What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Google re-direct - Please help [Solved]

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello, I had this issue a year ago and this forum was able to help me. It has now started to re-appear. If I click on a search result in google, it re-directs me to an advertising site. Any help would be greatly appreciated. Here are the results of Hijack This; Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 9:06:23 AM, on 7/5/2013 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v9.00 (9.00.8112.16490) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\RtHDVCpl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\McAfee Security Scan\2.1.121\SSScheduler.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Gwill\Desktop\HiJackThis.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - Unknown owner - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (file missing) O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe – End of file - 2190 bytes Thank You, Greg
Post #2
Hi there,
my name is Marius and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.
  • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.




Please download Gmer from here by clicking on the "Download EXE" Button.
  • Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Show All ( should be unchecked by default )
  • Leave everything else as it is.
  • Close all other running programs as well as your Browser.
  • Click the Scan button & wait for it to finish.
  • Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop.
  • Please post the content of the ark.txt here.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries




Download and run OTL

  • Download OTL by OldTimer and save it to your desktop.
  • Double click on the OTL.exe icon on your desktop. If you are using Vista, please right-click and select run as administrator
  • Click the "Scan All Users" checkbox.


    Note: If you are using a Windows 64bit machine, please make sure the checkbox next to Include 64Bit Scans is checked. It will be checked by default.

  • Push the [external image: Posted Image] button.
  • It will now begin to scan, please be paitent while it scans.
  • Two reports will open once it's done.
  • Please copy and paste them in your next reply:
  • OTL.txt <– Will be opened
  • Extras.txt <– Will be minimized





Please read and follow these instructions carefully. We do not want it to fix anything yet (if found), we need to see a report first.

Download TDSSKiller.exe and save it to your desktop
  • Execute TDSSKiller.exe by doubleclicking on it.
  • Press Start Scan
  • If Malicious objects are found, do NOT select Cure. Change the action to Skip, and save the log.
  • Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.log.txt

Please post the contents of that log in your next reply.
Post #3
Hello, Thank you for your help. I could not run GMER.exe. The first time it asked for a disk and locked up. Now it claims that it encountered a problem and will close
Post #4
It seems to hang up on \Device\HarddiskVolumeShadowCopy4. The message is that it stopped working correctly and will close. I re-loaded a new copy and it did the same thing. Would virus protection cause problems?
Post #5
Yes, that may be possible. Deactivate your virus protection for the scan. When failing again, skip the gmer scan
Post #6
Hello,
GMER would not run.
Here are the results of OTL

OTL logfile created on: 7/8/2013 12:48:01 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gwill\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 0.90 Gb Available Physical Memory | 45.16% Memory free
4.23 Gb Paging File | 2.79 Gb Available in Paging File | 65.83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 315.03 Gb Free Space | 69.13% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.07 Gb Free Space | 60.71% Space Free | Partition Type: NTFS

Computer Name: GWILL-DESKTOP | User Name: Gwill | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/07/08 12:28:48 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Gwill\Desktop\OTL.exe
PRC - [2013/01/27 12:11:46 | 000,295,232 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\NisSrv.exe
PRC - [2013/01/27 12:11:46 | 000,020,456 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/01/27 12:11:06 | 000,947,152 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/20 02:04:38 | 000,393,216 | —- | M] (AMD) – C:\Windows\System32\atieclxx.exe
PRC - [2011/04/20 02:04:08 | 000,176,128 | —- | M] (AMD) – C:\Windows\System32\atiesrxx.exe
PRC - [2010/09/03 02:45:02 | 000,255,536 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee Security Scan\2.1.121\SSScheduler.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/01/17 07:22:20 | 004,907,008 | —- | M] (Realtek Semiconductor) – C:\Windows\RtHDVCpl.exe
PRC - [2007/12/05 06:17:24 | 000,077,824 | —- | M] (Andrea Electronics Corporation) – C:\Windows\System32\AERTSrv.exe


========== Modules (No Company Name) ==========

MOD - [2013/07/02 22:27:54 | 000,360,448 | —- | M] () – C:\Users\Gwill\AppData\Roaming\isroht.dll
MOD - [2013/05/15 16:25:27 | 012,433,920 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\e9ea3e70247b4aa4a8b260426db3aa6b\System.Windows.Forms.ni.dll
MOD - [2013/02/15 17:57:49 | 011,820,544 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\421cb77e6a4c21f94e3c5ddf766de23b\System.Web.ni.dll
MOD - [2013/01/11 16:45:53 | 000,025,600 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9b2eef59d0cfc5aff182d0951de5f040\Accessibility.ni.dll
MOD - [2013/01/11 16:45:50 | 000,771,584 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b5df40c22ab563a816103629e2ca99d4\System.Runtime.Remoting.ni.dll
MOD - [2013/01/11 16:45:15 | 005,450,752 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b757806657fa5db2b1ed1a89b026b463\System.Xml.ni.dll
MOD - [2013/01/11 16:44:35 | 001,593,856 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\78157a494dc9a7e52be8840decfcd9cc\System.Drawing.ni.dll
MOD - [2013/01/11 16:43:33 | 007,977,984 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System\cc149d08e75f8c53cd28ac926b38c370\System.ni.dll
MOD - [2013/01/11 16:43:26 | 011,492,352 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\2227d1559f87943255069398608d5c56\mscorlib.ni.dll
MOD - [2012/02/20 21:29:04 | 000,087,912 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 21:28:42 | 001,242,472 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/04/20 01:21:02 | 000,037,376 | —- | M] () – C:\Windows\System32\atitmpxx.dll
MOD - [2008/08/19 20:08:06 | 000,266,240 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3075.38702__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2008/08/19 20:08:06 | 000,011,776 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Runtime\2.0.3075.39053__90ba9c70f846762e\CLI.Caste.HydraVision.Runtime.dll
MOD - [2008/08/19 20:08:06 | 000,008,704 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Shared\2.0.3075.39052__90ba9c70f846762e\CLI.Caste.HydraVision.Shared.dll
MOD - [2008/08/19 20:08:00 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3036.27945__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2008/08/19 20:08:00 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3036.27937__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2008/08/19 20:08:00 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3036.27963__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2008/08/19 20:07:59 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3036.27993__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2008/08/19 20:07:59 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3036.27993__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2008/08/19 20:07:58 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3036.27930__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2008/08/19 20:07:58 | 000,028,672 | —- | M] () – C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3036.27933__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2008/08/19 20:07:58 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3036.27964__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2008/08/19 20:07:58 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3036.27960__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2008/08/19 20:07:58 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.3036.27964__90ba9c70f846762e\DEM.OS.dll
MOD - [2008/08/19 20:07:57 | 000,053,248 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3036.27933__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2008/08/19 20:07:57 | 000,053,248 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3036.27946__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2008/08/19 20:07:57 | 000,045,056 | —- | M] () – C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2008/08/19 20:07:57 | 000,028,672 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3036.28032__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2008/08/19 20:07:57 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3036.27948__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2008/08/19 20:07:57 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3036.27945__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2008/08/19 20:07:57 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3036.27940__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2008/08/19 20:07:57 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3036.27964__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2008/08/19 20:07:57 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2008/08/19 20:07:57 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3036.27944__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2008/08/19 20:07:55 | 000,024,576 | —- | M] () – C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2008/08/19 20:07:55 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3036.27944__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2008/08/19 20:07:55 | 000,011,264 | —- | M] () – C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3075.39054__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll
MOD - [2008/08/19 20:07:54 | 000,397,312 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3075.38732__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2008/08/19 20:07:54 | 000,102,400 | —- | M] () – C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3075.39003__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2008/08/19 20:07:54 | 000,061,440 | —- | M] () – C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3075.39000__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2008/08/19 20:07:54 | 000,045,056 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3075.39039__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2008/08/19 20:07:54 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3036.27937__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2008/08/19 20:07:54 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3036.27941__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2008/08/19 20:07:54 | 000,024,576 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3036.27962__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2008/08/19 20:07:54 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3036.27961__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2008/08/19 20:07:54 | 000,016,384 | —- | M] () – C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3036.27941__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll
MOD - [2008/08/19 20:07:54 | 000,014,848 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
MOD - [2008/08/19 20:07:54 | 000,013,312 | —- | M] () – C:\Windows\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll
MOD - [2008/08/19 20:07:53 | 000,417,792 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3075.38993__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2008/08/19 20:07:53 | 000,053,248 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3075.38696__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2008/08/19 20:07:53 | 000,053,248 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3075.38693__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2008/08/19 20:07:53 | 000,045,056 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3036.27962__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2008/08/19 20:07:53 | 000,020,480 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3036.27959__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2008/08/19 20:07:51 | 000,991,232 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3075.38710__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2008/08/19 20:07:51 | 000,040,960 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3036.27949__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2008/08/19 20:07:51 | 000,028,672 | —- | M] () – C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3075.39002__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2008/08/19 20:07:50 | 000,069,632 | —- | M] () – C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.3075.38694__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2008/08/19 20:07:50 | 000,045,056 | —- | M] () – C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3075.38691__90ba9c70f846762e\AEM.Server.dll
MOD - [2008/08/19 20:07:50 | 000,032,768 | —- | M] () – C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll


========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter – (sprtsvc_dellsupportcenter)
SRV - File not found [Auto | Stopped] – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe – (aawservice)
SRV - [2013/06/11 17:26:40 | 000,256,904 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2013/01/27 12:11:46 | 000,295,232 | —- | M] (Microsoft Corporation) [On_Demand | Running] – c:\Program Files\Microsoft Security Client\NisSrv.exe – (NisSrv)
SRV - [2013/01/27 12:11:46 | 000,020,456 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - [2011/04/20 02:04:08 | 000,176,128 | —- | M] (AMD) [Auto | Running] – C:\Windows\System32\atiesrxx.exe – (AMD External Events Utility)
SRV - [2010/09/03 02:45:02 | 000,227,232 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee Security Scan\2.1.121\McCHSvc.exe – (McComponentHostService)
SRV - [2008/01/19 03:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/12/05 06:17:24 | 000,077,824 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Windows\System32\AERTSrv.exe – (AERTFilters)
SRV - [2007/03/19 13:44:44 | 000,070,656 | —- | M] () [On_Demand | Stopped] – C:\Program Files\DellSupport\brkrsvc.exe – (DSBrokerService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\ComboFix\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - File not found [Kernel | On_Demand | Unknown] – C:\Users\Gwill\AppData\Local\Temp\aglyiaob.sys – (aglyiaob)
DRV - [2013/05/03 10:20:02 | 000,022,640 | —- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] – c:\Program Files\My Dell\pcdsrvc.pkms – (PCDSRVC{5B8A2B68-04D6B966-06020200}_0)
DRV - [2013/01/20 16:59:04 | 000,100,328 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\Windows\System32\drivers\NisDrvWFP.sys – (NisDrv)
DRV - [2011/04/20 02:43:42 | 007,772,160 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2011/04/20 02:43:42 | 007,772,160 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (atikmdag)
DRV - [2011/04/20 02:43:42 | 007,772,160 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmdag.sys – (amdkmdag)
DRV - [2011/04/20 01:22:10 | 000,243,712 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmpag.sys – (amdkmdap)
DRV - [2008/01/19 02:14:59 | 000,016,896 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WSDPrint.sys – (WSDPrintDevice)
DRV - [2007/09/23 00:11:30 | 007,478,432 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\nvlddmkm.sys – (nvlddmkm)
DRV - [2007/08/09 19:12:30 | 000,110,624 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\nvstor32.sys – (nvstor32)
DRV - [2007/03/15 09:57:30 | 001,059,112 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\nvmfdx32.sys – (NVENETFD)
DRV - [2007/02/25 13:10:48 | 000,005,376 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\dsunidrv.sys – (dsunidrv)
DRV - [2006/11/02 03:30:55 | 000,200,704 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express)
DRV - [2006/10/18 14:08:18 | 000,258,048 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HSXHWBS2.sys – (HSXHWBS2)
DRV - [2006/10/05 18:07:28 | 000,004,736 | —- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2006/08/04 20:39:10 | 000,008,192 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUS


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
IE - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
IE - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.7: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Gwill\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/02 15:57:35 | 000,000,000 | —D | M]

[2008/09/02 20:40:43 | 000,000,000 | —D | M] (No name found) – C:\Users\Gwill\AppData\Roaming\Mozilla\Extensions
[2008/09/02 20:40:43 | 000,000,000 | —D | M] (No name found) – C:\Users\Gwill\AppData\Roaming\Mozilla\Extensions\[removed]

========== Chrome ==========


O1 HOSTS File: ([2012/10/22 12:10:16 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll File not found
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\..\Toolbar\WebBrowser: (no name) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000..\Run: [isroht] C:\Users\Gwill\AppData\Roaming\isroht.dll ()
O4 - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000..\Run: [Sidebar] C:\Program Files\windows sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000..\Run: [snsesi] C:\Users\Gwill\AppData\Roaming\snsesi.dll (Mise Technology,Inc)
O4 - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-2861772215-3948250270-1845948433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disableregistrytools = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O16 - DPF: {3641803B-72A4-4A9A-BA18-F1446F7CCDE4} http://hnshelby.dyndns.org/UltraHVCamX.cab (UltraHVCamX Class)
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} https://support.dell.com/systemprofiler/SysProExe.CAB (WMI Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E393E313-4DFC-443B-8446-CC200B06B290}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Gwill\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Gwill\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/07/08 12:28:48 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Gwill\Desktop\OTL.exe
[2013/07/05 09:04:28 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Gwill\Desktop\HiJackThis.exe
[2013/07/02 22:27:42 | 000,585,728 | —- | C] (Mise Technology,Inc) – C:\Users\Gwill\AppData\Roaming\snsesi.dll
[2013/06/21 16:35:41 | 000,000,000 | —D | C] – C:\Users\Gwill\AppData\Roaming\vlc
[2013/06/21 16:35:27 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2013/06/13 15:51:45 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2013/06/13 15:51:43 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2013/06/13 15:51:43 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2013/06/13 15:51:42 | 000,607,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2013/06/13 15:51:42 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2013/06/13 15:51:40 | 001,800,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2013/06/13 15:51:40 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2013/06/13 15:51:36 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2013/06/12 15:54:01 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printcom.dll
[2013/06/12 15:53:53 | 000,812,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\certutil.exe
[2013/06/12 15:53:52 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\certenc.dll
[2013/06/12 15:53:29 | 003,603,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2013/06/12 15:53:28 | 003,551,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2013/06/12 15:52:26 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cryptdlg.dll
[2013/06/10 20:15:46 | 000,000,000 | —D | C] – C:\Users\Gwill\Desktop\New Folder

========== Files - Modified Within 30 Days ==========

[2013/07/08 12:48:00 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/08 12:28:48 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Gwill\Desktop\OTL.exe
[2013/07/08 12:26:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/07/08 11:39:37 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/08 11:39:25 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/07/08 11:39:25 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/07/08 11:39:17 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/07/08 11:39:14 | 2145,902,592 | -HS- | M] () – C:\hiberfil.sys
[2013/07/07 17:25:59 | 000,011,776 | —- | M] () – C:\Users\Gwill\Desktop\Fuel Consumption 2010.xlr
[2013/07/07 17:25:59 | 000,002,016 | —- | M] () – C:\Users\Gwill\AppData\Roaming\wklnhst.dat
[2013/07/06 22:21:53 | 000,217,088 | —- | M] () – C:\Users\Gwill\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/07/05 09:04:28 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Gwill\Desktop\HiJackThis.exe
[2013/07/05 08:14:49 | 000,000,000 | —- | M] () – C:\Users\Gwill\AppData\Local\d3d9caps.dat
[2013/07/05 08:06:49 | 000,604,264 | —- | M] () – C:\Windows\System32\perfh009.dat
[2013/07/05 08:06:49 | 000,103,964 | —- | M] () – C:\Windows\System32\perfc009.dat
[2013/07/03 06:25:11 | 000,000,908 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/02 22:27:54 | 000,360,448 | —- | M] () – C:\Users\Gwill\AppData\Roaming\isroht.dll
[2013/07/02 22:27:43 | 000,585,728 | —- | M] (Mise Technology,Inc) – C:\Users\Gwill\AppData\Roaming\snsesi.dll
[2013/06/30 08:25:13 | 000,095,847 | —- | M] () – C:\Users\Gwill\Desktop\Septic Plan.pdf
[2013/06/21 16:35:28 | 000,000,861 | —- | M] () – C:\Users\Public\Desktop\VLC media player.lnk
[2013/06/16 19:50:02 | 000,405,920 | —- | M] () – C:\Users\Gwill\Desktop\67_WM300_Color68wm_wiring2.jpg
[2013/06/11 17:26:38 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2013/06/11 17:26:38 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2013/07/02 22:27:54 | 000,360,448 | —- | C] () – C:\Users\Gwill\AppData\Roaming\isroht.dll
[2013/06/30 08:25:13 | 000,095,847 | —- | C] () – C:\Users\Gwill\Desktop\Septic Plan.pdf
[2013/06/21 16:35:28 | 000,000,861 | —- | C] () – C:\Users\Public\Desktop\VLC media player.lnk
[2013/06/16 19:52:45 | 000,405,920 | —- | C] () – C:\Users\Gwill\Desktop\67_WM300_Color68wm_wiring2.jpg
[2013/04/28 20:20:24 | 000,876,544 | —- | C] () – C:\Windows\System32\TEACico2.dll
[2012/06/08 17:05:15 | 000,165,376 | —- | C] () – C:\Windows\System32\unrar.dll
[2012/03/13 23:33:00 | 000,002,554 | —- | C] () – C:\Windows\WAVEMIX.INI
[2012/03/13 23:32:52 | 000,000,162 | —- | C] () – C:\Windows\SimTower.ini
[2008/08/12 17:31:02 | 000,000,000 | —- | C] () – C:\Users\Gwill\AppData\Local\d3d9caps.dat
[2008/08/02 11:33:38 | 000,000,005 | —- | C] () – C:\Users\Gwill\AppData\Roaming\openList.awt
[2008/08/02 11:33:38 | 000,000,005 | —- | C] () – C:\Users\Gwill\AppData\Roaming\closedListSW.awt
[2008/08/02 11:33:38 | 000,000,005 | —- | C] () – C:\Users\Gwill\AppData\Roaming\closedList.awt
[2008/04/02 22:32:26 | 000,002,016 | —- | C] () – C:\Users\Gwill\AppData\Roaming\wklnhst.dat
[2008/04/02 20:35:58 | 000,217,088 | —- | C] () – C:\Users\Gwill\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2012/12/18 22:10:54 | 000,000,000 | -HSD | M] – C:\$RECYCLE.BIN\S-1-5-18\$e4547d5306294d448f43a6a348142b53\L
[2013/07/08 12:37:45 | 000,000,000 | -HSD | M] – C:\$RECYCLE.BIN\S-1-5-18\$e4547d5306294d448f43a6a348142b53\U
[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 13:47:00 | 011,586,048 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/04/11 02:28:25 | 000,347,648 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:5C321E34

< End of report >


OTL Extras logfile created on: 7/8/2013 12:48:01 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gwill\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 0.90 Gb Available Physical Memory | 45.16% Memory free
4.23 Gb Paging File | 2.79 Gb Available in Paging File | 65.83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 315.03 Gb Free Space | 69.13% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.07 Gb Free Space | 60.71% Space Free | Partition Type: NTFS

Computer Name: GWILL-DESKTOP | User Name: Gwill | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

[HKEY_USERS\S-1-5-21-2861772215-3948250270-1845948433-1000\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – Reg Error: Key error.
https [open] – Reg Error: Value error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" (VideoLAN)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" (VideoLAN)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{11E568E0-3244-4BCB-875E-F334269DFDCB}" = iTunes
"{12A77AEC-B633-97A3-76D1-1E51CD95B3DE}" = Skins
"{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
"{184E7118-0295-43C4-B72C-1D54AA75AAF7}" = Windows Live Mail
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217013FF}" = Java 7 Update 13
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{390DD8BB-BB57-4942-A029-2D913E4E9D74}" = Microsoft Security Client
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E25E350-949F-4DB7-8288-2A60E018B4C1}" = Games, Music, & Photos Launcher
"{3EE21862-A42C-7F88-21E4-CC69F08867A0}" = Catalyst Control Center InstallProxy
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{42820683-97F2-EEE7-40F9-F250177A331C}" = ccc-core-static
"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A3B5C49-25D6-48F8-7192-3BE2E9266D25}" = Catalyst Control Center HydraVision Full
"{51071D66-D034-4239-94E0-723FCA10B6FE}" = OpenOffice.org 3.4
"{57ED7672-598B-574A-C05A-ADE75DF353C4}" = Catalyst Control Center Graphics Previews Vista
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78898255-91E7-C0F9-D519-8F30D191504A}" = Catalyst Control Center Graphics Light
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{889174DD-608C-A160-0D56-B97B9ACC6AFE}" = Catalyst Control Center Core Implementation
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C4B3C02-A3B3-292C-6A5E-8963681E1916}" = Catalyst Control Center Graphics Full Existing
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95F7D93B-8323-B7A5-371A-92A5707DFF55}" = Catalyst Control Center Graphics Full New
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}" = Windows Live installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.3
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{BD9C0A48-6ABB-E1E1-A9FE-2BE2C0EBC179}" = CCC Help English
"{BE3F26EE-F81B-4A50-8376-271F5CA84C5B}" = Catalyst Control Center - Branding
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{CE1F6FEC-91B8-CF83-300F-5117BDFD9104}" = ccc-utility
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE6DEE87-1C87-42ED-A108-7369BFE9076F}" = 32 bit Windows Card Reader Driver
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{EB010F48-9101-4508-F160-62D69F6DD069}" = ATI Catalyst Install Manager
"{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"AMDAway INF" = AMDAway INF
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 PCI V.92 Modem
"ESET Online Scanner" = ESET Online Scanner v3
"InstallShield_{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"NVIDIA Drivers" = NVIDIA Drivers
"PC-Doctor for Windows" = My Dell
"SpywareBlaster_is1" = SpywareBlaster 4.6
"VLC media player" = VLC media player 2.0.7

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2861772215-3948250270-1845948433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 7/6/2013 5:33:04 PM | Computer Name = Gwill-Desktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7800

Error - 7/6/2013 5:33:04 PM | Computer Name = Gwill-Desktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7800

Error - 7/6/2013 5:33:05 PM | Computer Name = Gwill-Desktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/6/2013 5:33:05 PM | Computer Name = Gwill-Desktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8798

Error - 7/6/2013 5:33:05 PM | Computer Name = Gwill-Desktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8798

Error - 7/6/2013 5:33:06 PM | Computer Name = Gwill-Desktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/6/2013 5:33:06 PM | Computer Name = Gwill-Desktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9797

Error - 7/6/2013 5:33:06 PM | Computer Name = Gwill-Desktop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9797

Error - 7/7/2013 4:47:40 PM | Computer Name = Gwill-Desktop | Source = Application Error | ID = 1000
Description = Faulting application rundll32.exe, version 6.0.6000.16386, time stamp
0x4549b0e1, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception
code 0xc0000005, fault offset 0x00000000, process id 0xe38, application start time
0x01ce7b4f18877116.

Error - 7/8/2013 12:27:04 PM | Computer Name = Gwill-Desktop | Source = Application Error | ID = 1000
Description = Faulting application 3zzttntr.exe, version 2.1.19163.0, time stamp
0x515d31f0, faulting module 3zzttntr.exe, version 2.1.19163.0, time stamp 0x515d31f0,
exception code 0xc0000005, fault offset 0x00012288, process id 0x1658, application
start time 0x01ce7bf7eef04d78.

[ System Events ]
Error - 7/8/2013 11:40:58 AM | Computer Name = Gwill-Desktop | Source = Service Control Manager | ID = 7000
Description =

Error - 7/8/2013 11:40:58 AM | Computer Name = Gwill-Desktop | Source = Service Control Manager | ID = 7000
Description =

Error - 7/8/2013 11:40:58 AM | Computer Name = Gwill-Desktop | Source = Service Control Manager | ID = 7026
Description =

Error - 7/8/2013 11:50:33 AM | Computer Name = Gwill-Desktop | Source = DCOM | ID = 10016
Description =

Error - 7/8/2013 12:00:33 PM | Computer Name = Gwill-Desktop | Source = DCOM | ID = 10016
Description =

Error - 7/8/2013 12:10:33 PM | Computer Name = Gwill-Desktop | Source = DCOM | ID = 10016
Description =

Error - 7/8/2013 12:20:33 PM | Computer Name = Gwill-Desktop | Source = DCOM | ID = 10016
Description =

Error - 7/8/2013 12:30:33 PM | Computer Name = Gwill-Desktop | Source = DCOM | ID = 10016
Description =

Error - 7/8/2013 12:40:33 PM | Computer Name = Gwill-Desktop | Source = DCOM | ID = 10016
Description =

Error - 7/8/2013 12:50:33 PM | Computer Name = Gwill-Desktop | Source = DCOM | ID = 10016
Description =


< End of report >


And TDSSKiller

12:59:16.0819 1628 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
12:59:17.0584 1628 ============================================================
12:59:17.0584 1628 Current date / time: 2013/07/08 12:59:17.0584
12:59:17.0584 1628 SystemInfo:
12:59:17.0584 1628
12:59:17.0584 1628 OS Version: 6.0.6002 ServicePack: 2.0
12:59:17.0584 1628 Product type: Workstation
12:59:17.0584 1628 ComputerName: GWILL-DESKTOP
12:59:17.0584 1628 UserName: Gwill
12:59:17.0584 1628 Windows directory: C:\Windows
12:59:17.0584 1628 System windows directory: C:\Windows
12:59:17.0584 1628 Processor architecture: Intel x86
12:59:17.0584 1628 Number of processors: 2
12:59:17.0584 1628 Page size: 0x1000
12:59:17.0584 1628 Boot type: Normal boot
12:59:17.0584 1628 ============================================================
12:59:18.0567 1628 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
12:59:18.0707 1628 ============================================================
12:59:18.0707 1628 \Device\Harddisk0\DR0:
12:59:18.0707 1628 MBR partitions:
12:59:18.0707 1628 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x18000, BlocksNum 0x1400000
12:59:18.0707 1628 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1418000, BlocksNum 0x38F6D800
12:59:18.0707 1628 ============================================================
12:59:18.0754 1628 C: <-> \Device\Harddisk0\DR0\Partition2
12:59:18.0801 1628 D: <-> \Device\Harddisk0\DR0\Partition1
12:59:18.0801 1628 ============================================================
12:59:18.0801 1628 Initialize success
12:59:18.0801 1628 ============================================================
12:59:21.0375 4248 ============================================================
12:59:21.0375 4248 Scan started
12:59:21.0375 4248 Mode: Manual;
12:59:21.0375 4248 ============================================================
12:59:21.0687 4248 ================ Scan system memory ========================
12:59:21.0687 4248 System memory - ok
12:59:21.0687 4248 ================ Scan services =============================
12:59:21.0796 4248 aawservice - ok
12:59:21.0983 4248 [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI C:\Windows\system32\drivers\acpi.sys
12:59:21.0983 4248 ACPI - ok
12:59:22.0014 4248 [ 9915504F602D277EE47FD843A677FD15 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
12:59:22.0014 4248 AdobeFlashPlayerUpdateSvc - ok
12:59:22.0077 4248 [ 2EDC5BBAC6C651ECE337BDE8ED97C9FB ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
12:59:22.0092 4248 adp94xx - ok
12:59:22.0139 4248 [ B84088CA3CDCA97DA44A984C6CE1CCAD ] adpahci C:\Windows\system32\drivers\adpahci.sys
12:59:22.0139 4248 adpahci - ok
12:59:22.0170 4248 [ 7880C67BCCC27C86FD05AA2AFB5EA469 ] adpu160m C:\Windows\system32\drivers\adpu160m.sys
12:59:22.0170 4248 adpu160m - ok
12:59:22.0186 4248 [ 9AE713F8E30EFC2ABCCD84904333DF4D ] adpu320 C:\Windows\system32\drivers\adpu320.sys
12:59:22.0201 4248 adpu320 - ok
12:59:22.0233 4248 [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
12:59:22.0248 4248 AeLookupSvc - ok
12:59:22.0279 4248 [ 330A1E4DF07C2E29949ED8631CD8828E ] AERTFilters C:\Windows\system32\AERTSrv.exe
12:59:22.0279 4248 AERTFilters - ok
12:59:22.0326 4248 [ 3911B972B55FEA0478476B2E777B29FA ] AFD C:\Windows\system32\drivers\afd.sys
12:59:22.0342 4248 AFD - ok
12:59:22.0357 4248 [ 8B10CE1C1F9F1D47E4DEB1A547A00CD4 ] agp440 C:\Windows\system32\drivers\agp440.sys
12:59:22.0357 4248 agp440 - ok
12:59:22.0389 4248 [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx C:\Windows\system32\drivers\djsvs.sys
12:59:22.0389 4248 aic78xx - ok
12:59:22.0420 4248 [ A1545B731579895D8CC44FC0481C1192 ] ALG C:\Windows\System32\alg.exe
12:59:22.0435 4248 ALG - ok
12:59:22.0451 4248 [ DC67A153FDB8105B25D05334B5E1D8E2 ] aliide C:\Windows\system32\drivers\aliide.sys
12:59:22.0451 4248 aliide - ok
12:59:22.0498 4248 [ C5DBBCDA07D780BDA9B685DF333BB41E ] amacpi C:\Windows\system32\DRIVERS\null.sys
12:59:22.0498 4248 amacpi - ok
12:59:22.0545 4248 [ EBCCBCBF1DF132E4775E5D6E6DEA3ED0 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
12:59:22.0560 4248 AMD External Events Utility - ok
12:59:22.0576 4248 [ 848F27E5B27C1C253F6CEFDC1A5D8F21 ] amdagp C:\Windows\system32\drivers\amdagp.sys
12:59:22.0576 4248 amdagp - ok
12:59:22.0623 4248 [ 835C4C3355088298A5EBD818FA31430F ] amdide C:\Windows\system32\drivers\amdide.sys
12:59:22.0623 4248 amdide - ok
12:59:22.0654 4248 [ DC487885BCEF9F28EECE6FAC0E5DDFC5 ] AmdK7 C:\Windows\system32\drivers\amdk7.sys
12:59:22.0654 4248 AmdK7 - ok
12:59:22.0685 4248 [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
12:59:22.0685 4248 AmdK8 - ok
12:59:22.0935 4248 [ F89643A2CA001B1162061E306F8BF267 ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys
12:59:23.0044 4248 amdkmdag - ok
12:59:23.0091 4248 [ FB68E1B9CEC598F0F69503F3AEBB45DD ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys
12:59:23.0091 4248 amdkmdap - ok
12:59:23.0137 4248 [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo C:\Windows\System32\appinfo.dll
12:59:23.0137 4248 Appinfo - ok
12:59:23.0231 4248 [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
12:59:23.0231 4248 Apple Mobile Device - ok
12:59:23.0293 4248 [ 5F673180268BB1FDB69C99B6619FE379 ] arc C:\Windows\system32\drivers\arc.sys
12:59:23.0293 4248 arc - ok
12:59:23.0340 4248 [ 957F7540B5E7F602E44648C7DE5A1C05 ] arcsas C:\Windows\system32\drivers\arcsas.sys
12:59:23.0356 4248 arcsas - ok
12:59:23.0403 4248 [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
12:59:23.0403 4248 AsyncMac - ok
12:59:23.0465 4248 [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi C:\Windows\system32\drivers\atapi.sys
12:59:23.0465 4248 atapi - ok
12:59:23.0652 4248 [ F89643A2CA001B1162061E306F8BF267 ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys
12:59:23.0715 4248 atikmdag - ok
12:59:23.0777 4248 [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
12:59:23.0793 4248 AudioEndpointBuilder - ok
12:59:23.0793 4248 [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv C:\Windows\System32\Audiosrv.dll
12:59:23.0808 4248 Audiosrv - ok
12:59:23.0855 4248 [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep C:\Windows\system32\drivers\Beep.sys
12:59:23.0855 4248 Beep - ok
12:59:23.0902 4248 [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE C:\Windows\System32\bfe.dll
12:59:23.0902 4248 BFE - ok
12:59:23.0964 4248 [ 93952506C6D67330367F7E7934B6A02F ] BITS C:\Windows\System32\qmgr.dll
12:59:23.0980 4248 BITS - ok
12:59:23.0980 4248 blbdrive - ok
12:59:24.0058 4248 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
12:59:24.0058 4248 Bonjour Service - ok
12:59:24.0120 4248 [ 35F376253F687BDE63976CCB3F2108CA ] bowser C:\Windows\system32\DRIVERS\bowser.sys
12:59:24.0120 4248 bowser - ok
12:59:24.0167 4248 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys
12:59:24.0167 4248 BrFiltLo - ok
12:59:24.0167 4248 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys
12:59:24.0167 4248 BrFiltUp - ok
12:59:24.0198 4248 [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser C:\Windows\System32\browser.dll
12:59:24.0198 4248 Browser - ok
12:59:24.0229 4248 [ B304E75CFF293029EDDF094246747113 ] Brserid C:\Windows\system32\drivers\brserid.sys
12:59:24.0229 4248 Brserid - ok
12:59:24.0245 4248 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys
12:59:24.0245 4248 BrSerWdm - ok
12:59:24.0261 4248 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys
12:59:24.0261 4248 BrUsbMdm - ok
12:59:24.0276 4248 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys
12:59:24.0276 4248 BrUsbSer - ok
12:59:24.0292 4248 [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
12:59:24.0307 4248 BTHMODEM - ok
12:59:24.0323 4248 catchme - ok
12:59:24.0354 4248 [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
12:59:24.0354 4248 cdfs - ok
12:59:24.0417 4248 [ 6B4BFFB9BECD728097024276430DB314 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
12:59:24.0432 4248 cdrom - ok
12:59:24.0463 4248 [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc C:\Windows\System32\certprop.dll
12:59:24.0463 4248 CertPropSvc - ok
12:59:24.0479 4248 [ DA8E0AFC7BAA226C538EF53AC2F90897 ] circlass C:\Windows\system32\drivers\circlass.sys
12:59:24.0479 4248 circlass - ok
12:59:24.0495 4248 [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS C:\Windows\system32\CLFS.sys
12:59:24.0510 4248 CLFS - ok
12:59:24.0557 4248 [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:59:24.0573 4248 clr_optimization_v2.0.50727_32 - ok
12:59:24.0682 4248 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
12:59:24.0682 4248 clr_optimization_v4.0.30319_32 - ok
12:59:24.0697 4248 [ E79CBB2195E965F6E3256E2C1B23FD1C ] cmdide C:\Windows\system32\drivers\cmdide.sys
12:59:24.0713 4248 cmdide - ok
12:59:24.0713 4248 [ 82B8C91D327CFECF76CB58716F7D4997 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
12:59:24.0713 4248 Compbatt - ok
12:59:24.0729 4248 COMSysApp - ok
12:59:24.0744 4248 [ 2A213AE086BBEC5E937553C7D9A2B22C ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
12:59:24.0744 4248 crcdisk - ok
12:59:24.0744 4248 [ 22A7F883508176489F559EE745B5BF5D ] Crusoe C:\Windows\system32\drivers\crusoe.sys
12:59:24.0744 4248 Crusoe - ok
12:59:24.0822 4248 [ 3EDE4C1F9672C972479201544969ADCB ] CryptSvc C:\Windows\system32\cryptsvc.dll
12:59:24.0838 4248 CryptSvc - ok
12:59:24.0916 4248 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch C:\Windows\system32\rpcss.dll
12:59:24.0916 4248 DcomLaunch - ok
12:59:24.0931 4248 [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC C:\Windows\system32\Drivers\dfsc.sys
12:59:24.0931 4248 DfsC - ok
12:59:25.0009 4248 [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR C:\Windows\system32\DFSR.exe
12:59:25.0041 4248 DFSR - ok
12:59:25.0087 4248 [ 9028559C132146FB75EB7ACF384B086A ] Dhcp C:\Windows\System32\dhcpcsvc.dll
12:59:25.0087 4248 Dhcp - ok
12:59:25.0150 4248 [ 5D4AEFC3386920236A548271F8F1AF6A ] disk C:\Windows\system32\drivers\disk.sys
12:59:25.0181 4248 disk - ok
12:59:25.0212 4248 [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache C:\Windows\System32\dnsrslvr.dll
12:59:25.0212 4248 Dnscache - ok
12:59:25.0228 4248 [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc C:\Windows\System32\dot3svc.dll
12:59:25.0243 4248 dot3svc - ok
12:59:25.0275 4248 [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS C:\Windows\system32\dps.dll
12:59:25.0275 4248 DPS - ok
12:59:25.0321 4248 [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
12:59:25.0321 4248 drmkaud - ok
12:59:25.0368 4248 [ 245F62A2AA67F4A61F10174BF1017327 ] DSBrokerService C:\Program Files\DellSupport\brkrsvc.exe
12:59:25.0368 4248 DSBrokerService - ok
12:59:25.0415 4248 [ 413F2D5F9D802688242C23B38F767ECB ] DSproct C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys
12:59:25.0415 4248 DSproct - ok
12:59:25.0431 4248 [ DFEABB7CFFFADEA4A912AB95BDC3177A ] dsunidrv C:\Windows\system32\DRIVERS\dsunidrv.sys
12:59:25.0431 4248 dsunidrv - ok
12:59:25.0524 4248 [ 5DE0FAEC9E5D1AAE74F8568897891A01 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
12:59:25.0540 4248 DXGKrnl - ok
12:59:25.0587 4248 [ 7505290504C8E2D172FA378CC0497BCC ] e1express C:\Windows\system32\DRIVERS\e1e6032.sys
12:59:25.0587 4248 e1express - ok
12:59:25.0602 4248 [ F88FB26547FD2CE6D0A5AF2985892C48 ] E1G60 C:\Windows\system32\DRIVERS\E1G60I32.sys
12:59:25.0618 4248 E1G60 - ok
12:59:25.0649 4248 [ C0B95E40D85CD807D614E264248A45B9 ] EapHost C:\Windows\System32\eapsvc.dll
12:59:25.0649 4248 EapHost - ok
12:59:25.0665 4248 [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache C:\Windows\system32\drivers\ecache.sys
12:59:25.0680 4248 Ecache - ok
12:59:25.0711 4248 [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
12:59:25.0711 4248 ehRecvr - ok
12:59:25.0743 4248 [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched C:\Windows\ehome\ehsched.exe
12:59:25.0743 4248 ehSched - ok
12:59:25.0758 4248 [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart C:\Windows\ehome\ehstart.dll
12:59:25.0758 4248 ehstart - ok
12:59:25.0789 4248 [ E8F3F21A71720C84BCF423B80028359F ] elxstor C:\Windows\system32\drivers\elxstor.sys
12:59:25.0789 4248 elxstor - ok
12:59:25.0821 4248 [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt C:\Windows\system32\emdmgmt.dll
12:59:25.0852 4248 EMDMgmt - ok
12:59:25.0899 4248 [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem C:\Windows\system32\es.dll
12:59:25.0899 4248 EventSystem - ok
12:59:25.0961 4248 [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat C:\Windows\system32\drivers\exfat.sys
12:59:25.0961 4248 exfat - ok
12:59:25.0992 4248 [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat C:\Windows\system32\drivers\fastfat.sys
12:59:25.0992 4248 fastfat - ok
12:59:26.0008 4248 [ 63BDADA84951B9C03E641800E176898A ] fdc C:\Windows\system32\DRIVERS\fdc.sys
12:59:26.0008 4248 fdc - ok
12:59:26.0023 4248 [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost C:\Windows\system32\fdPHost.dll
12:59:26.0039 4248 fdPHost - ok
12:59:26.0055 4248 [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub C:\Windows\system32\fdrespub.dll
12:59:26.0055 4248 FDResPub - ok
12:59:26.0070 4248 [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
12:59:26.0086 4248 FileInfo - ok
12:59:26.0117 4248 [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace C:\Windows\system32\drivers\filetrace.sys
12:59:26.0117 4248 Filetrace - ok
12:59:26.0117 4248 [ 6603957EFF5EC62D25075EA8AC27DE68 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
12:59:26.0117 4248 flpydisk - ok
12:59:26.0164 4248 [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
12:59:26.0164 4248 FltMgr - ok
12:59:26.0242 4248 [ 8CE364388C8ECA59B14B539179276D44 ] FontCache C:\Windows\system32\FntCache.dll
12:59:26.0257 4248 FontCache - ok
12:59:26.0320 4248 [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
12:59:26.0320 4248 FontCache3.0.0.0 - ok
12:59:26.0351 4248 [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
12:59:26.0351 4248 Fs_Rec - ok
12:59:26.0367 4248 [ 4E1CD0A45C50A8882616CAE5BF82F3C5 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
12:59:26.0367 4248 gagp30kx - ok
12:59:26.0398 4248 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
12:59:26.0398 4248 GEARAspiWDM - ok
12:59:26.0429 4248 [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc C:\Windows\System32\gpsvc.dll
12:59:26.0445 4248 gpsvc - ok
12:59:26.0585 4248 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
12:59:26.0601 4248 gupdate - ok
12:59:26.0616 4248 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
12:59:26.0632 4248 gupdatem - ok
12:59:26.0741 4248 [ 3F90E001369A07243763BD5A523D8722 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
12:59:26.0757 4248 HdAudAddService - ok
12:59:26.0913 4248 [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
12:59:26.0944 4248 HDAudBus - ok
12:59:26.0975 4248 [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth C:\Windows\system32\drivers\hidbth.sys
12:59:26.0975 4248 HidBth - ok
12:59:26.0991 4248 [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr C:\Windows\system32\drivers\hidir.sys
12:59:26.0991 4248 HidIr - ok
12:59:27.0022 4248 [ 84067081F3318162797385E11A8F0582 ] hidserv C:\Windows\System32\hidserv.dll
12:59:27.0022 4248 hidserv - ok
12:59:27.0084 4248 [ CCA4B519B17E23A00B826C55716809CC ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
12:59:27.0084 4248 HidUsb - ok
12:59:27.0115 4248 [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc C:\Windows\system32\kmsvc.dll
12:59:27.0115 4248 hkmsvc - ok
12:59:27.0131 4248 [ DF353B401001246853763C4B7AAA6F50 ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys
12:59:27.0131 4248 HpCISSs - ok
12:59:27.0193 4248 [ 53229DCF431D76434816CD29251168A0 ] HSF_DPV C:\Windows\system32\DRIVERS\HSX_DPV.sys
12:59:27.0209 4248 HSF_DPV - ok
12:59:27.0225 4248 [ ED98350ECD4A5A9C9F1E641C09872BB2 ] HSXHWBS2 C:\Windows\system32\DRIVERS\HSXHWBS2.sys
12:59:27.0240 4248 HSXHWBS2 - ok
12:59:27.0287 4248 [ F870AA3E254628EBEAFE754108D664DE ] HTTP C:\Windows\system32\drivers\HTTP.sys
12:59:27.0303 4248 HTTP - ok
12:59:27.0303 4248 [ 324C2152FF2C61ABAE92D09F3CCA4D63 ] i2omp C:\Windows\system32\drivers\i2omp.sys
12:59:27.0303 4248 i2omp - ok
12:59:27.0365 4248 [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
12:59:27.0365 4248 i8042prt - ok
12:59:27.0381 4248 [ C957BF4B5D80B46C5017BF0101E6C906 ] iaStorV C:\Windows\system32\drivers\iastorv.sys
12:59:27.0396 4248 iaStorV - ok
12:59:27.0443 4248 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
12:59:27.0443 4248 IDriverT - ok
12:59:27.0552 4248 [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
12:59:27.0583 4248 idsvc - ok
12:59:27.0615 4248 [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp C:\Windows\system32\drivers\iirsp.sys
12:59:27.0615 4248 iirsp - ok
12:59:27.0677 4248 [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT C:\Windows\System32\ikeext.dll
12:59:27.0677 4248 IKEEXT - ok
12:59:27.0786 4248 [ F8F53C5449F15B23D4C61D51D2701DA8 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
12:59:27.0817 4248 IntcAzAudAddService - ok
12:59:27.0849 4248 [ 0084046C084D68E494F8CF36BCF08186 ] intelide C:\Windows\system32\drivers\intelide.sys
12:59:27.0849 4248 intelide - ok
12:59:27.0864 4248 [ CE44CC04262F28216DD4341E9E36A16F ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
12:59:27.0864 4248 intelppm - ok
12:59:27.0927 4248 [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
12:59:27.0927 4248 IPBusEnum - ok
12:59:27.0958 4248 [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
12:59:27.0958 4248 IpFilterDriver - ok
12:59:28.0005 4248 [ 1998BD97F950680BB55F55A7244679C2 ] IpHlpSvc C:\Windows\System32\iphlpsvc.dll
12:59:28.0020 4248 IpHlpSvc - ok
12:59:28.0020 4248 IpInIp - ok
12:59:28.0051 4248 [ 40F34F8ABA2A015D780E4B09138B6C17 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys
12:59:28.0051 4248 IPMIDRV - ok
12:59:28.0083 4248 [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys
12:59:28.0083 4248 IPNAT - ok
12:59:28.0254 4248 [ E3E71649A926CB34FA4D7AB75DCE126C ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
12:59:28.0254 4248 iPod Service - ok
12:59:28.0301 4248 [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
12:59:28.0301 4248 IRENUM - ok
12:59:28.0317 4248 [ 2F8ECE2699E7E2070545E9B0960A8ED2 ] isapnp C:\Windows\system32\drivers\isapnp.sys
12:59:28.0317 4248 isapnp - ok
12:59:28.0379 4248 [ 232FA340531D940AAC623B121A595034 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
12:59:28.0395 4248 iScsiPrt - ok
12:59:28.0410 4248 [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi C:\Windows\system32\drivers\iteatapi.sys
12:59:28.0410 4248 iteatapi - ok
12:59:28.0426 4248 [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid C:\Windows\system32\drivers\iteraid.sys
12:59:28.0426 4248 iteraid - ok
12:59:28.0457 4248 [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
12:59:28.0457 4248 kbdclass - ok
12:59:28.0504 4248 [ EDE59EC70E25C24581ADD1FBEC7325F7 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
12:59:28.0519 4248 kbdhid - ok
12:59:28.0551 4248 [ A3E186B4B935905B829219502557314E ] KeyIso C:\Windows\system32\lsass.exe
12:59:28.0551 4248 KeyIso - ok
12:59:28.0597 4248 [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
12:59:28.0597 4248 KSecDD - ok
12:59:28.0644 4248 [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm C:\Windows\system32\msdtckrm.dll
12:59:28.0660 4248 KtmRm - ok
12:59:28.0675 4248 [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer C:\Windows\System32\srvsvc.dll
12:59:28.0691 4248 LanmanServer - ok
12:59:28.0769 4248 [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
12:59:28.0769 4248 LanmanWorkstation - ok
12:59:28.0800 4248 [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
12:59:28.0800 4248 lltdio - ok
12:59:28.0831 4248 [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc C:\Windows\System32\lltdsvc.dll
12:59:28.0831 4248 lltdsvc - ok
12:59:28.0863 4248 [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts C:\Windows\System32\lmhsvc.dll
12:59:28.0863 4248 lmhosts - ok
12:59:28.0894 4248 [ A2262FB9F28935E862B4DB46438C80D2 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
12:59:28.0909 4248 LSI_FC - ok
12:59:28.0909 4248 [ 30D73327D390F72A62F32C103DAF1D6D ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
12:59:28.0925 4248 LSI_SAS - ok
12:59:28.0956 4248 [ E1E36FEFD45849A95F1AB81DE0159FE3 ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
12:59:28.0956 4248 LSI_SCSI - ok
12:59:28.0972 4248 [ 8F5C7426567798E62A3B3614965D62CC ] luafv C:\Windows\system32\drivers\luafv.sys
12:59:28.0987 4248 luafv - ok
12:59:29.0065 4248 [ FD3AD5E1ECDAA94A89D6697F5C5465D6 ] McComponentHostService C:\Program Files\McAfee Security Scan\2.1.121\McCHSvc.exe
12:59:29.0065 4248 McComponentHostService - ok
12:59:29.0112 4248 [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
12:59:29.0128 4248 Mcx2Svc - ok
12:59:29.0159 4248 [ 0CEA2D0D3FA284B85ED5B68365114F76 ] mdmxsdk C:\Windows\system32\DRIVERS\mdmxsdk.sys
12:59:29.0159 4248 mdmxsdk - ok
12:59:29.0175 4248 [ D153B14FC6598EAE8422A2037553ADCE ] megasas C:\Windows\system32\drivers\megasas.sys
12:59:29.0190 4248 megasas - ok
12:59:29.0206 4248 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS C:\Windows\system32\mmcss.dll
12:59:29.0206 4248 MMCSS - ok
12:59:29.0221 4248 [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem C:\Windows\system32\drivers\modem.sys
12:59:29.0221 4248 Modem - ok
12:59:29.0268 4248 [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
12:59:29.0268 4248 monitor - ok
12:59:29.0299 4248 [ 5BF6A1326A335C5298477754A506D263 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
12:59:29.0299 4248 mouclass - ok
12:59:29.0346 4248 [ 93B8D4869E12CFBE663915502900876F ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
12:59:29.0362 4248 mouhid - ok
12:59:29.0393 4248 [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr C:\Windows\system32\drivers\mountmgr.sys
12:59:29.0409 4248 MountMgr - ok
12:59:29.0440 4248 [ CF105EE42E3F71E648CEBB3F666E1CF0 ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys
12:59:29.0440 4248 MpFilter - ok
12:59:29.0455 4248 [ 583A41F26278D9E0EA548163D6139397 ] mpio C:\Windows\system32\drivers\mpio.sys
12:59:29.0455 4248 mpio - ok
12:59:29.0611 4248 [ A69630D039C38018689190234F866D77 ] MpKslcdf54f6a C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F6B7F0BE-0D02-4F71-B33F-80C8B84DB4C1}\MpKslcdf54f6a.sys
12:59:29.0627 4248 MpKslcdf54f6a - ok
12:59:29.0643 4248 [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
12:59:29.0658 4248 mpsdrv - ok
12:59:29.0783 4248 [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc C:\Windows\system32\mpssvc.dll
12:59:29.0799 4248 MpsSvc - ok
12:59:29.0830 4248 [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys
12:59:29.0830 4248 Mraid35x - ok
12:59:29.0861 4248 [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
12:59:29.0861 4248 MRxDAV - ok
12:59:29.0908 4248 [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
12:59:29.0908 4248 mrxsmb - ok
12:59:29.0955 4248 [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
12:59:29.0970 4248 mrxsmb10 - ok
12:59:29.0986 4248 [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
12:59:30.0001 4248 mrxsmb20 - ok
12:59:30.0017 4248 [ D420BC42A637AC3CC4F411220549C0DC ] msahci C:\Windows\system32\drivers\msahci.sys
12:59:30.0017 4248 msahci - ok
12:59:30.0048 4248 [ 3FC82A2AE4CC149165A94699183D3028 ] msdsm C:\Windows\system32\drivers\msdsm.sys
12:59:30.0048 4248 msdsm - ok
12:59:30.0079 4248 [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC C:\Windows\System32\msdtc.exe
12:59:30.0079 4248 MSDTC - ok
12:59:30.0111 4248 [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs C:\Windows\system32\drivers\Msfs.sys
12:59:30.0126 4248 Msfs - ok
12:59:30.0173 4248 [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
12:59:30.0173 4248 msisadrv - ok
12:59:30.0204 4248 [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
12:59:30.0204 4248 MSiSCSI - ok
12:59:30.0220 4248 msiserver - ok
12:59:30.0251 4248 [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
12:59:30.0251 4248 MSKSSRV - ok
12:59:30.0313 4248 [ C1F19D2BACBEE9AB64D9AE69E9859AC0 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe
12:59:30.0313 4248 MsMpSvc - ok
12:59:30.0329 4248 [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
12:59:30.0329 4248 MSPCLOCK - ok
12:59:30.0345 4248 [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
12:59:30.0345 4248 MSPQM - ok
12:59:30.0376 4248 [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
12:59:30.0376 4248 MsRPC - ok
12:59:30.0391 4248 [ E384487CB84BE41D09711C30CA79646C ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
12:59:30.0407 4248 mssmbios - ok
12:59:30.0423 4248 [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
12:59:30.0438 4248 MSTEE - ok
12:59:30.0454 4248 [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup C:\Windows\system32\Drivers\mup.sys
12:59:30.0454 4248 Mup - ok
12:59:30.0485 4248 [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent C:\Windows\system32\qagentRT.dll
12:59:30.0501 4248 napagent - ok
12:59:30.0547 4248 [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
12:59:30.0579 4248 NativeWifiP - ok
12:59:30.0610 4248 [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS C:\Windows\system32\drivers\ndis.sys
12:59:30.0625 4248 NDIS - ok
12:59:30.0657 4248 [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
12:59:30.0657 4248 NdisTapi - ok
12:59:30.0688 4248 [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
12:59:30.0688 4248 Ndisuio - ok
12:59:30.0703 4248 [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
12:59:30.0719 4248 NdisWan - ok
12:59:30.0750 4248 [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
12:59:30.0750 4248 NDProxy - ok
12:59:30.0781 4248 [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
12:59:30.0781 4248 NetBIOS - ok
12:59:30.0813 4248 [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt C:\Windows\system32\DRIVERS\netbt.sys
12:59:30.0813 4248 netbt - ok
12:59:30.0844 4248 [ A3E186B4B935905B829219502557314E ] Netlogon C:\Windows\system32\lsass.exe
12:59:30.0844 4248 Netlogon - ok
12:59:30.0922 4248 [ C8052711DAECC48B982434C5116CA401 ] Netman C:\Windows\System32\netman.dll
12:59:30.0937 4248 Netman - ok
12:59:30.0969 4248 [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm C:\Windows\System32\netprofm.dll
12:59:31.0000 4248 netprofm - ok
12:59:31.0047 4248 [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
12:59:31.0093 4248 NetTcpPortSharing - ok
12:59:31.0125 4248 [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
12:59:31.0125 4248 nfrd960 - ok
12:59:31.0171 4248 [ 832E098BCA8235436FE2D8AE50AC3718 ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys
12:59:31.0171 4248 NisDrv - ok
12:59:31.0249 4248 [ E570ECA850F30EB740C2E9699DF3D2BD ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe
12:59:31.0312 4248 NisSrv - ok
12:59:31.0327 4248 [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc C:\Windows\System32\nlasvc.dll
12:59:31.0343 4248 NlaSvc - ok
12:59:31.0359 4248 [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs C:\Windows\system32\drivers\Npfs.sys
12:59:31.0359 4248 Npfs - ok
12:59:31.0390 4248 [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi C:\Windows\system32\nsisvc.dll
12:59:31.0390 4248 nsi - ok
12:59:31.0405 4248 [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
12:59:31.0405 4248 nsiproxy - ok
12:59:31.0639 4248 [ 2C1121F2B87E9A6B12485DF53CD848C7 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
12:59:31.0655 4248 Ntfs - ok
12:59:31.0717 4248 [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi C:\Windows\system32\drivers\ntrigdigi.sys
12:59:31.0733 4248 ntrigdigi - ok
12:59:31.0764 4248 [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null C:\Windows\system32\drivers\Null.sys
12:59:31.0764 4248 Null - ok
12:59:31.0936 4248 [ A1108084B0D2FC43DCC401735770E2A3 ] NVENETFD C:\Windows\system32\DRIVERS\nvmfdx32.sys
12:59:31.0951 4248 NVENETFD - ok
12:59:32.0341 4248 [ C2C5BE49A6151B8F49633B51FA088B24 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
12:59:32.0451 4248 nvlddmkm - ok
12:59:32.0482 4248 [ E69E946F80C1C31C53003BFBF50CBB7C ] nvraid C:\Windows\system32\drivers\nvraid.sys
12:59:32.0482 4248 nvraid - ok
12:59:32.0497 4248 [ 4A5FCAB82D9BF6AF8A023A66802FE9E9 ] nvstor C:\Windows\system32\drivers\nvstor.sys
12:59:32.0497 4248 nvstor - ok
12:59:32.0529 4248 [ DC5F166422BEEBF195E3E4BB8AB4EE22 ] nvstor32 C:\Windows\system32\DRIVERS\nvstor32.sys
12:59:32.0529 4248 nvstor32 - ok
12:59:32.0544 4248 [ 055081FD5076401C1EE1BCAB08D81911 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
12:59:32.0560 4248 nv_agp - ok
12:59:32.0575 4248 NwlnkFlt - ok
12:59:32.0575 4248 NwlnkFwd - ok
12:59:32.0622 4248 [ BE32DA025A0BE1878F0EE8D6D9386CD5 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
12:59:32.0622 4248 ohci1394 - ok
12:59:32.0669 4248 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc C:\Windows\system32\p2psvc.dll
12:59:32.0700 4248 p2pimsvc - ok
12:59:32.0716 4248 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc C:\Windows\system32\p2psvc.dll
12:59:32.0716 4248 p2psvc - ok
12:59:32.0747 4248 [ 0FA9B5055484649D63C303FE404E5F4D ] Parport C:\Windows\system32\drivers\parport.sys
12:59:32.0747 4248 Parport - ok
12:59:32.0778 4248 [ B9C2B89F08670E159F7181891E449CD9 ] partmgr C:\Windows\system32\drivers\partmgr.sys
12:59:32.0778 4248 partmgr - ok
12:59:32.0794 4248 [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm C:\Windows\system32\drivers\parvdm.sys
12:59:32.0794 4248 Parvdm - ok
12:59:32.0841 4248 [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc C:\Windows\System32\pcasvc.dll
12:59:32.0841 4248 PcaSvc - ok
12:59:32.0934 4248 [ 2DD9D5A9150C7015AC7F215EFA59E44F ] PCDSRVC{5B8A2B68-04D6B966-06020200}_0 c:\program files\my dell\pcdsrvc.pkms
12:59:32.0934 4248 PCDSRVC{5B8A2B68-04D6B966-06020200}_0 - ok
12:59:32.0981 4248 [ 941DC1D19E7E8620F40BBC206981EFDB ] pci C:\Windows\system32\drivers\pci.sys
12:59:32.0997 4248 pci - ok
12:59:33.0028 4248 [ 1636D43F10416AEB483BC6001097B26C ] pciide C:\Windows\system32\drivers\pciide.sys
12:59:33.0028 4248 pciide - ok
12:59:33.0043 4248 [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
12:59:33.0043 4248 pcmcia - ok
12:59:33.0090 4248 [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
12:59:33.0106 4248 PEAUTH - ok
12:59:33.0199 4248 [ B1689DF169143F57053F795390C99DB3 ] pla C:\Windows\system32\pla.dll
12:59:33.0215 4248 pla - ok
12:59:33.0246 4248 [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay C:\Windows\system32\umpnpmgr.dll
12:59:33.0262 4248 PlugPlay - ok
12:59:33.0293 4248 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg C:\Windows\system32\p2psvc.dll
12:59:33.0293 4248 PNRPAutoReg - ok
12:59:33.0309 4248 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc C:\Windows\system32\p2psvc.dll
12:59:33.0309 4248 PNRPsvc - ok
12:59:33.0340 4248 [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
12:59:33.0340 4248 PolicyAgent - ok
12:59:33.0355 4248 [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
12:59:33.0371 4248 PptpMiniport - ok
12:59:33.0387 4248 [ 0E3CEF5D28B40CF273281D620C50700A ] Processor C:\Windows\system32\drivers\processr.sys
12:59:33.0387 4248 Processor - ok
12:59:33.0402 4248 [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc C:\Windows\system32\profsvc.dll
12:59:33.0402 4248 ProfSvc - ok
12:59:33.0418 4248 [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
12:59:33.0433 4248 ProtectedStorage - ok
12:59:33.0465 4248 [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched C:\Windows\system32\DRIVERS\pacer.sys
12:59:33.0465 4248 PSched - ok
12:59:33.0511 4248 [ FEFFCFDC528764A04C8ED63D5FA6E711 ] PxHelp20 C:\Windows\system32\Drivers\PxHelp20.sys
12:59:33.0511 4248 PxHelp20 - ok
12:59:33.0558 4248 [ CCDAC889326317792480C0A67156A1EC ] ql2300 C:\Windows\system32\drivers\ql2300.sys
12:59:33.0574 4248 ql2300 - ok
12:59:33.0589 4248 [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
12:59:33.0589 4248 ql40xx - ok
12:59:33.0605 4248 [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE C:\Windows\system32\qwave.dll
12:59:33.0605 4248 QWAVE - ok
12:59:33.0652 4248 [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
12:59:33.0667 4248 QWAVEdrv - ok
12:59:33.0855 4248 [ F89643A2CA001B1162061E306F8BF267 ] R300 C:\Windows\system32\DRIVERS\atikmdag.sys
12:59:33.0964 4248 R300 - ok
12:59:34.0026 4248 [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
12:59:34.0026 4248 RasAcd - ok
12:59:34.0057 4248 [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto C:\Windows\System32\rasauto.dll
12:59:34.0057 4248 RasAuto - ok
12:59:34.0104 4248 [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
12:59:34.0104 4248 Rasl2tp - ok
12:59:34.0135 4248 [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan C:\Windows\System32\rasmans.dll
12:59:34.0151 4248 RasMan - ok
12:59:34.0182 4248 [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
12:59:34.0182 4248 RasPppoe - ok
12:59:34.0213 4248 [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
12:59:34.0213 4248 RasSstp - ok
12:59:34.0245 4248 [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
12:59:34.0245 4248 rdbss - ok
12:59:34.0260 4248 [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
12:59:34.0260 4248 RDPCDD - ok
12:59:34.0291 4248 [ 0245418224CFA77BF4B41C2FE0622258 ] rdpdr C:\Windows\system32\drivers\rdpdr.sys
12:59:34.0291 4248 rdpdr - ok
12:59:34.0338 4248 [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
12:59:34.0338 4248 RDPENCDD - ok
12:59:34.0385 4248 [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
12:59:34.0385 4248 RDPWD - ok
12:59:34.0432 4248 [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess C:\Windows\System32\mprdim.dll
12:59:34.0432 4248 RemoteAccess - ok
12:59:34.0447 4248 [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry C:\Windows\system32\regsvc.dll
12:59:34.0463 4248 RemoteRegistry - ok
12:59:34.0525 4248 [ EBCDE8B48FADC6479D96A56D0A432160 ] RoxMediaDB9 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
12:59:34.0541 4248 RoxMediaDB9 - ok
12:59:34.0572 4248 [ AB2B1DE1C8F31EFCE2384B14B3DC4260 ] RoxWatch9 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
12:59:34.0572 4248 RoxWatch9 - ok
12:59:34.0588 4248 [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator C:\Windows\system32\locator.exe
12:59:34.0603 4248 RpcLocator - ok
12:59:34.0619 4248 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs C:\Windows\system32\rpcss.dll
12:59:34.0619 4248 RpcSs - ok
12:59:34.0650 4248 [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
12:59:34.0650 4248 rspndr - ok
12:59:34.0666 4248 [ A3E186B4B935905B829219502557314E ] SamSs C:\Windows\system32\lsass.exe
12:59:34.0666 4248 SamSs - ok
12:59:34.0713 4248 [ 3CE8F073A557E172B330109436984E30 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
12:59:34.0713 4248 sbp2port - ok
12:59:34.0759 4248 [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr C:\Windows\System32\SCardSvr.dll
12:59:34.0759 4248 SCardSvr - ok
12:59:34.0837 4248 [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule C:\Windows\system32\schedsvc.dll
12:59:34.0837 4248 Schedule - ok
12:59:34.0853 4248 [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc C:\Windows\System32\certprop.dll
12:59:34.0853 4248 SCPolicySvc - ok
12:59:34.0884 4248 [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC C:\Windows\System32\SDRSVC.dll
12:59:34.0884 4248 SDRSVC - ok
12:59:34.0900 4248 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
12:59:34.0900 4248 secdrv - ok
12:59:34.0931 4248 [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon C:\Windows\system32\seclogon.dll
12:59:34.0931 4248 seclogon - ok
12:59:34.0931 4248 [ A9BBAB5759771E523F55563D6CBE140F ] SENS C:\Windows\system32\sens.dll
12:59:34.0947 4248 SENS - ok
12:59:34.0947 4248 [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum C:\Windows\system32\drivers\serenum.sys
12:59:34.0947 4248 Serenum - ok
12:59:34.0978 4248 [ C70D69A918B178D3C3B06339B40C2E1B ] Serial C:\Windows\system32\drivers\serial.sys
12:59:34.0978 4248 Serial - ok
12:59:34.0993 4248 [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse C:\Windows\system32\drivers\sermouse.sys
12:59:34.0993 4248 sermouse - ok
12:59:35.0025 4248 [ D2193326F729B163125610DBF3E17D57 ] SessionEnv C:\Windows\system32\sessenv.dll
12:59:35.0040 4248 SessionEnv - ok
12:59:35.0056 4248 [ 51CF56AA8BCC241F134B420B8F850406 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
12:59:35.0071 4248 sffdisk - ok
12:59:35.0087 4248 [ 96DED8B20C734AC41641CE275250E55D ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
12:59:35.0087 4248 sffp_mmc - ok
12:59:35.0103 4248 [ 8B08CAB1267B2C377883FC9E56981F90 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
12:59:35.0103 4248 sffp_sd - ok
12:59:35.0118 4248 [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
12:59:35.0118 4248 sfloppy - ok
12:59:35.0165 4248 [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess C:\Windows\System32\ipnathlp.dll
12:59:35.0165 4248 SharedAccess - ok
12:59:35.0227 4248 [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
12:59:35.0227 4248 ShellHWDetection - ok
12:59:35.0259 4248 [ 08072B2FB92477FC813271A84B3A8698 ] sisagp C:\Windows\system32\drivers\sisagp.sys
12:59:35.0259 4248 sisagp - ok
12:59:35.0274 4248 [ CEDD6F4E7D84E9F98B34B3FE988373AA ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys
12:59:35.0274 4248 SiSRaid2 - ok
12:59:35.0290 4248 [ DF843C528C4F69D12CE41CE462E973A7 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
12:59:35.0290 4248 SiSRaid4 - ok
12:59:35.0399 4248 [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc C:\Windows\system32\SLsvc.exe
12:59:35.0461 4248 slsvc - ok
12:59:35.0493 4248 [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify C:\Windows\system32\SLUINotify.dll
12:59:35.0493 4248 SLUINotify - ok
12:59:35.0524 4248 [ 7B75299A4D201D6A6533603D6914AB04 ] Smb C:\Windows\system32\DRIVERS\smb.sys
12:59:35.0524 4248 Smb - ok
12:59:35.0555 4248 [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
12:59:35.0555 4248 SNMPTRAP - ok
12:59:35.0586 4248 [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr C:\Windows\system32\drivers\spldr.sys
12:59:35.0586 4248 spldr - ok
12:59:35.0602 4248 [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler C:\Windows\System32\spoolsv.exe
12:59:35.0602 4248 Spooler - ok
12:59:35.0649 4248 sprtsvc_dellsupportcenter - ok
12:59:35.0727 4248 [ 41987F9FC0E61ADF54F581E15029AD91 ] srv C:\Windows\system32\DRIVERS\srv.sys
12:59:35.0742 4248 srv - ok
12:59:35.0773 4248 [ FF33AFF99564B1AA534F58868CBE41EF ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
12:59:35.0773 4248 srv2 - ok
12:59:35.0805 4248 [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
12:59:35.0805 4248 srvnet - ok
12:59:35.0836 4248 [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
12:59:35.0836 4248 SSDPSRV - ok
12:59:35.0883 4248 [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc C:\Windows\system32\sstpsvc.dll
12:59:35.0883 4248 SstpSvc - ok
12:59:35.0914 4248 [ EF70B3D22B4BFFDA6EA851ECB063EFAA ] StillCam C:\Windows\system32\DRIVERS\serscan.sys
12:59:35.0914 4248 StillCam - ok
12:59:35.0961 4248 [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc C:\Windows\System32\wiaservc.dll
12:59:35.0976 4248 stisvc - ok
12:59:36.0039 4248 [ 51778FD315C9882F1CBD932743E62A72 ] stllssvr C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
12:59:36.0039 4248 stllssvr - ok
12:59:36.0070 4248 [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
12:59:36.0070 4248 swenum - ok
12:59:36.0101 4248 [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv C:\Windows\System32\swprv.dll
12:59:36.0117 4248 swprv - ok
12:59:36.0148 4248 [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys
12:59:36.0148 4248 Symc8xx - ok
12:59:36.0163 4248 [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys
12:59:36.0163 4248 Sym_hi - ok
12:59:36.0179 4248 [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys
12:59:36.0179 4248 Sym_u3 - ok
12:59:36.0226 4248 [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain C:\Windows\system32\sysmain.dll
12:59:36.0241 4248 SysMain - ok
12:59:36.0257 4248 [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
12:59:36.0257 4248 TabletInputService - ok
12:59:36.0288 4248 [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv C:\Windows\System32\tapisrv.dll
12:59:36.0288 4248 TapiSrv - ok
12:59:36.0319 4248 [ CB05822CD9CC6C688168E113C603DBE7 ] TBS C:\Windows\System32\tbssvc.dll
12:59:36.0319 4248 TBS - ok
12:59:36.0397 4248 [ 078218D74C4EFC2CE7E4C6DF22A94F2F ] Tcpip C:\Windows\system32\drivers\tcpip.sys
12:59:36.0413 4248 Tcpip - ok
12:59:36.0444 4248 [ 078218D74C4EFC2CE7E4C6DF22A94F2F ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys
12:59:36.0444 4248 Tcpip6 - ok
12:59:36.0460 4248 [ 4C11A1820DDC37FA653913AD680ACCAE ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
12:59:36.0460 4248 tcpipreg - ok
12:59:36.0491 4248 [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
12:59:36.0491 4248 TDPIPE - ok
12:59:36.0507 4248 [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
12:59:36.0507 4248 TDTCP - ok
12:59:36.0538 4248 [ 76B06EB8A01FC8624D699E7045303E54 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
12:59:36.0553 4248 tdx - ok
12:59:36.0616 4248 [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
12:59:36.0616 4248 TermDD - ok
12:59:36.0647 4248 [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService C:\Windows\System32\termsrv.dll
12:59:36.0663 4248 TermService - ok
12:59:36.0694 4248 [ C7230FBEE14437716701C15BE02C27B8 ] Themes C:\Windows\system32\shsvcs.dll
12:59:36.0709 4248 Themes - ok
12:59:36.0725 4248 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER C:\Windows\system32\mmcss.dll
12:59:36.0725 4248 THREADORDER - ok
12:59:36.0756 4248 [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks C:\Windows\System32\trkwks.dll
12:59:36.0772 4248 TrkWks - ok
12:59:36.0803 4248 [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
12:59:36.0819 4248 TrustedInstaller - ok
12:59:36.0834 4248 [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
12:59:36.0834 4248 tssecsrv - ok
12:59:36.0865 4248 [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp C:\Windows\system32\DRIVERS\tunmp.sys
12:59:36.0881 4248 tunmp - ok
12:59:36.0912 4248 [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
12:59:36.0912 4248 tunnel - ok
12:59:36.0943 4248 [ C3ADE15414120033A36C0F293D4A4121 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
12:59:36.0943 4248 uagp35 - ok
12:59:36.0975 4248 [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
12:59:36.0990 4248 udfs - ok
12:59:37.0021 4248 [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
12:59:37.0021 4248 UI0Detect - ok
12:59:37.0037 4248 [ 6D72EF05921ABDF59FC45C7EBFE7E8DD ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
12:59:37.0037 4248 uliagpkx - ok
12:59:37.0068 4248 [ 3CD4EA35A6221B85DCC25DAA46313F8D ] uliahci C:\Windows\system32\drivers\uliahci.sys
12:59:37.0068 4248 uliahci - ok
12:59:37.0084 4248 [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata C:\Windows\system32\drivers\ulsata.sys
12:59:37.0084 4248 UlSata - ok
12:59:37.0099 4248 [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys
12:59:37.0099 4248 ulsata2 - ok
12:59:37.0131 4248 [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
12:59:37.0131 4248 umbus - ok
12:59:37.0162 4248 [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost C:\Windows\System32\upnphost.dll
12:59:37.0162 4248 upnphost - ok
12:59:37.0209 4248 [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL C:\Windows\system32\Drivers\usbaapl.sys
12:59:37.0209 4248 USBAAPL - ok
12:59:37.0240 4248 [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
12:59:37.0255 4248 usbccgp - ok
12:59:37.0271 4248 [ E9476E6C486E76BC4898074768FB7131 ] usbcir C:\Windows\system32\drivers\usbcir.sys
12:59:37.0271 4248 usbcir - ok
12:59:37.0333 4248 [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
12:59:37.0333 4248 usbehci - ok
12:59:37.0349 4248 [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
12:59:37.0365 4248 usbhub - ok
12:59:37.0411 4248 [ CE697FEE0D479290D89BEC80DFE793B7 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
12:59:37.0411 4248 usbohci - ok
12:59:37.0427 4248 [ B51E52ACF758BE00EF3A58EA452FE360 ] usbprint C:\Windows\system32\drivers\usbprint.sys
12:59:37.0427 4248 usbprint - ok
12:59:37.0489 4248 [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
12:59:37.0489 4248 USBSTOR - ok
12:59:37.0505 4248 [ 325DBBACB8A36AF9988CCF40EAC228CC ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
12:59:37.0505 4248 usbuhci - ok
12:59:37.0536 4248 [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms C:\Windows\System32\uxsms.dll
12:59:37.0552 4248 UxSms - ok
12:59:37.0599 4248 [ CD88D1B7776DC17A119049742EC07EB4 ] vds C:\Windows\System32\vds.exe
12:59:37.0614 4248 vds - ok
12:59:37.0630 4248 [ 7D92BE0028ECDEDEC74617009084B5EF ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
12:59:37.0630 4248 vga - ok
12:59:37.0661 4248 [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave C:\Windows\System32\drivers\vga.sys
12:59:37.0661 4248 VgaSave - ok
12:59:37.0692 4248 [ D5929A28BDFF4367A12CAF06AF901971 ] viaagp C:\Windows\system32\drivers\viaagp.sys
12:59:37.0692 4248 viaagp - ok
12:59:37.0708 4248 [ 56A4DE5F02F2E88182B0981119B4DD98 ] ViaC7 C:\Windows\system32\drivers\viac7.sys
12:59:37.0708 4248 ViaC7 - ok
12:59:37.0723 4248 [ F3B4762EB85A2AFF4999401F14C3262B ] viaide C:\Windows\system32\drivers\viaide.sys
12:59:37.0723 4248 viaide - ok
12:59:37.0739 4248 [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr C:\Windows\system32\drivers\volmgr.sys
12:59:37.0739 4248 volmgr - ok
12:59:37.0770 4248 [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
12:59:37.0770 4248 volmgrx - ok
12:59:37.0801 4248 [ 786DB5771F05EF300390399F626BF30A ] volsnap C:\Windows\system32\drivers\volsnap.sys
12:59:37.0817 4248 volsnap - ok
12:59:37.0833 4248 [ D984439746D42B30FC65A4C3546C6829 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
12:59:37.0848 4248 vsmraid - ok
12:59:37.0895 4248 [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS C:\Windows\system32\vssvc.exe
12:59:37.0911 4248 VSS - ok
12:59:37.0942 4248 [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time C:\Windows\system32\w32time.dll
12:59:37.0942 4248 W32Time - ok
12:59:37.0957 4248 [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
12:59:37.0957 4248 WacomPen - ok
12:59:37.0989 4248 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys
12:59:37.0989 4248 Wanarp - ok
12:59:37.0989 4248 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
12:59:38.0004 4248 Wanarpv6 - ok
12:59:38.0020 4248 [ A3CD60FD826381B49F03832590E069AF ] wcncsvc C:\Windows\System32\wcncsvc.dll
12:59:38.0035 4248 wcncsvc - ok
12:59:38.0067 4248 [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
12:59:38.0067 4248 WcsPlugInService - ok
12:59:38.0082 4248 [ AFC5AD65B991C1E205CF25CFDBF7A6F4 ] Wd C:\Windows\system32\drivers\wd.sys
12:59:38.0082 4248 Wd - ok
12:59:38.0145 4248 [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
12:59:38.0145 4248 Wdf01000 - ok
12:59:38.0176 4248 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost C:\Windows\system32\wdi.dll
12:59:38.0176 4248 WdiServiceHost - ok
12:59:38.0191 4248 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost C:\Windows\system32\wdi.dll
12:59:38.0191 4248 WdiSystemHost - ok
12:59:38.0223 4248 [ 04C37D8107320312FBAE09926103D5E2 ] WebClient C:\Windows\System32\webclnt.dll
12:59:38.0223 4248 WebClient - ok
12:59:38.0285 4248 [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc C:\Windows\system32\wecsvc.dll
12:59:38.0285 4248 Wecsvc - ok
12:59:38.0316 4248 [ 670FF720071ED741206D69BD995EA453 ] wercplsupport C:\Windows\System32\wercplsupport.dll
12:59:38.0316 4248 wercplsupport - ok
12:59:38.0347 4248 [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc C:\Windows\System32\WerSvc.dll
12:59:38.0363 4248 WerSvc - ok
12:59:38.0410 4248 [ 6D2350BB6E77E800FC4BE4E5B7A2E89A ] winachsf C:\Windows\system32\DRIVERS\HSX_CNXT.sys
12:59:38.0425 4248 winachsf - ok
12:59:38.0488 4248 [ 4575AA12561C5648483403541D0D7F2B ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
12:59:38.0503 4248 WinDefend - ok
12:59:38.0519 4248 WinHttpAutoProxySvc - ok
12:59:38.0581 4248 [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
12:59:38.0581 4248 Winmgmt - ok
12:59:38.0675 4248 [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM C:\Windows\system32\WsmSvc.dll
12:59:38.0706 4248 WinRM - ok
12:59:38.0769 4248 [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc C:\Windows\System32\wlansvc.dll
12:59:38.0784 4248 Wlansvc - ok
12:59:38.0831 4248 [ 94A85E956A065E23E0010A6A7826243B ] WLSetupSvc C:\Program Files\Windows Live\installer\WLSetupSvc.exe
12:59:38.0847 4248 WLSetupSvc - ok
12:59:38.0862 4248 [ 701A9F884A294327E9141D73746EE279 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
12:59:38.0862 4248 WmiAcpi - ok
12:59:38.0909 4248 [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
12:59:38.0925 4248 wmiApSrv - ok
12:59:38.0987 4248 [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
12:59:39.0003 4248 WMPNetworkSvc - ok
12:59:39.0034 4248 [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc C:\Windows\System32\wpcsvc.dll
12:59:39.0049 4248 WPCSvc - ok
12:59:39.0127 4248 [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
12:59:39.0127 4248 WPDBusEnum - ok
12:59:39.0174 4248 [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb C:\Windows\system32\DRIVERS\wpdusb.sys
12:59:39.0174 4248 WpdUsb - ok
12:59:39.0283 4248 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
12:59:39.0283 4248 WPFFontCache_v0400 - ok
12:59:39.0315 4248 [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
12:59:39.0315 4248 ws2ifsl - ok
12:59:39.0330 4248 [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc C:\Windows\System32\wscsvc.dll
12:59:39.0346 4248 wscsvc - ok
12:59:39.0361 4248 [ 4422AC5ED8D4C2F0DB63E71D4C069DD7 ] WSDPrintDevice C:\Windows\system32\DRIVERS\WSDPrint.sys
12:59:39.0361 4248 WSDPrintDevice - ok
12:59:39.0377 4248 WSearch - ok
12:59:39.0486 4248 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
12:59:39.0517 4248 wuauserv - ok
12:59:39.0549 4248 [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
12:59:39.0549 4248 WudfPf - ok
12:59:39.0580 4248 [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
12:59:39.0580 4248 WUDFRd - ok
12:59:39.0627 4248 [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
12:59:39.0627 4248 wudfsvc - ok
12:59:39.0658 4248 [ 5A7FF9A18FF6D7E0527FE3ABF9204EF8 ] XAudio C:\Windows\system32\DRIVERS\xaudio.sys
12:59:39.0658 4248 XAudio - ok
12:59:39.0673 4248 [ 28DC5D626E036A75A572556F0A6EB1F6 ] XAudioService C:\Windows\system32\DRIVERS\xaudio.exe
12:59:39.0689 4248 XAudioService - ok
12:59:39.0720 4248 ================ Scan global ===============================
12:59:39.0751 4248 [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
12:59:39.0783 4248 [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll
12:59:39.0798 4248 [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll
12:59:39.0829 4248 [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
12:59:39.0829 4248 [Global] - ok
12:59:39.0829 4248 ================ Scan MBR ==================================
12:59:39.0845 4248 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
12:59:40.0344 4248 \Device\Harddisk0\DR0 - ok
12:59:40.0344 4248 ================ Scan VBR ==================================
12:59:40.0375 4248 [ C17528D67400CC63B0612299454D2C52 ] \Device\Harddisk0\DR0\Partition1
12:59:40.0375 4248 \Device\Harddisk0\DR0\Partition1 - ok
12:59:40.0407 4248 [ 137610FD2EEE73EB821E49CE8BF244A3 ] \Device\Harddisk0\DR0\Partition2
12:59:40.0407 4248 \Device\Harddisk0\DR0\Partition2 - ok
12:59:40.0407 4248 ============================================================
12:59:40.0407 4248 Scan finished
12:59:40.0407 4248 ============================================================
12:59:40.0422 4952 Detected object count: 0
12:59:40.0422 4952 Actual detected object count: 0


Thank you
Post #8
I believe that I uploaded what you had requested. It did not allow me to paste that string in, so I sent a link to the OTL file on my desktop and added the string to the comments. They also have the link to this post. Did I do that correctly?
Post #10
I cannot find this file on my computer. I can get to C:\Users\Gwill\ but there is nothing called AppData there. I tried a search of the computer and it directed me to OTL, nothing else. Where should I be looking?
Post #11
Combofix


Combofix should only be run when adviced by a team member!

Link


Important - Save the file to your desktop!


  • Deactivate any and all of your antivirus programs /spyware scanners - they can prevent CF from doing its work.
  • Run Combofix.exe

When finished, Combofix creates a log file named C:\Combofix.txt. Please post its content in your next reply.
Post #12
Hello,
I ran Combofix and here are the results;

ComboFix 13-07-09.01 - Gwill 07/09/2013 16:42:33.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2046.970 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\6261\AddOnDownloaded\31274d4c-b2a5-4954-874c-18abd8e795fc.dll
c:\programdata\PCDr\6261\AddOnDownloaded\b3ef58a2-77e9-414a-b8f6-b8cbbf497383.dll
c:\programdata\PCDr\6261\AddOnDownloaded\ba005e12-3139-4327-9f7a-9f2ea6a6c841.dll
c:\programdata\PCDr\6261\AddOnDownloaded\f80f957a-a781-4825-977a-a4ab79468916.dll
c:\users\Gwill\AppData\Roaming\isroht.dll
c:\users\Gwill\AppData\Roaming\snsesi.dll
.
.
((((((((((((((((((((((((( Files Created from 2013-06-09 to 2013-07-09 )))))))))))))))))))))))))))))))
.
.
2013-07-09 20:51 . 2013-07-09 20:53 ——– d—–w- c:\users\Gwill\AppData\Local\temp
2013-07-09 20:51 . 2013-07-09 20:51 ——– d—–w- c:\users\Public\AppData\Local\temp
2013-07-09 20:51 . 2013-07-09 20:51 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-07-09 02:26 . 2013-06-12 04:18 7068072 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5788D269-4129-4A8E-A330-0E7DFA25EC14}\mpengine.dll
2013-07-08 16:28 . 2013-06-12 04:18 7068072 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-06-21 20:35 . 2013-07-09 04:00 ——– d—–w- c:\users\Gwill\AppData\Roaming\vlc
2013-06-20 23:10 . 2013-06-20 23:05 724464 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0BD00A3A-ACEF-4C86-8525-BF46EA5BA76D}\gapaengine.dll
2013-06-12 19:54 . 2013-05-08 03:40 914792 —-a-w- c:\windows\system32\drivers\tcpip.sys
2013-06-12 19:54 . 2013-05-08 01:58 31232 —-a-w- c:\windows\system32\drivers\tcpipreg.sys
2013-06-12 19:54 . 2013-05-02 04:04 443904 —-a-w- c:\windows\system32\win32spl.dll
2013-06-12 19:54 . 2013-05-02 04:03 37376 —-a-w- c:\windows\system32\printcom.dll
2013-06-12 19:53 . 2013-04-24 01:46 812544 —-a-w- c:\windows\system32\certutil.exe
2013-06-12 19:53 . 2013-04-24 04:00 985600 —-a-w- c:\windows\system32\crypt32.dll
2013-06-12 19:53 . 2013-04-24 04:00 98304 —-a-w- c:\windows\system32\cryptnet.dll
2013-06-12 19:53 . 2013-04-24 04:00 133120 —-a-w- c:\windows\system32\cryptsvc.dll
2013-06-12 19:53 . 2013-04-24 04:00 41984 —-a-w- c:\windows\system32\certenc.dll
2013-06-12 19:53 . 2013-05-02 22:03 3603832 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-06-12 19:53 . 2013-05-02 22:03 3551096 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-06-12 19:52 . 2013-04-17 12:30 24576 —-a-w- c:\windows\system32\cryptdlg.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-11 21:26 . 2012-04-03 19:42 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-11 21:26 . 2011-06-01 17:10 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-21 23:53 . 2012-11-29 21:15 724464 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-05-02 15:28 . 2009-10-03 11:47 238872 ——w- c:\windows\system32\MpSigStub.exe
2013-04-15 14:20 . 2013-05-15 01:00 638328 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-04-13 10:56 . 2013-05-15 01:00 37376 —-a-w- c:\windows\system32\cdd.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\windows sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-17 4907008]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-09-23 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-23 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-23 81920]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-05-25 17920]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-15 152392]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-11-15 50688]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-3 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-05-15 18:59 152392 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [2007-12-05 77824]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2013-07-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 21:26]
.
2013-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-03 23:36]
.
2013-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-03 23:36]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.google.com/
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.2.1
DPF: {3641803B-72A4-4A9A-BA18-F1446F7CCDE4} - hxxp://hnshelby.dyndns.org/UltraHVCamX.cab
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-snsesi - c:\users\Gwill\AppData\Roaming\snsesi.dll
HKCU-Run-isroht - c:\users\Gwill\AppData\Roaming\isroht.dll
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-09 16:53
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCDSRVC{5B8A2B68-04D6B966-06020200}_0]
"ImagePath"="\??\c:\program files\my dell\pcdsrvc.pkms"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2013-07-09 16:55:13
ComboFix-quarantined-files.txt 2013-07-09 20:55
ComboFix2.txt 2012-10-22 16:14
.
Pre-Run: 338,436,239,360 bytes free
Post-Run: 338,867,044,352 bytes free
.
- - End Of File - - 6870E498CEEB81A7956F3DC2955A5840
5C616939100B85E558DA92B899A0FC36


Thanks, Greg
Post #13
Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Run Malwarebytes´ Antimalware.
  • Once the program has loaded, select Perform full scan, mark all your hard drives, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location.
  • The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Post that log back here.




Please go to here to run the online scannner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file….
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.
Post #14
Hello, Here are the results; Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.07.10.08 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Gwill :: GWILL-DESKTOP [administrator] 7/10/2013 6:03:54 PM mbam-log-2013-07-10 (18-03-54).txt Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 373685 Time elapsed: 1 hour(s), 27 minute(s), 45 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 7 C:\TDSSKiller_Quarantine\05.10.2012_13.37.22\rtkt0000\svc0000\tsk0000.dta (Trojan.0Access) -> Quarantined and deleted successfully. C:\TDSSKiller_Quarantine\05.10.2012_13.37.22\rtkt0000\zafs0000\tsk0001.dta (Rootkit.0Access) -> Quarantined and deleted successfully. C:\TDSSKiller_Quarantine\05.10.2012_13.37.22\rtkt0000\zafs0000\tsk0004.dta (Rootkit.Zaccess) -> Quarantined and deleted successfully. C:\TDSSKiller_Quarantine\05.10.2012_13.37.22\rtkt0000\zafs0000\tsk0005.dta (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully. C:\TDSSKiller_Quarantine\05.10.2012_13.37.22\rtkt0000\zafs0000\tsk0006.dta (Rootkit.0Access) -> Quarantined and deleted successfully. C:\TDSSKiller_Quarantine\05.10.2012_13.37.22\rtkt0000\zafs0000\tsk0007.dta (Trojan.Small) -> Quarantined and deleted successfully. C:\TDSSKiller_Quarantine\05.10.2012_13.37.22\rtkt0000\zafs0000\tsk0008.dta (Rootkit.0Access) -> Quarantined and deleted successfully. (end) C:\Qoobox\Quarantine\C\Users\Gwill\AppData\Roaming\isroht.dll.vir a variant of Win32/Medfos.RZ trojan C:\Qoobox\Quarantine\C\Users\Gwill\AppData\Roaming\snsesi.dll.vir a variant of Win32/Medfos.RT trojan C:\Users\Gwill\Downloads\setup.exe a variant of Win32/AirAdInstaller.A application
Post #15

C:\Users\Gwill\Downloads\setup.exe


Delete this file.


Then we can do the cleanup - if you are facing any issues, report that immediately.

Delete junk with adwCleaner


Please download AdwCleaner to your desktop.


  • Run adwcleaner.exe.
  • Hit delete.
  • When the run is finished, it will open up a text file.
  • Please post its contents within your next reply.
  • You´ll find the log file at C:\AdwCleaner[S1].txt also.

SecurityCheck

Please download SecurityCheck: LINK1 LINK2

  • Save it to your desktop, start it and follow the instructions in the window.
  • After the scan finished the (checkup.txt) will open. Copy its content to your thread.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI