windows\system32\drivers\spldr.sys
23:49:28.0276 5624 spldr - ok
23:49:28.0354 5624 [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler C:\Windows\System32\spoolsv.exe
23:49:28.0354 5624 Spooler - ok
23:49:28.0495 5624 [ 41987F9FC0E61ADF54F581E15029AD91 ] srv C:\Windows\system32\DRIVERS\srv.sys
23:49:28.0495 5624 srv - ok
23:49:28.0588 5624 [ FF33AFF99564B1AA534F58868CBE41EF ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
23:49:28.0604 5624 srv2 - ok
23:49:28.0619 5624 [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
23:49:28.0651 5624 srvnet - ok
23:49:28.0744 5624 [ D5DFFEAA1E15D4EFFABB9D9A3068AC5B ] sscdbus C:\Windows\system32\DRIVERS\sscdbus.sys
23:49:28.0744 5624 sscdbus - ok
23:49:28.0791 5624 [ 8A1BE0C347814F482F493AEA619D57F6 ] sscdmdfl C:\Windows\system32\DRIVERS\sscdmdfl.sys
23:49:28.0791 5624 sscdmdfl - ok
23:49:28.0838 5624 [ 5AB0B1987F682A59B15B78F84C6AD7D0 ] sscdmdm C:\Windows\system32\DRIVERS\sscdmdm.sys
23:49:28.0853 5624 sscdmdm - ok
23:49:28.0916 5624 [ 751E66EB32EFA80633B80F5D7FF0A1D8 ] sscdserd C:\Windows\system32\DRIVERS\sscdserd.sys
23:49:28.0916 5624 sscdserd - ok
23:49:28.0947 5624 [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
23:49:28.0947 5624 SSDPSRV - ok
23:49:28.0994 5624 [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc C:\Windows\system32\sstpsvc.dll
23:49:29.0009 5624 SstpSvc - ok
23:49:29.0056 5624 [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc C:\Windows\System32\wiaservc.dll
23:49:29.0072 5624 stisvc - ok
23:49:29.0103 5624 [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
23:49:29.0103 5624 swenum - ok
23:49:29.0150 5624 [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv C:\Windows\System32\swprv.dll
23:49:29.0165 5624 swprv - ok
23:49:29.0181 5624 [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys
23:49:29.0181 5624 Symc8xx - ok
23:49:29.0197 5624 [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys
23:49:29.0197 5624 Sym_hi - ok
23:49:29.0212 5624 [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys
23:49:29.0212 5624 Sym_u3 - ok
23:49:29.0243 5624 [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain C:\Windows\system32\sysmain.dll
23:49:29.0259 5624 SysMain - ok
23:49:29.0306 5624 [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
23:49:29.0321 5624 TabletInputService - ok
23:49:29.0353 5624 [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv C:\Windows\System32\tapisrv.dll
23:49:29.0353 5624 TapiSrv - ok
23:49:29.0399 5624 [ CB05822CD9CC6C688168E113C603DBE7 ] TBS C:\Windows\System32\tbssvc.dll
23:49:29.0399 5624 TBS - ok
23:49:29.0431 5624 [ 3535CD93F944C00F098E73E12EE7FEB6 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
23:49:29.0446 5624 Tcpip - ok
23:49:29.0493 5624 [ 3535CD93F944C00F098E73E12EE7FEB6 ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys
23:49:29.0509 5624 Tcpip6 - ok
23:49:29.0555 5624 [ CD21572F83F7EC6E2C20C465967BEDD9 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
23:49:29.0555 5624 tcpipreg - ok
23:49:29.0571 5624 [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
23:49:29.0571 5624 TDPIPE - ok
23:49:29.0587 5624 [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
23:49:29.0587 5624 TDTCP - ok
23:49:29.0618 5624 [ 76B06EB8A01FC8624D699E7045303E54 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
23:49:29.0618 5624 tdx - ok
23:49:29.0649 5624 [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
23:49:29.0649 5624 TermDD - ok
23:49:29.0680 5624 [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService C:\Windows\System32\termsrv.dll
23:49:29.0696 5624 TermService - ok
23:49:29.0711 5624 [ C7230FBEE14437716701C15BE02C27B8 ] Themes C:\Windows\system32\shsvcs.dll
23:49:29.0711 5624 Themes - ok
23:49:29.0727 5624 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER C:\Windows\system32\mmcss.dll
23:49:29.0727 5624 THREADORDER - ok
23:49:29.0758 5624 [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks C:\Windows\System32\trkwks.dll
23:49:29.0758 5624 TrkWks - ok
23:49:29.0805 5624 [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
23:49:29.0821 5624 TrustedInstaller - ok
23:49:29.0836 5624 [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
23:49:29.0836 5624 tssecsrv - ok
23:49:29.0852 5624 [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp C:\Windows\system32\DRIVERS\tunmp.sys
23:49:29.0852 5624 tunmp - ok
23:49:29.0883 5624 [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
23:49:29.0883 5624 tunnel - ok
23:49:29.0883 5624 [ 7D33C4DB2CE363C8518D2DFCF533941F ] uagp35 C:\Windows\system32\drivers\uagp35.sys
23:49:29.0883 5624 uagp35 - ok
23:49:29.0914 5624 [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
23:49:29.0914 5624 udfs - ok
23:49:29.0930 5624 [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
23:49:29.0945 5624 UI0Detect - ok
23:49:29.0961 5624 [ B0ACFDC9E4AF279E9116C03E014B2B27 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
23:49:29.0961 5624 uliagpkx - ok
23:49:29.0977 5624 [ 9224BB254F591DE4CA8D572A5F0D635C ] uliahci C:\Windows\system32\drivers\uliahci.sys
23:49:29.0977 5624 uliahci - ok
23:49:29.0992 5624 [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata C:\Windows\system32\drivers\ulsata.sys
23:49:29.0992 5624 UlSata - ok
23:49:30.0008 5624 [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys
23:49:30.0008 5624 ulsata2 - ok
23:49:30.0023 5624 [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
23:49:30.0023 5624 umbus - ok
23:49:30.0117 5624 [ 927754ABF077AEB5504BE4E0F2C60C1B ] UMVPFSrv C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
23:49:30.0148 5624 UMVPFSrv - ok
23:49:30.0179 5624 [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost C:\Windows\System32\upnphost.dll
23:49:30.0195 5624 upnphost - ok
23:49:30.0226 5624 [ 83CAFCB53201BBAC04D822F32438E244 ] USBAAPL C:\Windows\system32\Drivers\usbaapl.sys
23:49:30.0226 5624 USBAAPL - ok
23:49:30.0257 5624 [ 32DB9517628FF0D070682AAB61E688F0 ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
23:49:30.0257 5624 usbaudio - ok
23:49:30.0304 5624 [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
23:49:30.0304 5624 usbccgp - ok
23:49:30.0367 5624 [ 32C068EAF37C92D7194EEE1FAA1E7853 ] USBCCID C:\Windows\system32\DRIVERS\usbccid.sys
23:49:30.0367 5624 USBCCID - ok
23:49:30.0382 5624 [ 47B9770EA21436DE4AD5AEA7926E0900 ] usbcir C:\Windows\system32\DRIVERS\usbcir.sys
23:49:30.0382 5624 usbcir - ok
23:49:30.0398 5624 [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
23:49:30.0398 5624 usbehci - ok
23:49:30.0413 5624 [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
23:49:30.0413 5624 usbhub - ok
23:49:30.0429 5624 [ CE697FEE0D479290D89BEC80DFE793B7 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
23:49:30.0429 5624 usbohci - ok
23:49:30.0445 5624 [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
23:49:30.0445 5624 usbprint - ok
23:49:30.0507 5624 [ A508C9BD8724980512136B039BBA65E9 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
23:49:30.0507 5624 usbscan - ok
23:49:30.0538 5624 [ D575246188F63DE0ACCF6EAC5FB59E6A ] usbser C:\Windows\system32\DRIVERS\usbser.sys
23:49:30.0538 5624 usbser - ok
23:49:30.0554 5624 [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
23:49:30.0554 5624 USBSTOR - ok
23:49:30.0569 5624 [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
23:49:30.0569 5624 usbuhci - ok
23:49:30.0585 5624 [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys
23:49:30.0585 5624 usbvideo - ok
23:49:30.0647 5624 [ 228F444F9AF0D3B9ECA9FC3F4FEB12F2 ] usb_rndisx C:\Windows\system32\DRIVERS\usb8023x.sys
23:49:30.0663 5624 usb_rndisx - ok
23:49:30.0679 5624 [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms C:\Windows\System32\uxsms.dll
23:49:30.0694 5624 UxSms - ok
23:49:30.0725 5624 [ CD88D1B7776DC17A119049742EC07EB4 ] vds C:\Windows\System32\vds.exe
23:49:30.0741 5624 vds - ok
23:49:30.0757 5624 [ 87B06E1F30B749A114F74622D013F8D4 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
23:49:30.0757 5624 vga - ok
23:49:30.0772 5624 [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave C:\Windows\System32\drivers\vga.sys
23:49:30.0772 5624 VgaSave - ok
23:49:30.0788 5624 [ 5D7159DEF58A800D5781BA3A879627BC ] viaagp C:\Windows\system32\drivers\viaagp.sys
23:49:30.0788 5624 viaagp - ok
23:49:30.0803 5624 [ C4F3A691B5BAD343E6249BD8C2D45DEE ] ViaC7 C:\Windows\system32\drivers\viac7.sys
23:49:30.0803 5624 ViaC7 - ok
23:49:30.0819 5624 [ AADF5587A4063F52C2C3FED7887426FC ] viaide C:\Windows\system32\drivers\viaide.sys
23:49:30.0819 5624 viaide - ok
23:49:30.0835 5624 [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr C:\Windows\system32\drivers\volmgr.sys
23:49:30.0835 5624 volmgr - ok
23:49:30.0866 5624 [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
23:49:30.0866 5624 volmgrx - ok
23:49:30.0897 5624 [ 786DB5771F05EF300390399F626BF30A ] volsnap C:\Windows\system32\drivers\volsnap.sys
23:49:30.0913 5624 volsnap - ok
23:49:31.0022 5624 [ 2FECBD49AEFC6A64B9EA598B772EF8C9 ] Vsdatant C:\Windows\system32\DRIVERS\vsdatant.sys
23:49:31.0022 5624 Vsdatant - ok
23:49:31.0147 5624 vsmon - ok
23:49:31.0178 5624 [ 587253E09325E6BF226B299774B728A9 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
23:49:31.0193 5624 vsmraid - ok
23:49:31.0225 5624 [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS C:\Windows\system32\vssvc.exe
23:49:31.0256 5624 VSS - ok
23:49:31.0334 5624 [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time C:\Windows\system32\w32time.dll
23:49:31.0349 5624 W32Time - ok
23:49:31.0365 5624 [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
23:49:31.0365 5624 WacomPen - ok
23:49:31.0381 5624 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys
23:49:31.0381 5624 Wanarp - ok
23:49:31.0381 5624 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
23:49:31.0381 5624 Wanarpv6 - ok
23:49:31.0427 5624 [ A3CD60FD826381B49F03832590E069AF ] wcncsvc C:\Windows\System32\wcncsvc.dll
23:49:31.0443 5624 wcncsvc - ok
23:49:31.0459 5624 [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
23:49:31.0459 5624 WcsPlugInService - ok
23:49:31.0474 5624 [ 78FE9542363F297B18C027B2D7E7C07F ] Wd C:\Windows\system32\drivers\wd.sys
23:49:31.0474 5624 Wd - ok
23:49:31.0568 5624 [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
23:49:31.0583 5624 Wdf01000 - ok
23:49:31.0599 5624 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost C:\Windows\system32\wdi.dll
23:49:31.0599 5624 WdiServiceHost - ok
23:49:31.0599 5624 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost C:\Windows\system32\wdi.dll
23:49:31.0615 5624 WdiSystemHost - ok
23:49:31.0630 5624 [ 04C37D8107320312FBAE09926103D5E2 ] WebClient C:\Windows\System32\webclnt.dll
23:49:31.0646 5624 WebClient - ok
23:49:31.0708 5624 [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc C:\Windows\system32\wecsvc.dll
23:49:31.0724 5624 Wecsvc - ok
23:49:31.0755 5624 [ 670FF720071ED741206D69BD995EA453 ] wercplsupport C:\Windows\System32\wercplsupport.dll
23:49:31.0755 5624 wercplsupport - ok
23:49:31.0786 5624 [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc C:\Windows\System32\WerSvc.dll
23:49:31.0786 5624 WerSvc - ok
23:49:31.0833 5624 [ 4575AA12561C5648483403541D0D7F2B ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
23:49:31.0833 5624 WinDefend - ok
23:49:31.0849 5624 WinHttpAutoProxySvc - ok
23:49:31.0895 5624 [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
23:49:31.0911 5624 Winmgmt - ok
23:49:31.0958 5624 [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM C:\Windows\system32\WsmSvc.dll
23:49:31.0973 5624 WinRM - ok
23:49:32.0020 5624 [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc C:\Windows\System32\wlansvc.dll
23:49:32.0036 5624 Wlansvc - ok
23:49:32.0145 5624 [ 0A70F4022EC2E14C159EFC4F69AA2477 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
23:49:32.0176 5624 wlidsvc - ok
23:49:32.0207 5624 [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
23:49:32.0207 5624 WmiAcpi - ok
23:49:32.0239 5624 [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
23:49:32.0254 5624 wmiApSrv - ok
23:49:32.0301 5624 [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
23:49:32.0317 5624 WMPNetworkSvc - ok
23:49:32.0410 5624 [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc C:\Windows\System32\wpcsvc.dll
23:49:32.0441 5624 WPCSvc - ok
23:49:32.0457 5624 [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
23:49:32.0473 5624 WPDBusEnum - ok
23:49:32.0519 5624 [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb C:\Windows\system32\DRIVERS\wpdusb.sys
23:49:32.0519 5624 WpdUsb - ok
23:49:32.0972 5624 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
23:49:33.0019 5624 WPFFontCache_v0400 - ok
23:49:33.0034 5624 [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
23:49:33.0034 5624 ws2ifsl - ok
23:49:33.0065 5624 [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc C:\Windows\system32\wscsvc.dll
23:49:33.0065 5624 wscsvc - ok
23:49:33.0065 5624 WSearch - ok
23:49:33.0315 5624 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
23:49:33.0377 5624 wuauserv - ok
23:49:33.0393 5624 [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
23:49:33.0393 5624 WudfPf - ok
23:49:33.0455 5624 [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
23:49:33.0455 5624 WUDFRd - ok
23:49:33.0487 5624 [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
23:49:33.0487 5624 wudfsvc - ok
23:49:33.0518 5624 ================ Scan global ===============================
23:49:33.0549 5624 [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
23:49:33.0596 5624 [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll
23:49:33.0611 5624 [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll
23:49:33.0658 5624 [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
23:49:33.0658 5624 [Global] - ok
23:49:33.0658 5624 ================ Scan MBR ==================================
23:49:33.0674 5624 [ 81CD5EC01DB0CE57EDD853F82462EF27 ] \Device\Harddisk0\DR0
23:49:34.0516 5624 \Device\Harddisk0\DR0 - ok
23:49:34.0516 5624 ================ Scan VBR ==================================
23:49:34.0594 5624 [ CEF15918BE2688DEFAA35F41055B3604 ] \Device\Harddisk0\DR0\Partition1
23:49:34.0594 5624 \Device\Harddisk0\DR0\Partition1 - ok
23:49:34.0625 5624 [ 0B0DA37ADE752F88D2202D35A96D330D ] \Device\Harddisk0\DR0\Partition2
23:49:34.0625 5624 \Device\Harddisk0\DR0\Partition2 - ok
23:49:34.0625 5624 ============================================================
23:49:34.0625 5624 Scan finished
23:49:34.0625 5624 ============================================================
23:49:34.0641 5032 Detected object count: 0
23:49:34.0641 5032 Actual detected object count: 0

computerwannabe

Post #15June 6, 2013, 5:50 AM UTC

I just emptied out the java cache, but no improvement. So, I restarted firefox in safe mode and it goes away. The problem is that I don't have any extensions that should be causing the problem. I am going to try to isolate it to one add-on anyway.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Redirect insanity [Solved]

✨ Ask AI

Ask AI