Spyware / Malware / Virus Removal

Desktop has issues, possibly spyware/malware.... [Solved]

94 min read

Looking for the outcome? Ask AI

RetiredChief Topic Starter

Post #1September 28, 2013, 7:33 PM UTC

The Desktop that my wife and kids use is running really slow. Web pages take a very long time to load, when it initially boots up it is very slow to do so and it locks up periodically. I also know it has a large amount of programs running in the background that do not need to be. I also have gotten about 4 phone calls from some guy who claimed to be a Microsoft Tech and they were getting "reports" from my computer that it is sending out errors and is infected with the "Trojan Bug Virus". I told him to stop calling me and contacted Microsoft who replied it was a scam and I possibly had something on my computer. Enclosed is the log from Hijack This:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:24:57 PM, on 9/28/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Comodo\Dragon\dragon_updater.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\All Users\Application Data\Renaissance Wireless Server\Renaissance Wireless Server.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\SyncServer.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\HP_Administrator\My Documents\Downloads\HiJackThis (1).exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsearch.com/index.jhtml?n=…mp;si=199209XXX
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.*.*
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\program files\real\realplayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [MapsGalaxy Search Scope Monitor] "C:\PROGRA~1\MAPSGA~2\bar\1.bin\39srchmn.exe" /m=2 /w /h
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Facebook Update] "C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM')
O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: hc_tray.lnk = C:\Program Files\Kuma Games\hcsystray\hc_tray.exe
O4 - Startup: Jewell DeskMate.LNK = C:\Program Files\DeskMates\Jewell\Jewell.exe
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = C:\Sierra\Planner\PLNRnote.exe
O4 - Global Startup: Forget Me Not.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O4 - Global Startup: Renaissance Wireless Server.lnk = C:\Documents and Settings\All Users\Application Data\Renaissance Wireless Server\Renaissance Wireless Server.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: &Search - http://tbedits.couponxplorer.com/one-toolb…061414&cv=2
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {036F8A56-0BC8-4607-8F98-D3231E6FF5ED} - http://de225.centra.com/SiteRoots/main/Ins…raUpdaterAx.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shock…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F9665E1-6A11-4972-B941-EB22DFA68FC7}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{837C5F68-FB84-414E-8FEC-9FA666C52334}: NameServer = 8.26.56.26,156.154.70.22
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: COMODO System Utilities Service (CSUService) - Comodo Security Solutions, Inc. - C:\Program Files\COMODO\COMODO System Utilities\CSUService.exe
O23 - Service: COMODO Dragon Update Service (DragonUpdater) - Unknown owner - C:\Program Files\Comodo\Dragon\dragon_updater.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MapsGalaxyService (MapsGalaxy_39Service) - COMPANYVERS_NAME - C:\PROGRA~1\MAPSGA~2\bar\1.bin\39barsvc.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - Unknown owner - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (file missing)
O23 - Service: MotoHelper Service (MotoHelper) - Unknown owner - C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

–
End of file - 12549 bytes

I am glad you know what this says because I do not. Please assist in this, Thanks!

Chief

Satchfan

Post #2September 29, 2013, 10:32 AM UTC

Hello RetiredChief and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

I am looking at your log now and will reply with instructions shortly.

Satchfan

Satchfan

Post #3September 29, 2013, 11:48 AM UTC

You do have some adware but there doesn’t seem to be anything major in your log. However, we’ll do some further checks because HijackThis isn’t up to some of the nasty stuff that’s around these days.

You also have too many programs starting up which will be using up valuable resources. Stopping them won’t affect the programs and they can be started normally when you need them. For example, you don’t require HP Software Update to start automatically. If a shortcut doesn't exist, create your own and run it manually.

We’ll also stop some others.

Run HijackThis

Open HijackThis and click Do a system scan only.

Place a check mark next to:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsearch.com/index.jhtml?n=…mp;si=199209XXX
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe - Related to Photosmart_Essential_Software from Hewlett-Packard Edit photos, create albums, easily share photos with your family and friends. Note: Located in %\Program Files%\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe - Related to Hewlett-Packard Software updates. If a shortcut doesn't exist, create your own and run it manually. Note: Located in \%Program Files%\Hewlett-Packard\HP Software Update\
O4 - HKLM\..\Run: [TkBellExe] "C:\program files\real\realplayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MapsGalaxy Search Scope Monitor] "C:\PROGRA~1\MAPSGA~2\bar\1.bin\39srchmn.exe" /m=2 /w /h - O4 - Startup: hc_tray.lnk = C:\Program Files\Kuma Games\hcsystray\hc_tray.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: &Search - http://tbedits.couponxplorer.com/one-toolb…061414&cv=2
O23 - Service: MotoHelper Service (MotoHelper) - Unknown owner - C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe (file missing)

Close all windows except for HijackThis and click Fix checked.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

run AdwCleaner
when it has finished, select Clean
if it asks to reboot, allow the reboot
on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

[external image: Posted Image] Please download Junkware Removal Tool to your desktop.

shut down your protection software now to avoid potential conflicts.
run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
the tool will open and start scanning your system
please be patient as this can take a while to complete depending on your system's specifications
on completion, a log (JRT.txt) is saved to your desktop and will automatically open
post the contents of JRT.txt into your next message.

===================================================

Download and run OTL

download OTL to your desktop.
double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
click Scan all users.
under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
services.exe
/md5stop
%systemroot%\*. /rp /s
%systemdrive%\$Recycle.Bin|@;true;true;true
DRIVES
CREATERESTOREPOINT
click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
you may need two posts to fit them both in.

Logs to include with next post:

AdwCleaner log
JRT.txt
OTL.txt
Extras.txt

Satchfan

RetiredChief

Post #4September 29, 2013, 8:09 PM UTC

Satchfan, Thanks for the assist. I have ran the requested scans, except for OTL which locks up and is not responsive when it gets to "Scanning Firefox Folders". It sat for over an hour and did not re-start. I tried twice with the same results. The other logs are posted. Adware Cleaner: # AdwCleaner v3.005 - Report created 29/09/2013 at 11:39:51 # Updated 22/09/2013 by Xplode # Operating System : Microsoft Windows XP Service Pack 3 (32 bits) # Username : HP_Administrator - BLAKLEY # Running from : C:\Documents and Settings\HP_Administrator\My Documents\Downloads\adwcleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\Documents and Settings\All Users\Application Data\boost_interprocess Folder Deleted : C:\Documents and Settings\All Users\Application Data\Trymedia Folder Deleted : C:\Program Files\mapsgalaxy_39 Folder Deleted : C:\Program Files\Coupons.com Folder Deleted : C:\Documents and Settings\NetworkService\Local Settings\Application Data\Coupons.com Folder Deleted : C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Conduit Folder Deleted : C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\iac Folder Deleted : C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Coupons.com Folder Deleted : C:\Documents and Settings\HP_Administrator\Application Data\dvdvideosoftiehelpers Folder Deleted : C:\Documents and Settings\HP_Administrator\Application Data\iWin Folder Deleted : C:\Documents and Settings\HP_Administrator\Application Data\mapsgalaxy_39 Folder Deleted : C:\Documents and Settings\HP_Administrator\Application Data\searchquband Folder Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\ConduitCommon Folder Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\Searchqutoolbar Folder Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\CT2559647 Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\op5b9w5g.default\Searchqutoolbar Folder Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} Folder Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\Extensions\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\op5b9w5g.default\Extensions\{99079A25-328F-4BD4-BE04-00955ACAA0A7} Folder Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\Extensions\39ffxtbr@MapsGalaxy_39.com Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\op5b9w5g.default\Extensions\39ffxtbr@MapsGalaxy_39.com Folder Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\Extensions\{37153479-1976-43c3-a1ee-557513977b64} File Deleted : C:\Documents and Settings\All Users\Desktop\eBay.lnk File Deleted : C:\Documents and Settings\All Users\Start Menu\Programs\eBay.lnk File Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\searchplugins\Askcom.xml File Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\searchplugins\Conduit.xml File Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\searchplugins\my-web-search.xml File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\SearchResults.xml File Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\searchplugins\web-search.xml File Deleted : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\user.js ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [39ffxtbr@MapsGalaxy_39.com] Key Deleted : HKCU\Toolbar Key Deleted : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll Key Deleted : HKLM\SOFTWARE\Classes\AppID\DNSBHO.dll Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL Key Deleted : HKLM\SOFTWARE\Classes\DnsBHO.BHO Key Deleted : HKLM\SOFTWARE\Classes\DnsBHO.BHO.1 Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@MapsGalaxy_39.com/Plugin Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2559647 Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{13119113-0854-469D-807A-171568457991} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{33119133-0854-469D-807A-171568457991} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BF0118D4-63FF-4138-9327-F3028FB1A578} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{37AE00AB-70CA-4E98-B1CE-DC138AE847FA} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{03119103-0854-469D-807A-171568457991} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F0B76E1-4E46-427B-B55B-B90593468AC6} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{37AE00AB-70CA-4E98-B1CE-DC138AE847FA} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C5694DD-3247-4BB5-B793-1DE81A663B09} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6BD7F06E-A9A8-4203-8088-120D7C9E6A25} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421} Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\ConduitSearchScopes Key Deleted : HKCU\Software\Headlight Key Deleted : HKCU\Software\MapsGalaxy_39 Key Deleted : HKCU\Software\searchqutoolbar Key Deleted : HKCU\Software\YahooPartnerToolbar Key Deleted : HKCU\Software\Coupons.com Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\MapsGalaxy_39 Key Deleted : HKLM\Software\Coupons.com Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Coupons.com Toolbar Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Coupons.com Toolbar ***** [ Browsers ] ***** -\\ Internet Explorer v8.0.6001.18702 -\\ Mozilla Firefox v23.0.1 (en-US) [ File : C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\ehod9kc8.default\prefs.js ] Line Deleted : user_pref("CT2559647..clientLogIsEnabled", false); Line Deleted : user_pref("CT2559647..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent"); Line Deleted : user_pref("CT2559647..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation"); Line Deleted : user_pref("CT2559647.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); Line Deleted : user_pref("CT2559647.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Line Deleted : user_pref("CT2559647.AppTrackingLastCheckTime", "Sat Dec 29 2012 10:06:24 GMT-0800 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.CT2559647.lastNewTabSettings", "{\"isEnabled\":false,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT2559647&octid=CT2559647&SearchSource=15&CUI=SB_CUI&SSPV=EB_SSPV&Lay=1&UM=UM_[…] Line Deleted : user_pref("CT2559647.CTID", "CT2559647"); Line Deleted : user_pref("CT2559647.ConfigurationLastCheckTime", "Fri Sep 27 2013 15:12:27 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.CurrentServerDate", "28-9-2013"); Line Deleted : user_pref("CT2559647.DSChangedManually", true); Line Deleted : user_pref("CT2559647.DSInstall", true); Line Deleted : user_pref("CT2559647.DialogsAlignMode", "LTR"); Line Deleted : user_pref("CT2559647.DialogsGetterLastCheckTime", "Fri Sep 27 2013 15:12:24 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.DownloadReferralCookieData", ""); Line Deleted : user_pref("CT2559647.ExternalComponentPollDate129404749084494749", "Wed Feb 08 2012 15:31:28 GMT-0800 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.ExternalComponentPollDate129404791544181654", "Wed Feb 08 2012 15:31:28 GMT-0800 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.ExternalComponentPollDate129413165572169584", "Wed Feb 08 2012 15:31:28 GMT-0800 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.FirstServerDate", "12-10-2011"); Line Deleted : user_pref("CT2559647.FirstTime", true); Line Deleted : user_pref("CT2559647.FirstTimeFF3", true); Line Deleted : user_pref("CT2559647.FixPageNotFoundErrors", true); Line Deleted : user_pref("CT2559647.GroupingServerCheckInterval", 1440); Line Deleted : user_pref("CT2559647.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Line Deleted : user_pref("CT2559647.HPInstall", false); Line Deleted : user_pref("CT2559647.HasUserGlobalKeys", true); Line Deleted : user_pref("CT2559647.HomePageProtectorEnabled", false); Line Deleted : user_pref("CT2559647.HomepageBeforeUnload", "hxxp://www.yahoo.com/"); Line Deleted : user_pref("CT2559647.Initialize", true); Line Deleted : user_pref("CT2559647.InitializeCommonPrefs", true); Line Deleted : user_pref("CT2559647.InstallationAndCookieDataSentCount", 3); Line Deleted : user_pref("CT2559647.InstallationId", "CT2559647_Coupons.exe"); Line Deleted : user_pref("CT2559647.InstallationType", "ConduitIntegration"); Line Deleted : user_pref("CT2559647.InstalledDate", "Tue Oct 11 2011 15:19:51 GMT-0700 (Pacific Daylight Time)"); Line Deleted : user_pref("CT2559647.IsAlertDBUpdated", true); Line Deleted : user_pref("CT2559647.IsGrouping", false); Line Deleted : user_pref("CT2559647.IsInitSetupIni", true); Line Deleted : user_pref("CT2559647.IsMulticommunity", false); Line Deleted : user_pref("CT2559647.IsOpenThankYouPage", false); Line Deleted : user_pref("CT2559647.IsOpenUninstallPage", true); Line Deleted : user_pref("CT2559647.IsProtectorsInit", true); Line Deleted : user_pref("CT2559647.LanguagePackLastCheckTime", "Fri Sep 27 2013 15:12:24 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.LanguagePackReloadIntervalMM", 1440); Line Deleted : user_pref("CT2559647.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx"); Line Deleted : user_pref("CT2559647.LastLogin_3.10.0.1", "Tue Apr 17 2012 10:40:48 GMT-0700 (Pacific Daylight Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.12.0.7", "Tue Apr 24 2012 15:47:16 GMT-0700 (Pacific Daylight Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.12.2.3", "Wed May 30 2012 18:50:29 GMT-0700 (Pacific Daylight Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.13.0.6", "Mon Jul 16 2012 09:48:38 GMT-0700 (Pacific Daylight Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.14.1.0", "Tue Aug 21 2012 16:15:08 GMT-0700 (Pacific Daylight Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.15.1.0", "Fri Feb 22 2013 18:51:26 GMT-0800 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.18.0.7", "Sun Jul 14 2013 19:19:36 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.19.0.3", "Thu Sep 19 2013 08:19:21 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.20.0.4", "Fri Sep 27 2013 15:12:24 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.7.0.6", "Sat Nov 12 2011 17:16:54 GMT-0800 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.8.0.8", "Mon Dec 05 2011 15:18:59 GMT-0800 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.8.1.0", "Tue Jan 10 2012 16:24:06 GMT-0800 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.LastLogin_3.9.0.3", "Wed Mar 07 2012 06:51:19 GMT-0800 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.LatestVersion", "3.20.0.4"); Line Deleted : user_pref("CT2559647.Locale", "en"); Line Deleted : user_pref("CT2559647.MCDetectTooltipHeight", "83"); Line Deleted : user_pref("CT2559647.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Line Deleted : user_pref("CT2559647.MCDetectTooltipWidth", "295"); Line Deleted : user_pref("CT2559647.MyStuffEnabledAtInstallation", true); Line Deleted : user_pref("CT2559647.OriginalFirstVersion", "3.7.0.6"); Line Deleted : user_pref("CT2559647.SHRINK_TOOLBAR", 1); Line Deleted : user_pref("CT2559647.SearchAPILastCheckTime", "Fri Sep 27 2013 15:12:25 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.SearchBoxWidth", 150); Line Deleted : user_pref("CT2559647.SearchCaption", "Coupons.com Customized Web Search"); Line Deleted : user_pref("CT2559647.SearchEngineBeforeUnload", "Google"); Line Deleted : user_pref("CT2559647.SearchFromAddressBarIsInit", true); Line Deleted : user_pref("CT2559647.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2559647&SearchSource=2&q="); Line Deleted : user_pref("CT2559647.SearchInNewTabEnabled", false); Line Deleted : user_pref("CT2559647.SearchInNewTabIntervalMM", 1440); Line Deleted : user_pref("CT2559647.SearchInNewTabLastCheckTime", "Thu Sep 19 2013 08:19:03 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID&UM=UM_ID"); Line Deleted : user_pref("CT2559647.SearchInNewTabURLFromSearchAPI", "hxxp://search.conduit.com/?ctid=CT2559647&octid=CT2559647&SearchSource=15&CUI=SB_CUI&SSPV=EB_SSPV&Lay=1&UM=UM_ID"); Line Deleted : user_pref("CT2559647.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usage.ashx?ctid=EB_TOOLBAR_ID"); Line Deleted : user_pref("CT2559647.SearchProtectorEnabled", false); Line Deleted : user_pref("CT2559647.SearchProtectorToolbarDisabled", false); Line Deleted : user_pref("CT2559647.SendProtectorDataViaLogin", true); Line Deleted : user_pref("CT2559647.ServiceMapLastCheckTime", "Fri Sep 27 2013 15:12:27 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.SettingsLastCheckTime", "Fri Sep 27 2013 15:12:16 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.SettingsLastUpdate", "1380266682"); Line Deleted : user_pref("CT2559647.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2559647&SearchSource=13"); Line Deleted : user_pref("CT2559647.ThirdPartyComponentsInterval", 504); Line Deleted : user_pref("CT2559647.ThirdPartyComponentsLastCheck", "Tue Sep 24 2013 17:37:57 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.ThirdPartyComponentsLastUpdate", "1331805997"); Line Deleted : user_pref("CT2559647.ToolbarShrinkedFromSetup", false); Line Deleted : user_pref("CT2559647.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2559647"); Line Deleted : user_pref("CT2559647.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com,MyBlogToolbar. com,MyCity[…] Line Deleted : user_pref("CT2559647.UserID", "UN30501172201978644"); Line Deleted : user_pref("CT2559647.ValidationData_Search", 2); Line Deleted : user_pref("CT2559647.ValidationData_Toolbar", 2); Line Deleted : user_pref("CT2559647.alertChannelId", "952537"); Line Deleted : user_pref("CT2559647.countryCode", "US"); Line Deleted : user_pref("CT2559647.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com\",\"AppsDetectionUrlPattern\":\"hxxp://appdown[…] Line Deleted : user_pref("CT2559647.globalFirstTimeInfoLastCheckTime", "Thu Sep 19 2013 08:19:31 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.homepageProtectorEnableByLogin", true); Line Deleted : user_pref("CT2559647.initDone", true); Line Deleted : user_pref("CT2559647.isAppTrackingManagerOn", false); Line Deleted : user_pref("CT2559647.myStuffEnabled", true); Line Deleted : user_pref("CT2559647.myStuffPublihserMinWidth", 400); Line Deleted : user_pref("CT2559647.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID"); Line Deleted : user_pref("CT2559647.myStuffServiceIntervalMM", 1440); Line Deleted : user_pref("CT2559647.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT"); Line Deleted : user_pref("CT2559647.oldAppsList", "129126535051871363,129126535052027614,111,129732450647667807,1000034,100008 0,1000082,1000234,1000515,1000,1001,1002,1003,1004,1005,1006,1007,1008,1009,1010, 1011,101[…] Line Deleted : user_pref("CT2559647.revertSettingsEnabled", true); Line Deleted : user_pref("CT2559647.searchProtectorDialogDelayInSec", 10); Line Deleted : user_pref("CT2559647.searchProtectorEnableByLogin", true); Line Deleted : user_pref("CT2559647.testingCtid", ""); Line Deleted : user_pref("CT2559647.toolbarAppMetaDataLastCheckTime", "Fri Sep 27 2013 15:12:24 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.toolbarContextMenuLastCheckTime", "Sat Sep 14 2013 14:26:27 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CT2559647.usagesFlag", 2); Line Deleted : user_pref("CommunityToolbar.ConduitSearchList", "Coupons.com Customized Web Search"); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2559647/CT2559647", "\"6c8662e3b9e80e02d9177a5cfe8dad103\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/952537/948310/US", "\"0\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2559647", "\"0\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en", "C5ZJe6gL80JBW5CuLy+wkg=="); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en&ctid=CT2559647", "GNmdGrr6syWWiO5HPrW6Kg=="); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en", "mfQ70fvlD2zuBxSBj8rQqA=="); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en&ctid=CT2559647", "inm6N6Ad2DrQKGUsOGzkLg=="); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en", "k9un27OkAvkwB2ZmvXxTnA=="); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en&ctid=CT2559647", "6nU8AIjBECdJeC23UVuipQ=="); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en", "FqddrIU7eyJgaaLyHDeVMQ=="); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en&ctid=CT2559647", "Y3Dtc1pIAMMkuUpvgoTeaw=="); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\"0ea11bd291bce1:0\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10.0.1", "\"4ead38b3e6bcd1:0\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12.0.7", "\"4ead38b3e6bcd1:0\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12.2.3", "\"4ead38b3e6bcd1:0\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13.0.6", "\"0d648794549cd1:0\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14.1.0", "\"0e0a4327275cd1:1515\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15.1.0", "\"0343677cfb1cd1:160f\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.18.0.7", "\"0343677cfb1cd1:1694\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.19.0.3", "\"23c5489aa686ce1:0\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.20.0.4", "\"23c5489aa686ce1:0\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.7.0.6", "\"6a637346d78ccc1:1254\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.0.8", "\"6a637346d78ccc1:0\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.1.0", "\"6a637346d78ccc1:0\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.9.0.3", "\"801a319dd78ccc1:12e4\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2559647", "\"9971ee9815a5fc569766cf6ddcaaca8e\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2559647&octid=CT2559647", "\"1321973056\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE", "\"b7349b1da0af9818964ce9f063cd3443\""); Line Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"f2982e793f1ad490a79e05219fde8c7e\""); Line Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Documents and Settings\\HP_Administrator\\Application Data\\Mozilla\\Firefox\\Profiles\\ehod9kc8.default\\conduitCommon\\modules\\3.20.0.4"); Line Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.20.0.4"); Line Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://www.searchqu.com//web?src=ffb&appid=0&systemid=421&sr=0&q="); Line Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2559647"); Line Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2559647"); Line Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2559647"); Line Deleted : user_pref("CommunityToolbar.globalUserId", "bba52f0c-e43a-423d-aa87-a36c802554f2"); Line Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true); Line Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true); Line Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2559647"); Line Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Sep 14 2013 14:26:20 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440); Line Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Fri Sep 27 2013 15:12:29 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com"); Line Deleted : user_pref("CommunityToolbar.notifications.firstTimeAlertShown", true); Line Deleted : user_pref("CommunityToolbar.notifications.locale", "en"); Line Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440); Line Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Fri Sep 27 2013 15:12:20 GMT-0700 (Pacific Standard Time)"); Line Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611"); Line Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20); Line Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com"); Line Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false); Line Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300); Line Deleted : user_pref("CommunityToolbar.notifications.userId", "7e1f0798-c6ee-4cc6-a7a6-ee4c1612e204"); Line Deleted : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.yahoo.com/"); Line Deleted : user_pref("CommunityToolbar.originalSearchEngine", "Web Search"); Line Deleted : user_pref("browser.search.defaultengine", "Ask.com"); Line Deleted : user_pref("browser.search.defaultenginename", "My Web Search"); Line Deleted : user_pref("browser.search.defaultthis.engineName", "Coupons.com Customized Web Search"); Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2559647&SearchSource=3&q={searchTerms}"); Line Deleted : user_pref("browser.search.order.1", "Web Search"); Line Deleted : user_pref("browser.search.selectedEngine", "My Web Search"); Line Deleted : user_pref("extensions.mywebsearch.prevDefaultEngine", "Yahoo"); Line Deleted : user_pref("extensions.mywebsearch.prevSelectedEngine", "Google"); Line Deleted : user_pref("extensions.sahtb.searchEngineNameCurrent", "My Web Search"); Line Deleted : user_pref("extensions.sahtb.searchEngineNameOriginal", "My Web Search"); Line Deleted : user_pref("extensions.sahtb.searchEngineNameSAH", "Web Search"); Line Deleted : user_pref("extensions.sahtb.url.prefs.data", "\r\n \r\n

Satchfan

Post #5September 29, 2013, 10:46 PM UTC

Thanks for the logs which shows a lot was cleaned up but Firefox needs to be reset or re-installed. The Reset Firefox feature can fix many issues by restoring Firefox to its factory default state.

Reset Firefox

You need to reset Firefox to its default settings which will remove everything from Firefox.

If you need to keep your bookmarks, follow the instructions here.

at the top of the Firefox window, click on the Help menu and select Troubleshooting Information
click the "Reset Firefox" button in the upper-right corner of the Troubleshooting Information page.
on the right, click Reset Firefox
Firefox will close and be reset
when it's finished, click Finish and Firefox will open
restart the computer and check Firefox again.

===================================================

Run aswMBR

download aswMBR.exe to your desktop.
double click aswMBR.exe to run it
if asked, accept the AVAST virus definition download
click the "Scan" button to start scan
on completion of the scan click Save log, save it to your desktop and post in your next reply. Note - do NOT attempt any Fix yet.

Please try to run OTL again.

Satchfan

RetiredChief

Post #6September 30, 2013, 12:36 AM UTC

Here are the latest scans:

OTL logfile created on: 9/29/2013 5:16:29 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\HP_Administrator\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

958.48 Mb Total Physical Memory | 466.52 Mb Available Physical Memory | 48.67% Memory free
2.26 Gb Paging File | 1.80 Gb Available in Paging File | 79.88% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 177.80 Gb Total Space | 136.23 Gb Free Space | 76.62% Space Free | Partition Type: NTFS
Drive D: | 8.50 Gb Total Space | 1.12 Gb Free Space | 13.13% Space Free | Partition Type: FAT32

Computer Name: BLAKLEY | User Name: HP_Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/09/29 17:15:23 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Administrator\My Documents\Downloads\OTL.exe
PRC - [2013/09/16 20:21:30 | 000,829,392 | —- | M] (Google Inc.) – C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2013/06/20 18:05:14 | 000,022,208 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/06/20 17:25:44 | 000,995,176 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/11/28 04:45:16 | 001,868,432 | —- | M] () – C:\Program Files\COMODO\Dragon\dragon_updater.exe
PRC - [2012/10/02 12:13:44 | 003,064,000 | —- | M] (Skype Technologies S.A.) – C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2010/05/20 15:27:24 | 000,139,632 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/09/11 13:11:00 | 006,823,860 | —- | M] () – C:\Documents and Settings\All Users\Application Data\Renaissance Wireless Server\Renaissance Wireless Server.exe
PRC - [2005/08/03 00:19:16 | 000,058,880 | —- | M] (Microsoft) – C:\WINDOWS\arservice.exe

========== Modules (No Company Name) ==========

MOD - [2013/01/01 23:49:10 | 001,292,288 | —- | M] () – C:\WINDOWS\system32\quartz.dll
MOD - [2012/11/28 04:45:16 | 001,868,432 | —- | M] () – C:\Program Files\COMODO\Dragon\dragon_updater.exe
MOD - [2011/06/24 22:56:36 | 000,087,328 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/02/04 18:48:30 | 000,291,840 | —- | M] () – C:\WINDOWS\system32\sbe.dll
MOD - [2008/04/13 17:11:59 | 000,014,336 | —- | M] () – C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/13 17:11:51 | 000,059,904 | —- | M] () – C:\WINDOWS\system32\devenum.dll
MOD - [2007/09/11 13:11:00 | 006,823,860 | —- | M] () – C:\Documents and Settings\All Users\Application Data\Renaissance Wireless Server\Renaissance Wireless Server.exe
MOD - [2005/08/03 00:19:16 | 000,050,176 | —- | M] () – C:\WINDOWS\armcex.dll
MOD - [2005/03/15 23:17:28 | 000,204,800 | —- | M] () – c:\Program Files\HP\Digital Imaging\bin\HpqUtil.dll

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe – (MotoHelper)
SRV - File not found [On_Demand | Stopped] – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe – (McComponentHostService)
SRV - [2013/09/20 16:59:26 | 000,257,416 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2013/08/20 09:57:43 | 000,117,656 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2013/06/20 18:05:14 | 000,022,208 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - [2013/01/08 12:55:20 | 000,161,536 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2012/11/28 04:45:16 | 001,868,432 | —- | M] () [Auto | Running] – C:\Program Files\COMODO\Dragon\dragon_updater.exe – (DragonUpdater)
SRV - [2012/10/02 12:13:44 | 003,064,000 | —- | M] (Skype Technologies S.A.) [Auto | Running] – C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe – (Skype C2C Service)
SRV - [2012/02/24 06:26:28 | 000,261,952 | —- | M] (Comodo Security Solutions, Inc.) [Auto | Stopped] – C:\Program Files\COMODO\COMODO System Utilities\CSUService.exe – (CSUService)
SRV - [2010/05/20 15:27:24 | 000,139,632 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft LifeCam\MSCamS32.exe – (MSCamSvc)
SRV - [2005/08/03 00:19:16 | 000,058,880 | —- | M] (Microsoft) [Auto | Running] – C:\WINDOWS\arservice.exe – (ARSVC)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\motport.sys – (motport)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\motmodem.sys – (motmodem)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\motccgpfl.sys – (motccgpfl)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\motccgp.sys – (motccgp)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\mcdbus.sys – (mcdbus)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | On_Demand | Unknown] – C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\aswMBR.sys – (aswMBR)
DRV - [2011/08/03 13:54:12 | 000,223,128 | —- | M] (DT Soft Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\dtscsi.sys – (dtscsi)
DRV - [2011/08/03 13:31:07 | 000,664,064 | —- | M] () [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\sptd.sys – (sptd)
DRV - [2010/05/20 15:27:24 | 000,030,576 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nx6000.sys – (MSHUSBVideo)
DRV - [2010/04/28 07:44:02 | 000,054,760 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys – (fssfltr)
DRV - [2010/03/22 23:53:12 | 000,816,672 | R— | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AE1000XP.sys – (AE1000)
DRV - [2009/08/19 14:49:22 | 000,049,904 | R— | M] (Avanquest Software) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BVRPMPR5.SYS – (BVRPMPR5)
DRV - [2005/08/29 15:11:00 | 003,644,928 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ALCXWDM.SYS – (ALCXWDM)
DRV - [2005/08/13 22:35:54 | 001,313,792 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2005/07/04 00:30:34 | 000,026,624 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\PS2.sys – (Ps2)
DRV - [2005/06/30 01:03:18 | 000,175,104 | —- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\ftsata2.sys – (ftsata2)
DRV - [2005/03/09 14:53:00 | 000,036,352 | —- | M] (Advanced Micro Devices) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\AmdK8.sys – (AmdK8)
DRV - [2005/03/04 11:10:26 | 000,074,496 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtlnicxp.sys – (RTL8023xp)
DRV - [2004/12/15 15:18:32 | 000,220,928 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWBS2.sys – (HSFHWBS2)
DRV - [2004/12/15 15:18:28 | 000,703,232 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2004/12/15 15:18:26 | 001,038,208 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DP.sys – (HSF_DP)
DRV - [2004/08/03 22:31:34 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139)
DRV - [2003/11/05 15:45:12 | 000,017,408 | —- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\bb-run.sys – (bb-run)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?FORM=WLETDF&…rc=IE-SearchBox
IE - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.search.yahoo.com/search?p={searc…p;fr=chr-comodo
IE - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\..\SearchScopes\{DDC8D966-465C-2856-0BFE-6F4974176253}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 192.168.*.*

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.1: C:\Documents and Settings\HP_Administrator\Application Data\Facebook\npfbplugin_1_0_1.dll ( )
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\HP_Administrator\Application Data\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/10/13 08:27:12 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/08/20 09:56:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/09/19 16:20:14 | 000,000,000 | —D | M]

[2010/02/11 18:35:24 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Extensions
[2013/08/02 10:40:03 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\op5b9w5g.default\extensions
[2013/08/20 09:56:12 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/08/20 09:56:12 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2013/08/20 09:56:14 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/08/20 09:56:10 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/20 09:57:45 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2011/11/15 22:19:08 | 000,611,224 | —- | M] (Oracle Corporation) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/10/13 08:26:53 | 000,129,176 | —- | M] (RealPlayer) – C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2011/05/06 07:30:05 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml.old

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncodin
g}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyPar
ameter}
CHR - homepage: http://us.yahoo.com?fr=fpc-comodo
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.76\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 7.0.10.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 7 U1 (Enabled) = C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.76\pdf.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Documents and Settings\HP_Administrator\Application Data\Facebook\npfbplugin_1_0_1.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Documents and Settings\HP_Administrator\Application Data\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: Unity Player (Enabled) = C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility (Enabled) = C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Skype Click to Call = C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\
CHR - Extension: Chrome In-App Payments service = C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0\

O1 HOSTS File: ([2011/11/11 22:40:13 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008..\Run: [Facebook Update] C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Planner Reminders Tray Icon.lnk = File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Forget Me Not.lnk = File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Renaissance Wireless Server.lnk = C:\Documents and Settings\All Users\Application Data\Renaissance Wireless Server\Renaissance Wireless Server.exe ()
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\hc_tray.lnk = File not found
O4 - Startup: C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\Jewell DeskMate.LNK = File not found
O4 - Startup: C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Start Menu\Programs\Startup\Registration Silent Hunter III.LNK = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O16 - DPF: {036F8A56-0BC8-4607-8F98-D3231E6FF5ED} http://de225.centra.com/SiteRoots/main/Ins…raUpdaterAx.cab (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shock…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4F9665E1-6A11-4972-B941-EB22DFA68FC7}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{837C5F68-FB84-414E-8FEC-9FA666C52334}: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{837C5F68-FB84-414E-8FEC-9FA666C52334}: NameServer = 8.26.56.26,156.154.70.22
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EFDC876F-B06E-4EBB-8CF6-7765A6D04335}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/11/10 17:46:21 | 000,000,100 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/08/15 11:46:17 | 000,000,000 | R–D | M] - C:\autorun.inf – [ NTFS ]
O32 - AutoRun File - [2001/07/28 05:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2010/08/15 11:46:18 | 000,000,000 | R–D | M] - D:\autorun.inf – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk /r \??\J:)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/09/29 16:40:47 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Desktop\Old Firefox Data
[2013/09/29 11:50:10 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/09/29 11:35:27 | 000,000,000 | —D | C] – C:\AdwCleaner
[2013/09/24 16:13:35 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\My Documents\Pictures from Grammy
[2013/09/19 16:18:50 | 000,000,000 | -HSD | C] – C:\Config.Msi
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/09/29 17:19:12 | 000,000,444 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{BF38A124-251E-4DD5-B80F-B1ED348AAA54}.job
[2013/09/29 17:13:31 | 000,000,512 | —- | M] () – C:\Documents and Settings\HP_Administrator\Desktop\MBR.dat
[2013/09/29 16:59:15 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/09/29 16:53:11 | 000,000,384 | -H– | M] () – C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/09/29 16:43:18 | 000,000,902 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/09/29 16:43:13 | 000,000,452 | —- | M] () – C:\WINDOWS\tasks\CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}.job
[2013/09/29 16:43:13 | 000,000,452 | —- | M] () – C:\WINDOWS\tasks\CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}.job
[2013/09/29 16:43:12 | 000,000,300 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-657425056-1587324396-1979525332-1008.job
[2013/09/29 16:43:05 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/09/29 16:43:03 | 1005,113,344 | -HS- | M] () – C:\hiberfil.sys
[2013/09/29 15:21:01 | 000,000,906 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/09/29 14:57:02 | 000,001,042 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-657425056-1587324396-1979525332-1008UA.job
[2013/09/29 14:57:00 | 000,001,020 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-657425056-1587324396-1979525332-1008Core.job
[2013/09/28 21:31:00 | 000,000,484 | —- | M] () – C:\WINDOWS\tasks\CSU Updater.job
[2013/09/27 18:00:00 | 000,000,430 | —- | M] () – C:\WINDOWS\tasks\Norton Security Scan for HP_Administrator.job
[2013/09/27 17:06:00 | 000,000,308 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-657425056-1587324396-1979525332-1008.job
[2013/09/25 20:58:28 | 000,000,249 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2013/09/24 16:02:30 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/09/21 02:28:49 | 000,001,824 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/09/20 16:59:24 | 000,692,616 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/09/20 16:59:23 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/09/12 12:28:14 | 000,495,456 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/09/12 12:09:49 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2013/09/11 21:24:39 | 000,190,398 | —- | M] () – C:\Documents and Settings\HP_Administrator\Desktop\Proof (2).png
[2013/09/11 21:13:13 | 000,159,156 | —- | M] () – C:\Documents and Settings\HP_Administrator\Desktop\Proof (1).png
[2013/09/11 21:12:26 | 000,159,156 | —- | M] () – C:\Documents and Settings\HP_Administrator\Desktop\window cling.png
[2013/09/11 21:06:11 | 000,084,901 | —- | M] () – C:\Documents and Settings\HP_Administrator\Desktop\Proof.png
[2013/09/11 17:44:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/09/04 08:02:01 | 000,000,454 | —- | M] () – C:\WINDOWS\tasks\ReclaimerResumeInstall_HP_Administrator.job
[2013/09/01 19:10:57 | 000,030,072 | —- | M] () – C:\Documents and Settings\HP_Administrator\Desktop\103126-b.jpg
[2013/09/01 19:09:58 | 000,050,620 | —- | M] () – C:\Documents and Settings\HP_Administrator\Desktop\01.jpg
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/09/29 17:13:31 | 000,000,512 | —- | C] () – C:\Documents and Settings\HP_Administrator\Desktop\MBR.dat
[2013/09/11 21:24:41 | 000,190,398 | —- | C] () – C:\Documents and Settings\HP_Administrator\Desktop\Proof (2).png
[2013/09/11 21:13:16 | 000,159,156 | —- | C] () – C:\Documents and Settings\HP_Administrator\Desktop\Proof (1).png
[2013/09/11 21:12:39 | 000,159,156 | —- | C] () – C:\Documents and Settings\HP_Administrator\Desktop\window cling.png
[2013/09/11 21:06:18 | 000,084,901 | —- | C] () – C:\Documents and Settings\HP_Administrator\Desktop\Proof.png
[2013/09/01 19:11:01 | 000,030,072 | —- | C] () – C:\Documents and Settings\HP_Administrator\Desktop\103126-b.jpg
[2013/09/01 19:10:08 | 000,050,620 | —- | C] () – C:\Documents and Settings\HP_Administrator\Desktop\01.jpg
[2013/03/28 22:17:19 | 001,474,832 | —- | C] () – C:\WINDOWS\System32\drivers\sfi.dat
[2012/02/14 15:28:51 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/11/06 14:58:18 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/10/16 15:14:47 | 000,000,000 | —- | C] () – C:\WINDOWS\DC200_DC210_Updater.INI
[2010/11/23 13:28:10 | 000,138,056 | —- | C] () – C:\Documents and Settings\HP_Administrator\Application Data\PnkBstrK.sys
[2010/09/06 16:05:21 | 000,000,129 | —- | C] () – C:\Documents and Settings\HP_Administrator\jagex_runescape_preferences2.dat
[2010/09/06 16:05:21 | 000,000,000 | —- | C] () – C:\Documents and Settings\HP_Administrator\jagex__preferences3.dat
[2010/04/04 21:48:35 | 000,000,000 | —- | C] () – C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\prvlcl.dat
[2010/03/04 16:36:06 | 000,012,130 | -HS- | C] () – C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\04lB
[2010/02/11 19:28:30 | 000,000,139 | —- | C] () – C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\fusioncache.dat
[2008/08/26 15:30:07 | 000,000,046 | —- | C] () – C:\Documents and Settings\HP_Administrator\jagex_runescape_preferences.dat
[2006/04/04 16:11:55 | 000,031,744 | —- | C] () – C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/03/31 22:57:29 | 000,005,336 | —- | C] () – C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat

========== ZeroAccess Check ==========

[2005/08/31 04:58:26 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2008/04/13 17:12:05 | 001,499,136 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 05:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 17:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2006/07/22 16:19:40 | 001,029,367 | —- | M] (MicSoft) – C:\WIAdriverLiDE50.EXE

< MD5 for: EXPLORER.EXE >
[2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007/06/13 04:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 03:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/10 05:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/02/06 04:06:24 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 – C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
[2008/04/13 17:12:34 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\WINDOWS\ServicePackFiles\i386\services.exe
[2009/02/06 10:14:03 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE – C:\WINDOWS\$NtServicePackUninstall$\services.exe
[2009/02/06 03:22:21 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=4712531AB7A01B7EE059853CA17D39BD – C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe
[2009/02/06 04:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe
[2009/02/06 04:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\ERDNT\cache\services.exe
[2009/02/06 04:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\dllcache\services.exe
[2009/02/06 04:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\services.exe
[2004/08/10 05:00:00 | 000,108,032 | —- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 – C:\WINDOWS\$NtUninstallKB956572$\services.exe

< MD5 for: SVCHOST.EXE >
[2008/04/13 17:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/13 17:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 17:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe
[2004/08/10 05:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 – C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/10 05:00:00 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 17:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/13 17:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 17:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/10 05:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< %systemroot%\*. /rp /s >

< %systemdrive%\$Recycle.Bin|@;true;true;true >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed\thard disk media
Interface type: IDE
Media Type: Fixed\thard disk media
Model: ST3200826AS
Partitions: 2
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 -
Interface type: USB
Media Type:
Model: Generic USB SD Reader USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 -
Interface type: USB
Media Type:
Model: Generic USB CF Reader USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE3 -
Interface type: USB
Media Type:
Model: Generic USB SM Reader USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE4 -
Interface type: USB
Media Type:
Model: Generic USB MS Reader USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE5 -
Interface type: USB
Media Type:
Model: Canon MG5200 series USB Device
Partitions: 0
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 9.00GB
Starting Offset: 32256
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 178.00GB
Starting Offset: 9138286080
Hidden sectors: 0

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 -> Junction
[C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e -> Junction
[C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 -> Junction
[C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35] -> C:\WINDOWS\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5 -> Junction

< End of report >

———————————————————————————————————————————————————————————————————————————————————–
OTL Extras logfile created on: 9/29/2013 5:16:29 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\HP_Administrator\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

958.48 Mb Total Physical Memory | 466.52 Mb Available Physical Memory | 48.67% Memory free
2.26 Gb Paging File | 1.80 Gb Available in Paging File | 79.88% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 177.80 Gb Total Space | 136.23 Gb Free Space | 76.62% Space Free | Partition Type: NTFS
Drive D: | 8.50 Gb Total Space | 1.12 Gb Free Space | 13.13% Space Free | Partition Type: FAT32

Computer Name: BLAKLEY | User Name: HP_Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = ChromeHTML] – C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-657425056-1587324396-1979525332-1008\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
http [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger – (Microsoft Corporation)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\All Users\Application Data\Renaissance Wireless Server\Renaissance Wireless Server.exe" = C:\Documents and Settings\All Users\Application Data\Renaissance Wireless Server\Renaissance Wireless Server.exe:*:Enabled:Renaissance Wireless Server 1.4.5 – ()
"C:\Program Files\Microsoft LifeCam\LifeCam.exe" = C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe – (Microsoft Corporation)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger – (Microsoft Corporation)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)
"C:\Program Files\BitTorrent\BitTorrent.exe" = C:\Program Files\BitTorrent\BitTorrent.exe:*:Disabled:BitTorrent
"C:\WINDOWS\system32\PnkBstrA.exe" = C:\WINDOWS\system32\PnkBstrA.exe:*:Disabled:PnkBstrA
"C:\WINDOWS\system32\PnkBstrB.exe" = C:\WINDOWS\system32\PnkBstrB.exe:*:Disabled:PnkBstrB
"C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe" = C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Disabled:Facebook Video Calling Plugin – (Skype Limited)
"C:\Program Files\Microsoft LifeCam\LifeEnC2.exe" = C:\Program Files\Microsoft LifeCam\LifeEnC2.exe:*:Disabled:LifeEnC2.exe – (Microsoft Corporation)
"C:\Program Files\Microsoft LifeCam\LifeExp.exe" = C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Disabled:LifeExp.exe – (Microsoft Corporation)
"C:\Program Files\Microsoft LifeCam\LifeTray.exe" = C:\Program Files\Microsoft LifeCam\LifeTray.exe:*:Disabled:LifeTray.exe – (Microsoft Corporation)
"C:\Program Files\Rhapsody\rhapsody.exe" = C:\Program Files\Rhapsody\rhapsody.exe:*:Disabled:RealNetworks Rhapsody – (Rhapsody International Inc.)
"C:\WINDOWS\system32\sessmgr.exe" = C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit – (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype – (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03B1B42B-F6DE-41d9-8CFF-DC44E895C7A7}" = PhotoGallery
"{03CE1BCB-03F5-4C6A-B37E-69799AA3C544}" = SpyHunter
"{0611BD4E-4FE4-4a62-B0C0-18A4CC463428}" = CP_Package_Variety1
"{069730C2-755A-485B-A205-27A1AAFA836A}" = InstantShareAlert
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series" = Canon MG5200 series MP Drivers
"{172975EB-9465-4861-95B5-C7BB6D3DE62A}" = DocumentViewer
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1C139D7D-9FEA-468d-A9C8-2A6E3BDE564A}" = CP_Package_Variety3
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{21DB3D90-D816-4092-A260-CA3F6B55A6DD}" = Sonic_PrimoSDK
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23A7B376-BBEC-4e76-BBD7-0F155E70D74B}" = CP_Panorama1Config
"{268278CF-FB69-4D98-B70E-BFEC1CDCA225}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83217001FF}" = Java™ 7 Update 1
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}" = HP Deskjet Printer Preload
"{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{32BDCCB8-9DC8-496d-9DB1-F77510775BDB}" = InstantShareDevices
"{33D6CC28-9F75-4d1b-A11D-98895B3A3729}" = HP Photosmart 330,380,420,470,7800,8000,8200 Series
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36E47DA1-10E1-45d9-8B19-14D19607CDCF}" = CP_CalendarTemplates1
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{382E94C0-6E22-44e4-B003-8EB31DFE296F}" = cp_LightScribeConfig
"{3912A629-0020-0005-3757-2FBA74D4DF0A}" = InterVideo WinDVD Player
"{3BA95526-6AE0-4B87-A62D-17187EF565FC}" = HP Boot Optimizer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DADB23F-94E6-4E4D-AFE8-15DE4395E8F3}" = Microsoft Security Client
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{56EE8B17-8274-418d-89AC-C057C5DB251E}" = RandMap
"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg
"{5A01C58E-B0EC-49b9-AD71-7C0468688087}" = CP_Package_Basic1
"{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}" = Microsoft LifeCam
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{66BA8C26-AFE4-4408-807B-43E76B57EF53}" = SkinsHP1
"{6BB6627C-694F-4FDC-A3E5-C7F4BED4C724}" = DocProc
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.0.0
"{710BF966-43C8-4216-A8EC-BC4E169FF7C1}" = MobileMe Control Panel
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{755EC5E3-FD51-46bd-A57F-7A2D56FBF061}" = PSTAPlugin
"{769A295C-DCF4-41d6-AFBA-7D9394B23AFE}" = PSPrinters08
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7C03270C-4FAB-4F5C-B10D-52FEDA190790}" = DocumentViewerQFolder
"{7E27304E-BAA2-4d90-A34E-76641FAFABB4}" = CP_AtenaShokunin1Config
"{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISER_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91477C6F-EC7C-4BFC-BBE1-E45908019DED}" = LightScribe 1.4.52.1
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD Player
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{96AD3B61-EAE2-11E2-9E72-B8AC6F98CCE3}" = Google Earth
"{A195B13E-A5E3-4BAF-A995-7F70F445CD06}" = ScannerCopy
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3455242-DAE0-4523-8242-FD82706ABF4B}" = CameraDrivers
"{A436F67F-687E-4736-BD2B-537121A804CF}" = HP Product Detection
"{A5BB5365-EFB4-44c3-A7E2-EB59B7EFD23D}" = CueTour
"{A7DA4247-9F22-4d4a-974A-DD455CCF43B6}" = COMODO System Utilities
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.8)
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B4D279F1-4309-49cc-A4B5-3A0D2E59C7B5}" = PanoStandAlone
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B824B5C9-849F-4b9e-9EA7-6FD8CD8116DA}" = CP_Package_Variety2
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C104580B-1C79-4d73-9BF0-CA0B184296A4}" = cp_LightScribePlugin
"{C83A12B9-B31B-461A-BBD4-CE9B988094F1}" = HP Photosmart Cameras 5.0
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D518592A-0F1E-40ca-BECB-3D3F026C6B0D}" = CameraDrivers
"{D92FF8EB-BD77-40AE-B68B-A6BFC6F8661D}" = Windows Live Family Safety
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{DFB0FED6-0010-4E9B-A402-E513F2459161}" = muvee autoProducer unPlugged 1.2
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{E7137AFD-4E43-47A6-BDC7-533808F72B36}" = muvee autoProducer 4.5
"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status
"{F80239D8-7811-4D5E-B033-0D0BBFE32920}" = HP DigitalMedia Archive
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ATI Display Driver" = ATI Display Driver
"AwayMode160" = Microsoft Away Mode
"Canon MG5200 series User Registration" = Canon MG5200 series User Registration
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Data Fax SoftModem with SmartCP
"Comodo Dragon" = Comodo Dragon
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"ENTERPRISER" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"Google Chrome" = Google Chrome
"Hello Kitty Snap n Share" = Hello Kitty Snap n Share
"HijackThis" = HijackThis 2.0.2
"HP Document Viewer" = HP Document Viewer 5.3
"HP Image Zone for Media Center PC" = HP Image Zone for Media Center PC
"HP Imaging Device Functions" = HP Imaging Device Functions 5.3
"HP Photo & Imaging" = HP Image Zone 5.3
"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.3
"HPOOVClient-9972322 Uninstaller" = Updates from HP (remove only)
"ie8" = Windows Internet Explorer 8
"InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"MapsGalaxy_39bar Uninstall Firefox" = MapsGalaxy Firefox Toolbar
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 23.0.1 (x86 en-US)" = Mozilla Firefox 23.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"RealPlayer 15.0" = RealPlayer
"Rhapsody" = Rhapsody
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-657425056-1587324396-1979525332-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 9/22/2013 5:10:57 AM | Computer Name = BLAKLEY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: A connection with the server could not be established

Error - 9/22/2013 5:31:41 AM | Computer Name = BLAKLEY | Source = Application Error | ID = 1000
Description = Faulting application Skype.exe, version 6.1.0.129, faulting module
unknown, version 0.0.0.0, fault address 0x00000200.

Error - 9/24/2013 7:08:27 PM | Computer Name = BLAKLEY | Source = Application Error | ID = 1000
Description = Faulting application photoapp.exe, version 2.3.0.502, faulting module
photoapp.exe, version 2.3.0.502, fault address 0x0006861e.

Error - 9/24/2013 7:08:32 PM | Computer Name = BLAKLEY | Source = Application Error | ID = 1001
Description = Fault bucket 1021164869.

Error - 9/29/2013 4:42:16 AM | Computer Name = BLAKLEY | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 9/29/2013 4:42:17 AM | Computer Name = BLAKLEY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: A connection with the server could not be established

Error - 9/29/2013 2:49:35 PM | Computer Name = BLAKLEY | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 unspecified, P2 hardeningtelemetry, P3 hardeningtelemetrydisablertp,
P4 4.3.215.0, P5 unspecified, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10
NIL.

Error - 9/29/2013 3:58:52 PM | Computer Name = BLAKLEY | Source = Application Hang | ID = 1002
Description = Hanging application OTL(1).exe, version 3.2.69.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 9/29/2013 3:59:02 PM | Computer Name = BLAKLEY | Source = Application Hang | ID = 1001
Description = Fault bucket -1102560245.

Error - 9/29/2013 4:03:25 PM | Computer Name = BLAKLEY | Source = Application Hang | ID = 1002
Description = Hanging application OTL(1).exe, version 3.2.69.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ OSession Events ]
Error - 1/4/2012 3:08:59 AM | Computer Name = BLAKLEY | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 12429
seconds with 1680 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 9/24/2013 7:02:44 PM | Computer Name = BLAKLEY | Source = Service Control Manager | ID = 7000
Description = The MotoHelper Service service failed to start due to the following
error: %%2

Error - 9/24/2013 8:17:15 PM | Computer Name = BLAKLEY | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
MELINDAS that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{837C5F68-FB84-414E-. The master browser is stopping or an election
is being forced.

Error - 9/24/2013 9:36:21 PM | Computer Name = BLAKLEY | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 9/25/2013 11:49:23 PM | Computer Name = BLAKLEY | Source = Service Control Manager | ID = 7000
Description = The MotoHelper Service service failed to start due to the following
error: %%2

Error - 9/28/2013 12:58:48 PM | Computer Name = BLAKLEY | Source = Print | ID = 6161
Description = The document Print owned by HP_Administrator failed to print on printer
Canon MG5200 series Printer. Data type: NT EMF 1.008. Size of the spool file in
bytes: 2162688. Number of bytes printed: 1490512. Total number of pages in the
document: 2. Number of pages printed: 0. Client machine: \\BLAKLEY. Win32 error
code returned by the print processor: 13 (0xd).

Error - 9/29/2013 2:42:57 PM | Computer Name = BLAKLEY | Source = Service Control Manager | ID = 7000
Description = The MapsGalaxyService service failed to start due to the following
error: %%3

Error - 9/29/2013 2:42:57 PM | Computer Name = BLAKLEY | Source = Service Control Manager | ID = 7000
Description = The MotoHelper Service service failed to start due to the following
error: %%2

Error - 9/29/2013 2:44:20 PM | Computer Name = BLAKLEY | Source = Service Control Manager | ID = 7022
Description = The MSCamSvc service hung on starting.

Error - 9/29/2013 7:29:30 PM | Computer Name = BLAKLEY | Source = Service Control Manager | ID = 7000
Description = The MotoHelper Service service failed to start due to the following
error: %%2

Error - 9/29/2013 7:43:17 PM | Computer Name = BLAKLEY | Source = Service Control Manager | ID = 7000
Description = The MotoHelper Service service failed to start due to the following
error: %%2

< End of report >

—————————————————————————————————————————————————————————————————————————————————-

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2013-09-29 16:46:40
—————————–
16:46:40.890 OS Version: Windows 5.1.2600 Service Pack 3
16:46:40.890 Number of processors: 1 586 0x2701
16:46:40.890 ComputerName: BLAKLEY UserName:
16:46:42.343 Initialize success
16:49:16.296 AVAST engine defs: 13092901
16:49:25.765 The log file has been saved successfully to "C:\Documents and Settings\HP_Administrator\Desktop\aswMBR.txt"

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2013-09-29 16:46:40
—————————–
16:46:40.890 OS Version: Windows 5.1.2600 Service Pack 3
16:46:40.890 Number of processors: 1 586 0x2701
16:46:40.890 ComputerName: BLAKLEY UserName:
16:46:42.343 Initialize success
16:49:16.296 AVAST engine defs: 13092901
16:49:25.765 The log file has been saved successfully to "C:\Documents and Settings\HP_Administrator\Desktop\aswMBR.txt"
16:49:37.781 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
16:49:37.781 Disk 0 Vendor: ST3200826AS 3.03 Size: 190782MB BusType: 3
16:49:38.109 Disk 0 MBR read successfully
16:49:38.109 Disk 0 MBR scan
16:49:38.218 Disk 0 unknown MBR code
16:49:38.218 Disk 0 Partition 1 00 0C FAT32 LBA RECOVERY 8714 MB offset 63
16:49:38.234 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 182064 MB offset 17848215
16:49:38.250 Disk 0 scanning sectors +390716865
16:49:38.515 Disk 0 scanning C:\WINDOWS\system32\drivers
16:49:57.125 Service scanning
16:50:27.859 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32
16:50:34.015 Modules scanning
16:50:50.328 Disk 0 trace - called modules:
16:50:50.656 ntkrnlpa.exe >>UNKNOWN [0x867c70e8]<<
16:50:50.656 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8675cab8]
16:50:50.656 \Driver\Disk[0x86707f38] -> IRP_MJ_CREATE -> 0x867c70e8
16:50:52.500 AVAST engine scan C:\WINDOWS
16:51:07.390 AVAST engine scan C:\WINDOWS\system32
16:55:32.093 AVAST engine scan C:\WINDOWS\system32\drivers
16:55:58.656 AVAST engine scan C:\Documents and Settings\HP_Administrator
17:01:53.968 File: C:\Documents and Settings\HP_Administrator\Desktop\dds.scr **INFECTED** Win32:Malware-gen
17:11:30.671 AVAST engine scan C:\Documents and Settings\All Users
17:12:52.718 Scan finished successfully
17:13:31.671 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\HP_Administrator\Desktop\MBR.dat"
17:13:31.671 The log file has been saved successfully to "C:\Documents and Settings\HP_Administrator\Desktop\aswMBR.txt"

Satchfan

Post #7September 30, 2013, 12:47 AM UTC

Glad the OTL scan worked. Did you reset ot uninstall Firefox?

Based on the result of the aswMBR log I’d like another scan. I'll look at the OTL log later but it is 1.40 am here (UK) so I won’t reply tonight.

Meanwhile:

Run TDSSKiller

Please download TDSSKiller.zip

extract it to your desktop
double click TDSSKiller.exe
press Start Scan
only if Malicious objects are found then ensure Cure is selected - Note: If Cure is not available, please choose Skip instead : do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.
click Continue > Reboot now
copy and paste the log in your next reply
a copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

Additional information:

If you get the warning about a file “UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 (TDSS File System() - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue and then reboot to finish the cleaning process.

Remember, if Cure is not available, choose Skip instead; do not choose “Delete” unless instructed.

Satchfan

RetiredChief

Post #8October 1, 2013, 2:41 AM UTC last edited October 1, 2013, 2:42 AM UTC

I re-set Firefox. Here are the results of the TDSS scan: 19:23:07.0073 1960 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 19:23:07.0683 1960 ============================================================ 19:23:07.0683 1960 Current date / time: 2013/09/30 19:23:07.0683 19:23:07.0683 1960 SystemInfo: 19:23:07.0683 1960 19:23:07.0683 1960 OS Version: 5.1.2600 ServicePack: 3.0 19:23:07.0683 1960 Product type: Workstation 19:23:07.0683 1960 ComputerName: BLAKLEY 19:23:07.0683 1960 UserName: HP_Administrator 19:23:07.0683 1960 Windows directory: C:\WINDOWS 19:23:07.0683 1960 System windows directory: C:\WINDOWS 19:23:07.0683 1960 Processor architecture: Intel x86 19:23:07.0683 1960 Number of processors: 1 19:23:07.0683 1960 Page size: 0x1000 19:23:07.0683 1960 Boot type: Normal boot 19:23:07.0683 1960 ============================================================ 19:23:08.0870 1960 Drive \Device\Harddisk0\DR0 - Size: 0x2E93E36000 (186.31 Gb), SectorSize: 0x200, Cylinders: 0x5F01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 19:23:08.0980 1960 ============================================================ 19:23:08.0980 1960 \Device\Harddisk0\DR0: 19:23:08.0980 1960 MBR partitions: 19:23:08.0980 1960 \Device\Harddisk0\DR0\Partition1: MBR, Type 0xC, StartLBA 0x3F, BlocksNum 0x1105758 19:23:08.0980 1960 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1105797, BlocksNum 0x1639862A 19:23:08.0980 1960 ============================================================ 19:23:09.0011 1960 C: <-> \Device\Harddisk0\DR0\Partition2 19:23:09.0011 1960 D: <-> \Device\Harddisk0\DR0\Partition1 19:23:09.0011 1960 ============================================================ 19:23:09.0011 1960 Initialize success 19:23:09.0011 1960 ============================================================ 19:23:45.0870 3844 ============================================================ 19:23:45.0870 3844 Scan started 19:23:45.0870 3844 Mode: Manual; 19:23:45.0870 3844 ============================================================ 19:23:46.0026 3844 ================ Scan system memory ======================== 19:23:46.0026 3844 System memory - ok 19:23:46.0042 3844 ================ Scan services ============================= 19:23:46.0245 3844 Abiosdsk - ok 19:23:46.0261 3844 abp480n5 - ok 19:23:46.0308 3844 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 19:23:46.0308 3844 ACPI - ok 19:23:46.0355 3844 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 19:23:46.0355 3844 ACPIEC - ok 19:23:46.0464 3844 [ 24A0876D07EF356DCBC1D7A7929354AB ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 19:23:46.0480 3844 AdobeFlashPlayerUpdateSvc - ok 19:23:46.0495 3844 adpu160m - ok 19:23:46.0589 3844 [ 678C8FDB9D6094D41F322B7159853C54 ] AE1000 C:\WINDOWS\system32\DRIVERS\AE1000XP.sys 19:23:46.0605 3844 AE1000 - ok 19:23:46.0683 3844 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 19:23:46.0683 3844 aec - ok 19:23:46.0761 3844 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 19:23:46.0761 3844 AFD - ok 19:23:46.0776 3844 Aha154x - ok 19:23:46.0792 3844 aic78u2 - ok 19:23:46.0808 3844 aic78xx - ok 19:23:47.0011 3844 [ 7F26D024355CBADB60838F53DFB171EC ] ALCXWDM C:\WINDOWS\system32\drivers\ALCXWDM.SYS 19:23:47.0151 3844 ALCXWDM - ok 19:23:47.0214 3844 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll 19:23:47.0214 3844 Alerter - ok 19:23:47.0245 3844 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe 19:23:47.0245 3844 ALG - ok 19:23:47.0261 3844 AliIde - ok 19:23:47.0323 3844 [ 59301936898AE62245A6F09C0ABA9475 ] AmdK8 C:\WINDOWS\system32\DRIVERS\AmdK8.sys 19:23:47.0323 3844 AmdK8 - ok 19:23:47.0339 3844 amsint - ok 19:23:47.0542 3844 [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 19:23:47.0542 3844 Apple Mobile Device - ok 19:23:47.0620 3844 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 19:23:47.0620 3844 AppMgmt - ok 19:23:47.0667 3844 [ 00523019E3579C8F8A94457FE25F0F24 ] aracpi C:\WINDOWS\system32\DRIVERS\aracpi.sys 19:23:47.0683 3844 aracpi - ok 19:23:47.0714 3844 [ 9FEDAA46EB1A572AC4D9EE6B5F123CF2 ] arhidfltr C:\WINDOWS\system32\DRIVERS\arhidfltr.sys 19:23:47.0714 3844 arhidfltr - ok 19:23:47.0792 3844 [ 82969576093CD983DD559F5A86F382B4 ] arkbcfltr C:\WINDOWS\system32\DRIVERS\arkbcfltr.sys 19:23:47.0792 3844 arkbcfltr - ok 19:23:47.0823 3844 [ 9B21791D8A78FAECE999FADBEBDA6C22 ] armoucfltr C:\WINDOWS\system32\DRIVERS\armoucfltr.sys 19:23:47.0823 3844 armoucfltr - ok 19:23:47.0886 3844 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys 19:23:47.0886 3844 Arp1394 - ok 19:23:47.0901 3844 [ 7A2DA7C7B0C524EF26A79F17A5C69FDE ] ARPolicy C:\WINDOWS\system32\DRIVERS\arpolicy.sys 19:23:47.0901 3844 ARPolicy - ok 19:23:47.0948 3844 [ 9A0D9B2E263BEDE80FB79DDBAD240EC1 ] ARSVC C:\WINDOWS\arservice.exe 19:23:50.0011 3844 ARSVC - ok 19:23:50.0089 3844 asc - ok 19:23:50.0151 3844 asc3350p - ok 19:23:50.0198 3844 asc3550 - ok 19:23:50.0417 3844 [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 19:23:50.0480 3844 aspnet_state - ok 19:23:50.0542 3844 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 19:23:50.0542 3844 AsyncMac - ok 19:23:50.0605 3844 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 19:23:50.0605 3844 atapi - ok 19:23:50.0605 3844 Atdisk - ok 19:23:50.0683 3844 [ D21352BCAAB174948EB9672BC203BB0F ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe 19:23:50.0698 3844 Ati HotKey Poller - ok 19:23:50.0808 3844 [ 7A6CF9F411A9C5BD5C442A1CD46AF401 ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 19:23:50.0870 3844 ati2mtag - ok 19:23:50.0933 3844 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 19:23:50.0933 3844 Atmarpc - ok 19:23:50.0980 3844 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 19:23:50.0980 3844 AudioSrv - ok 19:23:50.0980 3844 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 19:23:50.0980 3844 audstub - ok 19:23:51.0011 3844 [ 7270D070173B20AC9487EA16BB08B45F ] bb-run C:\WINDOWS\system32\DRIVERS\bb-run.sys 19:23:51.0011 3844 bb-run - ok 19:23:51.0026 3844 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 19:23:51.0026 3844 Beep - ok 19:23:51.0105 3844 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll 19:23:51.0120 3844 BITS - ok 19:23:51.0183 3844 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll 19:23:51.0183 3844 Browser - ok 19:23:51.0214 3844 [ 248DFA5762DDE38DFDDBBD44149E9D7A ] BVRPMPR5 C:\WINDOWS\system32\drivers\BVRPMPR5.SYS 19:23:51.0230 3844 BVRPMPR5 - ok 19:23:51.0292 3844 catchme - ok 19:23:51.0339 3844 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 19:23:51.0339 3844 cbidf2k - ok 19:23:51.0370 3844 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 19:23:51.0370 3844 CCDECODE - ok 19:23:51.0386 3844 cd20xrnt - ok 19:23:51.0417 3844 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 19:23:51.0433 3844 Cdaudio - ok 19:23:51.0495 3844 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 19:23:51.0511 3844 Cdfs - ok 19:23:51.0573 3844 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 19:23:51.0573 3844 Cdrom - ok 19:23:51.0589 3844 Changer - ok 19:23:51.0620 3844 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe 19:23:51.0620 3844 CiSvc - ok 19:23:51.0636 3844 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 19:23:51.0651 3844 ClipSrv - ok 19:23:51.0776 3844 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 19:23:51.0886 3844 clr_optimization_v2.0.50727_32 - ok 19:23:51.0948 3844 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 19:23:52.0026 3844 clr_optimization_v4.0.30319_32 - ok 19:23:52.0042 3844 CmdIde - ok 19:23:52.0105 3844 COMSysApp - ok 19:23:52.0136 3844 Cpqarray - ok 19:23:52.0198 3844 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 19:23:52.0198 3844 CryptSvc - ok 19:23:52.0339 3844 [ 93424C48B54E1419B02015B062C9A295 ] CSUService C:\Program Files\COMODO\COMODO System Utilities\CSUService.exe 19:23:52.0355 3844 CSUService - ok 19:23:52.0370 3844 dac2w2k - ok 19:23:52.0370 3844 dac960nt - ok 19:23:52.0433 3844 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 19:23:52.0433 3844 DcomLaunch - ok 19:23:52.0495 3844 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 19:23:52.0495 3844 Dhcp - ok 19:23:52.0526 3844 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 19:23:52.0526 3844 Disk - ok 19:23:52.0558 3844 dmadmin - ok 19:23:52.0636 3844 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 19:23:52.0683 3844 dmboot - ok 19:23:52.0698 3844 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys 19:23:52.0698 3844 dmio - ok 19:23:52.0714 3844 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 19:23:52.0714 3844 dmload - ok 19:23:52.0745 3844 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll 19:23:52.0761 3844 dmserver - ok 19:23:52.0776 3844 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 19:23:52.0776 3844 DMusic - ok 19:23:52.0839 3844 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 19:23:52.0839 3844 Dnscache - ok 19:23:52.0917 3844 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 19:23:52.0917 3844 Dot3svc - ok 19:23:52.0933 3844 dpti2o - ok 19:23:53.0105 3844 [ 7D78A1AE39A95A22A8184907898EE019 ] DragonUpdater C:\Program Files\Comodo\Dragon\dragon_updater.exe 19:23:53.0167 3844 DragonUpdater - ok 19:23:53.0230 3844 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 19:23:53.0230 3844 drmkaud - ok 19:23:53.0292 3844 [ 6461E57BB51A848AAE26F52427B7CF9E ] dtscsi C:\WINDOWS\System32\Drivers\dtscsi.sys 19:23:53.0323 3844 dtscsi - ok 19:23:53.0323 3844 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll 19:23:53.0339 3844 EapHost - ok 19:23:53.0417 3844 [ 5D1347AA5AE6E2F77D7F4F8372D95AC9 ] ehRecvr C:\WINDOWS\eHome\ehRecvr.exe 19:23:53.0433 3844 ehRecvr - ok 19:23:53.0495 3844 [ A53243709439AC2A4C216B817F8D7411 ] ehSched C:\WINDOWS\eHome\ehSched.exe 19:23:53.0495 3844 ehSched - ok 19:23:53.0542 3844 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll 19:23:53.0542 3844 ERSvc - ok 19:23:53.0589 3844 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe 19:23:53.0589 3844 Eventlog - ok 19:23:53.0636 3844 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll 19:23:53.0636 3844 EventSystem - ok 19:23:53.0698 3844 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 19:23:53.0698 3844 Fastfat - ok 19:23:53.0761 3844 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 19:23:53.0776 3844 FastUserSwitchingCompatibility - ok 19:23:53.0823 3844 [ E97D6A8684466DF94FF3BC24FB787A07 ] Fax C:\WINDOWS\system32\fxssvc.exe 19:23:53.0839 3844 Fax - ok 19:23:53.0901 3844 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys 19:23:53.0901 3844 Fdc - ok 19:23:53.0964 3844 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 19:23:53.0964 3844 Fips - ok 19:23:53.0980 3844 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys 19:23:53.0980 3844 Flpydisk - ok 19:23:54.0011 3844 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 19:23:54.0011 3844 FltMgr - ok 19:23:54.0058 3844 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 19:23:54.0105 3844 FontCache3.0.0.0 - ok 19:23:54.0151 3844 [ E0087225B137E57239FF40F8AE82059B ] fssfltr C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys 19:23:54.0167 3844 fssfltr - ok 19:23:54.0323 3844 [ 45B52394F9624237F33A8A3D73C0B221 ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe 19:23:54.0355 3844 fsssvc - ok 19:23:54.0401 3844 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 19:23:54.0401 3844 Fs_Rec - ok 19:23:54.0417 3844 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 19:23:54.0433 3844 Ftdisk - ok 19:23:54.0448 3844 [ 22399D3CE5840C6082844679CCA5D2FC ] ftsata2 C:\WINDOWS\system32\DRIVERS\ftsata2.sys 19:23:54.0448 3844 ftsata2 - ok 19:23:54.0511 3844 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 19:23:54.0511 3844 GEARAspiWDM - ok 19:23:54.0558 3844 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 19:23:54.0558 3844 Gpc - ok 19:23:54.0651 3844 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe 19:23:54.0667 3844 gupdate - ok 19:23:54.0698 3844 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe 19:23:54.0698 3844 gupdatem - ok 19:23:54.0823 3844 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 19:23:54.0823 3844 helpsvc - ok 19:23:54.0870 3844 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll 19:23:54.0886 3844 HidServ - ok 19:23:54.0948 3844 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys 19:23:54.0948 3844 HidUsb - ok 19:23:55.0011 3844 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 19:23:55.0011 3844 hkmsvc - ok 19:23:55.0026 3844 hpn - ok 19:23:55.0120 3844 [ 5DF616ADDB75C1AD36C1F9E4DE0F7654 ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 19:23:55.0120 3844 HSFHWBS2 - ok 19:23:55.0198 3844 [ DFA8F86C0DBCA7DB948043AA3BE6793B ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 19:23:55.0245 3844 HSF_DP - ok 19:23:55.0308 3844 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 19:23:55.0323 3844 HTTP - ok 19:23:55.0386 3844 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 19:23:55.0401 3844 HTTPFilter - ok 19:23:55.0417 3844 i2omgmt - ok 19:23:55.0433 3844 i2omp - ok 19:23:55.0464 3844 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 19:23:55.0464 3844 i8042prt - ok 19:23:55.0526 3844 [ 9A65E42664D1534B68512CAAD0EFE963 ] iaStor C:\WINDOWS\system32\DRIVERS\iaStor.sys 19:23:55.0558 3844 iaStor - ok 19:23:55.0636 3844 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe 19:23:55.0636 3844 IDriverT - ok 19:23:55.0745 3844 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 19:23:55.0761 3844 idsvc - ok 19:23:55.0792 3844 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 19:23:55.0792 3844 Imapi - ok 19:23:55.0870 3844 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe 19:23:55.0870 3844 ImapiService - ok 19:23:55.0886 3844 ini910u - ok 19:23:55.0917 3844 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys 19:23:55.0917 3844 IntelIde - ok 19:23:55.0964 3844 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys 19:23:55.0964 3844 intelppm - ok 19:23:55.0980 3844 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys 19:23:55.0980 3844 Ip6Fw - ok 19:23:56.0011 3844 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 19:23:56.0011 3844 IpFilterDriver - ok 19:23:56.0058 3844 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 19:23:56.0058 3844 IpInIp - ok 19:23:56.0105 3844 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 19:23:56.0105 3844 IpNat - ok 19:23:56.0183 3844 [ E46B17060D3962A384AE484094614788 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 19:23:56.0214 3844 iPod Service - ok 19:23:56.0276 3844 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 19:23:56.0276 3844 IPSec - ok 19:23:56.0292 3844 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 19:23:56.0292 3844 IRENUM - ok 19:23:56.0355 3844 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 19:23:56.0355 3844 isapnp - ok 19:23:56.0386 3844 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 19:23:56.0386 3844 Kbdclass - ok 19:23:56.0401 3844 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys 19:23:56.0401 3844 kbdhid - ok 19:23:56.0433 3844 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 19:23:56.0433 3844 kmixer - ok 19:23:56.0464 3844 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 19:23:56.0464 3844 KSecDD - ok 19:23:56.0511 3844 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 19:23:56.0511 3844 lanmanserver - ok 19:23:56.0573 3844 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 19:23:56.0573 3844 lanmanworkstation - ok 19:23:56.0589 3844 lbrtfdc - ok 19:23:56.0714 3844 [ 6E68E520E6F2F5DCE97A9FF947038769 ] LightScribeService C:\Program Files\Common Files\LightScribe\LSSrvc.exe 19:23:56.0730 3844 LightScribeService - ok 19:23:56.0776 3844 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 19:23:56.0776 3844 LmHosts - ok 19:23:56.0776 3844 McComponentHostService - ok 19:23:56.0792 3844 mcdbus - ok 19:23:56.0839 3844 [ DF0A511F38F16016BF658FCA0090CB87 ] McrdSvc C:\WINDOWS\ehome\mcrdsvc.exe 19:23:56.0839 3844 McrdSvc - ok 19:23:56.0917 3844 [ 11F714F85530A2BD134074DC30E99FCA ] MDM C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 19:23:56.0917 3844 MDM - ok 19:23:56.0948 3844 [ 3C318B9CD391371BED62126581EE9961 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 19:23:56.0948 3844 mdmxsdk - ok 19:23:56.0980 3844 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll 19:23:56.0980 3844 Messenger - ok 19:23:57.0011 3844 [ B7521F69C0A9B29D356157229376FB21 ] MHN C:\WINDOWS\System32\mhn.dll 19:23:57.0011 3844 MHN - ok 19:23:57.0026 3844 [ 7F2F1D2815A6449D346FCCCBC569FBD6 ] MHNDRV C:\WINDOWS\system32\DRIVERS\mhndrv.sys 19:23:57.0026 3844 MHNDRV - ok 19:23:57.0058 3844 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 19:23:57.0058 3844 mnmdd - ok 19:23:57.0089 3844 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 19:23:57.0089 3844 mnmsrvc - ok 19:23:57.0136 3844 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 19:23:57.0136 3844 Modem - ok 19:23:57.0136 3844 motccgp - ok 19:23:57.0151 3844 motccgpfl - ok 19:23:57.0167 3844 motmodem - ok 19:23:57.0198 3844 MotoHelper - ok 19:23:57.0198 3844 motport - ok 19:23:57.0245 3844 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 19:23:57.0245 3844 Mouclass - ok 19:23:57.0276 3844 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys 19:23:57.0276 3844 mouhid - ok 19:23:57.0308 3844 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 19:23:57.0308 3844 MountMgr - ok 19:23:57.0386 3844 [ A35576A433F4AEB0D48976A004657CB6 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe 19:23:57.0386 3844 MozillaMaintenance - ok 19:23:57.0417 3844 [ 24406D75B40F0F6B3C1AC7031D734565 ] MpFilter C:\WINDOWS\system32\DRIVERS\MpFilter.sys 19:23:57.0417 3844 MpFilter - ok 19:23:57.0433 3844 mraid35x - ok 19:23:57.0464 3844 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 19:23:57.0480 3844 MRxDAV - ok 19:23:57.0542 3844 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 19:23:57.0558 3844 MRxSmb - ok 19:23:57.0651 3844 [ D98350792A7CE82E7459A7C36481BEDA ] MSCamSvc C:\Program Files\Microsoft LifeCam\MSCamS32.exe 19:23:57.0683 3844 MSCamSvc - ok 19:23:57.0714 3844 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe 19:23:57.0714 3844 MSDTC - ok 19:23:57.0730 3844 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 19:23:57.0730 3844 Msfs - ok 19:23:57.0776 3844 [ 5119FFC2A6B51089CDB0EFDC75808C97 ] MSHUSBVideo C:\WINDOWS\system32\Drivers\nx6000.sys 19:23:57.0776 3844 MSHUSBVideo - ok 19:23:57.0792 3844 MSIServer - ok 19:23:57.0839 3844 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 19:23:57.0839 3844 MSKSSRV - ok 19:23:57.0917 3844 [ 37F77AEBFF23A99D1BFB4F34CD2D07F2 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe 19:23:57.0917 3844 MsMpSvc - ok 19:23:57.0964 3844 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 19:23:57.0964 3844 MSPCLOCK - ok 19:23:58.0105 3844 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 19:23:58.0120 3844 MSPQM - ok 19:23:58.0167 3844 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 19:23:58.0167 3844 mssmbios - ok 19:23:58.0198 3844 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys 19:23:58.0198 3844 MSTEE - ok 19:23:58.0245 3844 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 19:23:58.0245 3844 Mup - ok 19:23:58.0276 3844 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 19:23:58.0276 3844 NABTSFEC - ok 19:23:58.0323 3844 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll 19:23:58.0339 3844 napagent - ok 19:23:58.0355 3844 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 19:23:58.0355 3844 NDIS - ok 19:23:58.0417 3844 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys 19:23:58.0417 3844 NdisIP - ok 19:23:58.0448 3844 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 19:23:58.0448 3844 NdisTapi - ok 19:23:58.0495 3844 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 19:23:58.0511 3844 Ndisuio - ok 19:23:58.0542 3844 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 19:23:58.0542 3844 NdisWan - ok 19:23:58.0573 3844 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 19:23:58.0589 3844 NDProxy - ok 19:23:58.0620 3844 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 19:23:58.0636 3844 NetBIOS - ok 19:23:58.0651 3844 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 19:23:58.0651 3844 NetBT - ok 19:23:58.0683 3844 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe 19:23:58.0698 3844 NetDDE - ok 19:23:58.0698 3844 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 19:23:58.0698 3844 NetDDEdsdm - ok 19:23:58.0745 3844 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe 19:23:58.0745 3844 Netlogon - ok 19:23:58.0776 3844 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll 19:23:58.0776 3844 Netman - ok 19:23:58.0839 3844 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 19:23:58.0855 3844 NetTcpPortSharing - ok 19:23:58.0917 3844 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys 19:23:58.0917 3844 NIC1394 - ok 19:23:58.0980 3844 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll 19:23:58.0980 3844 Nla - ok 19:23:59.0011 3844 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 19:23:59.0011 3844 Npfs - ok 19:23:59.0042 3844 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 19:23:59.0058 3844 Ntfs - ok 19:23:59.0105 3844 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 19:23:59.0105 3844 NtLmSsp - ok 19:23:59.0167 3844 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 19:23:59.0198 3844 NtmsSvc - ok 19:23:59.0261 3844 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 19:23:59.0261 3844 Null - ok 19:23:59.0292 3844 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 19:23:59.0292 3844 NwlnkFlt - ok 19:23:59.0308 3844 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 19:23:59.0308 3844 NwlnkFwd - ok 19:23:59.0433 3844 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 19:23:59.0448 3844 odserv - ok 19:23:59.0495 3844 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys 19:23:59.0495 3844 ohci1394 - ok 19:23:59.0542 3844 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 19:23:59.0542 3844 ose - ok 19:23:59.0605 3844 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys 19:23:59.0605 3844 Parport - ok 19:23:59.0636 3844 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 19:23:59.0651 3844 PartMgr - ok 19:23:59.0683 3844 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 19:23:59.0683 3844 ParVdm - ok 19:23:59.0714 3844 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 19:23:59.0714 3844 PCI - ok 19:23:59.0730 3844 PCIDump - ok 19:23:59.0745 3844 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 19:23:59.0745 3844 PCIIde - ok 19:23:59.0776 3844 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 19:23:59.0792 3844 Pcmcia - ok 19:23:59.0792 3844 PDCOMP - ok 19:23:59.0808 3844 PDFRAME - ok 19:23:59.0839 3844 PDRELI - ok 19:23:59.0870 3844 PDRFRAME - ok 19:23:59.0886 3844 perc2 - ok 19:23:59.0901 3844 perc2hib - ok 19:23:59.0964 3844 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe 19:23:59.0964 3844 PlugPlay - ok 19:24:00.0058 3844 [ 2D091A99624FB9E7EEF0A86D872EC0C3 ] Pml Driver HPZ12 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE 19:24:00.0073 3844 Pml Driver HPZ12 - ok 19:24:00.0073 3844 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 19:24:00.0073 3844 PolicyAgent - ok 19:24:00.0136 3844 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 19:24:00.0136 3844 PptpMiniport - ok 19:24:00.0151 3844 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys 19:24:00.0151 3844 Processor - ok 19:24:00.0167 3844 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 19:24:00.0167 3844 ProtectedStorage - ok 19:24:00.0214 3844 [ 0E2EB30605CA6ED2509D59AF6A7362B4 ] Ps2 C:\WINDOWS\system32\DRIVERS\PS2.sys 19:24:00.0214 3844 Ps2 - ok 19:24:00.0245 3844 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 19:24:00.0245 3844 PSched - ok 19:24:00.0261 3844 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 19:24:00.0261 3844 Ptilink - ok 19:24:00.0308 3844 [ 86724469CD077901706854974CD13C3E ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys 19:24:00.0308 3844 PxHelp20 - ok 19:24:00.0323 3844 ql1080 - ok 19:24:00.0339 3844 Ql10wnt - ok 19:24:00.0355 3844 ql12160 - ok 19:24:00.0370 3844 ql1240 - ok 19:24:00.0386 3844 ql1280 - ok 19:24:00.0401 3844 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 19:24:00.0401 3844 RasAcd - ok 19:24:00.0464 3844 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll 19:24:00.0480 3844 RasAuto - ok 19:24:00.0480 3844 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 19:24:00.0480 3844 Rasl2tp - ok 19:24:00.0542 3844 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll 19:24:00.0542 3844 RasMan - ok 19:24:00.0558 3844 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 19:24:00.0558 3844 RasPppoe - ok 19:24:00.0573 3844 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 19:24:00.0573 3844 Raspti - ok 19:24:00.0589 3844 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 19:24:00.0589 3844 Rdbss - ok 19:24:00.0605 3844 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 19:24:00.0605 3844 RDPCDD - ok 19:24:00.0667 3844 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 19:24:00.0667 3844 rdpdr - ok 19:24:00.0730 3844 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 19:24:00.0730 3844 RDPWD - ok 19:24:00.0761 3844 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 19:24:00.0761 3844 RDSessMgr - ok 19:24:00.0792 3844 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 19:24:00.0792 3844 redbook - ok 19:24:00.0855 3844 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 19:24:00.0855 3844 RemoteAccess - ok 19:24:00.0901 3844 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 19:24:00.0917 3844 RemoteRegistry - ok 19:24:00.0948 3844 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe 19:24:00.0948 3844 RpcLocator - ok 19:24:00.0995 3844 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll 19:24:00.0995 3844 RpcSs - ok 19:24:01.0042 3844 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe 19:24:01.0042 3844 RSVP - ok 19:24:01.0089 3844 [ 7F0413BDD7D53EB4C7A371E7F6F84DF1 ] RTL8023xp C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys 19:24:01.0089 3844 RTL8023xp - ok 19:24:01.0120 3844 [ D507C1400284176573224903819FFDA3 ] rtl8139 C:\WINDOWS\system32\DRIVERS\RTL8139.SYS 19:24:01.0136 3844 rtl8139 - ok 19:24:01.0151 3844 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe 19:24:01.0151 3844 SamSs - ok 19:24:01.0230 3844 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 19:24:01.0230 3844 SCardSvr - ok 19:24:01.0276 3844 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll 19:24:01.0276 3844 Schedule - ok 19:24:01.0323 3844 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 19:24:01.0323 3844 Secdrv - ok 19:24:01.0355 3844 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll 19:24:01.0355 3844 seclogon - ok 19:24:01.0370 3844 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll 19:24:01.0370 3844 SENS - ok 19:24:01.0417 3844 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\drivers\Serial.sys 19:24:01.0417 3844 Serial - ok 19:24:01.0495 3844 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 19:24:01.0495 3844 Sfloppy - ok 19:24:01.0558 3844 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 19:24:01.0558 3844 SharedAccess - ok 19:24:01.0589 3844 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 19:24:01.0589 3844 ShellHWDetection - ok 19:24:01.0589 3844 Simbad - ok 19:24:01.0870 3844 [ 388AE59FE75F1B959DFA0900923C61BB ] Skype C2C Service C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe 19:24:01.0995 3844 Skype C2C Service - ok 19:24:02.0026 3844 [ 8C4F0DCC6A5100D48F9B2F950CDD220F ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe 19:24:02.0042 3844 SkypeUpdate - ok 19:24:02.0073 3844 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys 19:24:02.0073 3844 SLIP - ok 19:24:02.0136 3844 [ A1ECEEAA5C5E74B2499EB51D38185B84 ] SONYPVU1 C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS 19:24:02.0136 3844 SONYPVU1 - ok 19:24:02.0151 3844 Sparrow - ok 19:24:02.0198 3844 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 19:24:02.0214 3844 splitter - ok 19:24:02.0261 3844 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 19:24:02.0261 3844 Spooler - ok 19:24:02.0339 3844 [ 70B7F9F6F826DF5F510A29A983C00F27 ] sptd C:\WINDOWS\system32\Drivers\sptd.sys 19:24:02.0355 3844 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 70B7F9F6F826DF5F510A29A983C00F27 19:24:02.0355 3844 sptd ( LockedFile.Multi.Generic ) - warning 19:24:02.0355 3844 sptd - detected LockedFile.Multi.Generic (1) 19:24:02.0401 3844 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 19:24:02.0417 3844 sr - ok 19:24:02.0464 3844 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll 19:24:02.0464 3844 srservice - ok 19:24:02.0573 3844 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 19:24:02.0573 3844 Srv - ok 19:24:02.0636 3844 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 19:24:02.0651 3844 SSDPSRV - ok 19:24:02.0698 3844 [ A9573045BAA16EAB9B1085205B82F1ED ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys 19:24:02.0698 3844 StillCam - ok 19:24:02.0761 3844 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll 19:24:02.0776 3844 stisvc - ok 19:24:02.0808 3844 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys 19:24:02.0808 3844 streamip - ok 19:24:02.0870 3844 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 19:24:02.0870 3844 swenum - ok 19:24:02.0933 3844 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 19:24:02.0933 3844 swmidi - ok 19:24:02.0948 3844 SwPrv - ok 19:24:02.0980 3844 symc810 - ok 19:24:02.0995 3844 symc8xx - ok 19:24:03.0011 3844 sym_hi - ok 19:24:03.0026 3844 sym_u3 - ok 19:24:03.0073 3844 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 19:24:03.0073 3844 sysaudio - ok 19:24:03.0136 3844 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 19:24:03.0136 3844 SysmonLog - ok 19:24:03.0198 3844 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 19:24:03.0214 3844 TapiSrv - ok 19:24:03.0276 3844 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 19:24:03.0276 3844 Tcpip - ok 19:24:03.0323 3844 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 19:24:03.0323 3844 TDPIPE - ok 19:24:03.0339 3844 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 19:24:03.0339 3844 TDTCP - ok 19:24:03.0370 3844 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 19:24:03.0370 3844 TermDD - ok 19:24:03.0401 3844 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll 19:24:03.0417 3844 TermService - ok 19:24:03.0433 3844 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll 19:24:03.0433 3844 Themes - ok 19:24:03.0480 3844 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe 19:24:03.0480 3844 TlntSvr - ok 19:24:03.0480 3844 TosIde - ok 19:24:03.0542 3844 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll 19:24:03.0542 3844 TrkWks - ok 19:24:03.0605 3844 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 19:24:03.0605 3844 Udfs - ok 19:24:03.0620 3844 ultra - ok 19:24:03.0683 3844 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 19:24:03.0698 3844 Update - ok 19:24:03.0730 3844 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll 19:24:03.0730 3844 upnphost - ok 19:24:03.0745 3844 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe 19:24:03.0745 3844 UPS - ok 19:24:03.0808 3844 [ 6E421CCC57059B0186C6259CA3B6DFC9 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys 19:24:03.0808 3844 USBAAPL - ok 19:24:03.0839 3844 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys 19:24:03.0839 3844 usbaudio - ok 19:24:03.0855 3844 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 19:24:03.0855 3844 usbccgp - ok 19:24:03.0901 3844 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 19:24:03.0901 3844 usbehci - ok 19:24:03.0933 3844 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 19:24:03.0933 3844 usbhub - ok 19:24:03.0948 3844 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys 19:24:03.0948 3844 usbohci - ok 19:24:03.0964 3844 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 19:24:03.0980 3844 usbprint - ok 19:24:03.0995 3844 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 19:24:03.0995 3844 usbscan - ok 19:24:04.0026 3844 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 19:24:04.0042 3844 usbstor - ok 19:24:04.0058 3844 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys 19:24:04.0058 3844 usbuhci - ok 19:24:04.0120 3844 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys 19:24:04.0120 3844 usbvideo - ok 19:24:04.0167 3844 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 19:24:04.0167 3844 VgaSave - ok 19:24:04.0198 3844 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys 19:24:04.0198 3844 ViaIde - ok 19:24:04.0214 3844 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 19:24:04.0214 3844 VolSnap - ok 19:24:04.0261 3844 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe 19:24:04.0276 3844 VSS - ok 19:24:04.0308 3844 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll 19:24:04.0308 3844 W32Time - ok 19:24:04.0339 3844 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 19:24:04.0355 3844 Wanarp - ok 19:24:04.0417 3844 [ BBCFEAB7E871CDDAC2D397EE7FA91FDC ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys 19:24:04.0433 3844 Wdf01000 - ok 19:24:04.0433 3844 WDICA - ok 19:24:04.0464 3844 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 19:24:04.0480 3844 wdmaud - ok 19:24:04.0480 3844 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll 19:24:04.0495 3844 WebClient - ok 19:24:04.0511 3844 [ 473EE64C368CE2EED110376C11960259 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 19:24:04.0542 3844 winachsf - ok 19:24:04.0714 3844 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 19:24:04.0714 3844 winmgmt - ok 19:24:04.0776 3844 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 19:24:04.0776 3844 WmdmPmSN - ok 19:24:04.0855 3844 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll 19:24:04.0870 3844 Wmi - ok 19:24:04.0917 3844 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 19:24:04.0917 3844 WmiApSrv - ok 19:24:05.0026 3844 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 19:24:05.0058 3844 WMPNetworkSvc - ok 19:24:05.0073 3844 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys 19:24:05.0089 3844 WpdUsb - ok 19:24:05.0214 3844 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 19:24:05.0245 3844 WPFFontCache_v0400 - ok 19:24:05.0308 3844 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll 19:24:05.0323 3844 wscsvc - ok 19:24:05.0339 3844 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 19:24:05.0355 3844 WSTCODEC - ok 19:24:05.0386 3844 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll 19:24:05.0401 3844 wuauserv - ok 19:24:05.0448 3844 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 19:24:05.0464 3844 WudfPf - ok 19:24:05.0511 3844 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 19:24:05.0511 3844 WudfRd - ok 19:24:05.0542 3844 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 19:24:05.0542 3844 WudfSvc - ok 19:24:05.0636 3844 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 19:24:05.0651 3844 WZCSVC - ok 19:24:05.0698 3844 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 19:24:05.0714 3844 xmlprov - ok 19:24:05.0761 3844 [ 09E5340BD9B2CB730BF4DC6BE7721291 ] xusb21 C:\WINDOWS\system32\DRIVERS\xusb21.sys 19:24:05.0761 3844 xusb21 - ok 19:24:05.0808 3844 ================ Scan global =============================== 19:24:05.0855 3844 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll 19:24:05.0886 3844 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll 19:24:05.0933 3844 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll 19:24:05.0980 3844 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe 19:24:05.0980 3844 [Global] - ok 19:24:05.0980 3844 ================ Scan MBR ================================== 19:24:06.0011 3844 [ 0AC6D996BCE152AED9600E6D6B797E2E ] \Device\Harddisk0\DR0 19:24:06.0245 3844 \Device\Harddisk0\DR0 - ok 19:24:06.0245 3844 ================ Scan VBR ================================== 19:24:06.0245 3844 [ E127784CE8D59AE190C48BAF1264CB67 ] \Device\Harddisk0\DR0\Partition1 19:24:06.0245 3844 \Device\Harddisk0\DR0\Partition1 - ok 19:24:06.0261 3844 [ 006359F80626DEDEB1AF8CA4A1715EA2 ] \Device\Harddisk0\DR0\Partition2 19:24:06.0261 3844 \Device\Harddisk0\DR0\Partition2 - ok 19:24:06.0276 3844 ============================================================ 19:24:06.0276 3844 Scan finished 19:24:06.0276 3844 ============================================================ 19:24:06.0308 3528 Detected object count: 1 19:24:06.0308 3528 Actual detected object count: 1 19:24:24.0464 3528 sptd ( LockedFile.Multi.Generic ) - skipped by user 19:24:24.0464 3528 sptd ( LockedFile.Multi.Generic ) - User select action: Skip 19:24:44.0073 2032 ============================================================ 19:24:44.0073 2032 Scan started 19:24:44.0073 2032 Mode: Manual; 19:24:44.0089 2032 ============================================================ 19:24:44.0214 2032 ================ Scan system memory ======================== 19:24:44.0214 2032 System memory - ok 19:24:44.0214 2032 ================ Scan services ============================= 19:24:44.0386 2032 Abiosdsk - ok 19:24:44.0401 2032 abp480n5 - ok 19:24:44.0448 2032 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 19:24:44.0448 2032 ACPI - ok 19:24:44.0480 2032 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 19:24:44.0480 2032 ACPIEC - ok 19:24:44.0573 2032 [ 24A0876D07EF356DCBC1D7A7929354AB ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 19:24:44.0573 2032 AdobeFlashPlayerUpdateSvc - ok 19:24:44.0573 2032 adpu160m - ok 19:24:44.0683 2032 [ 678C8FDB9D6094D41F322B7159853C54 ] AE1000 C:\WINDOWS\system32\DRIVERS\AE1000XP.sys 19:24:44.0683 2032 AE1000 - ok 19:24:44.0745 2032 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 19:24:44.0745 2032 aec - ok 19:24:44.0808 2032 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 19:24:44.0808 2032 AFD - ok 19:24:44.0823 2032 Aha154x - ok 19:24:44.0839 2032 aic78u2 - ok 19:24:44.0855 2032 aic78xx - ok 19:24:45.0042 2032 [ 7F26D024355CBADB60838F53DFB171EC ] ALCXWDM C:\WINDOWS\system32\drivers\ALCXWDM.SYS 19:24:45.0120 2032 ALCXWDM - ok 19:24:45.0183 2032 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll 19:24:45.0183 2032 Alerter - ok 19:24:45.0198 2032 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe 19:24:45.0198 2032 ALG - ok 19:24:45.0214 2032 AliIde - ok 19:24:45.0276 2032 [ 59301936898AE62245A6F09C0ABA9475 ] AmdK8 C:\WINDOWS\system32\DRIVERS\AmdK8.sys 19:24:45.0276 2032 AmdK8 - ok 19:24:45.0292 2032 amsint - ok 19:24:45.0480 2032 [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 19:24:45.0480 2032 Apple Mobile Device - ok 19:24:45.0511 2032 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 19:24:45.0511 2032 AppMgmt - ok 19:24:45.0558 2032 [ 00523019E3579C8F8A94457FE25F0F24 ] aracpi C:\WINDOWS\system32\DRIVERS\aracpi.sys 19:24:45.0558 2032 aracpi - ok 19:24:45.0573 2032 [ 9FEDAA46EB1A572AC4D9EE6B5F123CF2 ] arhidfltr C:\WINDOWS\system32\DRIVERS\arhidfltr.sys 19:24:45.0573 2032 arhidfltr - ok 19:24:45.0589 2032 [ 82969576093CD983DD559F5A86F382B4 ] arkbcfltr C:\WINDOWS\system32\DRIVERS\arkbcfltr.sys 19:24:45.0589 2032 arkbcfltr - ok 19:24:45.0605 2032 [ 9B21791D8A78FAECE999FADBEBDA6C22 ] armoucfltr C:\WINDOWS\system32\DRIVERS\armoucfltr.sys 19:24:45.0605 2032 armoucfltr - ok 19:24:45.0667 2032 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys 19:24:45.0667 2032 Arp1394 - ok 19:24:45.0698 2032 [ 7A2DA7C7B0C524EF26A79F17A5C69FDE ] ARPolicy C:\WINDOWS\system32\DRIVERS\arpolicy.sys 19:24:45.0698 2032 ARPolicy - ok 19:24:45.0761 2032 [ 9A0D9B2E263BEDE80FB79DDBAD240EC1 ] ARSVC C:\WINDOWS\arservice.exe 19:24:45.0761 2032 ARSVC - ok 19:24:45.0761 2032 asc - ok 19:24:45.0776 2032 asc3350p - ok 19:24:45.0792 2032 asc3550 - ok 19:24:45.0933 2032 [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 19:24:45.0933 2032 aspnet_state - ok 19:24:45.0964 2032 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 19:24:45.0964 2032 AsyncMac - ok 19:24:46.0026 2032 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 19:24:46.0026 2032 atapi - ok 19:24:46.0042 2032 Atdisk - ok 19:24:46.0089 2032 [ D21352BCAAB174948EB9672BC203BB0F ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe 19:24:46.0105 2032 Ati HotKey Poller - ok 19:24:46.0198 2032 [ 7A6CF9F411A9C5BD5C442A1CD46AF401 ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 19:24:46.0214 2032 ati2mtag - ok 19:24:46.0245 2032 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 19:24:46.0245 2032 Atmarpc - ok 19:24:46.0276 2032 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 19:24:46.0276 2032 AudioSrv - ok 19:24:46.0292 2032 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 19:24:46.0292 2032 audstub - ok 19:24:46.0323 2032 [ 7270D070173B20AC9487EA16BB08B45F ] bb-run C:\WINDOWS\system32\DRIVERS\bb-run.sys 19:24:46.0323 2032 bb-run - ok 19:24:46.0339 2032 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 19:24:46.0339 2032 Beep - ok 19:24:46.0417 2032 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll 19:24:46.0417 2032 BITS - ok 19:24:46.0480 2032 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll 19:24:46.0480 2032 Browser - ok 19:24:46.0526 2032 [ 248DFA5762DDE38DFDDBBD44149E9D7A ] BVRPMPR5 C:\WINDOWS\system32\drivers\BVRPMPR5.SYS 19:24:46.0526 2032 BVRPMPR5 - ok 19:24:46.0605 2032 catchme - ok 19:24:46.0636 2032 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 19:24:46.0636 2032 cbidf2k - ok 19:24:46.0698 2032 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 19:24:46.0698 2032 CCDECODE - ok 19:24:46.0714 2032 cd20xrnt - ok 19:24:46.0761 2032 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 19:24:46.0761 2032 Cdaudio - ok 19:24:46.0808 2032 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 19:24:46.0823 2032 Cdfs - ok 19:24:46.0886 2032 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 19:24:46.0886 2032 Cdrom - ok 19:24:46.0901 2032 Changer - ok 19:24:46.0948 2032 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe 19:24:46.0948 2032 CiSvc - ok 19:24:46.0964 2032 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 19:24:46.0964 2032 ClipSrv - ok 19:24:47.0073 2032 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 19:24:47.0073 2032 clr_optimization_v2.0.50727_32 - ok 19:24:47.0136 2032 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 19:24:47.0151 2032 clr_optimization_v4.0.30319_32 - ok 19:24:47.0151 2032 CmdIde - ok 19:24:47.0183 2032 COMSysApp - ok 19:24:47.0214 2032 Cpqarray - ok 19:24:47.0245 2032 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 19:24:47.0261 2032 CryptSvc - ok 19:24:47.0370 2032 [ 93424C48B54E1419B02015B062C9A295 ] CSUService C:\Program Files\COMODO\COMODO System Utilities\CSUService.exe 19:24:47.0370 2032 CSUService - ok 19:24:47.0386 2032 dac2w2k - ok 19:24:47.0401 2032 dac960nt - ok 19:24:47.0464 2032 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 19:24:47.0480 2032 DcomLaunch - ok 19:24:47.0542 2032 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 19:24:47.0542 2032 Dhcp - ok 19:24:47.0558 2032 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 19:24:47.0573 2032 Disk - ok 19:24:47.0589 2032 dmadmin - ok 19:24:47.0667 2032 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 19:24:47.0667 2032 dmboot - ok 19:24:47.0683 2032 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys 19:24:47.0683 2032 dmio - ok 19:24:47.0730 2032 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 19:24:47.0730 2032 dmload - ok 19:24:47.0761 2032 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll 19:24:47.0761 2032 dmserver - ok 19:24:47.0792 2032 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 19:24:47.0792 2032 DMusic - ok 19:24:47.0855 2032 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 19:24:47.0855 2032 Dnscache - ok 19:24:47.0917 2032 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 19:24:47.0917 2032 Dot3svc - ok 19:24:47.0933 2032 dpti2o - ok 19:24:48.0105 2032 [ 7D78A1AE39A95A22A8184907898EE019 ] DragonUpdater C:\Program Files\Comodo\Dragon\dragon_updater.exe 19:24:48.0136 2032 DragonUpdater - ok 19:24:48.0183 2032 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 19:24:48.0198 2032 drmkaud - ok 19:24:48.0245 2032 [ 6461E57BB51A848AAE26F52427B7CF9E ] dtscsi C:\WINDOWS\System32\Drivers\dtscsi.sys 19:24:48.0261 2032 dtscsi - ok 19:24:48.0276 2032 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll 19:24:48.0276 2032 EapHost - ok 19:24:48.0370 2032 [ 5D1347AA5AE6E2F77D7F4F8372D95AC9 ] ehRecvr C:\WINDOWS\eHome\ehRecvr.exe 19:24:48.0370 2032 ehRecvr - ok 19:24:48.0401 2032 [ A53243709439AC2A4C216B817F8D7411 ] ehSched C:\WINDOWS\eHome\ehSched.exe 19:24:48.0417 2032 ehSched - ok 19:24:48.0433 2032 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll 19:24:48.0433 2032 ERSvc - ok 19:24:48.0480 2032 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe 19:24:48.0495 2032 Eventlog - ok 19:24:48.0558 2032 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll 19:24:48.0558 2032 EventSystem - ok 19:24:48.0620 2032 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 19:24:48.0620 2032 Fastfat - ok 19:24:48.0683 2032 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 19:24:48.0698 2032 FastUserSwitchingCompatibility - ok 19:24:48.0730 2032 [ E97D6A8684466DF94FF3BC24FB787A07 ] Fax C:\WINDOWS\system32\fxssvc.exe 19:24:48.0730 2032 Fax - ok 19:24:48.0792 2032 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys 19:24:48.0792 2032 Fdc - ok 19:24:48.0808 2032 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 19:24:48.0823 2032 Fips - ok 19:24:48.0839 2032 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys 19:24:48.0839 2032 Flpydisk - ok 19:24:48.0886 2032 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 19:24:48.0901 2032 FltMgr - ok 19:24:48.0964 2032 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 19:24:48.0964 2032 FontCache3.0.0.0 - ok 19:24:49.0011 2032 [ E0087225B137E57239FF40F8AE82059B ] fssfltr C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys 19:24:49.0011 2032 fssfltr - ok 19:24:49.0136 2032 [ 45B52394F9624237F33A8A3D73C0B221 ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe 19:24:49.0136 2032 fsssvc - ok 19:24:49.0183 2032 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 19:24:49.0198 2032 Fs_Rec - ok 19:24:49.0214 2032 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 19:24:49.0214 2032 Ftdisk - ok 19:24:49.0245 2032 [ 22399D3CE5840C6082844679CCA5D2FC ] ftsata2 C:\WINDOWS\system32\DRIVERS\ftsata2.sys 19:24:49.0245 2032 ftsata2 - ok 19:24:49.0292 2032 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 19:24:49.0292 2032 GEARAspiWDM - ok 19:24:49.0323 2032 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 19:24:49.0323 2032 Gpc - ok 19:24:49.0433 2032 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe 19:24:49.0433 2032 gupdate - ok 19:24:49.0448 2032 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe 19:24:49.0448 2032 gupdatem - ok 19:24:49.0558 2032 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 19:24:49.0558 2032 helpsvc - ok 19:24:49.0620 2032 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll 19:24:49.0620 2032 HidServ - ok 19:24:49.0651 2032 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys 19:24:49.0651 2032 HidUsb - ok 19:24:49.0698 2032 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 19:24:49.0714 2032 hkmsvc - ok 19:24:49.0730 2032 hpn - ok 19:24:49.0808 2032 [ 5DF616ADDB75C1AD36C1F9E4DE0F7654 ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 19:24:49.0808 2032 HSFHWBS2 - ok 19:24:49.0870 2032 [ DFA8F86C0DBCA7DB948043AA3BE6793B ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 19:24:49.0886 2032 HSF_DP - ok 19:24:49.0964 2032 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 19:24:49.0964 2032 HTTP - ok 19:24:49.0995 2032 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 19:24:49.0995 2032 HTTPFilter - ok 19:24:50.0011 2032 i2omgmt - ok 19:24:50.0026 2032 i2omp - ok 19:24:50.0073 2032 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 19:24:50.0073 2032 i8042prt - ok 19:24:50.0136 2032 [ 9A65E42664D1534B68512CAAD0EFE963 ] iaStor C:\WINDOWS\system32\DRIVERS\iaStor.sys 19:24:50.0151 2032 iaStor - ok 19:24:50.0230 2032 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe 19:24:50.0230 2032 IDriverT - ok 19:24:50.0355 2032 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 19:24:50.0370 2032 idsvc - ok 19:24:50.0417 2032 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 19:24:50.0417 2032 Imapi - ok 19:24:50.0480 2032 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe 19:24:50.0495 2032 ImapiService - ok 19:24:50.0511 2032 ini910u - ok 19:24:50.0573 2032 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys 19:24:50.0573 2032 IntelIde - ok 19:24:50.0620 2032 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys 19:24:50.0620 2032 intelppm - ok 19:24:50.0636 2032 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys 19:24:50.0636 2032 Ip6Fw - ok 19:24:50.0667 2032 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 19:24:50.0667 2032 IpFilterDriver - ok 19:24:50.0714 2032 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 19:24:50.0714 2032 IpInIp - ok 19:24:50.0745 2032 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 19:24:50.0761 2032 IpNat - ok 19:24:50.0839 2032 [ E46B17060D3962A384AE484094614788 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 19:24:50.0839 2032 iPod Service - ok 19:24:50.0901 2032 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 19:24:50.0901 2032 IPSec - ok 19:24:50.0933 2032 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 19:24:50.0933 2032 IRENUM - ok 19:24:50.0980 2032 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 19:24:50.0980 2032 isapnp - ok 19:24:50.0995 2032 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 19:24:50.0995 2032 Kbdclass - ok 19:24:51.0011 2032 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys 19:24:51.0011 2032 kbdhid - ok 19:24:51.0042 2032 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 19:24:51.0042 2032 kmixer - ok 19:24:51.0073 2032 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 19:24:51.0089 2032 KSecDD - ok 19:24:51.0120 2032 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 19:24:51.0136 2032 lanmanserver - ok 19:24:51.0198 2032 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 19:24:51.0198 2032 lanmanworkstation - ok 19:24:51.0214 2032 lbrtfdc - ok 19:24:51.0276 2032 [ 6E68E520E6F2F5DCE97A9FF947038769 ] LightScribeService C:\Program Files\Common Files\LightScribe\LSSrvc.exe 19:24:51.0276 2032 LightScribeService - ok 19:24:51.0339 2032 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 19:24:51.0339 2032 LmHosts - ok 19:24:51.0355 2032 McComponentHostService - ok 19:24:51.0370 2032 mcdbus - ok 19:24:51.0433 2032 [ DF0A511F38F16016BF658FCA0090CB87 ] McrdSvc C:\WINDOWS\ehome\mcrdsvc.exe 19:24:51.0433 2032 McrdSvc - ok 19:24:51.0511 2032 [ 11F714F85530A2BD134074DC30E99FCA ] MDM C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 19:24:51.0511 2032 MDM - ok 19:24:51.0558 2032 [ 3C318B9CD391371BED62126581EE9961 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 19:24:51.0558 2032 mdmxsdk - ok 19:24:51.0589 2032 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll 19:24:51.0589 2032 Messenger - ok 19:24:51.0636 2032 [ B7521F69C0A9B29D356157229376FB21 ] MHN C:\WINDOWS\System32\mhn.dll 19:24:51.0636 2032 MHN - ok 19:24:51.0651 2032 [ 7F2F1D2815A6449D346FCCCBC569FBD6 ] MHNDRV C:\WINDOWS\system32\DRIVERS\mhndrv.sys 19:24:51.0667 2032 MHNDRV - ok 19:24:51.0698 2032 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 19:24:51.0698 2032 mnmdd - ok 19:24:51.0730 2032 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 19:24:51.0745 2032 mnmsrvc - ok 19:24:51.0792 2032 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 19:24:51.0792 2032 Modem - ok 19:24:51.0808 2032 motccgp - ok 19:24:51.0823 2032 motccgpfl - ok 19:24:51.0839 2032 motmodem - ok 19:24:51.0855 2032 MotoHelper - ok 19:24:51.0901 2032 motport - ok 19:24:51.0948 2032 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 19:24:51.0948 2032 Mouclass - ok 19:24:51.0995 2032 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys 19:24:51.0995 2032 mouhid - ok 19:24:52.0026 2032 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 19:24:52.0042 2032 MountMgr - ok 19:24:52.0120 2032 [ A35576A433F4AEB0D48976A004657CB6 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe 19:24:52.0120 2032 MozillaMaintenance - ok 19:24:52.0167 2032 [ 24406D75B40F0F6B3C1AC7031D734565 ] MpFilter C:\WINDOWS\system32\DRIVERS\MpFilter.sys 19:24:52.0167 2032 MpFilter - ok 19:24:52.0183 2032 mraid35x - ok 19:24:52.0230 2032 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 19:24:52.0230 2032 MRxDAV - ok 19:24:52.0308 2032 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 19:24:52.0323 2032 MRxSmb - ok 19:24:52.0433 2032 [ D98350792A7CE82E7459A7C36481BEDA ] MSCamSvc C:\Program Files\Microsoft LifeCam\MSCamS32.exe 19:24:52.0433 2032 MSCamSvc - ok 19:24:52.0480 2032 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe 19:24:52.0480 2032 MSDTC - ok 19:24:52.0511 2032 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 19:24:52.0511 2032 Msfs - ok 19:24:52.0558 2032 [ 5119FFC2A6B51089CDB0EFDC75808C97 ] MSHUSBVideo C:\WINDOWS\system32\Drivers\nx6000.sys 19:24:52.0558 2032 MSHUSBVideo - ok 19:24:52.0589 2032 MSIServer - ok 19:24:52.0620 2032 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 19:24:52.0620 2032 MSKSSRV - ok 19:24:52.0698 2032 [ 37F77AEBFF23A99D1BFB4F34CD2D07F2 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe 19:24:52.0698 2032 MsMpSvc - ok 19:24:52.0761 2032 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 19:24:52.0761 2032 MSPCLOCK - ok 19:24:52.0792 2032 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 19:24:52.0792 2032 MSPQM - ok 19:24:52.0855 2032 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 19:24:52.0855 2032 mssmbios - ok 19:24:52.0886 2032 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys 19:24:52.0886 2032 MSTEE - ok 19:24:52.0964 2032 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 19:24:52.0964 2032 Mup - ok 19:24:52.0995 2032 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 19:24:53.0011 2032 NABTSFEC - ok 19:24:53.0120 2032 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll 19:24:53.0136 2032 napagent - ok 19:24:53.0261 2032 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 19:24:53.0276 2032 NDIS - ok 19:24:53.0339 2032 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys 19:24:53.0339 2032 NdisIP - ok 19:24:53.0386 2032 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 19:24:53.0386 2032 NdisTapi - ok 19:24:53.0448 2032 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 19:24:53.0448 2032 Ndisuio - ok 19:24:53.0511 2032 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 19:24:53.0511 2032 NdisWan - ok 19:24:53.0558 2032 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 19:24:53.0558 2032 NDProxy - ok 19:24:53.0605 2032 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 19:24:53.0605 2032 NetBIOS - ok 19:24:53.0636 2032 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 19:24:53.0636 2032 NetBT - ok 19:24:53.0698 2032 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe 19:24:53.0698 2032 NetDDE - ok 19:24:53.0714 2032 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 19:24:53.0714 2032 NetDDEdsdm - ok 19:24:53.0761 2032 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe 19:24:53.0761 2032 Netlogon - ok 19:24:53.0776 2032 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll 19:24:53.0776 2032 Netman - ok 19:24:53.0823 2032 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 19:24:53.0839 2032 NetTcpPortSharing - ok 19:24:53.0901 2032 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys 19:24:53.0901 2032 NIC1394 - ok 19:24:53.0964 2032 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll 19:24:53.0980 2032 Nla - ok 19:24:53.0995 2032 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 19:24:53.0995 2032 Npfs - ok 19:24:54.0026 2032 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 19:24:54.0026 2032 Ntfs - ok 19:24:54.0058 2032 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 19:24:54.0058 2032 NtLmSsp - ok 19:24:54.0136 2032 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 19:24:54.0136 2032 NtmsSvc - ok 19:24:54.0198 2032 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 19:24:54.0198 2032 Null - ok 19:24:54.0230 2032 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 19:24:54.0230 2032 NwlnkFlt - ok 19:24:54.0276 2032 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 19:24:54.0292 2032 NwlnkFwd - ok 19:24:54.0401 2032 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 19:24:54.0417 2032 odserv - ok 19:24:54.0448 2032 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys 19:24:54.0448 2032 ohci1394 - ok 19:24:54.0511 2032 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 19:24:54.0511 2032 ose - ok 19:24:54.0573 2032 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys 19:24:54.0573 2032 Parport - ok 19:24:54.0589 2032 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 19:24:54.0589 2032 PartMgr - ok 19:24:54.0620 2032 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 19:24:54.0620 2032 ParVdm - ok 19:24:54.0651 2032 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 19:24:54.0667 2032 PCI - ok 19:24:54.0698 2032 PCIDump - ok 19:24:54.0730 2032 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 19:24:54.0730 2032 PCIIde - ok 19:24:54.0745 2032 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 19:24:54.0745 2032 Pcmcia - ok 19:24:54.0761 2032 PDCOMP - ok 19:24:54.0776 2032 PDFRAME - ok 19:24:54.0776 2032 PDRELI - ok 19:24:54.0792 2032 PDRFRAME - ok 19:24:54.0808 2032 perc2 - ok 19:24:54.0823 2032 perc2hib - ok 19:24:54.0901 2032 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe 19:24:54.0917 2032 PlugPlay - ok 19:24:55.0026 2032 [ 2D091A99624FB9E7EEF0A86D872EC0C3 ] Pml Driver HPZ12 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE 19:24:55.0026 2032 Pml Driver HPZ12 - ok 19:24:55.0042 2032 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 19:24:55.0042 2032 PolicyAgent - ok 19:24:55.0073 2032 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 19:24:55.0073 2032 PptpMiniport - ok 19:24:55.0120 2032 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys 19:24:55.0120 2032 Processor - ok 19:24:55.0136 2032 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 19:24:55.0136 2032 ProtectedStorage - ok 19:24:55.0183 2032 [ 0E2EB30605CA6ED2509D59AF6A7362B4 ] Ps2 C:\WINDOWS\system32\DRIVERS\PS2.sys 19:24:55.0183 2032 Ps2 - ok 19:24:55.0214 2032 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 19:24:55.0214 2032 PSched - ok 19:24:55.0245 2032 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 19:24:55.0245 2032 Ptilink - ok 19:24:55.0308 2032 [ 86724469CD077901706854974CD13C3E ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys 19:24:55.0308 2032 PxHelp20 - ok 19:24:55.0339 2032 ql1080 - ok 19:24:55.0355 2032 Ql10wnt - ok 19:24:55.0355 2032 ql12160 - ok 19:24:55.0370 2032 ql1240 - ok 19:24:55.0386 2032 ql1280 - ok 19:24:55.0417 2032 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 19:24:55.0417 2032 RasAcd - ok 19:24:55.0480 2032 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll 19:24:55.0480 2032 RasAuto - ok 19:24:55.0511 2032 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 19:24:55.0526 2032 Rasl2tp - ok 19:24:55.0589 2032 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll 19:24:55.0589 2032 RasMan - ok 19:24:55.0636 2032 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 19:24:55.0636 2032 RasPppoe - ok 19:24:55.0667 2032 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 19:24:55.0667 2032 Raspti - ok 19:24:55.0698 2032 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 19:24:55.0698 2032 Rdbss - ok 19:24:55.0714 2032 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 19:24:55.0714 2032 RDPCDD - ok 19:24:55.0792 2032 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 19:24:55.0792 2032 rdpdr - ok 19:24:55.0870 2032 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 19:24:55.0870 2032 RDPWD - ok 19:24:55.0917 2032 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 19:24:55.0917 2032 RDSessMgr - ok 19:24:55.0948 2032 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 19:24:55.0948 2032 redbook - ok 19:24:56.0011 2032 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 19:24:56.0011 2032 RemoteAccess - ok 19:24:56.0089 2032 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 19:24:56.0089 2032 RemoteRegistry - ok 19:24:56.0136 2032 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe 19:24:56.0136 2032 RpcLocator - ok 19:24:56.0183 2032 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll 19:24:56.0198 2032 RpcSs - ok 19:24:56.0245 2032 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe 19:24:56.0261 2032 RSVP - ok 19:24:56.0323 2032 [ 7F0413BDD7D53EB4C7A371E7F6F84DF1 ] RTL8023xp C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys 19:24:56.0323 2032 RTL8023xp - ok 19:24:56.0370 2032 [ D507C1400284176573224903819FFDA3 ] rtl8139 C:\WINDOWS\system32\DRIVERS\RTL8139.SYS 19:24:56.0370 2032 rtl8139 - ok 19:24:56.0401 2032 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe 19:24:56.0401 2032 SamSs - ok 19:24:56.0433 2032 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 19:24:56.0448 2032 SCardSvr - ok 19:24:56.0495 2032 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll 19:24:56.0511 2032 Schedule - ok 19:24:56.0558 2032 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 19:24:56.0558 2032 Secdrv - ok 19:24:56.0605 2032 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll 19:24:56.0605 2032 seclogon - ok 19:24:56.0636 2032 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll 19:24:56.0651 2032 SENS - ok 19:24:56.0698 2032 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\drivers\Serial.sys 19:24:56.0698 2032 Serial - ok 19:24:56.0745 2032 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 19:24:56.0745 2032 Sfloppy - ok 19:24:56.0808 2032 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 19:24:56.0823 2032 SharedAccess - ok 19:24:56.0870 2032 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 19:24:56.0870 2032 ShellHWDetection - ok 19:24:56.0917 2032 Simbad - ok 19:24:57.0183 2032 [ 388AE59FE75F1B959DFA0900923C61BB ] Skype C2C Service C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe 19:24:57.0214 2032 Skype C2C Service - ok 19:24:57.0245 2032 [ 8C4F0DCC6A5100D48F9B2F950CDD220F ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe 19:24:57.0245 2032 SkypeUpdate - ok 19:24:57.0276 2032 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys 19:24:57.0276 2032 SLIP - ok 19:24:57.0370 2032 [ A1ECEEAA5C5E74B2499EB51D38185B84 ] SONYPVU1 C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS 19:24:57.0370 2032 SONYPVU1 - ok 19:24:57.0386 2032 Sparrow - ok 19:24:57.0433 2032 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 19:24:57.0433 2032 splitter - ok 19:24:57.0480 2032 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 19:24:57.0495 2032 Spooler - ok 19:24:57.0589 2032 [ 70B7F9F6F826DF5F510A29A983C00F27 ] sptd C:\WINDOWS\system32\Drivers\sptd.sys 19:24:57.0589 2032 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 70B7F9F6F826DF5F510A29A983C00F27 19:24:57.0589 2032 sptd ( LockedFile.Multi.Generic ) - warning 19:24:57.0589 2032 sptd - detected LockedFile.Multi.Generic (1) 19:24:57.0651 2032 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 19:24:57.0651 2032 sr - ok 19:24:57.0714 2032 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll 19:24:57.0730 2032 srservice - ok 19:24:57.0823 2032 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 19:24:57.0823 2032 Srv - ok 19:24:57.0886 2032 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 19:24:57.0886 2032 SSDPSRV - ok 19:24:57.0948 2032 [ A9573045BAA16EAB9B1085205B82F1ED ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys 19:24:57.0948 2032 StillCam - ok 19:24:58.0026 2032 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll 19:24:58.0026 2032 stisvc - ok 19:24:58.0058 2032 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys 19:24:58.0073 2032 streamip - ok 19:24:58.0120 2032 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 19:24:58.0120 2032 swenum - ok 19:24:58.0183 2032 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 19:24:58.0183 2032 swmidi - ok 19:24:58.0198 2032 SwPrv - ok 19:24:58.0214 2032 symc810 - ok 19:24:58.0230 2032 symc8xx - ok 19:24:58.0245 2032 sym_hi - ok 19:24:58.0245 2032 sym_u3 - ok 19:24:58.0292 2032 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 19:24:58.0308 2032 sysaudio - ok 19:24:58.0370 2032 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 19:24:58.0386 2032 SysmonLog - ok 19:24:58.0464 2032 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 19:24:58.0480 2032 TapiSrv - ok 19:24:58.0558 2032 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 19:24:58.0558 2032 Tcpip - ok 19:24:58.0605 2032 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 19:24:58.0605 2032 TDPIPE - ok 19:24:58.0620 2032 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 19:24:58.0620 2032 TDTCP - ok 19:24:58.0667 2032 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 19:24:58.0667 2032 TermDD - ok 19:24:58.0698 2032 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll 19:24:58.0698 2032 TermService - ok 19:24:58.0714 2032 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll 19:24:58.0730 2032 Themes - ok 19:24:58.0792 2032 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe 19:24:58.0792 2032 TlntSvr - ok 19:24:58.0808 2032 TosIde - ok 19:24:58.0839 2032 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll 19:24:58.0839 2032 TrkWks - ok 19:24:58.0901 2032 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 19:24:58.0901 2032 Udfs - ok 19:24:58.0917 2032 ultra - ok 19:24:58.0980 2032 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 19:24:58.0980 2032 Update - ok 19:24:59.0011 2032 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll 19:24:59.0011 2032 upnphost - ok 19:24:59.0026 2032 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe 19:24:59.0026 2032 UPS - ok 19:24:59.0073 2032 [ 6E421CCC57059B0186C6259CA3B6DFC9 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys 19:24:59.0073 2032 USBAAPL - ok 19:24:59.0136 2032 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys 19:24:59.0136 2032 usbaudio - ok 19:24:59.0151 2032 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 19:24:59.0151 2032 usbccgp - ok 19:24:59.0198 2032 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 19:24:59.0198 2032 usbehci - ok 19:24:59.0214 2032 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 19:24:59.0214 2032 usbhub - ok 19:24:59.0230 2032 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys 19:24:59.0230 2032 usbohci - ok 19:24:59.0261 2032 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 19:24:59.0276 2032 usbprint - ok 19:24:59.0292 2032 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 19:24:59.0292 2032 usbscan - ok 19:24:59.0308 2032 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 19:24:59.0308 2032 usbstor - ok 19:24:59.0355 2032 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys 19:24:59.0355 2032 usbuhci - ok 19:24:59.0386 2032 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys 19:24:59.0386 2032 usbvideo - ok 19:24:59.0433 2032 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 19:24:59.0433 2032 VgaSave - ok 19:24:59.0448 2032 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys 19:24:59.0448 2032 ViaIde - ok 19:24:59.0448 2032 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 19:24:59.0464 2032 VolSnap - ok 19:24:59.0511 2032 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe 19:24:59.0511 2032 VSS - ok 19:24:59.0542 2032 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll 19:24:59.0558 2032 W32Time - ok 19:24:59.0573 2032 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 19:24:59.0573 2032 Wanarp - ok 19:24:59.0651 2032 [ BBCFEAB7E871CDDAC2D397EE7FA91FDC ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys 19:24:59.0651 2032 Wdf01000 - ok 19:24:59.0667 2032 WDICA - ok 19:24:59.0698 2032 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 19:24:59.0698 2032 wdmaud - ok 19:24:59.0745 2032 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll 19:24:59.0745 2032 WebClient - ok 19:24:59.0792 2032 [ 473EE64C368CE2EED110376C11960259 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 19:24:59.0792 2032 winachsf - ok 19:24:59.0901 2032 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 19:24:59.0901 2032 winmgmt - ok 19:24:59.0980 2032 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 19:24:59.0980 2032 WmdmPmSN - ok 19:25:00.0042 2032 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll 19:25:00.0058 2032 Wmi - ok 19:25:00.0089 2032 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 19:25:00.0089 2032 WmiApSrv - ok 19:25:00.0214 2032 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 19:25:00.0214 2032 WMPNetworkSvc - ok 19:25:00.0245 2032 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys 19:25:00.0261 2032 WpdUsb - ok 19:25:00.0386 2032 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 19:25:00.0386 2032 WPFFontCache_v0400 - ok 19:25:00.0448 2032 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll 19:25:00.0448 2032 wscsvc - ok 19:25:00.0480 2032 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 19:25:00.0480 2032 WSTCODEC - ok 19:25:00.0558 2032 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll 19:25:00.0558 2032 wuauserv - ok 19:25:00.0620 2032 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 19:25:00.0620 2032 WudfPf - ok 19:25:00.0683 2032 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 19:25:00.0683 2032 WudfRd - ok 19:25:00.0714 2032 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 19:25:00.0730 2032 WudfSvc - ok 19:25:00.0808 2032 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 19:25:00.0808 2032 WZCSVC - ok 19:25:00.0870 2032 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 19:25:00.0886 2032 xmlprov - ok 19:25:00.0933 2032 [ 09E5340BD9B2CB730BF4DC6BE7721291 ] xusb21 C:\WINDOWS\system32\DRIVERS\xusb21.sys 19:25:00.0933 2032 xusb21 - ok 19:25:00.0995 2032 ================ Scan global =============================== 19:25:01.0042 2032 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll 19:25:01.0089 2032 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll 19:25:01.0105 2032 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll 19:25:01.0167 2032 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe 19:25:01.0167 2032 [Global] - ok 19:25:01.0183 2032 ================ Scan MBR ================================== 19:25:01.0214 2032 [ 0AC6D996BCE152AED9600E6D6B797E2E ] \Device\Harddisk0\DR0 19:25:01.0433 2032 \Device\Harddisk0\DR0 - ok 19:25:01.0433 2032 ================ Scan VBR ================================== 19:25:01.0433 2032 [ E127784CE8D59AE190C48BAF1264CB67 ] \Device\Harddisk0\DR0\Partition1 19:25:01.0433 2032 \Device\Harddisk0\DR0\Partition1 - ok 19:25:01.0448 2032 [ 006359F80626DEDEB1AF8CA4A1715EA2 ] \Device\Harddisk0\DR0\Partition2 19:25:01.0448 2032 \Device\Harddisk0\DR0\Partition2 - ok 19:25:01.0464 2032 ============================================================ 19:25:01.0464 2032 Scan finished 19:25:01.0464 2032 ============================================================ 19:25:01.0480 3780 Detected object count: 1 19:25:01.0480 3780 Actual detected object count: 1 19:25:09.0026 3780 sptd ( LockedFile.Multi.Generic ) - skipped by user 19:25:09.0026 3780 sptd ( LockedFile.Multi.Generic ) - User select action: Skip 19:26:30.0480 4072 ============================================================ 19:26:30.0480 4072 Scan started 19:26:30.0480 4072 Mode: Manual; 19:26:30.0480 4072 ============================================================ 19:26:30.0667 4072 ================ Scan system memory ======================== 19:26:30.0667 4072 System memory - ok 19:26:30.0667 4072 ================ Scan services ============================= 19:26:30.0886 4072 Abiosdsk - ok 19:26:30.0901 4072 abp480n5 - ok 19:26:30.0995 4072 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 19:26:30.0995 4072 ACPI - ok 19:26:31.0026 4072 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 19:26:31.0026 4072 ACPIEC - ok 19:26:31.0136 4072 [ 24A0876D07EF356DCBC1D7A7929354AB ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 19:26:31.0151 4072 AdobeFlashPlayerUpdateSvc - ok 19:26:31.0167 4072 adpu160m - ok 19:26:31.0245 4072 [ 678C8FDB9D6094D41F322B7159853C54 ] AE1000 C:\WINDOWS\system32\DRIVERS\AE1000XP.sys 19:26:31.0261 4072 AE1000 - ok 19:26:31.0323 4072 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 19:26:31.0323 4072 aec - ok 19:26:31.0386 4072 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 19:26:31.0386 4072 AFD - ok 19:26:31.0401 4072 Aha154x - ok 19:26:31.0417 4072 aic78u2 - ok 19:26:31.0448 4072 aic78xx - ok 19:26:31.0636 4072 [ 7F26D024355CBADB60838F53DFB171EC ] ALCXWDM C:\WINDOWS\system32\drivers\ALCXWDM.SYS 19:26:31.0698 4072 ALCXWDM - ok 19:26:31.0761 4072 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll 19:26:31.0761 4072 Alerter - ok 19:26:31.0776 4072 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe 19:26:31.0776 4072 ALG - ok 19:26:31.0792 4072 AliIde - ok 19:26:31.0839 4072 [ 59301936898AE62245A6F09C0ABA9475 ] AmdK8 C:\WINDOWS\system32\DRIVERS\AmdK8.sys 19:26:31.0839 4072 AmdK8 - ok 19:26:31.0855 4072 amsint - ok 19:26:32.0042 4072 [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 19:26:32.0042 4072 Apple Mobile Device - ok 19:26:32.0073 4072 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 19:26:32.0073 4072 AppMgmt - ok 19:26:32.0105 4072 [ 00523019E3579C8F8A94457FE25F0F24 ] aracpi C:\WINDOWS\system32\DRIVERS\aracpi.sys 19:26:32.0105 4072 aracpi - ok 19:26:32.0136 4072 [ 9FEDAA46EB1A572AC4D9EE6B5F123CF2 ] arhidfltr C:\WINDOWS\system32\DRIVERS\arhidfltr.sys 19:26:32.0136 4072 arhidfltr - ok 19:26:32.0151 4072 [ 82969576093CD983DD559F5A86F382B4 ] arkbcfltr C:\WINDOWS\system32\DRIVERS\arkbcfltr.sys 19:26:32.0151 4072 arkbcfltr - ok 19:26:32.0167 4072 [ 9B21791D8A78FAECE999FADBEBDA6C22 ] armoucfltr C:\WINDOWS\system32\DRIVERS\armoucfltr.sys 19:26:32.0167 4072 armoucfltr - ok 19:26:32.0230 4072 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys 19:26:32.0230 4072 Arp1394 - ok 19:26:32.0245 4072 [ 7A2DA7C7B0C524EF26A79F17A5C69FDE ] ARPolicy C:\WINDOWS\system32\DRIVERS\arpolicy.sys 19:26:32.0245 4072 ARPolicy - ok 19:26:32.0308 4072 [ 9A0D9B2E263BEDE80FB79DDBAD240EC1 ] ARSVC C:\WINDOWS\arservice.exe 19:26:32.0308 4072 ARSVC - ok 19:26:32.0323 4072 asc - ok 19:26:32.0339 4072 asc3350p - ok 19:26:32.0339 4072 asc3550 - ok 19:26:32.0480 4072 [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 19:26:32.0480 4072 aspnet_state - ok 19:26:32.0526 4072 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 19:26:32.0526 4072 AsyncMac - ok 19:26:32.0589 4072 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 19:26:32.0605 4072 atapi - ok 19:26:32.0620 4072 Atdisk - ok 19:26:32.0683 4072 [ D21352BCAAB174948EB9672BC203BB0F ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe 19:26:32.0683 4072 Ati HotKey Poller - ok 19:26:32.0792 4072 [ 7A6CF9F411A9C5BD5C442A1CD46AF401 ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 19:26:32.0823 4072 ati2mtag - ok 19:26:32.0870 4072 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 19:26:32.0870 4072 Atmarpc - ok 19:26:32.0917 4072 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 19:26:32.0917 4072 AudioSrv - ok 19:26:32.0933 4072 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 19:26:32.0933 4072 audstub - ok 19:26:32.0964 4072 [ 7270D070173B20AC9487EA16BB08B45F ] bb-run C:\WINDOWS\system32\DRIVERS\bb-run.sys 19:26:32.0964 4072 bb-run - ok 19:26:32.0980 4072 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 19:26:32.0980 4072 Beep - ok 19:26:33.0058 4072 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll 19:26:33.0058 4072 BITS - ok 19:26:33.0120 4072 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll 19:26:33.0120 4072 Browser - ok 19:26:33.0183 4072 [ 248DFA5762DDE38DFDDBBD44149E9D7A ] BVRPMPR5 C:\WINDOWS\system32\drivers\BVRPMPR5.SYS 19:26:33.0183 4072 BVRPMPR5 - ok 19:26:33.0261 4072 catchme - ok 19:26:33.0292 4072 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 19:26:33.0292 4072 cbidf2k - ok 19:26:33.0339 4072 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 19:26:33.0339 4072 CCDECODE - ok 19:26:33.0355 4072 cd20xrnt - ok 19:26:33.0401 4072 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 19:26:33.0401 4072 Cdaudio - ok 19:26:33.0464 4072 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 19:26:33.0480 4072 Cdfs - ok 19:26:33.0542 4072 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 19:26:33.0542 4072 Cdrom - ok 19:26:33.0558 4072 Changer - ok 19:26:33.0589 4072 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe 19:26:33.0589 4072 CiSvc - ok 19:26:33.0636 4072 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 19:26:33.0651 4072 ClipSrv - ok 19:26:33.0730 4072 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 19:26:33.0730 4072 clr_optimization_v2.0.50727_32 - ok 19:26:33.0792 4072 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 19:26:33.0792 4072 clr_optimization_v4.0.30319_32 - ok 19:26:33.0823 4072 CmdIde - ok 19:26:33.0839 4072 COMSysApp - ok 19:26:33.0870 4072 Cpqarray - ok 19:26:33.0886 4072 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 19:26:33.0886 4072 CryptSvc - ok 19:26:34.0011 4072 [ 93424C48B54E1419B02015B062C9A295 ] CSUService C:\Program Files\COMODO\COMODO System Utilities\CSUService.exe 19:26:34.0011 4072 CSUService - ok 19:26:34.0026 4072 dac2w2k - ok 19:26:34.0042 4072 dac960nt - ok 19:26:34.0120 4072 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 19:26:34.0120 4072 DcomLaunch - ok 19:26:34.0198 4072 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 19:26:34.0198 4072 Dhcp - ok 19:26:34.0230 4072 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 19:26:34.0230 4072 Disk - ok 19:26:34.0230 4072 dmadmin - ok 19:26:34.0323 4072 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 19:26:34.0339 4072 dmboot - ok 19:26:34.0355 4072 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys 19:26:34.0370 4072 dmio - ok 19:26:34.0386 4072 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 19:26:34.0386 4072 dmload - ok 19:26:34.0433 4072 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll 19:26:34.0448 4072 dmserver - ok 19:26:34.0480 4072 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 19:26:34.0480 4072 DMusic - ok 19:26:34.0542 4072 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 19:26:34.0542 4072 Dnscache - ok 19:26:34.0605 4072 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 19:26:34.0605 4072 Dot3svc - ok 19:26:34.0620 4072 dpti2o - ok 19:26:34.0776 4072 [ 7D78A1AE39A95A22A8184907898EE019 ] DragonUpdater C:\Program Files\Comodo\Dragon\dragon_updater.exe 19:26:34.0808 4072 DragonUpdater - ok 19:26:34.0855 4072 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 19:26:34.0855 4072 drmkaud - ok 19:26:34.0901 4072 [ 6461E57BB51A848AAE26F52427B7CF9E ] dtscsi C:\WINDOWS\System32\Drivers\dtscsi.sys 19:26:34.0917 4072 dtscsi - ok 19:26:34.0948 4072 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll 19:26:34.0948 4072 EapHost - ok 19:26:35.0058 4072 [ 5D1347AA5AE6E2F77D7F4F8372D95AC9 ] ehRecvr C:\WINDOWS\eHome\ehRecvr.exe 19:26:35.0058 4072 ehRecvr - ok 19:26:35.0105 4072 [ A53243709439AC2A4C216B817F8D7411 ] ehSched C:\WINDOWS\eHome\ehSched.exe 19:26:35.0105 4072 ehSched - ok 19:26:35.0120 4072 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll 19:26:35.0120 4072 ERSvc - ok 19:26:35.0167 4072 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe 19:26:35.0167 4072 Eventlog - ok 19:26:35.0230 4072 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll 19:26:35.0230 4072 EventSystem - ok 19:26:35.0292 4072 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 19:26:35.0292 4072 Fastfat - ok 19:26:35.0370 4072 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 19:26:35.0370 4072 FastUserSwitchingCompatibility - ok 19:26:35.0433 4072 [ E97D6A8684466DF94FF3BC24FB787A07 ] Fax C:\WINDOWS\system32\fxssvc.exe 19:26:35.0433 4072 Fax - ok 19:26:35.0495 4072 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys 19:26:35.0495 4072 Fdc - ok 19:26:35.0511 4072 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 19:26:35.0511 4072 Fips - ok 19:26:35.0526 4072 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys 19:26:35.0526 4072 Flpydisk - ok 19:26:35.0589 4072 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 19:26:35.0589 4072 FltMgr - ok 19:26:35.0651 4072 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 19:26:35.0651 4072 FontCache3.0.0.0 - ok 19:26:35.0714 4072 [ E0087225B137E57239FF40F8AE82059B ] fssfltr C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys 19:26:35.0714 4072 fssfltr - ok 19:26:35.0823 4072 [ 45B52394F9624237F33A8A3D73C0B221 ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe 19:26:35.0839 4072 fsssvc - ok 19:26:35.0886 4072 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 19:26:35.0886 4072 Fs_Rec - ok 19:26:35.0917 4072 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 19:26:35.0917 4072 Ftdisk - ok 19:26:35.0933 4072 [ 22399D3CE5840C6082844679CCA5D2FC ] ftsata2 C:\WINDOWS\system32\DRIVERS\ftsata2.sys 19:26:35.0948 4072 ftsata2 - ok 19:26:35.0995 4072 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 19:26:36.0011 4072 GEARAspiWDM - ok 19:26:36.0042 4072 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 19:26:36.0042 4072 Gpc - ok 19:26:36.0136 4072 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe 19:26:36.0136 4072 gupdate - ok 19:26:36.0167 4072 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe 19:26:36.0167 4072 gupdatem - ok 19:26:36.0276 4072 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 19:26:36.0276 4072 helpsvc - ok 19:26:36.0323 4072 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll 19:26:36.0323 4072 HidServ - ok 19:26:36.0355 4072 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys 19:26:36.0355 4072 HidUsb - ok 19:26:36.0433 4072 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 19:26:36.0433 4072 hkmsvc - ok 19:26:36.0448 4072 hpn - ok 19:26:36.0511 4072 [ 5DF616ADDB75C1AD36C1F9E4DE0F7654 ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 19:26:36.0526 4072 HSFHWBS2 - ok 19:26:36.0589 4072 [ DFA8F86C0DBCA7DB948043AA3BE6793B ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 19:26:36.0605 4072 HSF_DP - ok 19:26:36.0667 4072 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 19:26:36.0683 4072 HTTP - ok 19:26:36.0698 4072 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 19:26:36.0698 4072 HTTPFilter - ok 19:26:36.0745 4072 i2omgmt - ok 19:26:36.0761 4072 i2omp - ok 19:26:36.0792 4072 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 19:26:36.0792 4072 i8042prt - ok 19:26:36.0870 4072 [ 9A65E42664D1534B68512CAAD0EFE963 ] iaStor C:\WINDOWS\system32\DRIVERS\iaStor.sys 19:26:36.0870 4072 iaStor - ok 19:26:36.0948 4072 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe 19:26:36.0948 4072 IDriverT - ok 19:26:37.0058 4072 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 19:26:37.0073 4072 idsvc - ok 19:26:37.0105 4072 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 19:26:37.0105 4072 Imapi - ok 19:26:37.0167 4072 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe 19:26:37.0183 4072 ImapiService - ok 19:26:37.0198 4072 ini910u - ok 19:26:37.0230 4072 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys 19:26:37.0230 4072 IntelIde - ok 19:26:37.0276 4072 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys 19:26:37.0276 4072 intelppm - ok 19:26:37.0292 4072 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys 19:26:37.0292 4072 Ip6Fw - ok 19:26:37.0339 4072 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 19:26:37.0339 4072 IpFilterDriver - ok 19:26:37.0386 4072 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 19:26:37.0386 4072 IpInIp - ok 19:26:37.0433 4072 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 19:26:37.0433 4072 IpNat - ok 19:26:37.0526 4072 [ E46B17060D3962A384AE484094614788 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 19:26:37.0526 4072 iPod Service - ok 19:26:37.0589 4072 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 19:26:37.0589 4072 IPSec - ok 19:26:37.0620 4072 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 19:26:37.0620 4072 IRENUM - ok 19:26:37.0667 4072 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 19:26:37.0667 4072 isapnp - ok 19:26:37.0683 4072 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 19:26:37.0683 4072 Kbdclass - ok 19:26:37.0698 4072 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys 19:26:37.0698 4072 kbdhid - ok 19:26:37.0714 4072 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 19:26:37.0714 4072 kmixer - ok 19:26:37.0792 4072 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 19:26:37.0792 4072 KSecDD - ok 19:26:37.0839 4072 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 19:26:37.0839 4072 lanmanserver - ok 19:26:37.0901 4072 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 19:26:37.0917 4072 lanmanworkstation - ok 19:26:37.0933 4072 lbrtfdc - ok 19:26:38.0011 4072 [ 6E68E520E6F2F5DCE97A9FF947038769 ] LightScribeService C:\Program Files\Common Files\LightScribe\LSSrvc.exe 19:26:38.0011 4072 LightScribeService - ok 19:26:38.0073 4072 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 19:26:38.0073 4072 LmHosts - ok 19:26:38.0089 4072 McComponentHostService - ok 19:26:38.0105 4072 mcdbus - ok 19:26:38.0151 4072 [ DF0A511F38F16016BF658FCA0090CB87 ] McrdSvc C:\WINDOWS\ehome\mcrdsvc.exe 19:26:38.0151 4072 McrdSvc - ok 19:26:38.0245 4072 [ 11F714F85530A2BD134074DC30E99FCA ] MDM C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 19:26:38.0261 4072 MDM - ok 19:26:38.0292 4072 [ 3C318B9CD391371BED62126581EE9961 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 19:26:38.0292 4072 mdmxsdk - ok 19:26:38.0323 4072 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll 19:26:38.0323 4072 Messenger - ok 19:26:38.0370 4072 [ B7521F69C0A9B29D356157229376FB21 ] MHN C:\WINDOWS\System32\mhn.dll 19:26:38.0370 4072 MHN - ok 19:26:38.0401 4072 [ 7F2F1D2815A6449D346FCCCBC569FBD6 ] MHNDRV C:\WINDOWS\system32\DRIVERS\mhndrv.sys 19:26:38.0401 4072 MHNDRV - ok 19:26:38.0433 4072 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 19:26:38.0433 4072 mnmdd - ok 19:26:38.0464 4072 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 19:26:38.0480 4072 mnmsrvc - ok 19:26:38.0542 4072 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 19:26:38.0542 4072 Modem - ok 19:26:38.0558 4072 motccgp - ok 19:26:38.0573 4072 motccgpfl - ok 19:26:38.0589 4072 motmodem - ok 19:26:38.0620 4072 MotoHelper - ok 19:26:38.0636 4072 motport - ok 19:26:38.0667 4072 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 19:26:38.0667 4072 Mouclass - ok 19:26:38.0730 4072 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys 19:26:38.0730 4072 mouhid - ok 19:26:38.0745 4072 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 19:26:38.0745 4072 MountMgr - ok 19:26:38.0839 4072 [ A35576A433F4AEB0D48976A004657CB6 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe 19:26:38.0839 4072 MozillaMaintenance - ok 19:26:38.0886 4072 [ 24406D75B40F0F6B3C1AC7031D734565 ] MpFilter C:\WINDOWS\system32\DRIVERS\MpFilter.sys 19:26:38.0886 4072 MpFilter - ok 19:26:38.0901 4072 mraid35x - ok 19:26:38.0917 4072 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 19:26:38.0917 4072 MRxDAV - ok 19:26:38.0995 4072 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 19:26:39.0011 4072 MRxSmb - ok 19:26:39.0073 4072 [ D98350792A7CE82E7459A7C36481BEDA ] MSCamSvc C:\Program Files\Microsoft LifeCam\MSCamS32.exe 19:26:39.0073 4072 MSCamSvc - ok 19:26:39.0120 4072 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe 19:26:39.0136 4072 MSDTC - ok 19:26:39.0167 4072 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 19:26:39.0167 4072 Msfs - ok 19:26:39.0214 4072 [ 5119FFC2A6B51089CDB0EFDC75808C97 ] MSHUSBVideo C:\WINDOWS\system32\Drivers\nx6000.sys 19:26:39.0214 4072 MSHUSBVideo - ok 19:26:39.0230 4072 MSIServer - ok 19:26:39.0261 4072 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 19:26:39.0261 4072 MSKSSRV - ok 19:26:39.0355 4072 [ 37F77AEBFF23A99D1BFB4F34CD2D07F2 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe 19:26:39.0355 4072 MsMpSvc - ok 19:26:39.0417 4072 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 19:26:39.0417 4072 MSPCLOCK - ok 19:26:39.0448 4072 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 19:26:39.0448 4072 MSPQM - ok 19:26:39.0511 4072 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 19:26:39.0511 4072 mssmbios - ok 19:26:39.0542 4072 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys 19:26:39.0558 4072 MSTEE - ok 19:26:39.0589 4072 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 19:26:39.0589 4072 Mup - ok 19:26:39.0636 4072 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 19:26:39.0636 4072 NABTSFEC - ok 19:26:39.0698 4072 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll 19:26:39.0698 4072 napagent - ok 19:26:39.0761 4072 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 19:26:39.0761 4072 NDIS - ok 19:26:39.0792 4072 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys 19:26:39.0792 4072 NdisIP - ok 19:26:39.0870 4072 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 19:26:39.0870 4072 NdisTapi - ok 19:26:39.0886 4072 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 19:26:39.0886 4072 Ndisuio - ok 19:26:39.0933 4072 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 19:26:39.0933 4072 NdisWan - ok 19:26:39.0980 4072 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 19:26:39.0980 4072 NDProxy - ok 19:26:40.0042 4072 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 19:26:40.0042 4072 NetBIOS - ok 19:26:40.0073 4072 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 19:26:40.0073 4072 NetBT - ok 19:26:40.0120 4072 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe 19:26:40.0120 4072 NetDDE - ok 19:26:40.0151 4072 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 19:26:40.0151 4072 NetDDEdsdm - ok 19:26:40.0198 4072 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe 19:26:40.0198 4072 Netlogon - ok 19:26:40.0230 4072 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll 19:26:40.0230 4072 Netman - ok 19:26:40.0292 4072 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 19:26:40.0308 4072 NetTcpPortSharing - ok 19:26:40.0355 4072 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys 19:26:40.0355 4072 NIC1394 - ok 19:26:40.0433 4072 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll 19:26:40.0433 4072 Nla - ok 19:26:40.0511 4072 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 19:26:40.0511 4072 Npfs - ok 19:26:40.0542 4072 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 19:26:40.0558 4072 Ntfs - ok 19:26:40.0605 4072 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 19:26:40.0605 4072 NtLmSsp - ok 19:26:40.0636 4072 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 19:26:40.0651 4072 NtmsSvc - ok 19:26:40.0698 4072 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 19:26:40.0698 4072 Null - ok 19:26:40.0745 4072 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 19:26:40.0745 4072 NwlnkFlt - ok 19:26:40.0761 4072 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 19:26:40.0761 4072 NwlnkFwd - ok 19:26:40.0855 4072 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 19:26:40.0855 4072 odserv - ok 19:26:40.0901 4072 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys 19:26:40.0901 4072 ohci1394 - ok 19:26:40.0948 4072 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 19:26:40.0948 4072 ose - ok 19:26:41.0011 4072 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys 19:26:41.0011 4072 Parport - ok 19:26:41.0011 4072 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 19:26:41.0011 4072 PartMgr - ok 19:26:41.0073 4072 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 19:26:41.0073 4072 ParVdm - ok 19:26:41.0089 4072 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 19:26:41.0089 4072 PCI - ok 19:26:41.0105 4072 PCIDump - ok 19:26:41.0105 4072 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 19:26:41.0120 4072 PCIIde - ok 19:26:41.0136 4072 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 19:26:41.0136 4072 Pcmcia - ok 19:26:41.0151 4072 PDCOMP - ok 19:26:41.0167 4072 PDFRAME - ok 19:26:41.0183 4072 PDRELI - ok 19:26:41.0183 4072 PDRFRAME - ok 19:26:41.0198 4072 perc2 - ok 19:26:41.0214 4072 perc2hib - ok 19:26:41.0276 4072 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe 19:26:41.0276 4072 PlugPlay - ok 19:26:41.0370 4072 [ 2D091A99624FB9E7EEF0A86D872EC0C3 ] Pml Driver HPZ12 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE 19:26:41.0370 4072 Pml Driver HPZ12 - ok 19:26:41.0386 4072 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 19:26:41.0386 4072 PolicyAgent - ok 19:26:41.0417 4072 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 19:26:41.0417 4072 PptpMiniport - ok 19:26:41.0433 4072 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys 19:26:41.0433 4072 Processor - ok 19:26:41.0448 4072 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 19:26:41.0448 4072 ProtectedStorage - ok 19:26:41.0495 4072 [ 0E2EB30605CA6ED2509D59AF6A7362B4 ] Ps2 C:\WINDOWS\system32\DRIVERS\PS2.sys 19:26:41.0495 4072 Ps2 - ok 19:26:41.0558 4072 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 19:26:41.0558 4072 PSched - ok 19:26:41.0605 4072 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 19:26:41.0605 4072 Ptilink - ok 19:26:41.0636 4072 [ 86724469CD077901706854974CD13C3E ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys 19:26:41.0651 4072 PxHelp20 - ok 19:26:41.0651 4072 ql1080 - ok 19:26:41.0667 4072 Ql10wnt - ok 19:26:41.0683 4072 ql12160 - ok 19:26:41.0698 4072 ql1240 - ok 19:26:41.0698 4072 ql1280 - ok 19:26:41.0730 4072 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 19:26:41.0730 4072 RasAcd - ok 19:26:41.0776 4072 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll 19:26:41.0792 4072 RasAuto - ok 19:26:41.0792 4072 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 19:26:41.0792 4072 Rasl2tp - ok 19:26:41.0855 4072 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll 19:26:41.0870 4072 RasMan - ok 19:26:41.0870 4072 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 19:26:41.0870 4072 RasPppoe - ok 19:26:41.0870 4072 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 19:26:41.0870 4072 Raspti - ok 19:26:41.0886 4072 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 19:26:41.0886 4072 Rdbss - ok 19:26:41.0933 4072 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 19:26:41.0933 4072 RDPCDD - ok 19:26:42.0011 4072 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 19:26:42.0011 4072 rdpdr - ok 19:26:42.0058 4072 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 19:26:42.0058 4072 RDPWD - ok 19:26:42.0105 4072 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 19:26:42.0105 4072 RDSessMgr - ok 19:26:42.0136 4072 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 19:26:42.0136 4072 redbook - ok 19:26:42.0198 4072 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 19:26:42.0198 4072 RemoteAccess - ok 19:26:42.0245 4072 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 19:26:42.0245 4072 RemoteRegistry - ok 19:26:42.0292 4072 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe 19:26:42.0292 4072 RpcLocator - ok 19:26:42.0339 4072 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll 19:26:42.0339 4072 RpcSs - ok 19:26:42.0401 4072 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe 19:26:42.0401 4072 RSVP - ok 19:26:42.0464 4072 [ 7F0413BDD7D53EB4C7A371E7F6F84DF1 ] RTL8023xp C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys 19:26:42.0464 4072 RTL8023xp - ok 19:26:42.0511 4072 [ D507C1400284176573224903819FFDA3 ] rtl8139 C:\WINDOWS\system32\DRIVERS\RTL8139.SYS 19:26:42.0511 4072 rtl8139 - ok 19:26:42.0558 4072 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe 19:26:42.0558 4072 SamSs - ok 19:26:42.0589 4072 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 19:26:42.0605 4072 SCardSvr - ok 19:26:42.0651 4072 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll 19:26:42.0651 4072 Schedule - ok 19:26:42.0698 4072 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 19:26:42.0698 4072 Secdrv - ok 19:26:42.0761 4072 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll 19:26:42.0761 4072 seclogon - ok 19:26:42.0792 4072 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll 19:26:42.0808 4072 SENS - ok 19:26:42.0855 4072 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\drivers\Serial.sys 19:26:42.0855 4072 Serial - ok 19:26:42.0917 4072 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 19:26:42.0917 4072 Sfloppy - ok 19:26:42.0995 4072 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 19:26:43.0011 4072 SharedAccess - ok 19:26:43.0042 4072 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 19:26:43.0042 4072 ShellHWDetection - ok 19:26:43.0058 4072 Simbad - ok 19:26:43.0370 4072 [ 388AE59FE75F1B959DFA0900923C61BB ] Skype C2C Service C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe 19:26:43.0417 4072 Skype C2C Service - ok 19:26:43.0464 4072 [ 8C4F0DCC6A5100D48F9B2F950CDD220F ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe 19:26:43.0464 4072 SkypeUpdate - ok 19:26:43.0526 4072 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys 19:26:43.0526 4072 SLIP - ok 19:26:43.0589 4072 [ A1ECEEAA5C5E74B2499EB51D38185B84 ] SONYPVU1 C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS 19:26:43.0589 4072 SONYPVU1 - ok 19:26:43.0605 4072 Sparrow - ok 19:26:43.0667 4072 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 19:26:43.0667 4072 splitter - ok 19:26:43.0714 4072 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 19:26:43.0714 4072 Spooler - ok 19:26:43.0792 4072 [ 70B7F9F6F826DF5F510A29A983C00F27 ] sptd C:\WINDOWS\system32\Drivers\sptd.sys 19:26:43.0792 4072 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 70B7F9F6F826DF5F510A29A983C00F27 19:26:43.0808 4072 sptd ( LockedFile.Multi.Generic ) - warning 19:26:43.0808 4072 sptd - detected LockedFile.Multi.Generic (1) 19:26:43.0870 4072 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 19:26:43.0870 4072 sr - ok 19:26:43.0933 4072 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll 19:26:43.0933 4072 srservice - ok 19:26:44.0011 4072 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 19:26:44.0011 4072 Srv - ok 19:26:44.0042 4072 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 19:26:44.0042 4072 SSDPSRV - ok 19:26:44.0105 4072 [ A9573045BAA16EAB9B1085205B82F1ED ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys 19:26:44.0105 4072 StillCam - ok 19:26:44.0183 4072 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll 19:26:44.0198 4072 stisvc - ok 19:26:44.0230 4072 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys 19:26:44.0230 4072 streamip - ok 19:26:44.0245 4072 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 19:26:44.0245 4072 swenum - ok 19:26:44.0308 4072 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 19:26:44.0323 4072 swmidi - ok 19:26:44.0339 4072 SwPrv - ok 19:26:44.0370 4072 symc810 - ok 19:26:44.0386 4072 symc8xx - ok 19:26:44.0401 4072 sym_hi - ok 19:26:44.0417 4072 sym_u3 - ok 19:26:44.0480 4072 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 19:26:44.0480 4072 sysaudio - ok 19:26:44.0542 4072 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 19:26:44.0542 4072 SysmonLog - ok 19:26:44.0620 4072 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 19:26:44.0620 4072 TapiSrv - ok 19:26:44.0698 4072 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 19:26:44.0698 4072 Tcpip - ok 19:26:44.0745 4072 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 19:26:44.0745 4072 TDPIPE - ok 19:26:44.0776 4072 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 19:26:44.0776 4072 TDTCP - ok 19:26:44.0823 4072 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 19:26:44.0823 4072 TermDD - ok 19:26:44.0870 4072 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll 19:26:44.0870 4072 TermService - ok 19:26:44.0901 4072 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll 19:26:44.0917 4072 Themes - ok 19:26:44.0964 4072 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe 19:26:44.0964 4072 TlntSvr - ok 19:26:44.0995 4072 TosIde - ok 19:26:45.0026 4072 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll 19:26:45.0042 4072 TrkWks - ok 19:26:45.0105 4072 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 19:26:45.0105 4072 Udfs - ok 19:26:45.0120 4072 ultra - ok 19:26:45.0198 4072 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 19:26:45.0198 4072 Update - ok 19:26:45.0245 4072 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll 19:26:45.0245 4072 upnphost - ok 19:26:45.0276 4072 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe 19:26:45.0276 4072 UPS - ok 19:26:45.0323 4072 [ 6E421CCC57059B0186C6259CA3B6DFC9 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys 19:26:45.0339 4072 USBAAPL - ok 19:26:45.0370 4072 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys 19:26:45.0370 4072 usbaudio - ok 19:26:45.0401 4072 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 19:26:45.0401 4072 usbccgp - ok 19:26:45.0448 4072 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 19:26:45.0448 4072 usbehci - ok 19:26:45.0480 4072 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 19:26:45.0480 4072 usbhub - ok 19:26:45.0495 4072 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys 19:26:45.0495 4072 usbohci - ok 19:26:45.0558 4072 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 19:26:45.0558 4072 usbprint - ok 19:26:45.0589 4072 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 19:26:45.0589 4072 usbscan - ok 19:26:45.0605 4072 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 19:26:45.0605 4072 usbstor - ok 19:26:45.0651 4072 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys 19:26:45.0651 4072 usbuhci - ok 19:26:45.0683 4072 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys 19:26:45.0683 4072 usbvideo - ok 19:26:45.0730 4072 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 19:26:45.0730 4072 VgaSave - ok 19:26:45.0745 4072 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys 19:26:45.0745 4072 ViaIde - ok 19:26:45.0776 4072 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 19:26:45.0776 4072 VolSnap - ok 19:26:45.0823 4072 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe 19:26:45.0839 4072 VSS - ok 19:26:45.0886 4072 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll 19:26:45.0901 4072 W32Time - ok 19:26:45.0933 4072 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 19:26:45.0933 4072 Wanarp - ok 19:26:46.0011 4072 [ BBCFEAB7E871CDDAC2D397EE7FA91FDC ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys 19:26:46.0026 4072 Wdf01000 - ok 19:26:46.0042 4072 WDICA - ok 19:26:46.0058 4072 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 19:26:46.0073 4072 wdmaud - ok 19:26:46.0105 4072 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll 19:26:46.0120 4072 WebClient - ok 19:26:46.0183 4072 [ 473EE64C368CE2EED110376C11960259 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 19:26:46.0183 4072 winachsf - ok 19:26:46.0292 4072 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 19:26:46.0292 4072 winmgmt - ok 19:26:46.0370 4072 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 19:26:46.0370 4072 WmdmPmSN - ok 19:26:46.0448 4072 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll 19:26:46.0448 4072 Wmi - ok 19:26:46.0495 4072 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 19:26:46.0495 4072 WmiApSrv - ok 19:26:46.0605 4072 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 19:26:46.0605 4072 WMPNetworkSvc - ok 19:26:46.0636 4072 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys 19:26:46.0636 4072 WpdUsb - ok 19:26:46.0776 4072 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 19:26:46.0776 4072 WPFFontCache_v0400 - ok 19:26:46.0839 4072 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll 19:26:46.0839 4072 wscsvc - ok 19:26:46.0855 4072 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 19:26:46.0870 4072 WSTCODEC - ok 19:26:46.0917 4072 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll 19:26:46.0933 4072 wuauserv - ok 19:26:46.0995 4072 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 19:26:46.0995 4072 WudfPf - ok 19:26:47.0058 4072 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 19:26:47.0058 4072 WudfRd - ok 19:26:47.0089 4072 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 19:26:47.0089 4072 WudfSvc - ok 19:26:47.0183 4072 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 19:26:47.0183 4072 WZCSVC - ok 19:26:47.0230 4072 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 19:26:47.0230 4072 xmlprov - ok 19:26:47.0292 4072 [ 09E5340BD9B2CB730BF4DC6BE7721291 ] xusb21 C:\WINDOWS\system32\DRIVERS\xusb21.sys 19:26:47.0308 4072 xusb21 - ok 19:26:47.0355 4072 ================ Scan global =============================== 19:26:47.0417 4072 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll 19:26:47.0448 4072 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll 19:26:47.0480 4072 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll 19:26:47.0526 4072 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe 19:26:47.0526 4072 [Global] - ok 19:26:47.0526 4072 ================ Scan MBR ================================== 19:26:47.0573 4072 [ 0AC6D996BCE152AED9600E6D6B797E2E ] \Device\Harddisk0\DR0 19:26:47.0792 4072 \Device\Harddisk0\DR0 - ok 19:26:47.0792 4072 ================ Scan VBR ================================== 19:26:47.0808 4072 [ E127784CE8D59AE190C48BAF1264CB67 ] \Device\Harddisk0\DR0\Partition1 19:26:47.0808 4072 \Device\Harddisk0\DR0\Partition1 - ok 19:26:47.0808 4072 [ 006359F80626DEDEB1AF8CA4A1715EA2 ] \Device\Harddisk0\DR0\Partition2 19:26:47.0808 4072 \Device\Harddisk0\DR0\Partition2 - ok 19:26:47.0823 4072 ============================================================ 19:26:47.0823 4072 Scan finished 19:26:47.0823 4072 ============================================================ 19:26:47.0839 0724 Detected object count: 1 19:26:47.0839 0724 Actual detected object count: 1 19:26:55.0886 0724 sptd ( LockedFile.Multi.Generic ) - skipped by user 19:26:55.0886 0724 sptd ( LockedFile.Multi.Generic ) - User select action: Skip 19:27:08.0011 0492 Deinitialize success

Satchfan

Post #9October 1, 2013, 11:23 AM UTC

Can you tell me if you set this proxy server:

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

RetiredChief

Post #10October 1, 2013, 12:35 PM UTC

I do not believe I did, but I cannot say for sure. Iknow we did need to get a new router for the wireless server in the house.

Satchfan

Post #11October 1, 2013, 1:29 PM UTC

I didn’t think you’d set it.

Note: If you have MalwareBytes Anti-Malware 1.6 or higher installed and are using the Pro version or trial version, please temporarily disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555 [2011/05/06 07:30:05 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml.old O3 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKU\S-1-5-21-657425056-1587324396-1979525332-1008\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Planner Reminders Tray Icon.lnk = File not found O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Forget Me Not.lnk = File not found O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = File not found O4 - Startup: C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\hc_tray.lnk = File not found O4 - Startup: C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\Jewell DeskMate.LNK = File not found O4 - Startup: C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75\Start Menu\Programs\Startup\Registration Silent Hunter III.LNK = File not found O16 - DPF: {036F8A56-0BC8-4607-8F98-D3231E6FF5ED} http://de225.centra.com/SiteRoots/main/Ins…raUpdaterAx.cab (Reg Error: Key error.) :Reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusOverride"=dword:00000000 "FirewallOverride"=dword:00000000 :Files ipconfig /flushdns /c :Commands [purity] [emptytemp] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
please post the OTL fix log and new OTL log.

==================================================

Download and run ComboFix

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, as they may otherwise interfere with our tools. See here for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.

🖼Click to load external image (Posted Image)

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

🖼Click to load external image (Posted Image)

Click on Yes, to continue scanning for malware.

Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

Logs to include in the next post:

OTL fix log
New OTL log
ComboFix.txt

Satchfan

RetiredChief

Post #12October 1, 2013, 1:34 PM UTC

I will perform all of these tasks when I get home from work. Have a great day, Cheers!!!!

Satchfan

Post #13October 1, 2013, 1:46 PM UTC

RetiredChief

Post #14October 2, 2013, 1:53 AM UTC

Houston, we have a problem. When I got home today, the computer booted to the HP window. When I chose Esc=boot menu, all I have is a black screen with a flashing cursor at the top left corner. Does this mean we are done with the exercise and will need to go computer shopping? (I am using my laptop right now)

Satchfan

Post #15October 2, 2013, 7:39 AM UTC

Does this mean we are done with the exercise and will need to go computer shopping?

Don't panic yet.

Try booting in Safe mode with Networking.

go to Start> Shut off your Computer> Restart
as the computer starts to boot-up, tap the F8 key - this will bring up a menu
use the Up and Down arrow keys to scroll up to Safe mode with Networking
then press Enter on your keyboard

If this works, continue with the instructions.

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Desktop has issues, possibly spyware/malware.... [Solved]

✨ Ask AI

Ask AI