Spyware / Malware / Virus Removal

SUPER slow PC Usage - Maybe Malware [Solved]

55 min read

Looking for the outcome? Ask AI

DanielDude Topic Starter

Post #1May 13, 2015, 7:11 PM UTC

I don't know if it's Malware or memory bleed

My CPU Usage is at 100% all the time. It was a big chore just to get here and run highjackthis due to it slowing down

: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

c:\documents and settings\all users\application data\excellent4app\sn.booster\SN.Booster.exe

C:\Program Files\Java\jre7\bin\jqs.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\wscript.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.searchsun.info/?pid=34&r=2014/05/24&hid=5011814741841314998&lg=EN&cc=CA&unqvl=52

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.searchsun.info/?pid=34&r=2014/05/24&hid=5011814741841314998&lg=EN&cc=CA&unqvl=52

R3 - URLSearchHook: (no name) - {D8278076-BC68-4484-9233-6E7F1628B56C} - (no file)

R3 - URLSearchHook: YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

O2 - BHO: save net - {9105C6A4-F937-F0AF-40CE-CB303432F5A1} - C:\Program Files\save net\1ZVc1X.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll

O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [UpdatePDRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\8.0"

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto

O4 - HKLM\..\Run: [FlashPlayerUpdate] C:\Documents and Settings\Protoman\Local Settings\Application Data\Macromedia\Flash Player\FlashPlayerUpdateService.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [5281a4a] C:\5281a4a3\5281a4a3.exe

O4 - HKCU\..\Run: [5281a4a3] C:\Documents and Settings\Protoman\Application Data\5281a4a3.exe

O4 - HKCU\..\Run: [fmkfgp] "C:\Documents and Settings\Protoman\Local Settings\Application Data\xgniwe\xgniwe.exe" -a

O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.5; .NET CLR 2.0.50727; .NET4.0C; .NET CLR 3.5.30729; .NET4.0E; .NET CLR 3.0.4506.2152)" -"http://www.frivdejuegos.com/juegos/4-wheel-fury2.html"

O4 - HKLM\..\Policies\Explorer\Run: [138630849] "C:\Documents and Settings\All Users\msnzdmcc.exe"

O4 - Startup: 5281a4a3.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/bin/LogitechDeviceDetection32.cab

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

O16 - DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} (FBootloaderAX) - http://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab

O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1349749252515

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab

O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/cab9_1/dmcc2.cab?Version=1,0,0,10

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: etgismo - C:\Documents and Settings\Protoman\Local Settings\Application Data\etgismo.dll

O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe

O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\jswpsapi.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe

O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe

O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

–

End of file - 11412 bytes

ken545

Post #2May 13, 2015, 8:55 PM UTC

Hijackthis is a very outdated program and not used much anymore but we can try to remove a few things and see if it helps your system to calm down more so we can run other programs, your Hijackthis log is not showing what version it is and also what Operating System you are running

Open Hijackthis and go to the Main Menu > Do a system scan only

Then check these off and on the bottom click on fix checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.sea…&cc=CA&unqvl=52

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.sea…&cc=CA&unqvl=52

R3 - URLSearchHook: (no name) - {D8278076-BC68-4484-9233-6E7F1628B56C} - (no file)

O2 - BHO: save net - {9105C6A4-F937-F0AF-40CE-CB303432F5A1} - C:\Program Files\save net\1ZVc1X.dll

O4 - HKCU\..\Run: [5281a4a] C:\5281a4a3\5281a4a3.exe

O4 - HKCU\..\Run: [5281a4a3] C:\Documents and Settings\Protoman\Application Data\5281a4a3.exe

O4 - HKCU\..\Run: [fmkfgp] "C:\Documents and Settings\Protoman\Local Settings\Application Data\xgniwe\xgniwe.exe" -a

O4 - Startup: 5281a4a3.exe

Then see if you can run these programs, download them all to your desktop, all our tools and scanners run more efficiently from the desktop in lieu of being buried in some folder

-AdwCleaner-by Xplode

Click on this link to download : ADWCleaner To your Desktop

Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers

Do not click on any links in the top Advertisment.

[external image: AdwCleaner4.201_zpsxrbk2llq.jpg]

Close all open programs and internet browsers.

Double click on AdwCleaner.exe to run the tool.

Click on Scan.

After the scan is complete click on "Clean"

Confirm each time with Ok.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the content of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

===============================================================================

[external image: thisisujrt.gif] Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

===============================================================================

Download Malwarebytes' Anti-Malware to your desktop. <———

Windows XP : Double click on the icon to run it.

Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

[external image: MBAM2010601022_zpsyvzbaddn.jpg]

On the Dashboard click on Update Now

Go to the Setting Tab

Under Setting go to Detection and Protection

Under PUP and PUM make sure both are set to show Treat Detections as Malware

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

Then on the Dashboard click on Scan

Make sure to select THREAT SCAN

Then click on Scan

When the scan is finished and the log pops up…select Copy to Clipboard

Please paste the log back into this thread for review

Exit Malwarebytes

DanielDude

Post #3May 14, 2015, 4:46 AM UTC

Hey! Thank you for coming to my help

This is an XP system

So………..

—————-

Hijack files deleted

—-

For the ADWcleaner thing , I noticed it would crash everytime I would do the Cleaning part, then I just didn't clean the area where it would always crash (at Folders) and it went fine, you will see in the log that I didn't delete the infected "folder" stuff

Here is the log

# AdwCleaner v4.203 - Logfile created 13/05/2015 at 22:23:15

# Updated 30/04/2015 by Xplode

# Database : 2015-04-30.2 [Local]

# Operating system : Microsoft Windows XP Service Pack 3 (x86)

# Username : Protoman - DANIEL

# Running from : C:\Documents and Settings\Protoman\Desktop\adwcleaner_4.203.exe

# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

[x] Not Deleted : C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

[x] Not Deleted : C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

[x] Not Deleted : C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

[x] Not Deleted : C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

File Deleted : C:\Program Files\Mozilla Firefox\defaults\pref\firefox-branding.js

File Deleted : C:\Program Files\Mozilla Firefox\defaults\pref\firefox-l10n.js

File Deleted : C:\Program Files\Mozilla Firefox\defaults\pref\firefox.js

File Deleted : C:\Program Files\Mozilla Firefox\defaults\pref\reporter.js

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\net

Key Deleted : HKLM\SOFTWARE\Classes\net.5.14

Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho

Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.EasyHideBtn

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.EasyHideBtn.1

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.Localizer

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.Localizer.1

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighter

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighter.1

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighterStatistics

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighterStatistics.1

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.SkypeIEHelper

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.SkypeIEHelper.1

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.SNameProxy

[#] Key Deleted : HKLM\SOFTWARE\Classes\ToolBand.SNameProxy.1

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@qq.com/TXSSO

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ask.com

Key Deleted : HKLM\SOFTWARE\Classes\AppID\DownloadProxy.EXE

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\DriversHQ.DriverDetective.Client.exe

Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-11624655

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{916e5338}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{937936AF-28CA-4973-B8AE-F250406149A2}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{51BEE30D-EEC8-4BA3-930B-298B8E759EB1}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D8278076-BC68-4484-9233-6E7F1628B56C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}]

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{695C7159-126E-4916-AD68-28963A304699}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}

Key Deleted : HKCU\Software\APN PIP

Key Deleted : HKCU\Software\RegisteredApplicationsEx

Key Deleted : HKCU\Software\YahooPartnerToolbar

Key Deleted : HKCU\Software\Local AppWizard-Generated Applications

Key Deleted : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Deleted : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

Key Deleted : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}

Key Deleted : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}

Key Deleted : HKLM\SOFTWARE\APN

Key Deleted : HKLM\SOFTWARE\PIP

Key Deleted : HKLM\SOFTWARE\SN.Booster

Key Deleted : HKLM\SOFTWARE\Viewpoint

Key Deleted : HKU\.DEFAULT\Software\AskPartnerNetwork

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7DD5E91C-3864-77EC-7635-D14910C2A03E}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Viewpoint Manager

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4640FDE1-B83A-4376-84ED-86F86BEE2D41}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{7DD5E91C-3864-77EC-7635-D14910C2A03E}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\P2P Networking

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{4640FDE1-B83A-4376-84ED-86F86BEE2D41}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\1EDF0464A38B673448DE688FB6EED214

Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\1EDF0464A38B673448DE688FB6EED214

Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\1EDF0464A38B673448DE688FB6EED214

***** [ Web browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

-\\ Mozilla Firefox v37.0.2 (x86 en-US)

-\\ Google Chrome v

-\\ Comodo Dragon v

-\\ Chrome Canary v

*************************

AdwCleaner[R0].txt - [36830 bytes] - [13/05/2015 18:34:26]

AdwCleaner[R1].txt - [36066 bytes] - [13/05/2015 19:10:12]

AdwCleaner[R2].txt - [35552 bytes] - [13/05/2015 21:33:12]

AdwCleaner[R3].txt - [10016 bytes] - [13/05/2015 22:09:09]

AdwCleaner[R4].txt - [9159 bytes] - [13/05/2015 22:15:16]

AdwCleaner[S0].txt - [1324 bytes] - [13/05/2015 18:59:49]

AdwCleaner[S1].txt - [1110 bytes] - [13/05/2015 19:20:39]

AdwCleaner[S2].txt - [11328 bytes] - [13/05/2015 21:42:37]

AdwCleaner[S3].txt - [1383 bytes] - [13/05/2015 22:13:11]

AdwCleaner[S4].txt - [9001 bytes] - [13/05/2015 22:23:15]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [9060 bytes] ##########

—————–

The JRT scan would not work, would say "Backing up Registry" then close after about 10 minutes, maybe it has to do with my computer being in a bogged down slowness (I can't stress how slow it is now)

—————-

Malwarebyte Log

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 5/13/2015

Scan Time: 10:51:07 PM

Logfile:

Administrator: Yes

Version: 2.01.6.1022

Malware Database: v2015.05.13.06

Rootkit Database: v2015.04.21.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows XP Service Pack 3

CPU: x86

File System: NTFS

User: Protoman

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 418267

Time Elapsed: 1 hr, 24 min, 2 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 1

PUP.Optional.MultiPlug.A, C:\Documents and Settings\All Users\Application Data\Excellent4App\SN.Booster\SN.Booster.exe, 920, , [04262a69dfab37ff5315d98cd42da55b]

Modules: 1

Trojan.Agent.SDLED, C:\Documents and Settings\Protoman\Local Settings\Application Data\etgismo.dll, , [a882c4cfa7e3ea4c91281df10006df21],

Registry Keys: 2

Trojan.Agent.SDLED, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\etgismo, , [a882c4cfa7e3ea4c91281df10006df21],

PUP.Optional.MultiPlug, HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}, , [3feb50437d0db482e369801193708977],

Registry Values: 1

Trojan.Agent.RPED, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN|138630849, "C:\Documents and Settings\All Users\msnzdmcc.exe", , [6cbeb5de593151e50c3fb3a253afee12]

Registry Data: 0

(No malicious items detected)

Folders: 8

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed]\content, , [5cce3e55e5a552e48cc391d5aa5b57a9],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed], , [5cce3e55e5a552e48cc391d5aa5b57a9],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed]\content, , [58d24f4467238ea859f65b0b768f7b85],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed], , [58d24f4467238ea859f65b0b768f7b85],

PUP.Optional.SNBooster.A, C:\Documents and Settings\All Users\Application Data\Excellent4App\SN.Booster, , [0c1e1e7572180e28bb3fe1d134cf08f8],

PUP.Optional.SNBooster.A, C:\Documents and Settings\All Users\Application Data\Excellent4App\SN.Booster\11624655, , [0c1e1e7572180e28bb3fe1d134cf08f8],

PUP.Optional.Excellent4App.A, C:\Documents and Settings\All Users\Application Data\Excellent4App, , [c8622c67652575c15b3aa71eb35036ca],

PUP.Optional.Excellent4App.A, C:\Documents and Settings\All Users\Application Data\Excellent4App\Setup, , [c8622c67652575c15b3aa71eb35036ca],

Files: 45

Trojan.Agent.SDLED, C:\Documents and Settings\Protoman\Local Settings\Application Data\etgismo.dll, , [a882c4cfa7e3ea4c91281df10006df21],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\All Users\Application Data\Excellent4App\SN.Booster\SN.Booster.exe, , [04262a69dfab37ff5315d98cd42da55b],

Trojan.Agent.RPED, C:\Documents and Settings\All Users\msnzdmcc.exe, , [6cbeb5de593151e50c3fb3a253afee12],

PUP.Optional.Spigot.A, C:\Documents and Settings\All Users\Application Data\YouTube Downloader\ytd_installer.exe, , [02282a699af0e056369d34f4649c21df],

Trojan.Agent.RPED, C:\Documents and Settings\Protoman\Application Data\5281a4a3.exe, , [c9614a491575e650a3a8b4a1867c32ce],

Trojan.Dropper.NS, C:\Documents and Settings\Protoman\Application Data\qUtThV46DiSEzjO-rvI7zx1thuLPpnj-cys3oNuTV6QqpG8-RSylfMXB7YaZU0x.exe, , [e5451f74deac54e2126284c8d52edb25],

Trojan.Inject, C:\Documents and Settings\Protoman\Application Data\xILFsyyS\EjBZRhPe\XJuNfgcH\HLJsxAJSi.exe, , [2efc1d767d0dfd39677be5929e628977],

PUP.Optional.MultiPlug, C:\Documents and Settings\Protoman\My Documents\Downloads\Mario And Luigi - Superstar Saga.exe, , [64c6f59e05854fe7af96da768280b749],

PUP.Optional.Somoto.SID.A, C:\Documents and Settings\Protoman\My Documents\Downloads\MasterBoy2_downloader-Q1EKbmexj.exe, , [7ab0088b6b1f54e29fe78bcb8f772ed2],

PUP.Optional.InstallRex, C:\Documents and Settings\Protoman\My Documents\Downloads\tcollectionsreview.pdf.exe, , [d5558c07f397df5781f875644bb607f9],

PUP.Optional.Installex, C:\Documents and Settings\Protoman\My Documents\Downloads\Story Pages.rar.exe, , [71b99df62a60d363b8a544486998f010],

PUP.Optional.InstallCore, C:\Documents and Settings\Protoman\My Documents\Downloads\CR_Downloader_for_divine-sealing.exe, , [85a5e7aca3e774c2897b36a5679e23dd],

PUP.Optional.InstallRex, C:\Documents and Settings\Protoman\My Documents\Downloads\TFG1ampG2Manga.rar.exe, , [63c7f99a0a80ba7c1c7cd47b08f88878],

Trojan.Agent.ED, C:\Documents and Settings\Protoman\Local Settings\temp\FD.tmp, , [75b58a090288c67050dc9bbe3bc741bf],

Trojan.Agent.RPED, C:\Documents and Settings\Protoman\Local Settings\temp\KB17012781.exe, , [0525187bcdbd5adcb29967eeac5633cd],

Backdoor.Bot, C:\Documents and Settings\Protoman\Local Settings\temp\KB17024046.exe, , [7dad1e75f8922a0ce99534188380ee12],

Trojan.Inject, C:\Documents and Settings\Protoman\Local Settings\temp\systemrestore.exe, , [51d99ff45733e155e1014b2c9868a060],

Trojan.Agent.ED, C:\Documents and Settings\Protoman\Local Settings\temp\1E5.tmp, , [2efc326186043006719cc594ff03a35d],

Trojan.CryptoLocker, C:\Documents and Settings\Protoman\Local Settings\temp\52.tmp, , [be6c543ff298ae8841dbd88124de827e],

Trojan.CryptoLocker, C:\Documents and Settings\Protoman\Local Settings\temp\53.tmp, , [a882147f672396a0bb613d1ca1617888],

Trojan.Injector.ED, C:\Documents and Settings\Protoman\Local Settings\temp\rad183DC.tmp.exe, , [fb2faee588024de90d9815f9986e817f],

Trojan.Injector.ED, C:\Documents and Settings\Protoman\Local Settings\temp\rad2877E.tmp.exe, , [a08a286b94f6989ee4c1fc12798d6f91],

Trojan.Injector.ED, C:\Documents and Settings\Protoman\Local Settings\temp\rad56280.tmp.exe, , [8aa0088b6327999dc2e3a26c62a46e92],

Trojan.Injector.ED, C:\Documents and Settings\Protoman\Local Settings\temp\rad687BD.tmp.exe, , [1f0b088b6327e056adf829e5996d847c],

Trojan.Injector.ED, C:\Documents and Settings\Protoman\Local Settings\temp\rad82474.tmp.exe, , [2efc40532a6044f21f86da34d92d01ff],

Trojan.Injector.ED, C:\Documents and Settings\Protoman\Local Settings\temp\rad97994.tmp.exe, , [dc4e1e753357fd393e670a04bb4bad53],

Trojan.Injector.ED, C:\Documents and Settings\Protoman\Local Settings\temp\radCA19C.tmp.exe, , [a7830a897e0c3df9693ce82681853dc3],

Trojan.Injector.ED, C:\Documents and Settings\Protoman\Local Settings\temp\radDA6CE.tmp.exe, , [a783ace7b3d76fc7eeb7ba5420e6bc44],

Trojan.Injector.ED, C:\Documents and Settings\Protoman\Local Settings\temp\radE3FCA.tmp.exe, , [c862890a38524aec7b2adb337c8a23dd],

Trojan.Injector.ED, C:\Documents and Settings\Protoman\Local Settings\temp\radE83ED.tmp.exe, , [8f9b860dc4c6a49200a58e80bf47f10f],

Trojan.Injector.ED, C:\Documents and Settings\Protoman\Local Settings\temp\radF3A1C.tmp.exe, , [2a00217237531e18ecb95bb352b4e21e],

PUP.Optional.iBryte, C:\Documents and Settings\Protoman\Local Settings\Application Data\ac1f74ea-c03a-4f9d-8b12-73511e125dd7\sysad.exe, , [a585d4bf0b7f0630ccc9034df11138c8],

Backdoor.Bot, C:\Documents and Settings\Protoman\Local Settings\Application Data\xgniwe\xgniwe.exe, , [3ceeccc790fa56e025593517e2219d63],

PUP.Optional.Booster.A, C:\WINDOWS\Tasks\SN.Booster-S-11624655.job, , [f238deb5bbcf41f5720ed52af80bab55],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed]\content\bg.js, , [5cce3e55e5a552e48cc391d5aa5b57a9],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed]\bootstrap.js, , [5cce3e55e5a552e48cc391d5aa5b57a9],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed]\chrome.manifest, , [5cce3e55e5a552e48cc391d5aa5b57a9],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed]\install.rdf, , [5cce3e55e5a552e48cc391d5aa5b57a9],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed]\content\bg.js, , [58d24f4467238ea859f65b0b768f7b85],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed]\bootstrap.js, , [58d24f4467238ea859f65b0b768f7b85],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed]\chrome.manifest, , [58d24f4467238ea859f65b0b768f7b85],

PUP.Optional.MultiPlug.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\[removed]\install.rdf, , [58d24f4467238ea859f65b0b768f7b85],

PUP.Optional.SNBooster.A, C:\Documents and Settings\All Users\Application Data\Excellent4App\SN.Booster\11624655.ini, , [0c1e1e7572180e28bb3fe1d134cf08f8],

PUP.Optional.SearchSun.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\prefs.js, Good: (), Bad: (user_pref("keyword.URL", "http://websearch.searchsun.info/?pid=34&r;=2014/05/24&hid;=5011814741841314998≶=EN&cc;=CA&unqvl;=52&l;=1&q;=");),,[0d1d2d667812f046466398c336d0926e]

PUP.Optional.SearchSun.A, C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\prefs.js, Good: (), Bad: (user_pref("browser.startup.homepage", "http://websearch.searchsun.info/?pid=34&r;=2014/05/24&hid;=5011814741841314998≶=EN&cc;=CA&unqvl;=52");),,[32f8f69db8d20a2c72ad68f522e4c63a]

Physical Sectors: 0

(No malicious items detected)

(end)

ken545

Post #4May 14, 2015, 11:29 AM UTC

All that garbage that Malwarebytes found needs to be Quarantined, you need to run the program again

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked <—————-

DanielDude

Post #5May 14, 2015, 9:41 PM UTC

Did all that, system still 100% CPU usage and slow as a snail

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 5/14/2015

Scan Time: 4:19:45 PM

Logfile:

Administrator: Yes

Version: 0.00.0.0000

Malware Database: v2015.05.14.05

Rootkit Database: v2015.04.21.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows XP Service Pack 3

CPU: x86

File System: NTFS

User: Protoman

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 417576

Time Elapsed: 2 hr, 35 min, 50 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

Still 100% cpu and slow, took me about 30 minutes just to get to this reply page to post this.

Everytime I open task manager is 100% CPU

ken545

Post #6May 14, 2015, 9:58 PM UTC

You may have to run these in Safemode if its hard to run in normal windows

[external image: 1QYkxTZ.jpg] Please download aswMBR to your desktop.

Right click the aswMBR icon and select Run as Administrator

XP users just Double Click it to run

If it says that this computer supports VIRTUALIZATION TECHNOLOGY do you want to use it say Yes

Click the Scan button to start scan.

Select Quickscan on the dropdown list

If you are asked to update the Avast Virus database please allow it to do so.

The scan could take 20 minutes or more , please be patient and let it finish

It will say Scan Finished when its done.

When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

I just want to see the report….Please Do Not Fix Anything

============================================================================

Please download Farbar Recovery Scan Tool and save it to your DESKTOP

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system

A simple way to check your system: Start –> Computer (right click) –> Properties

[external image: FRST_zps5d956a1a.jpg]

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

Please make sure All Users is checked

Just keep the defaults as in the picture checkmarked

Press Scan button.

It will produce a log called FRST.txt in the same directory the tool is run from.

Please copy and paste log back here.

The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

ken545

Post #7May 14, 2015, 9:59 PM UTC

Safemode with Network Support

To Enter Safemode

Go to Start> Shut off your Computer> Restart

As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,

this will bring up a menu.

Use the Up and Down Arrow Keys to scroll up to Safemode with Networking

Then press the Enter Key on your Keyboard

Tutorial if you need it How to boot into Safemode

DanielDude

Post #8May 14, 2015, 11:17 PM UTC

Run date: 2015-05-14 18:34:28

—————————–

18:34:28.828 OS Version: Windows 5.1.2600 Service Pack 3

18:34:28.828 Number of processors: 2 586 0x403

18:34:28.828 ComputerName: DANIEL UserName:

18:34:30.718 Initialize success

18:34:30.796 VM: initialized successfully

18:34:30.796 VM: Intel CPU virtualization not supported

18:40:12.125 AVAST engine error: 42003

18:41:11.921 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e

18:41:11.921 Disk 0 Vendor: WDC_WD1001FALS-00J7B0 05.00K05 Size: 953869MB BusType: 3

18:41:12.109 Disk 0 MBR read successfully

18:41:12.109 Disk 0 MBR scan

18:41:12.109 Disk 0 Windows XP default MBR code

18:41:12.109 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 953867 MB offset 63

18:41:12.140 Disk 0 default boot code

18:41:12.156 Disk 0 scanning sectors +1953520065

18:41:12.218 Disk 0 scanning C:\WINDOWS\system32\drivers

18:41:25.765 Service scanning

18:41:48.140 Modules scanning

18:41:48.156 Disk 0 trace - called modules:

18:41:48.187 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS

18:41:48.187 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a728ab8]

18:41:48.187 3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> \Device\0000006e[0x8a7a3030]

18:41:48.203 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-e[0x8a791d98]

18:41:48.203 Disk 0 statistics 65095/0/0 @ 3.09 MB/s

18:41:48.203 Scan finished successfully

18:45:52.140 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Protoman\Desktop\MBR.dat"

18:45:52.156 The log file has been saved successfully to "C:\Documents and Settings\Protoman\Desktop\aswMBR.txt"

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-05-2015 02

Ran by [removed] (administrator) on DANIEL on 14-05-2015 19:01:00

Running from C:\Documents and Settings\[removed]\Desktop

[removed]

Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English (United States)

Internet Explorer Version 8 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe

(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe

(Atheros) C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe

(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe

(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe

() C:\Program Files\CyberLink\Shared Files\RichVideo.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Microsoft Corporation) C:\WINDOWS\system32\cmd.exe

(Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe

(Microsoft Corporation) C:\WINDOWS\system32\cmd.exe

(Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe

(Microsoft Corporation) C:\WINDOWS\system32\cmd.exe

(Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe

(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe

(Microsoft Corporation) C:\WINDOWS\system32\cmd.exe

(Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)

HKLM\…\Run: [MSConfig] => C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE [169984 2008-04-13] (Microsoft Corporation)

HKLM\…\Run: [FlashPlayerUpdate] => C:\Documents and Settings\Protoman\Local Settings\Application Data\Macromedia\Flash Player\FlashPlayerUpdateService.exe [114688 2015-05-13] (Microsoft Corporation)

HKLM\…\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [421888 2013-05-01] (Apple Inc.)

HKLM\…\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)

Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll [2005-10-28] (ATI Technologies Inc.)

Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]

HKLM\…\Policies\Explorer: [NoCDBurning] 0

HKLM\…\Policies\Explorer: [TaskbarNoNotification] 1

HKLM\…\Policies\Explorer: [HideSCAHealth] 1

HKU\S-1-5-21-839522115-562591055-2147167427-1004\…\RunOnce: [Shockwave Updater] => C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1103471.exe [460216 2008-12-06] (Adobe Systems, Inc.)

ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll [2014-04-25] (Google)

ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll [2014-04-25] (Google)

ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll [2014-04-25] (Google)

ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll [2014-04-25] (Google)

ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll [2014-04-25] (Google)

BootExecute: autocheck autochk * lsdeletesdnclean.exe

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-839522115-562591055-2147167427-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=msnhome

HKU\S-1-5-21-839522115-562591055-2147167427-1004\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

HKU\S-1-5-21-839522115-562591055-2147167427-1004\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-839522115-562591055-2147167427-1004 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL =

BHO: Skype add-on (mastermind) -> {22BF413B-C6D2-4d91-82A9-A0F997BA588C} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04] (Skype Technologies S.A.)

BHO: DriveLetterAccess -> {5CA3D70E-1895-11CF-8E15-001234567890} -> C:\WINDOWS\system32\dla\tfswshx.dll [2004-08-13] (Sonic Solutions)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-04-14] (Oracle Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2014-03-27] (Google Inc.)

BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll [2013-10-05] (Google Inc.)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-04-14] (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2014-03-27] (Google Inc.)

Toolbar: HKU\S-1-5-21-839522115-562591055-2147167427-1004 -> No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

Toolbar: HKU\S-1-5-21-839522115-562591055-2147167427-1004 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2014-03-27] (Google Inc.)

Toolbar: HKU\S-1-5-21-839522115-562591055-2147167427-1004 -> No Name - {4D594333-0076-A76A-76A7-7A786E7484D7} - No File

DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} http://www.logitech.com/devicedetector/bin/LogitechDeviceDetection32.cab

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} http://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab

DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab

DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} http://upload.facebook.com/controls/FacebookPhotoUploader3.cab

DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/FacebookPhotoUploader.cab

DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://go.divx.com/plugin/DivXBrowserPlugin.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} http://cafeimg.hanmail.net/cab9_1/dmcc2.cab?Version=1,0,0,10

DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.dll [2005-10-12] (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll [2014-03-06] (Microsoft Corporation)

Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll [2014-03-06] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:

========

FF ProfilePath: C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default

FF DefaultSearchEngine,S: WebSearch

FF DefaultSearchUrl: hxxp://websearch.searchsun.info/?pid=34&r;=2014/05/24&hid;=5011814741841314998≶=EN&cc;=CA&unqvl;=52&l;=1&q;=

FF SearchEngineOrder.1: WebSearch

FF SearchEngineOrder.1,S: WebSearch

FF SelectedSearchEngine: WebSearch

FF SelectedSearchEngine,S: WebSearch

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll [2012-05-10] ()

FF Plugin: @adobe.com/ShockwavePlayer -> C:\WINDOWS\system32\Adobe\Director\np32dsw.dll [2008-12-05] (Adobe Systems, Inc.)

FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll [2007-07-26] (DivX,Inc.)

FF Plugin: @divx.com/DivX Content Upload Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Content Uploader\npUpload.dll [2007-07-26] (DivX,Inc.)

FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-04-14] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-04-14] (Oracle Corporation)

FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.1 -> C:\Program Files\Yahoo!\Shared\npYState.dll [2009-05-26] (Yahoo! Inc.)

FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [2009-05-26] (Yahoo! Inc.)

FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)

FF Plugin: @qq.com/npchrome -> C:\Program Files\Common Files\Tencent\Npchrome\npchrome.dll No File

FF Plugin: @qq.com/npqscall -> C:\Program Files\Common Files\Tencent\NPQSCALL\npqscall.dll No File

FF Plugin: @real.com/nppl3260;version=6.0.11.2303 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2006-02-01] (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=1.0.2.2361 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll [2006-02-01] (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=6.0.12.1465 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll [2006-02-01] (RealNetworks, Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll [2014-05-08] (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll [2014-05-08] (Google Inc.)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-09-03] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-839522115-562591055-2147167427-1004: @facebook.com/FBPlugin,version=1.0.3 -> C:\Documents and Settings\Protoman\Application Data\Facebook\npfbplugin_1_0_3.dll [2010-03-06] ( )

FF Plugin HKU\S-1-5-21-839522115-562591055-2147167427-1004: @talk.google.com/GoogleTalkPlugin -> C:\Documents and Settings\Protoman\Application Data\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)

FF Plugin HKU\S-1-5-21-839522115-562591055-2147167427-1004: @talk.google.com/O1DPlugin -> C:\Documents and Settings\Protoman\Application Data\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)

FF Plugin HKU\S-1-5-21-839522115-562591055-2147167427-1004: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)

FF Plugin HKU\S-1-5-21-839522115-562591055-2147167427-1004: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)

FF Plugin HKU\S-1-5-21-839522115-562591055-2147167427-1004: @unity3d.com/UnityPlayer,version=1.0 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll [2013-07-20] (Unity Technologies ApS)

FF user.js: detected! => C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\user.js [2012-08-25]

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32dsw.dll [2008-12-05] (Adobe Systems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdivx32.dll [2007-07-26] (DivX,Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npnul32.dll [2014-11-19] (mozilla.org)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2013-09-03] (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2013-06-18] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2013-06-18] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2013-06-18] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2013-06-18] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2013-06-18] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Documents and Settings\Protoman\Application Data\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)

FF Plugin ProgramFiles/Appdata: C:\Documents and Settings\Protoman\Application Data\mozilla\plugins\npo1d.dll [2015-04-17] (Google)

FF SearchPlugin: C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\searchplugins\aim-search.xml [2010-01-12]

FF SearchPlugin: C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\searchplugins\ask-search.xml [2013-06-06]

FF Extension: Microsoft .NET Framework Assistant - C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011-08-25]

FF Extension: Yahoo! Toolbar - C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-03-27]

FF Extension: AOL Messaging Toolbar - C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\Extensions\{c2f863cd-0429-48c7-bb54-db756a951760} [2015-03-27]

FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-04-22]

FF HKLM\…\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-07-25]

FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions

FF HKU\S-1-5-21-839522115-562591055-2147167427-1004\…\Firefox\Extensions: [{8363DA2C-C976-11E1-8270-B8AC6F996F26}] - C:\Documents and Settings\Protoman\Local Settings\Application Data\{8363DA2C-C976-11E1-8270-B8AC6F996F26}

FF Extension: Mozilla Safe Browsing - C:\Documents and Settings\Protoman\Local Settings\Application Data\{8363DA2C-C976-11E1-8270-B8AC6F996F26} [2012-07-08]

FF HKU\S-1-5-21-839522115-562591055-2147167427-1004\…\Firefox\Extensions: [[removed]] - C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions

Chrome:

=======

CHR HomePage: Default -> hxxp://www.google.com/

CHR StartupUrls: Default -> "hxxp://websearch.searchsun.info/?pid=34&r;=2014/05/24&hid;=5011814741841314998≶=EN&cc;=CA&unqvl;=52"

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\Application\42.0.2311.152\ppGoogleNaClPluginChrome.dll No File

CHR Plugin: (Chrome PDF Viewer) - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\Application\42.0.2311.152\pdf.dll No File

CHR Plugin: (Shockwave Flash) - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\Application\42.0.2311.152\gcswf32.dll No File

CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Google Talk Plugin) - C:\Documents and Settings\Protoman\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)

CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Documents and Settings\Protoman\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Java Deployment Toolkit 6.0.290.11) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File

CHR Plugin: (Java(TM) Platform SE 6 U29) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File

CHR Plugin: (Shockwave for Director) - C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll (Adobe Systems, Inc.)

CHR Plugin: (DivXÂ® Web Player) - C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll (DivX,Inc.)

CHR Plugin: (downloadUpdater) - C:\Program Files\Mozilla Firefox\plugins\npdnu.dll No File

CHR Plugin: (downloadUpdater2) - C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll No File

CHR Plugin: (QuickTime Plug-in 7.5.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.5.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File

CHR Plugin: (QuickTime Plug-in 7.5.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File

CHR Plugin: (MicrosoftÂ® DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)

CHR Plugin: (MicrosoftÂ® DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)

CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))

CHR Plugin: (Facebook Plugin) - C:\Documents and Settings\Protoman\Application Data\Facebook\npfbplugin_1_0_3.dll ( )

CHR Plugin: (Google Update) - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Plugin: (DivXÂ® Content Upload Plugin) - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)

CHR Plugin: (RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

CHR Plugin: (Windows Presentation Foundation) - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Profile: C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\User Data\Default

CHR Extension: (YouTube) - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-12]

CHR Extension: (Google Search) - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-12]

CHR Extension: (NC Downloader) - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fhoofdceoggleefoalmfbfdmboaalhpo [2012-12-04]

CHR Extension: (Bookmark Manager) - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-05-13]

CHR Extension: (Chrome Hotword Shared Module) - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-11]

CHR Extension: (Google Wallet) - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Gmail) - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-12]

StartMenuInternet: Google Chrome - C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 6to4; C:\WINDOWS\System32\6to4svc.dll [100864 2010-02-12] (Microsoft Corporation)

S4 aawservice; C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [587096 2008-01-04] (Lavasoft)

R2 ACS; C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe [467028 2007-12-13] (Atheros) [File not signed]

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2011-09-28] (Adobe Systems) [File not signed]

S2 ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [520192 2005-10-28] () [File not signed]

S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]

R2 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182696 2014-04-14] (Oracle Corporation)

S3 jswpsapi; C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\jswpsapi.exe [356434 2008-04-16] (Atheros Communications, Inc.) [File not signed]

S3 p2pgasvc; C:\WINDOWS\system32\p2pgasvc.dll [105472 2008-04-13] (Microsoft Corporation)

R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [247152 2009-04-17] ()

R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

S2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

S4 SpyroService; C:\Program Files\FS\Spyro Portal\FlashPortal.exe [48128 2011-09-09] (FS) [File not signed]

S2 916e5338; "C:\WINDOWS\system32\rundll32.exe" "c:\progra~1\SNSvc.dll",service

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\WINDOWS\System32\drivers\Afc.sys [11776 2005-02-22] (Arcsoft, Inc.) [File not signed]

R3 AR5416; C:\WINDOWS\System32\DRIVERS\athw.sys [1331136 2008-01-17] (Atheros Communications, Inc.)

S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)

S3 CoachUsb; C:\WINDOWS\System32\DRIVERS\CoachUsb.sys [46944 2004-01-22] (FotoNation Ltd.)

S3 CoachVc; C:\WINDOWS\System32\DRIVERS\CoachVc.sys [44256 2003-11-03] (Accapella Ltd.)

R0 drvmcdb; C:\WINDOWS\System32\drivers\drvmcdb.sys [87136 2004-08-04] (Sonic Solutions) [File not signed]

R2 drvnddm; C:\WINDOWS\System32\drivers\drvnddm.sys [40544 2004-08-13] (Sonic Solutions) [File not signed]

R3 HdAudAddService; C:\WINDOWS\System32\drivers\HdAudio.sys [113664 2004-03-17] (Windows (R) Server 2003 DDK provider)

R3 JSWSCIMD; C:\WINDOWS\System32\DRIVERS\jswscimd.sys [57344 2007-08-28] (Atheros Communications, Inc.)

R3 LgBttPort; C:\WINDOWS\System32\DRIVERS\lgbtport.sys [12160 2009-09-29] (LG Electronics Inc.)

R3 lgbusenum; C:\WINDOWS\System32\DRIVERS\lgbtbus.sys [10496 2009-09-29] (LG Electronics Inc.)

R3 LGVMODEM; C:\WINDOWS\System32\DRIVERS\lgvmodem.sys [12928 2009-09-29] (LG Electronics Inc.)

R3 ManyCam; C:\WINDOWS\System32\DRIVERS\mcvidrv.sys [34432 2012-10-10] (ManyCam LLC)

R3 mcaudrv_simple; C:\WINDOWS\System32\drivers\mcaudrv.sys [25088 2012-10-10] (ManyCam LLC)

S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)

R3 pfc; C:\WINDOWS\System32\drivers\pfc.sys [10368 2003-12-05] (Padus, Inc.) [File not signed]

S3 PhilCam8116; C:\WINDOWS\System32\DRIVERS\CamDrO21.sys [314752 2001-08-17] (Microsoft Corporation)

R0 PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [20576 2004-08-02] (Sonic Solutions) [File not signed]

S3 RT25USBAP; C:\WINDOWS\System32\DRIVERS\rt25usbap.sys [162816 2005-10-24] (Ralink Technology Inc.) [File not signed]

R3 scrcap; C:\WINDOWS\System32\DRIVERS\scrcap.sys [9006 2006-12-27] (ZD Soft) [File not signed]

R3 SMBios; C:\WINDOWS\System32\DRIVERS\SMBios.sys [36484 2004-06-06] (Intel Corporation) [File not signed]

S3 SNPSTD3; C:\WINDOWS\System32\DRIVERS\snpstd3.sys [10252544 2007-03-27] (Sonix Co. Ltd.)

R1 sscdbhk5; C:\WINDOWS\System32\drivers\sscdbhk5.sys [5627 2004-07-14] (Sonic Solutions) [File not signed]

R1 ssrtln; C:\WINDOWS\System32\drivers\ssrtln.sys [23545 2004-07-14] (Sonic Solutions) [File not signed]

R1 Tcpip6; C:\WINDOWS\System32\DRIVERS\tcpip6.sys [226880 2010-02-11] (Microsoft Corporation)

R2 tfsnboio; C:\WINDOWS\System32\dla\tfsnboio.sys [25723 2004-08-13] (Sonic Solutions) [File not signed]

R2 tfsncofs; C:\WINDOWS\System32\dla\tfsncofs.sys [34843 2004-08-13] (Sonic Solutions) [File not signed]

R2 tfsndrct; C:\WINDOWS\System32\dla\tfsndrct.sys [4123 2004-08-13] (Sonic Solutions) [File not signed]

R2 tfsndres; C:\WINDOWS\System32\dla\tfsndres.sys [2239 2004-08-13] (Sonic Solutions) [File not signed]

R2 tfsnifs; C:\WINDOWS\System32\dla\tfsnifs.sys [86202 2004-08-13] (Sonic Solutions) [File not signed]

R2 tfsnopio; C:\WINDOWS\System32\dla\tfsnopio.sys [14715 2004-08-13] (Sonic Solutions) [File not signed]

R2 tfsnpool; C:\WINDOWS\System32\dla\tfsnpool.sys [6363 2004-08-13] (Sonic Solutions) [File not signed]

R2 tfsnudf; C:\WINDOWS\System32\dla\tfsnudf.sys [98714 2004-08-13] (Sonic Solutions) [File not signed]

R2 tfsnudfa; C:\WINDOWS\System32\dla\tfsnudfa.sys [100603 2004-08-13] (Sonic Solutions) [File not signed]

R3 WSIMD; C:\WINDOWS\System32\DRIVERS\wsimd.sys [57408 2007-12-13] (Atheros Communications, Inc.) [File not signed]

S1 ASPI32; No ImagePath

U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)

U3 TlntSvr; No ImagePath

U3 aswMBR; \??\C:\DOCUME~1\Protoman\LOCALS~1\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\DOCUME~1\Protoman\LOCALS~1\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-14 19:01 - 2015-05-14 19:03 - 00029428 _____ () C:\Documents and Settings\Protoman\Desktop\FRST.txt

2015-05-14 19:00 - 2015-05-14 19:01 - 00000000 ____D () C:\FRST

2015-05-14 18:49 - 2015-05-14 18:52 - 01145856 _____ (Farbar) C:\Documents and Settings\Protoman\Desktop\FRST.exe

2015-05-14 18:45 - 2015-05-14 18:45 - 00001844 _____ () C:\Documents and Settings\Protoman\Desktop\aswMBR.txt

2015-05-14 18:45 - 2015-05-14 18:45 - 00000512 _____ () C:\Documents and Settings\Protoman\Desktop\MBR.dat

2015-05-14 18:17 - 2015-05-14 18:26 - 05198336 _____ (AVAST Software) C:\Documents and Settings\Protoman\Desktop\aswMBR.exe

2015-05-14 00:22 - 2015-05-14 00:42 - 00020048 _____ () C:\Documents and Settings\Protoman\Desktop\post.txt

2015-05-13 22:46 - 2015-05-13 22:46 - 00000777 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

2015-05-13 22:31 - 2015-05-13 22:31 - 00009140 _____ () C:\Documents and Settings\Protoman\Desktop\AdwCleaner[S4].txt

2015-05-13 20:11 - 2015-05-13 20:11 - 00000000 ____D () C:\RegBackup

2015-05-13 19:12 - 2015-05-14 09:48 - 00049282 _____ (Apple Inc.) C:\Documents and Settings\Protoman\Application Data\LJ0HQ4jZkqah9l1-V7TLO5ox9rbPwEM-gfbXZ3ANJpWCwGQ-dwJ43CuXHqcmEbi.exe

2015-05-13 18:49 - 2015-05-13 18:49 - 00000335 _____ () C:\Documents and Settings\Protoman\Application Data\8178audayu1bjiao

2015-05-13 18:34 - 2015-05-13 22:23 - 00000000 ____D () C:\AdwCleaner

2015-05-13 16:42 - 2015-05-13 16:42 - 00049284 _____ (Apple Inc.) C:\Documents and Settings\Protoman\Application Data\5xsKoHcXkdIeQR8-QTC0OYZAbf1cXqG-SI504jKzGAbJRhy-X8gWkRs5dDqTpHN.exe

2015-05-13 14:32 - 2015-05-13 14:32 - 00043520 _____ () C:\Documents and Settings\Protoman\Application Data\mimetype

2015-05-13 08:37 - 2015-05-14 16:54 - 00000386 _____ () C:\WINDOWS\Tasks\{A2944C8B-360D-FF6A-8DBE-13FC19E5146B}.job

2015-05-13 08:37 - 2015-05-13 08:37 - 00000000 ___HD () C:\Documents and Settings\Protoman\Application Data\xILFsyyS

2015-05-13 06:36 - 2015-05-13 14:31 - 00008620 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.HTML

2015-05-13 06:36 - 2015-05-13 14:31 - 00004250 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.TXT

2015-05-13 06:36 - 2015-05-13 14:31 - 00000292 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.URL

2015-05-13 06:07 - 2015-05-13 06:07 - 00008620 _____ () C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.HTML

2015-05-13 06:07 - 2015-05-13 06:07 - 00008620 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.HTML

2015-05-13 06:07 - 2015-05-13 06:07 - 00008620 _____ () C:\Documents and Settings\LocalService\HELP_DECRYPT.HTML

2015-05-13 06:07 - 2015-05-13 06:07 - 00004250 _____ () C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.TXT

2015-05-13 06:07 - 2015-05-13 06:07 - 00004250 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.TXT

2015-05-13 06:07 - 2015-05-13 06:07 - 00004250 _____ () C:\Documents and Settings\LocalService\HELP_DECRYPT.TXT

2015-05-13 06:07 - 2015-05-13 06:07 - 00000292 _____ () C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.URL

2015-05-13 06:07 - 2015-05-13 06:07 - 00000292 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.URL

2015-05-13 06:07 - 2015-05-13 06:07 - 00000292 _____ () C:\Documents and Settings\LocalService\HELP_DECRYPT.URL

2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.HTML

2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.HTML

2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\HELP_DECRYPT.HTML

2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.HTML

2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.HTML

2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.HTML

2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.TXT

2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.TXT

2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\HELP_DECRYPT.TXT

2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.TXT

2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.TXT

2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.TXT

2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.URL

2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.URL

2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\HELP_DECRYPT.URL

2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.URL

2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.URL

2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.URL

2015-05-13 05:59 - 2015-05-14 00:16 - 00000000 ____D () C:\Documents and Settings\Protoman\Local Settings\Application Data\xgniwe

2015-05-13 05:58 - 2015-05-13 05:58 - 00000000 ___HD () C:\5281a4a3

2015-05-13 02:54 - 2015-05-13 14:14 - 00065536 _____ () C:\WINDOWS\system32\config\Spybot -.evt

2015-05-13 02:23 - 2015-05-13 02:23 - 00001842 _____ () C:\Documents and Settings\All Users\Start Menu\Programs\Spybot-S&D; Start Center.lnk

2015-05-13 02:17 - 2015-05-13 02:51 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy 2

2015-05-13 02:17 - 2013-09-20 10:49 - 00018968 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean.exe

2015-05-12 19:48 - 2015-05-12 19:48 - 00000000 ____D () C:\Documents and Settings\Protoman\Local Settings\Application Data\Macromedia

2015-04-22 08:25 - 2015-04-22 08:25 - 09189321 _____ () C:\Documents and Settings\Protoman\Desktop\SKRILLEX - Slats slats slats.mp4

2015-04-22 05:47 - 2015-04-22 05:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2015-04-18 17:58 - 2015-04-18 18:30 - 621004800 _____ () C:\Documents and Settings\Protoman\My Documents\RIDfixit.mpg

2015-04-17 01:59 - 2015-04-17 01:59 - 00000000 ____D () C:\Program Files\7-Zip

2015-04-17 01:59 - 2015-04-17 01:59 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-14 19:03 - 2012-08-25 22:39 - 00000000 ____D () C:\Documents and Settings\Protoman\Local Settings\temp

2015-05-14 18:46 - 2015-02-04 11:36 - 00000990 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-562591055-2147167427-1004UA.job

2015-05-14 18:38 - 2011-04-22 21:54 - 00000664 _____ () C:\WINDOWS\system32\d3d9caps.dat

2015-05-14 16:58 - 2015-01-15 00:53 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys

2015-05-14 16:55 - 2004-08-04 08:00 - 00012674 _____ () C:\WINDOWS\system32\wpa.dbl

2015-05-14 16:54 - 2015-04-10 01:59 - 00000228 _____ () C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job

2015-05-14 16:54 - 2013-01-04 19:49 - 00000310 _____ () C:\WINDOWS\Tasks\Ejejetpfni.job

2015-05-14 16:54 - 2005-11-12 02:18 - 00000159 _____ () C:\WINDOWS\wiadebug.log

2015-05-14 16:54 - 2005-11-12 02:18 - 00000049 _____ () C:\WINDOWS\wiaservc.log

2015-05-14 16:54 - 2005-11-11 18:21 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-05-14 16:53 - 2009-09-10 02:53 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB968816_WM9$

2015-05-14 16:52 - 2013-09-12 19:41 - 00524288 _____ () C:\WINDOWS\system32\config\acs.evt

2015-05-14 16:52 - 2005-11-11 18:23 - 00000178 ___SH () C:\Documents and Settings\Protoman\ntuser.ini

2015-05-14 16:52 - 2005-11-11 18:21 - 00032522 _____ () C:\WINDOWS\SchedLgU.Txt

2015-05-14 16:52 - 2005-11-11 18:17 - 01444004 _____ () C:\WINDOWS\WindowsUpdate.log

2015-05-14 10:25 - 2010-10-14 18:29 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2279986$

2015-05-14 10:25 - 2008-08-13 00:40 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB952287$

2015-05-14 09:14 - 2011-02-13 20:55 - 00000000 ____D () C:\Documents and Settings\Protoman\Local Settings\Application Data\Temp

2015-05-14 07:50 - 2008-06-14 12:13 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\Skype

2015-05-14 00:43 - 2013-12-27 01:44 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Post these

2015-05-14 00:16 - 2015-02-05 05:10 - 00000000 ____D () C:\Documents and Settings\Protoman\Local Settings\Application Data\ac1f74ea-c03a-4f9d-8b12-73511e125dd7

2015-05-14 00:16 - 2011-08-05 00:25 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\YouTube Downloader

2015-05-13 23:46 - 2015-02-04 11:36 - 00000938 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-562591055-2147167427-1004Core.job

2015-05-13 22:47 - 2015-01-15 00:52 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2015-05-13 22:44 - 2015-01-15 00:52 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware

2015-05-13 17:46 - 2005-12-01 03:55 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Episodes

2015-05-13 14:32 - 2010-08-25 20:10 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\blog

2015-05-13 07:59 - 2011-02-25 23:43 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Ebay

2015-05-13 07:58 - 2007-07-19 02:07 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\DS Roms

2015-05-13 07:41 - 2007-05-30 14:51 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Cyber Formula

2015-05-13 07:39 - 2011-09-20 22:52 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\cops

2015-05-13 07:07 - 2012-01-10 23:05 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Collection

2015-05-13 07:06 - 2011-08-22 19:38 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\camera move

2015-05-13 06:54 - 2013-01-25 01:17 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\BTS

2015-05-13 06:51 - 2011-05-05 00:42 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\bomber

2015-05-13 06:49 - 2011-02-26 00:54 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Beast Wars

2015-05-13 06:48 - 2011-01-28 00:32 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\backups

2015-05-13 06:46 - 2009-01-20 01:33 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Atari

2015-05-13 06:36 - 2012-11-02 23:20 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\Ustream Producer

2015-05-13 06:36 - 2012-08-26 22:36 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\Tencent

2015-05-13 06:35 - 2008-02-05 20:44 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\Sony

2015-05-13 06:35 - 2005-11-19 01:00 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\Sun

2015-05-13 06:34 - 2008-11-14 01:09 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\Runaware

2015-05-13 06:34 - 2007-04-09 23:24 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\Mozilla

2015-05-13 06:34 - 2006-02-01 15:35 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\Real

2015-05-13 06:32 - 2006-04-27 01:25 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\MetaCafe

2015-05-13 06:32 - 2005-11-12 03:01 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\Macromedia

2015-05-13 06:31 - 2010-05-06 23:24 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\Facebook

2015-05-13 06:31 - 2005-11-13 05:37 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\CyberLink

2015-05-13 06:15 - 2011-09-27 23:32 - 00000000 ____D () C:\Documents and Settings\Protoman\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant

2015-05-13 06:15 - 2005-11-19 01:01 - 00000000 ___HD () C:\Documents and Settings\Protoman\Application Data\Azureus

2015-05-13 06:14 - 2009-09-28 00:49 - 00000000 ___HD () C:\Documents and Settings\Protoman\Application Data\Ahead

2015-05-13 06:14 - 2008-12-20 18:34 - 00000000 ___HD () C:\Documents and Settings\Protoman\.SunDownloadManager

2015-05-13 06:14 - 2008-03-27 05:17 - 00000000 ___HD () C:\Documents and Settings\Protoman\Application Data\acccore

2015-05-13 06:14 - 2005-11-14 18:38 - 00000000 ___HD () C:\Documents and Settings\Protoman\Application Data\Adobe

2015-05-13 06:06 - 2005-12-13 23:58 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2015-05-13 06:04 - 2008-06-14 12:13 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Skype

2015-05-13 06:03 - 2006-04-27 01:25 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Metacafe

2015-05-13 06:00 - 2014-05-25 22:26 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\GridinSoft

2015-05-13 06:00 - 2014-05-24 14:23 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\InstallMate

2015-05-13 06:00 - 2008-02-23 01:29 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Lavasoft

2015-05-13 06:00 - 2005-12-21 15:51 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\CyberLink

2015-05-13 05:59 - 2009-10-15 20:17 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Azureus

2015-05-13 05:59 - 2008-03-27 05:13 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AOL OCP

2015-05-13 05:59 - 2006-04-11 18:28 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Adobe

2015-05-13 03:25 - 2005-11-12 02:14 - 00000315 __RSH () C:\boot.ini

2015-05-13 02:54 - 2014-06-01 01:05 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2

2015-05-13 01:13 - 2004-08-04 08:00 - 00000542 _____ () C:\WINDOWS\win.ini

2015-05-13 01:13 - 2004-08-04 08:00 - 00000243 _____ () C:\WINDOWS\system.ini

2015-05-13 01:04 - 2012-08-25 22:39 - 00000000 ____D () C:\Documents and Settings\LocalService\Local Settings\temp

2015-05-13 00:46 - 2012-10-10 03:00 - 00268477 _____ () C:\WINDOWS\setupapi.log

2015-05-12 22:02 - 2006-10-13 00:36 - 00006577 _____ () C:\Documents and Settings\Protoman\Desktop\Hot Rod Missing.txt

2015-05-12 19:49 - 2015-01-25 11:54 - 00000000 ___HD () C:\Documents and Settings\All Users\Application Data\{58C525CE-3049-415C-8553-F8D254D6744F}

2015-05-12 16:26 - 2006-09-30 02:19 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Manga

2015-05-12 03:04 - 2005-11-12 02:22 - 00000000 ____D () C:\Documents and Settings\Protoman\My Documents\E Drive

2015-05-12 02:39 - 2006-09-09 02:38 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Sandy fun

2015-05-10 19:48 - 2012-07-18 22:13 - 00000000 ___HD () C:\Documents and Settings\Protoman\Application Data\Applian FLV and Media Player

2015-05-10 17:54 - 2005-11-12 04:14 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Winstuff

2015-05-08 16:23 - 2006-03-28 01:30 - 00000000 ____D () C:\Documents and Settings\Protoman\My Documents\My Photo Book

2015-05-08 15:00 - 2015-04-10 01:59 - 00000222 _____ () C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job

2015-05-07 23:14 - 2008-12-20 15:41 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Projects

2015-05-07 15:20 - 2014-07-28 02:27 - 00000000 ____D () C:\Games

2015-05-05 17:38 - 2005-11-20 00:54 - 00240640 _____ () C:\Documents and Settings\Protoman\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-05-05 00:38 - 2011-01-10 23:37 - 00066627 _____ () C:\Documents and Settings\Protoman\Desktop\G1 Missing.txt

2015-04-30 02:48 - 2012-09-09 23:44 - 00000000 ____D () C:\Program Files\Replay Video Capture 6

2015-04-27 01:15 - 2009-07-09 18:21 - 00000000 ____D () C:\Documents and Settings\Protoman\Desktop\Page

2015-04-22 07:17 - 2015-03-26 16:50 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2015-04-19 01:34 - 2015-04-12 23:08 - 17102848 _____ () C:\Documents and Settings\Protoman\My Documents\ProtoRetroEnding.mpg

2015-04-18 17:56 - 2015-02-24 18:02 - 00231638 _____ () C:\Documents and Settings\Protoman\My Documents\mario02.pds

2015-04-17 13:05 - 2005-11-11 18:15 - 00299044 _____ () C:\WINDOWS\wmsetup.log

2015-04-17 02:00 - 2005-11-12 02:20 - 00000000 ____D () C:\Documents and Settings\Protoman\My Documents\D Drive

2015-04-14 09:37 - 2015-01-15 00:52 - 00120024 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-04-14 09:37 - 2010-08-19 19:20 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

==================== Files in the root of some directories =======

2008-02-16 05:35 - 2008-02-16 05:35 - 2293848 _____ () C:\Program Files\FLV PlayerFCSetup.exe

2008-01-23 01:47 - 1997-11-09 11:24 - 0002794 _____ () C:\Program Files\Palette.pal

2005-11-12 10:12 - 2004-03-11 14:27 - 0040960 _____ () C:\Program Files\Uninstall_CDS.exe

2015-05-12 13:34 - 2015-05-12 13:34 - 0043808 _____ () C:\Documents and Settings\Protoman\Application Data\12 - Here's The Thing.mp3

2009-07-09 23:18 - 2009-07-09 23:22 - 0002119 ____H () C:\Documents and Settings\Protoman\Application Data\5eT7WQpJat.gif

2009-07-09 23:18 - 2009-07-09 23:22 - 0000598 ____H () C:\Documents and Settings\Protoman\Application Data\5eT7WQpJby.gif

2009-07-09 23:18 - 2009-07-09 23:22 - 0000607 ____H () C:\Documents and Settings\Protoman\Application Data\5eT7WQpJzn.gif

2015-05-13 16:42 - 2015-05-13 16:42 - 0049284 _____ (Apple Inc.) C:\Documents and Settings\Protoman\Application Data\5xsKoHcXkdIeQR8-QTC0OYZAbf1cXqG-SI504jKzGAbJRhy-X8gWkRs5dDqTpHN.exe

2015-05-13 18:49 - 2015-05-13 18:49 - 0000335 _____ () C:\Documents and Settings\Protoman\Application Data\8178audayu1bjiao

2015-05-13 06:36 - 2015-05-13 14:31 - 0008620 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.HTML

2015-05-13 06:36 - 2015-05-13 14:31 - 0045287 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.PNG

2015-05-13 06:36 - 2015-05-13 14:31 - 0004250 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.TXT

2015-05-13 06:36 - 2015-05-13 14:31 - 0000292 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.URL

2015-05-13 19:12 - 2015-05-14 09:48 - 0049282 _____ (Apple Inc.) C:\Documents and Settings\Protoman\Application Data\LJ0HQ4jZkqah9l1-V7TLO5ox9rbPwEM-gfbXZ3ANJpWCwGQ-dwJ43CuXHqcmEbi.exe

2015-05-13 14:32 - 2015-05-13 14:32 - 0043520 _____ () C:\Documents and Settings\Protoman\Application Data\mimetype

2012-11-02 23:20 - 2012-12-25 15:59 - 0000159 ____H () C:\Documents and Settings\Protoman\Application Data\net.telestream.producer.xml

2015-05-13 18:49 - 2015-05-13 18:49 - 0043520 _____ () C:\Documents and Settings\Protoman\Application Data\Reboot with Joe Recipe Book - Cross, Joe.jpg

2014-05-24 14:24 - 2014-05-24 14:40 - 0000368 _____ () C:\Documents and Settings\Protoman\Application Data\regsvr32.exe_log.txt

2015-01-25 05:43 - 2015-01-25 05:43 - 0001324 _____ () C:\Documents and Settings\Protoman\Local Settings\Application Data\d3d9caps.tmp

2005-11-20 00:54 - 2015-05-05 17:38 - 0240640 _____ () C:\Documents and Settings\Protoman\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-05-13 06:06 - 2015-05-13 06:06 - 0008620 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.HTML

2015-05-13 06:06 - 2015-05-13 06:06 - 0045219 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.PNG

2015-05-13 06:06 - 2015-05-13 06:06 - 0004250 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.TXT

2015-05-13 06:06 - 2015-05-13 06:06 - 0000292 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.URL

ZeroAccess:

C:\Windows\Installer\{8fbe83f6-cd2a-ea73-912c-8fd940d1935a}

Files to move or delete:

====================

C:\Windows\Tasks\{A2944C8B-360D-FF6A-8DBE-13FC19E5146B}.job

Some content of TEMP:

====================

C:\Documents and Settings\Protoman\Local Settings\temp\BlackBerryDeviceManager.exe

C:\Documents and Settings\Protoman\Local Settings\temp\defsrag.exe

C:\Documents and Settings\Protoman\Local Settings\temp\diskswtool.exe

C:\Documents and Settings\Protoman\Local Settings\temp\Quarantine.exe

C:\Documents and Settings\Protoman\Local Settings\temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 14-05-2015 02

Ran by [removed] at 2015-05-14 19:11:56

Running from C:\Documents and Settings\[removed]\Desktop

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-839522115-562591055-2147167427-500 - Administrator - Enabled)

ASPNET (S-1-5-21-839522115-562591055-2147167427-1005 - Limited - Enabled)

Guest (S-1-5-21-839522115-562591055-2147167427-501 - Limited - Disabled)

HelpAssistant (S-1-5-21-839522115-562591055-2147167427-1000 - Limited - Disabled)

Protoman (S-1-5-21-839522115-562591055-2147167427-1004 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Protoman

SUPPORT_388945a0 (S-1-5-21-839522115-562591055-2147167427-1002 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM\…\uTorrent) (Version: 3.3.0.29625 - BitTorrent Inc.)

µTorrent (HKU\S-1-5-21-839522115-562591055-2147167427-1004\…\uTorrent) (Version: 3.4.2.35702 - BitTorrent Inc.)

3GP Video Converter 3 (HKLM\…\3GP Video Converter 3) (Version: 3.1.5.0430b - Xilisoft)

7-Zip 9.20 (HKLM\…\7-Zip) (Version: - )

Activision Anthology Remix Edition (HKLM\…\{C04092C7-B2E0-452A-8EA4-22DA47905724}) (Version: - )

Ad-Aware 2007 (HKLM\…\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}) (Version: 7.0.2.6 - Lavasoft)

Adobe AIR (HKLM\…\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)

Adobe Download Assistant (HKLM\…\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.0.4 - Adobe Systems Incorporated)

Adobe Flash Player 11 ActiveX (HKLM\…\Adobe Flash Player ActiveX) (Version: 11.4.402.265 - Adobe Systems Incorporated)

Adobe Flash Player 11 Plugin (HKLM\…\Adobe Flash Player Plugin) (Version: 11.2.202.235 - Adobe Systems Incorporated)

Adobe Photoshop CS2 (HKLM\…\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)

Adobe Reader X (10.1.8) (HKLM\…\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.8 - Adobe Systems Incorporated)

Adobe Shockwave Player 11 (HKLM\…\Adobe Shockwave Player) (Version: 11 - Adobe Systems, Inc.)

AIM 7 (HKLM\…\AIM_7) (Version: - )

AltoMP3 Gold 5.20 (HKLM\…\AltoMP3 Gold) (Version: 5.20 - Thomas Yuan)

Animated GIF producer 3.1 TRIAL (HKLM\…\Animated GIF producer 3.1 TRIAL_is1) (Version: - AVLAN Design)

Apple Application Support (HKLM\…\{F5266D28-E0B2-4130-BFC5-EE155AD514DC}) (Version: 2.3 - Apple Inc.)

Apple Software Update (HKLM\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Applian FLV and Media Player 3.1.1.12 (HKLM\…\Applian FLV and Media Player) (Version: 3.1.1.12 - Applian Technologies)

Applian FLV Player (HKLM\…\Applian FLV Player2.0.23) (Version: 2.0.23 - Applian Technologies Inc.)

ATI - Software Uninstall Utility (HKLM\…\All ATI Software) (Version: 6.14.10.1013 - )

ATI Control Panel (HKLM\…\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}) (Version: 6.14.10.5171 - )

ATI Display Driver (HKLM\…\ATI Display Driver) (Version: 8.191-051028a1-027345C-ATI - )

Audacity 1.2.6 (HKLM\…\Audacity_is1) (Version: - )

AutoUpdate (HKLM\…\{18D10072035C4515918F7E37EAFAACFC}) (Version: 1.1 - )

Azureus (HKLM\…\Azureus) (Version: 2.3.0.4 - )

BackStreet Browser 3.1 (HKLM\…\BackStreet Browser_is1) (Version: - )

BitTornado 0.3.7 (HKLM\…\BitTornado) (Version: 0.3.7 - John Hoffman)

CDisplay 1.8 (HKLM\…\CDisplay_is1) (Version: - dvd8n)

Combined Community Codec Pack 2008-09-21 16:18 (HKLM\…\Combined Community Codec Pack_is1) (Version: 2008.09.21.0 - CCCP Project)

Critical Update for Windows Media Player 11 (KB959772) (HKLM\…\KB959772_WM11) (Version: - Microsoft Corporation)

CyberLink PowerDirector (HKLM\…\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.2013 - CyberLink Corp.)

DC++ 0.674 (HKLM\…\DC++) (Version: 0.674 - Jacek Sieka)

DebugMode Wax 2.0 (HKLM\…\DebugMode Wax 2.0) (Version: - )

Digital Media Converter 2.62 (HKLM\…\Digital Media Converter_is1) (Version: - Deskshare Inc.)

Digital Video (HKLM\…\{C833C7B6-1140-471D-932B-391B5CA66D7D}) (Version: 1.00.000 - )

DivX (HKLM\…\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.0.3 - DivXNetworks, Inc.)

DivX Content Uploader (HKLM\…\{D050D7362D214723AD585B541FFB6C11}) (Version: 1.2.1 - DivX, Inc.)

DivX Player (HKLM\…\{8ADFC4160D694100B5B8A22DE9DCABD9}) (Version: 6.0 - DivXNetworks, Inc.)

DivX Web Player (HKLM\…\{B7050CBDB2504B34BC2A9CA0A692CC29}) (Version: 1.3.1 - DivX,Inc.)

DVD Solution (HKLM\…\{B97CF5C3-0487-11D8-A36E-0050BAE317E1}) (Version: - )

DWA-542 (HKLM\…\{6F6F39E3-D24D-4EEE-9AEA-DEDAF991385D}) (Version: 1.20b01 - D-Link)

ESET Online Scanner v3 (HKLM\…\ESET Online Scanner) (Version: - )

Facebook Plug-In (HKU\S-1-5-21-839522115-562591055-2147167427-1004\…\Facebook Plug-In) (Version: - Facebook, Inc.)

FileZilla (remove only) (HKLM\…\FileZilla) (Version: - )

Google Chrome (HKU\S-1-5-21-839522115-562591055-2147167427-1004\…\Google Chrome) (Version: 42.0.2311.152 - Google Inc.)

Google Drive (HKLM\…\{418BAAD1-754D-48B4-B078-46EF4F25AF42}) (Version: 1.15.6556.8063 - Google, Inc.)

Google Talk Plugin (HKLM\…\{CA3DD97D-1FD7-37A7-BD5C-FC4430C8B8E6}) (Version: 5.41.2.0 - Google)

Google Toolbar for Internet Explorer (HKLM\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden

HF pAppLoc version 1.0 (HKLM\…\{9143B17E-BBDE-4EA7-A4E3-20D384D9C8A5}_is1) (Version: 1.0 - Inquisitor)

High Definition Audio Driver Package - KB835221 (HKLM\…\KB835221WXP) (Version: 20040219.000000 - Microsoft Corporation)

HiJackThis (HKLM\…\{45A66726-69BC-466B-A7A4-12FCBA4883D7}) (Version: 1.0.0 - Trend Micro)

HijackThis 2.0.2 (HKLM\…\HijackThis) (Version: 2.0.2 - TrendMicro)

HyperCam 2 (HKLM\…\HyperCam 2) (Version: 2.28.01 - Hyperionics Technology LLC)

Intel(R) PRO Network Adapters and Drivers (HKLM\…\PROSet) (Version: - )

IrfanView (remove only) (HKLM\…\IrfanView) (Version: - )

Java 7 Update 55 (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.550 - Oracle)

Java(TM) 6 Update 33 (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F83216032FF}) (Version: 6.0.330 - Oracle)

LG Bluetooth Drivers (HKLM\…\{AC7EE5F1-0DE4-4256-8E43-92B73C8E6019}) (Version: 1.1 - LG Electronics)

LG PC Suite IV (HKLM\…\LG PC Suite IV) (Version: 4.3.80.20121017 - LG Electronics)

LG United Mobile Drivers (HKLM\…\{5DB849D6-9392-4FB7-9ABB-87ED433152E5}) (Version: 3.8.1 - LG Electronics)

Logitech QuickCam (HKLM\…\{77E70C3C-DBB9-4C47-8663-1E1F81FEC623}) (Version: 6.01.0000 - Logitech, Inc.)

Macromedia Dreamweaver 8 (HKLM\…\{0837A661-FEC3-48B3-876C-91E7D32048A9}) (Version: 8.0.0.2734 - Macromedia)

Macromedia Extension Manager (HKLM\…\{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}) (Version: 1.7.240 - Macromedia, Inc.)

Macromedia Flash MX (HKLM\…\{3BE480ED-E17A-431A-981C-5C2EDDBCD3BF}) (Version: 6 - Macromedia)

Macromedia Shockwave Player (HKLM\…\Macromedia Shockwave Player) (Version: 10.1.0.11 - Macromedia, Inc.)

Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)

ManyCam 3.1.21 (HKLM\…\ManyCam) (Version: 3.1.21 - ManyCam LLC)

Mega Man Effect (HKLM\…\{C4860702-8F8F-4858-938E-0F941C4A46C4}_is1) (Version: - Virtual Constructs)

Metacafe (HKLM\…\Metacafe) (Version: - )

Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\…\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)

Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\…\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (HKLM\…\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile (HKLM\…\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended (HKLM\…\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\…\MSCompPackV1) (Version: 1 - Microsoft Corporation)

Microsoft MPEG-4 VKI Video Codec V1/V2/V3 (HKLM\…\MS-MPEG4) (Version: - )

Microsoft Office PowerPoint Viewer 2007 (English) (HKLM\…\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\…\Wudf01000) (Version: - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\…\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\…\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Windows Application Compatibility Database (HKLM\…\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb) (Version: - )

Microsoft WinUsb 2.0 (HKLM\…\winusb0200) (Version: - Microsoft Corporation)

Microsoft XNA Framework Redistributable 4.0 (HKLM\…\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)

mIRC (HKLM\…\mIRC) (Version: - )

MKV TO AVI CONVERTER version 3.0 (HKLM\…\MKV TO AVI CONVERTER_is1) (Version: - )

Mozilla Firefox 37.0.2 (x86 en-US) (HKLM\…\Mozilla Firefox 37.0.2 (x86 en-US)) (Version: 37.0.2 - Mozilla)

Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 36.0.4 - Mozilla)

MSN Messenger 7.5 (HKLM\…\{CEB3A11A-03EA-11DA-BFBD-00065BBDC0B5}) (Version: 7.5.0311.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB927978) (HKLM\…\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB936181) (HKLM\…\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB954430) (HKLM\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP2 Parser and SDK (HKLM\…\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)

Multimedia Launcher (HKLM\…\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: - )

Palace Uninstall (HKLM\…\Palace) (Version: - )

Phalanx v4.0 (HKLM\…\Phalanx) (Version: - )

piaip AppLocale (HKLM\…\{394BE3D9-7F57-4638-A8D1-1D88671913B7}) (Version: 1.0.0 - MS)

PowerDVD (HKLM\…\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: - )

PowerProducer (HKLM\…\{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: - )

Project64 1.6 (HKLM\…\{9559F7CA-5E34-4237-A2D9-D856464AD727}) (Version: 1.6 - Project64)

QQ International (HKLM\…\{3CA54984-A14B-42FE-9FF1-7EA90151D725}) (Version: 1.91.1369.0 - Tencent Technology(Shenzhen) Company Limited)

QuickTime (HKLM\…\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)

RealPlayer (HKLM\…\RealPlayer 6.0) (Version: - )

Realtek High Definition Audio Driver (HKLM\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - )

Replay Video Capture 6 (HKLM\…\Replay Video Capture6.0.6) (Version: 6.0.6 - Applian Technologies Inc.)

SIW version 2010.07.14 (HKLM\…\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2010.07.14 - Topala Software Solutions)

Skype web features (HKLM\…\{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}) (Version: 1.0.3971 - Skype Technologies S.A.)

Skype™ 7.3 (HKLM\…\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)

SlimDX Runtime .NET 4.0 x86 (January 2012) (HKLM\…\{7EBD0E43-6AC0-4CA8-9990-00E50069AD29}) (Version: 2.0.13.43 - SlimDX Group)

SmartFTP Client (HKLM\…\{11C762F9-95EA-486A-A8E7-683A50C231C1}) (Version: 1.5.991 - SmartFTP)

SmartFTP Client (HKLM\…\{C169D3BB-9A27-43F5-9979-09A0D65FE95C}) (Version: 2.5.1005.27 - SmartSoft)

SmartSound Quicktracks Plugin (HKLM\…\InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}) (Version: 3.0.3.0 - SmartSound Software Inc)

SmartSound Quicktracks Plugin (Version: 3.0.3.0 - SmartSound Software Inc) Hidden

Sonic DLA (HKLM\…\{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}) (Version: 4.95 - Sonic Solutions)

Sonic RecordNow! (HKLM\…\{9541FED0-327F-4DF0-8B96-EF57EF622F19}) (Version: 7.3 - Sonic Solutions)

Sonic Update Manager (HKLM\…\{09DA4F91-2A09-4232-AB8C-6BC740096DE3}) (Version: 2.9 - Sonic Solutions)

Spybot - Search & Destroy (HKLM\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)

SpyroDriver (HKLM\…\{B77128D1-6826-437A-BD8E-8828809A2A95}) (Version: 1.06.0000 - FS)

SpyroPortalDriver (HKLM\…\{B8C72ECE-87C6-4676-B949-519C1954F9F2}) (Version: 1.0.1 - FS)

Steam (HKLM\…\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

Stella 2.5.1 (HKLM\…\Stella_is1) (Version: - Bradford W. Mott and the Stella team)

Terraria (HKLM\…\Steam App 105600) (Version: - )

TestDrive Client (HKLM\…\{36C9E08A-BE2B-40A0-83C5-576748F7B777}) (Version: 1.00.2000 - Runaware)

The Elder Scrolls II: Daggerfall, DaggerfallSetup 2.8 (HKLM\…\DaggerfallSetup_is1) (Version: - Bethesda Softworks)

Unity Web Player (HKU\S-1-5-21-839522115-562591055-2147167427-1004\…\UnityWebPlayer) (Version: - Unity Technologies ApS)

VLC media player 1.1.9 (HKLM\…\VLC media player) (Version: 1.1.9 - VideoLAN)

WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden

Winamp (remove only) (HKLM\…\Winamp) (Version: - )

Windows Genuine Advantage Notifications (KB905474) (HKLM\…\WgaNotify) (Version: 1.5.0540.0 - Microsoft Corporation)

Windows Genuine Advantage Validation Tool (KB892130) (HKLM\…\KB892130) (Version: - Microsoft Corporation)

Windows Genuine Advantage Validation Tool (KB892130) (HKLM\…\WGA) (Version: 1.7.0069.2 - Microsoft Corporation)

Windows Internet Explorer 8 (HKLM\…\ie8) (Version: 20090308.140743 - Microsoft Corporation)

Windows Media Format 11 runtime (HKLM\…\Windows Media Format Runtime) (Version: - )

Windows Media Player 11 (HKLM\…\Windows Media Player) (Version: - )

Windows XP Service Pack 3 (HKLM\…\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)

WinRAR archiver (HKLM\…\WinRAR archiver) (Version: - )

XLS Reader (HKLM\…\{30D6D257-BE4B-48F2-8D9E-E787A52A0738}_is1) (Version: 1.0 - )

XMLinst (HKLM\…\{EA23971F-2CEE-48FC-B64D-7F74A6EF90F0}) (Version: 1.0.0.0 - Intel Corporation)

XVID Codec Installation (HKLM\…\{534C6D59-D6E3-48A6-AD0B-747799019960}) (Version: - )

XviD MPEG-4 Video Codec (HKLM\…\xvid) (Version: - XviD Development Team)

XviD MPEG-4 Video Codec (HKLM\…\XviD_is1) (Version: XviD-1.0.3-20122004 - XviD Team (Koepi))

Yahoo! Messenger (HKLM\…\Yahoo! Messenger) (Version: - Yahoo! Inc.)

Yahoo! Software Update (HKLM\…\Yahoo! Software Update) (Version: - )

ZD Soft Screen Recorder (HKLM\…\ZD Soft Screen Recorder) (Version: 2.6 - )

ZD Soft Screen Video Decoder (HKLM\…\ZDSV) (Version: - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{00B7E0AB-817A-44AD-A04B-D1148D524136}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.135\psuser.d (the data entry has 10 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.99\psuser.dl (the data entry has 9 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.57\psuser.dl (the data entry has 9 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{218D2740-5A50-42A8-AB9F-62FF1B168782}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.69\psuser.dl (the data entry has 9 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{238F6F80-B8B4-11CF-8771-00A024541EE3}\InprocServer32 -> C:\Documents and Settings\Protoman\Application Data\Runaware\TestDrive Wizard\WFICA.OCX (Citrix Systems, Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{238F6F83-B8B4-11CF-8771-00A024541EE3}\InprocServer32 -> C:\Documents and Settings\Protoman\Application Data\Runaware\TestDrive Wizard\WFICA.OCX (Citrix Systems, Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{238F6F85-B8B4-11CF-8771-00A024541EE3}\InprocServer32 -> C:\Documents and Settings\Protoman\Application Data\Runaware\TestDrive Wizard\WFICA.OCX (Citrix Systems, Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{320F0FDB-BE0A-4648-9D18-4A2C3448C007}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.79\psuser.dl (the data entry has 9 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\InprocServer32 -> C:\Documents and Settings\Protoman\Application Data\Facebook\axfbootloader.dll ( )

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.23.9\psuser.dll (the data entry has 8 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{38216570-5DB1-45F8-A344-B0C4E252B14B}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.26.7\psuser.dll (the data entry has 8 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{39125640-8D80-11DC-A2FE-C5C455D89593}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Google Talk Plugin\googletalkax.dll (Google)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\Application\42.0.2311.152\delegate_execute.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.145\psuser.d (the data entry has 10 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.123\psuser.d (the data entry has 10 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{666006C6-C743-11D5-BA02-00C04F2EFC0F}\InprocServer32 -> C:\Documents and Settings\Protoman\Application Data\Runaware\TestDrive Wizard\ProxySup.ocx (Citrix Systems, Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.153\psuser.d (the data entry has 10 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{7C6E29BC-8B8B-4C3D-859E-AF6CD158BE0F}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{88D969C2-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{88D969C3-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{88D969C8-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{88D969C9-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{88D969CA-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\WINDOWS\system32\msxml4.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{91EFB276-CEFE-48EC-BB3A-57795A7B4008}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.149\psuser.d (the data entry has 10 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.22.3\psuser.dll (the data entry has 8 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.165\psuser.d (the data entry has 10 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{AB9F4455-E591-4132-A386-0B91EAEDB96C}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Google Talk Plugin\o1dax.dll (Google)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.26.9\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.115\psuser.d (the data entry has 10 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{C98FE784-B96E-41e1-8399-1337AE3E539F}\InprocServer32 -> C:\Documents and Settings\Protoman\Application Data\Facebook\npfbplugin_1_0_3.dll ( )

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{DB25D157-76D4-41C1-97B5-359E4A4CECEB}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.65\psuser.dl (the data entry has 9 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.26.9\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.22.5\psuser.dll (the data entry has 8 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{F2990EE3-564C-4A6C-8058-5F915A6A0A7C}\InprocServer32 -> C:\Documents and Settings\All Users\Application Data\{58C525CE-3049-415C-8553-F8D254D6744F}\mf.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.21.111\psuser.d (the data entry has 10 more characters).

CustomCLSID: HKU\S-1-5-21-839522115-562591055-2147167427-1004_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\1.3.24.7\psuser.dll (the data entry has 8 more characters).

==================== Restore Points =========================

ATTENTION: System Restore is disabled.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2010-01-03 20:46 - 2012-08-25 22:35 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Ejejetpfni.job => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\extsq.dll

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-562591055-2147167427-1004Core.job => C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-562591055-2147167427-1004UA.job => C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe

Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe

Task: C:\WINDOWS\Tasks\{A2944C8B-360D-FF6A-8DBE-13FC19E5146B}.job => C:\Documents and Settings\Protoman\Application Data\xILFsyyS\EjBZRhPe\XJuNfgcH\HLJsxAJSi.exe

==================== Loaded Modules (Whitelisted) ==============

2013-09-12 19:41 - 2008-06-20 15:30 - 00212992 _____ () C:\WINDOWS\WlanGINA\Version\1.0.4.0\WlanGINA.dll

2005-11-18 02:12 - 2005-10-07 16:05 - 00125440 _____ () C:\Program Files\WinRAR\rarext.dll

2010-11-20 20:24 - 2009-04-17 19:01 - 00247152 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe

2015-05-13 02:17 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2015-05-13 02:17 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl

2015-05-13 02:17 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2015-05-13 02:17 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll

2015-05-13 02:17 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2003-06-13 17:23 - 2003-06-13 17:23 - 00081408 _____ () C:\WINDOWS\AppPatch\AlLayer.DLL

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\Temp:05D195EC

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\aawservice => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\…\007guard.com -> install.007guard.com

IE restricted site: HKU\.DEFAULT\…\008i.com -> 008i.com

IE restricted site: HKU\.DEFAULT\…\008k.com -> www.008k.com

IE restricted site: HKU\.DEFAULT\…\00hq.com -> www.00hq.com

IE restricted site: HKU\.DEFAULT\…\010402.com -> 010402.com

IE restricted site: HKU\.DEFAULT\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com

IE restricted site: HKU\.DEFAULT\…\0scan.com -> www.0scan.com

IE restricted site: HKU\.DEFAULT\…\1-2005-search.com -> www.1-2005-search.com

IE restricted site: HKU\.DEFAULT\…\1-domains-registrations.com -> www.1-domains-registrations.com

IE restricted site: HKU\.DEFAULT\…\1000gratisproben.com -> www.1000gratisproben.com

IE restricted site: HKU\.DEFAULT\…\1001namen.com -> www.1001namen.com

IE restricted site: HKU\.DEFAULT\…\100888290cs.com -> mir.100888290cs.com

IE restricted site: HKU\.DEFAULT\…\100sexlinks.com -> www.100sexlinks.com

IE restricted site: HKU\.DEFAULT\…\10sek.com -> www.10sek.com

IE restricted site: HKU\.DEFAULT\…\12-26.net -> user1.12-26.net

IE restricted site: HKU\.DEFAULT\…\12-27.net -> user1.12-27.net

IE restricted site: HKU\.DEFAULT\…\123haustiereundmehr.com -> www.123haustiereundmehr.com

IE restricted site: HKU\.DEFAULT\…\123simsen.com -> www.123simsen.com

IE restricted site: HKU\.DEFAULT\…\123topsearch.com -> www.123topsearch.com

IE restricted site: HKU\.DEFAULT\…\125sms.co.uk -> www.125sms.co.uk

There are 5222 more restricted sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-839522115-562591055-2147167427-1004\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Protoman\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp

DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Wireless Connection Manager.lnk => C:\WINDOWS\pss\Wireless Connection Manager.lnkCommon Startup

MSCONFIG\startupfolder: C:^Documents and Settings^Protoman^Start Menu^Programs^Startup^Adobe Gamma.lnk => C:\WINDOWS\pss\Adobe Gamma.lnkStartup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: dla => C:\WINDOWS\system32\dla\tfswctrl.exe

MSCONFIG\startupreg: etgismo => rundll32 "C:\Documents and Settings\Protoman\Local Settings\Application Data\etgismo.dll",etgismo

MSCONFIG\startupreg: FlashPlayerUpdate => C:\Documents and Settings\Protoman\Local Settings\Application Data\Macromedia\Flash Player\FlashPlayerUpdateService.exe

MSCONFIG\startupreg: Google Update => "C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

MSCONFIG\startupreg: LVCOMS => C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE

MSCONFIG\startupreg: QQIntl => "C:\Program Files\Tencent\QQIntl\Bin\QQ.exe" /background

MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\qttask.exe" -atboottime

MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun

MSCONFIG\startupreg: snpstd3 => C:\WINDOWS\vsnpstd3.exe

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

MSCONFIG\startupreg: UpdateManager => "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

MSCONFIG\startupreg: UserFaultCheck => %systemroot%\system32\dumprep 0 -u

MSCONFIG\startupreg: WebCamRT.exe =>

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

StandardProfile\AuthorizedApplications: [Host-process Windows (Rundll32.exe)] => C:\Documents and Settings\Protoman\Application Data\System32\csrss.exe

StandardProfile\AuthorizedApplications: [Client Server Runtime Process] => C:\Documents and Settings\Protoman\Application Data\csrss.exe

StandardProfile\AuthorizedApplications: [Service Host Process for Windows] => C:\Documents and Settings\Protoman\Application Data\svchost.exe

StandardProfile\AuthorizedApplications: [C:\Program Files\MSN Messenger\msnmsgr.exe] => Enabled:MSN Messenger

StandardProfile\AuthorizedApplications: [C:\Program Files\Tencent\QQIntl\Bin\QQ.exe] => Enabled:Tencent QQ

StandardProfile\AuthorizedApplications: [C:\Program Files\Tencent\QQIntl\Bin\auclt.exe] => Enabled:QQIntlUpdate

StandardProfile\AuthorizedApplications: [C:\Program Files\Tencent\QQIntl\Bin\txupd.exe] => Enabled:QQIntlUpdate2011

StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe] => Enabled:Google Talk Plugin

StandardProfile\AuthorizedApplications: [C:\Program Files\uTorrent\uTorrent.exe] => Enabled:µTorrent

StandardProfile\AuthorizedApplications: [C:\Program Files\Ustream\Ustream Producer\rsrc\Desktop Presenter.exe] => Enabled:Desktop Presenter

StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe] => Enabled:WebKit

StandardProfile\AuthorizedApplications: [C:\Program Files\VideoLAN\VLC\vlc.exe] => Enabled:VLC media player

StandardProfile\AuthorizedApplications: [C:\Program Files\AIM\aim.exe] => Enabled:AOL Instant Messenger

StandardProfile\AuthorizedApplications: [C:\Program Files\mIRC\mirc.exe] => Disabled:mIRC

StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Protoman\Local Settings\temp\Rar$EX00.515\Super Cock Blockers.exe] => C:\Documents and Settings\Protoman\Local Settings\temp\Rar$EX00.515\Super Cock Blockers.exe:*:Disabled:Super Cock Blockers

StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Protoman\My Documents\D Drive\NES Nesticle\NESTCL95.EXE] => Disabled:NESTCL95

StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\rundll32.exe] => Enabled:Rundll32

StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Chrome\Application\chrome.exe] => Enabled:Google Chrome

StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Protoman\Application Data\Tencent\QQ\STemp\SetupEx~0\QQSetupEx.exe] => Enabled:QQSetupEX

StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\Tencent\QQDownload\119\Tencentdl.exe] => Enabled:ÌÚÑ¶²úÆ·ÏÂÔØ×é¼þ

StandardProfile\AuthorizedApplications: [C:\Program Files\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Program Files\Mozilla Firefox)

StandardProfile\AuthorizedApplications: [C:\Program Files\Skype\Phone\Skype.exe] => Enabled:Skype

StandardProfile\AuthorizedApplications: [C:\DOCUME~1\Protoman\LOCALS~1\temp\radFD92C.tmp.exe] => Enabled:radFD92C.tmp

StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access

StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service

StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater

StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service

StandardProfile\AuthorizedApplications: [\??\C:\WINDOWS\system32\winlogon.exe] => \??:*:Enabled:winlogon

StandardProfile\GloballyOpenPorts: [1900:TCP] => :LocalSubNet:Enabled:UDP 1900

StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22007

StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22008

==================== Faulty Device Manager Devices =============

Name: Activision Xbox360 Spyro Portal

Description: Activision Xbox360 Spyro Portal

Class Guid: {4A9C2FA7-D63F-44C5-A247-BB3289A3739F}

Manufacturer: Activision

Service: WinUSB

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (05/14/2015 06:52:30 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application msiexec.exe, version 3.1.4001.5512, faulting module urlmon.dll, version 8.0.6001.23580, fault address 0x00029db4.

Processing media-specific event for [msiexec.exe!ws!]

Error: (05/14/2015 04:41:18 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application msiexec.exe, version 3.1.4001.5512, faulting module mshtml.dll, version 8.0.6001.23588, fault address 0x0014c493.

Processing media-specific event for [msiexec.exe!ws!]

Error: (05/14/2015 01:00:43 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application msiexec.exe, version 3.1.4001.5512, faulting module unknown, version 0.0.0.0, fault address 0x00045e53.

Processing media-specific event for [msiexec.exe!ws!]

Error: (05/14/2015 11:44:10 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application msiexec.exe, version 3.1.4001.5512, faulting module unknown, version 0.0.0.0, fault address 0x000468d3.

Processing media-specific event for [msiexec.exe!ws!]

Error: (05/14/2015 07:19:04 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application msiexec.exe, version 3.1.4001.5512, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

Processing media-specific event for [msiexec.exe!ws!]

Error: (05/13/2015 03:50:24 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application msiexec.exe, version 3.1.4001.5512, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

Processing media-specific event for [msiexec.exe!ws!]

Error: (05/13/2015 03:45:57 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application ctfmon.exe, version 5.1.2600.5512, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

Processing media-specific event for [ctfmon.exe!ws!]

Error: (05/13/2015 03:12:36 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

Processing media-specific event for [explorer.exe!ws!]

Error: (05/13/2015 10:39:03 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application ctfmon.exe, version 5.1.2600.5512, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

Processing media-specific event for [ctfmon.exe!ws!]

Error: (05/13/2015 03:21:44 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application msiexec.exe, version 3.1.4001.5512, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

Processing media-specific event for [msiexec.exe!ws!]

System errors:

=============

Error: (05/14/2015 04:55:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Spybot-S&D; 2 Security Center Service service failed to start due to the following error:

%%1053

Error: (05/14/2015 04:55:42 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Timeout (30000 milliseconds) waiting for the Spybot-S&D; 2 Security Center Service service to connect.

Error: (05/14/2015 04:55:42 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Timeout (30000 milliseconds) waiting for the SN.Sustainer service to connect.

Error: (05/14/2015 10:27:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Spybot-S&D; 2 Security Center Service service failed to start due to the following error:

%%1053

Error: (05/14/2015 10:27:03 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Timeout (30000 milliseconds) waiting for the Spybot-S&D; 2 Security Center Service service to connect.

Error: (05/14/2015 10:27:03 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Timeout (30000 milliseconds) waiting for the SN.Sustainer service to connect.

Error: (05/13/2015 10:26:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Spybot-S&D; 2 Security Center Service service failed to start due to the following error:

%%1053

Error: (05/13/2015 10:26:49 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Timeout (30000 milliseconds) waiting for the Spybot-S&D; 2 Security Center Service service to connect.

Error: (05/13/2015 10:26:49 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Timeout (30000 milliseconds) waiting for the SN.Sustainer service to connect.

Error: (05/13/2015 09:59:41 PM) (Source: EventLog) (EventID: 6004) (User: )

Description: A driver packet received from the I/O subsystem was invalid. The data is the

packet.

Microsoft Office Sessions:

=========================

==================== Memory info ===========================

Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz

Percentage of memory in use: 39%

Total physical RAM: 2046.73 MB

Available physical RAM: 1229.6 MB

Total Pagefile: 1893.72 MB

Available Pagefile: 1070.63 MB

Total Virtual: 2047.88 MB

Available Virtual: 1930.01 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.51 GB) (Free:379.38 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: D09BD09B)

Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================

ken545

Post #9May 15, 2015, 12:51 AM UTC

You have lot going on on this system, I see your using the torrents , bad idea, not all but almost everything downloaded via the torrents is infected

I am attaching a FIXLIST file, you need to download it to your desktop where you now have FRST or the fix wont work, use your mouse to drag FIXLIST right next to FRST, either above or below it but not right on top of it, after its downloaded open up FRST and click on FIX (Not Scan) it wont take long, after your computer reboots you will find a FIXLOG file on your desktop, post it please

Post the Fixlog after your system reboots and then run this program, you may be infected with ZeroAccess

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

See this Link for programs that need to be disabled and instruction on how to disable them.

Remember to re-enable them when we're done.

Double click on ComboFix.exe & follow the prompts.

For Windows XP Users

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: RC1.png]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: RC2-1.png]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Attachments:

📎Fixlist.txt

DanielDude

Post #10May 15, 2015, 4:50 AM UTC

So hit a snag

Did the Fix, but after awhile it got jammed while trying to fix "Shared Objects" a folder it seems

Tried again on Safe Mode with Networking, still slow, same problem happened and it gave me a log that might not be correct (no doubt overlooked what happened the previous failed "fix"

DanielDude

Post #11May 15, 2015, 4:51 AM UTC

Here is the log

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 14-05-2015 02

Ran by [removed] at 2015-05-15 00:27:01 Run:2

Running from C:\Documents and Settings\[removed]\Desktop

[removed]

Boot Mode: Safe Mode (with Networking)

==============================================

Content of fixlist:

*****************

Start

CloseProcesses:

CreateRestorePoint:

BootExecute: autocheck autochk * lsdeletesdnclean.exe

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-839522115-562591055-2147167427-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

SearchScopes: HKU\S-1-5-21-839522115-562591055-2147167427-1004 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL =

Toolbar: HKU\S-1-5-21-839522115-562591055-2147167427-1004 -> No Name - {4D594333-0076-A76A-76A7-7A786E7484D7} - No File

FF DefaultSearchEngine,S: WebSearch

FF DefaultSearchUrl: hxxp://websearch.searchsun.info/?pid=34&r=2014/05/24&hid=5011814741841314998&lg=EN&cc=CA&unqvl=52&l=1&q=

FF SearchEngineOrder.1: WebSearch

FF SearchEngineOrder.1,S: WebSearch

FF SelectedSearchEngine: WebSearch

FF SelectedSearchEngine,S: WebSearch

FF SearchPlugin: C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\searchplugins\ask-search.xml [2013-06-06]

FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions

FF HKU\S-1-5-21-839522115-562591055-2147167427-1004\…\Firefox\Extensions: [[removed]] - C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions

CHR StartupUrls: Default -> "hxxp://websearch.searchsun.info/?pid=34&r=2014/05/24&hid=5011814741841314998&lg=EN&cc=CA&unqvl=5

CMD: ipconfig /flushdns

Hosts:

EmptyTemp:

End

*****************

Processes closed successfully.

Error: Restore point can only be created in normal mode.

HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => Value was restored successfully.

HKLM\SOFTWARE\Policies\Google => Key not found.

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => Key not found.

HKU\S-1-5-21-839522115-562591055-2147167427-1004\SOFTWARE\Policies\Microsoft\Internet Explorer => Key not found.

HKU\S-1-5-21-839522115-562591055-2147167427-1004\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key not found.

HKCR\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key not found.

HKU\S-1-5-21-839522115-562591055-2147167427-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4D594333-0076-A76A-76A7-7A786E7484D7} => Value not found.

HKCR\CLSID\{4D594333-0076-A76A-76A7-7A786E7484D7} => Key not found.

Firefox DefaultSearchEngine,S deleted successfully.

Firefox DefaultSearchUrl deleted successfully.

Firefox SearchEngineOrder.1 deleted successfully.

Firefox SearchEngineOrder.1,S deleted successfully.

Firefox SelectedSearchEngine deleted successfully.

Firefox SelectedSearchEngine,S deleted successfully.

"C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\searchplugins\ask-search.xml" => not found.

HKLM\Software\Mozilla\Firefox\Extensions\\[removed] => Value not found.

HKU\S-1-5-21-839522115-562591055-2147167427-1004\Software\Mozilla\Firefox\Extensions\\[removed] => Value not found.

Chrome StartupUrls not detected.

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.

Hosts was reset successfully.

ken545

Post #12May 15, 2015, 11:36 AM UTC

I am looking at markers on your log for the ZeroAccess Rootkit and also markers for Cryptowall, are you getting any messages that your files have been encrypted and held for ransom ??

You need to run Combofix like I posted

DanielDude

Post #13May 15, 2015, 6:03 PM UTC

ComboFix 15-05-13.01 - Protoman 05/15/2015 13:13:41.15.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.652 [GMT -4:00]

Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp

c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\background.html

c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\content.js

c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\HFhISM2y.js

c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\lsdb.js

c:\documents and settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\manifest.json

c:\documents and settings\All Users\Application Data\TEMP

c:\documents and settings\ASPNET\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp

c:\documents and settings\ASPNET\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\background.html

c:\documents and settings\ASPNET\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\content.js

c:\documents and settings\ASPNET\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\HFhISM2y.js

c:\documents and settings\ASPNET\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\lsdb.js

c:\documents and settings\ASPNET\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\manifest.json

c:\documents and settings\ASPNET\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\background.html

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\content.js

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\HFhISM2y.js

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\lsdb.js

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\manifest.json

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\background.html

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\content.js

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\lsdb.js

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\manifest.json

c:\documents and settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\YHba1Rz.js

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\background.html

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\content.js

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\HFhISM2y.js

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\lsdb.js

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\manifest.json

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\background.html

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\content.js

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\lsdb.js

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\manifest.json

c:\documents and settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\YHba1Rz.js

c:\documents and settings\Protoman\Application Data\5xsKoHcXkdIeQR8-QTC0OYZAbf1cXqG-SI504jKzGAbJRhy-X8gWkRs5dDqTpHN.exe

c:\documents and settings\Protoman\Application Data\LJ0HQ4jZkqah9l1-V7TLO5ox9rbPwEM-gfbXZ3ANJpWCwGQ-dwJ43CuXHqcmEbi.exe

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\background.html

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\content.js

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\HFhISM2y.js

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\lsdb.js

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\manifest.json

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\background.html

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\content.js

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\lsdb.js

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\manifest.json

c:\documents and settings\Protoman\Local Settings\Application Data\Chromatic Browser\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\YHba1Rz.js

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\background.html

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\content.js

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\HFhISM2y.js

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\lsdb.js

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\manifest.json

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\background.html

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\content.js

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\lsdb.js

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\manifest.json

c:\documents and settings\Protoman\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\YHba1Rz.js

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\background.html

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\content.js

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\HFhISM2y.js

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\lsdb.js

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\manifest.json

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\background.html

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\content.js

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\lsdb.js

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\manifest.json

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\YHba1Rz.js

c:\documents and settings\Protoman\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\background.html

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\content.js

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\HFhISM2y.js

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\lsdb.js

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\manifest.json

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\background.html

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\content.js

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\lsdb.js

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\manifest.json

c:\documents and settings\Protoman\Local Settings\Application Data\Torch\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\YHba1Rz.js

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\background.html

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\content.js

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\HFhISM2y.js

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\lsdb.js

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\manifest.json

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\background.html

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\content.js

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\HFhISM2y.js

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\lsdb.js

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ahompfjfcadkceimfodnblknomcgembp\1.0\manifest.json

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\background.html

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\content.js

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\lsdb.js

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\manifest.json

c:\documents and settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\cknebhggccemgcnbidipinkifmmegdel\1\YHba1Rz.js

c:\windows\$msi31uninstall_kb893803v2$

c:\windows\$msi31uninstall_kb893803v2$\msi.dll

c:\windows\$msi31uninstall_kb893803v2$\msiexec.exe

c:\windows\$msi31uninstall_kb893803v2$\msihnd.dll

c:\windows\$msi31uninstall_kb893803v2$\msimsg.dll

c:\windows\$msi31uninstall_kb893803v2$\msisip.dll

c:\windows\$msi31uninstall_kb893803v2$\reg00013

c:\windows\$msi31uninstall_kb893803v2$\reg00014

c:\windows\$msi31uninstall_kb893803v2$\reg00015

c:\windows\$msi31uninstall_kb893803v2$\reg00016

c:\windows\$msi31uninstall_kb893803v2$\reg00017

c:\windows\$msi31uninstall_kb893803v2$\reg00018

c:\windows\$msi31uninstall_kb893803v2$\reg00019

c:\windows\$msi31uninstall_kb893803v2$\reg00020

c:\windows\$msi31uninstall_kb893803v2$\reg00021

c:\windows\$msi31uninstall_kb893803v2$\reg00022

c:\windows\$msi31uninstall_kb893803v2$\reg00023

c:\windows\$msi31uninstall_kb893803v2$\reg00024

c:\windows\$msi31uninstall_kb893803v2$\reg00025

c:\windows\$msi31uninstall_kb893803v2$\reg00026

c:\windows\$msi31uninstall_kb893803v2$\reg00027

c:\windows\$msi31uninstall_kb893803v2$\reg00028

c:\windows\$msi31uninstall_kb893803v2$\reg00029

c:\windows\$msi31uninstall_kb893803v2$\reg00030

c:\windows\$msi31uninstall_kb893803v2$\reg00031

c:\windows\$msi31uninstall_kb893803v2$\reg00032

c:\windows\$msi31uninstall_kb893803v2$\reg00033

c:\windows\$msi31uninstall_kb893803v2$\reg00034

c:\windows\$msi31uninstall_kb893803v2$\reg00035

c:\windows\$msi31uninstall_kb893803v2$\reg00036

c:\windows\$msi31uninstall_kb893803v2$\reg00037

c:\windows\$msi31uninstall_kb893803v2$\reg00038

c:\windows\$msi31uninstall_kb893803v2$\reg00039

c:\windows\$msi31uninstall_kb893803v2$\reg00040

c:\windows\$msi31uninstall_kb893803v2$\reg00041

c:\windows\$msi31uninstall_kb893803v2$\reg00042

c:\windows\$msi31uninstall_kb893803v2$\reg00043

c:\windows\$msi31uninstall_kb893803v2$\reg00044

c:\windows\$msi31uninstall_kb893803v2$\reg00045

c:\windows\$msi31uninstall_kb893803v2$\reg00046

c:\windows\$msi31uninstall_kb893803v2$\reg00047

c:\windows\$msi31uninstall_kb893803v2$\reg00048

c:\windows\$msi31uninstall_kb893803v2$\reg00051

c:\windows\$msi31uninstall_kb893803v2$\reg00052

c:\windows\$msi31uninstall_kb893803v2$\reg00053

c:\windows\$msi31uninstall_kb893803v2$\reg00054

c:\windows\$msi31uninstall_kb893803v2$\reg00055

c:\windows\$msi31uninstall_kb893803v2$\reg00056

c:\windows\$msi31uninstall_kb893803v2$\reg00057

c:\windows\$msi31uninstall_kb893803v2$\reg00058

c:\windows\$msi31uninstall_kb893803v2$\reg00059

c:\windows\$msi31uninstall_kb893803v2$\reg00060

c:\windows\$msi31uninstall_kb893803v2$\reg00061

c:\windows\$msi31uninstall_kb893803v2$\reg00062

c:\windows\$msi31uninstall_kb893803v2$\reg00063

c:\windows\$msi31uninstall_kb893803v2$\reg00064

c:\windows\$msi31uninstall_kb893803v2$\reg00065

c:\windows\$msi31uninstall_kb893803v2$\reg00066

c:\windows\$msi31uninstall_kb893803v2$\reg00067

c:\windows\$msi31uninstall_kb893803v2$\reg00068

c:\windows\$msi31uninstall_kb893803v2$\reg00069

c:\windows\$msi31uninstall_kb893803v2$\reg00070

c:\windows\$msi31uninstall_kb893803v2$\reg00071

c:\windows\$msi31uninstall_kb893803v2$\reg00072

c:\windows\$msi31uninstall_kb893803v2$\reg00073

c:\windows\$msi31uninstall_kb893803v2$\reg00074

c:\windows\$msi31uninstall_kb893803v2$\reg00075

c:\windows\$msi31uninstall_kb893803v2$\reg00076

c:\windows\$msi31uninstall_kb893803v2$\reg00077

c:\windows\$msi31uninstall_kb893803v2$\reg00078

c:\windows\$msi31uninstall_kb893803v2$\reg00079

c:\windows\$msi31uninstall_kb893803v2$\reg00080

c:\windows\$msi31uninstall_kb893803v2$\reg00081

c:\windows\$msi31uninstall_kb893803v2$\reg00082

c:\windows\$msi31uninstall_kb893803v2$\reg00083

c:\windows\$msi31uninstall_kb893803v2$\reg00084

c:\windows\$msi31uninstall_kb893803v2$\reg00085

c:\windows\$msi31uninstall_kb893803v2$\reg00086

c:\windows\$msi31uninstall_kb893803v2$\reg00087

c:\windows\$msi31uninstall_kb893803v2$\reg00088

c:\windows\$msi31uninstall_kb893803v2$\reg00089

c:\windows\$msi31uninstall_kb893803v2$\reg00090

c:\windows\$msi31uninstall_kb893803v2$\reg00091

c:\windows\$msi31uninstall_kb893803v2$\reg00092

c:\windows\$msi31uninstall_kb893803v2$\reg00093

c:\windows\$msi31uninstall_kb893803v2$\reg00094

c:\windows\$msi31uninstall_kb893803v2$\reg00095

c:\windows\$msi31uninstall_kb893803v2$\reg00096

c:\windows\$msi31uninstall_kb893803v2$\reg00097

c:\windows\$msi31uninstall_kb893803v2$\reg00098

c:\windows\$msi31uninstall_kb893803v2$\reg00099

c:\windows\$msi31uninstall_kb893803v2$\reg00100

c:\windows\$msi31uninstall_kb893803v2$\reg00101

c:\windows\$msi31uninstall_kb893803v2$\reg00102

c:\windows\$msi31uninstall_kb893803v2$\reg00103

c:\windows\$msi31uninstall_kb893803v2$\reg00104

c:\windows\$msi31uninstall_kb893803v2$\reg00105

c:\windows\$msi31uninstall_kb893803v2$\reg00106

c:\windows\$msi31uninstall_kb893803v2$\reg00107

c:\windows\$msi31uninstall_kb893803v2$\reg00108

c:\windows\$msi31uninstall_kb893803v2$\reg00109

c:\windows\$msi31uninstall_kb893803v2$\reg00110

c:\windows\$msi31uninstall_kb893803v2$\reg00111

c:\windows\$msi31uninstall_kb893803v2$\reg00112

c:\windows\$msi31uninstall_kb893803v2$\reg00113

c:\windows\$msi31uninstall_kb893803v2$\reg00114

c:\windows\$msi31uninstall_kb893803v2$\reg00115

c:\windows\$msi31uninstall_kb893803v2$\reg00116

c:\windows\$msi31uninstall_kb893803v2$\spuninst\spuninst.exe

c:\windows\$msi31uninstall_kb893803v2$\spuninst\spuninst.inf

c:\windows\$msi31uninstall_kb893803v2$\spuninst\spuninst.txt

c:\windows\$msi31uninstall_kb893803v2$\spuninst\updspapi.dll

c:\windows\apppatch\AppLoc.exe

c:\windows\apppatch\AppLocA.exe

c:\windows\apppatch\unins000.dat

c:\windows\apppatch\unins000.exe

c:\windows\msdownld.tmp

c:\windows\WlanGINA\Version\1.0.4.0\WlanGINA.dll

((((((((((((((((((((((((( Files Created from 2015-04-15 to 2015-05-15 )))))))))))))))))))))))))))))))

2015-05-14 23:00 . 2015-05-15 04:27 ——– d—–w- C:\FRST

2015-05-14 00:11 . 2015-05-14 00:11 ——– d—–w- C:\RegBackup

2015-05-13 22:34 . 2015-05-14 02:23 ——– d—–w- C:\AdwCleaner

2015-05-13 12:37 . 2015-05-13 12:37 ——– d–h–w- c:\documents and settings\Protoman\Application Data\xILFsyyS

2015-05-13 09:59 . 2015-05-14 04:16 ——– d—–w- c:\documents and settings\Protoman\Local Settings\Application Data\xgniwe

2015-05-13 09:58 . 2015-05-13 09:58 ——– d—–w- C:\5281a4a3

2015-05-13 06:17 . 2013-09-20 14:49 18968 —-a-w- c:\windows\system32\sdnclean.exe

2015-05-12 23:48 . 2015-05-12 23:48 ——– d—–w- c:\documents and settings\Protoman\Local Settings\Application Data\Macromedia

2015-04-17 05:59 . 2015-04-17 05:59 ——– d—–w- c:\program files\7-Zip

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2015-05-14 20:58 . 2015-01-15 04:53 119512 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2015-04-14 13:37 . 2015-01-15 04:52 120024 —-a-w- c:\windows\system32\drivers\mbamchameleon.sys

2015-04-14 13:37 . 2010-08-19 23:20 23256 —-a-w- c:\windows\system32\drivers\mbam.sys

2008-02-16 09:35 . 2008-02-16 09:35 2293848 —-a-w- c:\program files\FLV PlayerFCSetup.exe

2004-03-11 18:27 . 2005-11-12 14:12 40960 —-a-w- c:\program files\Uninstall_CDS.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]

2015-04-28 15:33 576840 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

2015-04-28 15:33 576840 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]

2015-04-28 15:33 576840 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]

2015-04-28 15:33 576840 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]

2015-04-28 15:33 576840 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]

"FlashPlayerUpdate"="c:\documents and settings\Protoman\Local Settings\Application Data\Macromedia\Flash Player\FlashPlayerUpdateService.exe" [2015-05-13 114688]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2013-05-01 421888]

"SDTray"="c:\program files\Spybot - Search & Destroy 2\SDTray.exe" [2014-06-24 4101576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"TaskbarNoNotification"= 1 (0x1)

"HideSCAHealth"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"TaskbarNoNotification"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Wireless Connection Manager.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Wireless Connection Manager.lnk

backup=c:\windows\pss\Wireless Connection Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Protoman^Start Menu^Programs^Startup^Adobe Gamma.lnk]

path=c:\documents and settings\Protoman\Start Menu\Programs\Startup\Adobe Gamma.lnk

backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]

c:\windows\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2013-11-21 16:57 959904 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2012-10-12 02:56 59280 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]

2004-08-13 06:05 122939 —-a-w- c:\windows\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]

2015-05-13 22:59 114688 —-a-w- c:\documents and settings\Protoman\Local Settings\Application Data\Macromedia\Flash Player\FlashPlayerUpdateService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2015-02-04 15:36 107848 —-atw- c:\documents and settings\Protoman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMS]

2002-06-10 18:21 102400 —-a-w- c:\program files\Common Files\Logitech\QCDriver\LVComS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2013-05-01 07:59 421888 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2015-03-25 18:20 31682144 —-a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]

2006-09-19 13:07 827392 —-a-w- c:\windows\vsnpstd3.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2013-07-02 14:16 254336 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]

2004-01-07 06:01 110592 —-a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"YahooAUService"=2 (0x2)

"WMPNetworkSvc"=3 (0x3)

"SpyroService"=2 (0x2)

"aawservice"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"Host-process Windows (Rundll32.exe)"= c:\documents and settings\Protoman\Application Data\System32\csrss.exe

"Client Server Runtime Process"= c:\documents and settings\Protoman\Application Data\csrss.exe

"Service Host Process for Windows"= c:\documents and settings\Protoman\Application Data\svchost.exe

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Documents and Settings\\Protoman\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

"c:\\Program Files\\mIRC\\mirc.exe"=

"c:\\Documents and Settings\\Protoman\\My Documents\\D Drive\\NES Nesticle\\NESTCL95.EXE"=

"c:\\Documents and Settings\\Protoman\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=

"c:\\Documents and Settings\\Protoman\\Application Data\\Tencent\\QQ\\STemp\\SetupEx~0\\QQSetupEx.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Spybot - Search & Destroy 2\\SDTray.exe"=

"c:\\Program Files\\Spybot - Search & Destroy 2\\SDFSSvc.exe"=

"c:\\Program Files\\Spybot - Search & Destroy 2\\SDUpdate.exe"=

"c:\\Program Files\\Spybot - Search & Destroy 2\\SDUpdSvc.exe"=

"\\??\\c:\\WINDOWS\\system32\\winlogon.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\Spybot - Search & Destroy 2\SDFSSvc.exe [5/13/2015 2:17 AM 1738168]

R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\Spybot - Search & Destroy 2\SDUpdSvc.exe [5/13/2015 2:17 AM 2088408]

R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [9/12/2013 7:39 PM 57344]

R3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\drivers\lgbtport.sys [9/29/2009 9:11 AM 12160]

R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\drivers\lgbtbus.sys [9/29/2009 9:11 AM 10496]

R3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\drivers\lgvmodem.sys [9/29/2009 9:11 AM 12928]

R3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\drivers\mcvidrv.sys [10/10/2012 11:08 PM 34432]

R3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv.sys [10/10/2012 11:08 PM 25088]

R3 scrcap;scrcap;c:\windows\system32\drivers\scrcap.sys [12/27/2006 10:47 AM 9006]

S2 916e5338;SN.Sustainer;c:\windows\system32\rundll32.exe [8/4/2004 8:00 AM 33280]

S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files\Spybot - Search & Destroy 2\SDWSCSvc.exe [5/13/2015 2:17 AM 171928]

S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2/18/2015 7:11 PM 315488]

S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\D-Link\D-Link RangeBooster N DWA-542\jswpsapi.exe [9/12/2013 7:39 PM 356434]

S4 SpyroService;Spyro Portal Service;c:\program files\FS\Spyro Portal\FlashPortal.exe [9/9/2011 10:44 AM 48128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

Contents of the 'Scheduled Tasks' folder

2015-05-15 c:\windows\Tasks\Ejejetpfni.job

- c:\windows\system32\extsq.dll [2013-01-04 23:49]

2015-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-08 04:40]

2015-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-08 04:40]

2015-05-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-562591055-2147167427-1004Core.job

- c:\documents and settings\Protoman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-10 15:36]

2015-05-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-562591055-2147167427-1004UA.job

- c:\documents and settings\Protoman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-10 15:36]

2015-05-15 c:\windows\Tasks\Microsoft Windows XP End of Service Notification Logon.job

- c:\windows\system32\xp_eos.exe [2015-01-15 01:59]

2015-05-08 c:\windows\Tasks\Microsoft Windows XP End of Service Notification Monthly.job

- c:\windows\system32\xp_eos.exe [2015-01-15 01:59]

——- Supplementary Scan ——-

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

TCP: DhcpNameServer = 192.168.2.1

DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} - hxxp://cafeimg.hanmail.net/cab9_1/dmcc2.cab?Version=1,0,0,10

FF - ProfilePath - c:\documents and settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\

FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(yahoo.ytff.general.dontshowhpoffer, true

- - - - ORPHANS REMOVED - - - -

Notify-SDWinLogon - SDWinLogon.dll

MSConfigStartUp-etgismo - c:\documents and settings\Protoman\Local Settings\Application Data\etgismo.dll

MSConfigStartUp-QQIntl - c:\program files\Tencent\QQIntl\Bin\QQ.exe

AddRemove-{9143B17E-BBDE-4EA7-A4E3-20D384D9C8A5}_is1 - c:\windows\AppPatch\unins000.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2015-05-15 13:41

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

**************************************************************************

——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1364)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(380)

c:\windows\system32\WININET.dll

c:\program files\Google\Drive\googledrivesync32.dll

c:\windows\system32\ieframe.dll

c:\documents and settings\All Users\Application Data\{58C525CE-3049-415C-8553-F8D254D6744F}\mf.dll

———————— Other Running Processes ————————

c:\windows\system32\Ati2evxx.exe

c:\program files\D-Link\D-Link RangeBooster N DWA-542\acs.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Java\jre7\bin\jqs.exe

c:\program files\CyberLink\Shared Files\RichVideo.exe

**************************************************************************

Completion time: 2015-05-15 13:48:02 - machine was rebooted

ComboFix-quarantined-files.txt 2015-05-15 17:47

Pre-Run: 407,281,479,680 bytes free

Post-Run: 409,302,159,360 bytes free

- - End Of File - - 3952B032A4E456851B840057A21A174A

8F558EB6672622401DA993E1E865C861

ken545

Post #14May 15, 2015, 7:35 PM UTC

No ZeroAccess, thats good

One more scanner, this wont take long

Please download TDSSKiller

Download TDSSKiller.exe to your desktop, if it is prevented from being downloaded than download the Zip version and extract it to your desktop

Double click TDSSKiller To start the program <– XP/Vista Users

Right Click TDSSKiller and select RUN AS ADMINISTRATOR <–Windows 7 and 8

Press Start Scan

Only if Malicious objects are found then ensure Cure is selected

Then click Continue > Reboot now

Copy and paste the log in your next reply

A copy of the log will be saved automatically to the root of the drive (typically C:\)

DanielDude

Post #15May 16, 2015, 2:10 AM UTC

Did scan, nothing was found.

Computer still runs at 100% CPU Usage (see 2 attachment screen shots)

21:33:16.0546 0x0ec4 TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04

21:33:22.0875 0x0ec4 ============================================================

21:33:22.0875 0x0ec4 Current date / time: 2015/05/15 21:33:22.0875

21:33:22.0875 0x0ec4 SystemInfo:

21:33:22.0875 0x0ec4

21:33:22.0875 0x0ec4 OS Version: 5.1.2600 ServicePack: 3.0

21:33:22.0875 0x0ec4 Product type: Workstation

21:33:22.0875 0x0ec4 ComputerName: DANIEL

21:33:22.0875 0x0ec4 UserName: Protoman

21:33:22.0875 0x0ec4 Windows directory: C:\WINDOWS

21:33:22.0875 0x0ec4 System windows directory: C:\WINDOWS

21:33:22.0875 0x0ec4 Processor architecture: Intel x86

21:33:22.0875 0x0ec4 Number of processors: 2

21:33:22.0875 0x0ec4 Page size: 0x1000

21:33:22.0875 0x0ec4 Boot type: Normal boot

21:33:22.0875 0x0ec4 ============================================================

21:33:27.0312 0x0ec4 KLMD registered as C:\WINDOWS\system32\drivers\42702620.sys

21:33:27.0375 0x0ec4 System UUID: {ABFF1214-BBCC-BD15-1F4B-5B78AE99D86D}

21:33:28.0656 0x0ec4 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

21:33:28.0671 0x0ec4 ============================================================

21:33:28.0671 0x0ec4 \Device\Harddisk0\DR0:

21:33:28.0671 0x0ec4 MBR partitions:

21:33:28.0671 0x0ec4 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74705982

21:33:28.0671 0x0ec4 ============================================================

21:33:28.0734 0x0ec4 C: <-> \Device\Harddisk0\DR0\Partition1

21:33:28.0734 0x0ec4 ============================================================

21:33:28.0734 0x0ec4 Initialize success

21:33:28.0734 0x0ec4 ============================================================

21:33:44.0921 0x0234 ============================================================

21:33:44.0921 0x0234 Scan started

21:33:44.0921 0x0234 Mode: Manual;

21:33:44.0921 0x0234 ============================================================

21:33:44.0921 0x0234 KSN ping started

21:34:13.0609 0x0234 KSN ping finished: true

21:34:16.0218 0x0234 ================ Scan system memory ========================

21:34:16.0218 0x0234 System memory - ok

21:34:16.0218 0x0234 ================ Scan services =============================

21:34:16.0421 0x0234 [ C07D5197410AAB28D0D93F943F59656D, 482164BA2B57C7026A7DF3213E0AC59B752A898D9B880BC0629F9CADD05D2894 ] 6to4 C:\WINDOWS\System32\6to4svc.dll

21:34:16.0421 0x0234 6to4 - ok

21:34:16.0640 0x0234 [ 037B1E7798960E0420003D05BB577EE6, DEE53D6D332DADD40C0CE34A425A6C0781F611765DCD4299D869F2B1EE80AE66 ] 916e5338 C:\WINDOWS\system32\rundll32.exe

21:34:16.0703 0x0234 916e5338 - ok

21:34:16.0828 0x0234 [ 0629361FAC4576BA48AB39F4903DCE9E, 6A22BE613A428664DB2474C8DBC55579EFAE25AAF7849F8D7CB9EA32051C32E8 ] aawservice C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

21:34:16.0859 0x0234 aawservice - ok

21:34:16.0875 0x0234 Abiosdsk - ok

21:34:16.0890 0x0234 abp480n5 - ok

21:34:16.0968 0x0234 [ 8FD99680A539792A30E97944FDAECF17, 594F8E0C3695400B0C09A797AF6BDFAC6F750ECD67D0EE803914C572B1DCC43C ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys

21:34:16.0968 0x0234 ACPI - ok

21:34:17.0015 0x0234 [ 9859C0F6936E723E4892D7141B1327D5, 5E8F6A2FC4DF2E5E92A1D66ECC2810E08B42B64E9CD0DF4AD3F78EA8558B90AF ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys

21:34:17.0015 0x0234 ACPIEC - ok

21:34:17.0093 0x0234 [ 3B12023C7D12176DEAF0D6D59AC5E9B4, B33F4A1E7A1453739E62A9359C04354306B290F71AA1176B22F22E2FC08B7477 ] ACS C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe

21:34:17.0109 0x0234 ACS - ok

21:34:17.0187 0x0234 [ C1EB9968EC89FBA5F3A264E2E57923AB, DEB0FC346C84FBF1192CC21D177BD1A8D86D552D5056BF95AE86B93C94124049 ] Adobe LM Service C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

21:34:17.0187 0x0234 Adobe LM Service - ok

21:34:17.0203 0x0234 adpu160m - ok

21:34:17.0265 0x0234 [ 8BED39E3C35D6A489438B8141717A557, 1B5796E56B0927360CE0759641B1151828BC0A9E45620D2B2D880491F5CE33D0 ] aec C:\WINDOWS\system32\drivers\aec.sys

21:34:17.0265 0x0234 aec - ok

21:34:17.0328 0x0234 [ A7B8A3A79D35215D798A300DF49ED23F, D441633C0F8E22F8976B95D6A3DCD552AA07C616AC5FE4379472954F7BE6075E ] Afc C:\WINDOWS\system32\drivers\Afc.sys

21:34:17.0328 0x0234 Afc - ok

21:34:17.0406 0x0234 [ 1E44BC1E83D8FD2305F8D452DB109CF9, CF5EC07E0B589FA2A4701C6CFD69E893FC3ABF274AD57AE3C13FFE49063B02C8 ] AFD C:\WINDOWS\System32\drivers\afd.sys

21:34:17.0406 0x0234 AFD - ok

21:34:17.0421 0x0234 Aha154x - ok

21:34:17.0437 0x0234 aic78u2 - ok

21:34:17.0453 0x0234 aic78xx - ok

21:34:17.0515 0x0234 [ A9A3DAA780CA6C9671A19D52456705B4, 67C959144B57AE0BBF1D82DBED197F32CDB06FECD883A80C441A0202FE83FAB4 ] Alerter C:\WINDOWS\system32\alrsvc.dll

21:34:17.0515 0x0234 Alerter - ok

21:34:17.0546 0x0234 [ 8C515081584A38AA007909CD02020B3D, A5E13CA10F702928E0DE84C74D0EA8ACCB117FD76FBABC55220C75C4FFD596DC ] ALG C:\WINDOWS\System32\alg.exe

21:34:17.0546 0x0234 ALG - ok

21:34:17.0562 0x0234 AliIde - ok

21:34:17.0578 0x0234 amsint - ok

21:34:17.0578 0x0234 AppMgmt - ok

21:34:17.0687 0x0234 [ 2F9A4BEB4163590B78E26CDEDC789ED4, 82640D8BD2EB9A4E663C551EBD4BD89BCBAD6C51FE2BADB064E9C0C43F95BE3C ] AR5416 C:\WINDOWS\system32\DRIVERS\athw.sys

21:34:17.0734 0x0234 AR5416 - ok

21:34:17.0765 0x0234 asc - ok

21:34:17.0781 0x0234 asc3350p - ok

21:34:17.0781 0x0234 asc3550 - ok

21:34:17.0812 0x0234 ASPI32 - ok

21:34:17.0984 0x0234 [ 776ACEFA0CA9DF0FAA51A5FB2F435705, 72DF7ED6B085BC468994F5B3189506FD726A9A17A9C42ACA1E420D787691361D ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

21:34:18.0015 0x0234 aspnet_state - ok

21:34:18.0046 0x0234 [ B153AFFAC761E7F5FCFA822B9C4E97BC, 7E60F572A6B3C6219E3C86225AA37243AFFD74337DB7F108B04778042E5CC959 ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys

21:34:18.0046 0x0234 AsyncMac - ok

21:34:18.0109 0x0234 [ 9F3A2F5AA6875C72BF062C712CFA2674, B4DF1D2C56A593C6B54DE57395E3B51D288F547842893B32B0F59228A0CF70B9 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys

21:34:18.0109 0x0234 atapi - ok

21:34:18.0125 0x0234 Atdisk - ok

21:34:18.0218 0x0234 [ E51398CD3B4C9BAE9D58D0AA35C8FE73, D8E697B8480503B544815F2BCFAB1BD08A52CA22B18AE3EBC9FBC97924C54A88 ] athr C:\WINDOWS\system32\DRIVERS\athr.sys

21:34:18.0250 0x0234 athr - ok

21:34:18.0328 0x0234 [ 38BBF02E43DC3212B2A75F335AA61810, 3004DDCE189DD75F921AC6C5B0D619DADBC5F5A911117CF545E0C986E337EFCB ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe

21:34:18.0343 0x0234 Ati HotKey Poller - ok

21:34:18.0406 0x0234 [ 32D1DFECCA0986DA7AD8B09440EA6214, A6FA785D75161CBACBF83DA4FCE8E31E20E68D198D27FAAF9347B89461133F0B ] ATI Smart C:\WINDOWS\system32\ati2sgag.exe

21:34:18.0437 0x0234 ATI Smart - ok

21:34:18.0546 0x0234 [ CD35697CB6C7E081EFFA98F46023E10B, 6EA6EFC65CFCEFDC8FD1D48E63CB89259F3897128C8560C809EFE9B5F80B971F ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

21:34:18.0609 0x0234 ati2mtag - ok

21:34:18.0625 0x0234 [ 9916C1225104BA14794209CFA8012159, 5D6F05F715C52A16D05CAE15C3DFE77A139A7F27F7AE710EC9A10F9EE05115A1 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys

21:34:18.0625 0x0234 Atmarpc - ok

21:34:18.0687 0x0234 [ DEF7A7882BEC100FE0B2CE2549188F9D, 462C95B63D0A1058291A2DC8CBFCB13D7D74CCD1CA43B613A7EB43D49E3276F8 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll

21:34:18.0687 0x0234 AudioSrv - ok

21:34:18.0750 0x0234 [ D9F724AA26C010A217C97606B160ED68, 329B5118F2409731D06FDAE85B6ADD64A048292801BCB3546651CEB303111695 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys

21:34:18.0750 0x0234 audstub - ok

21:34:18.0812 0x0234 [ DA1F27D85E0D1525F6621372E7B685E9, 5A81A46A3BDD19DAFC6C87D277267A5D44F3A1B5302F2CC1111D84B7BAD5610D ] Beep C:\WINDOWS\system32\drivers\Beep.sys

21:34:18.0812 0x0234 Beep - ok

21:34:18.0890 0x0234 [ 574738F61FCA2935F5265DC4E5691314, 3C7CCF064397186C3A3863DD2370AB6414A61B330097DCA4F299CA7BBAA3D1B4 ] BITS C:\WINDOWS\system32\qmgr.dll

21:34:18.0921 0x0234 BITS - ok

21:34:18.0984 0x0234 [ CFD4E51402DA9838B5A04AE680AF54A0, 5378F42B195B5832B00A05AD64E00473A45FFB86AC25C57241F26EA82B149FE1 ] Browser C:\WINDOWS\System32\browser.dll

21:34:18.0984 0x0234 Browser - ok

21:34:19.0015 0x0234 catchme - ok

21:34:19.0078 0x0234 [ 90A673FC8E12A79AFBED2576F6A7AAF9, BDE7858A3457DB979FEDD8577FA6321BF72848E4A7BF9F173C78A6A10CBB3EBE ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys

21:34:19.0078 0x0234 cbidf2k - ok

21:34:19.0109 0x0234 [ 0BE5AEF125BE881C4F854C554F2B025C, 1770DD70B3F115A0EF460907DEDC1E4B7241C08615A98F194D61A49C3E2BAA54 ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

21:34:19.0125 0x0234 CCDECODE - ok

21:34:19.0125 0x0234 cd20xrnt - ok

21:34:19.0203 0x0234 [ C1B486A7658353D33A10CC15211A873B, AA4DD9E7AAE5AAB1146B360B17001F975D2F29A1281CF7B13E7136480410F347 ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys

21:34:19.0203 0x0234 Cdaudio - ok

21:34:19.0281 0x0234 [ C885B02847F5D2FD45A24E219ED93B32, B26B2F8E3A831E2B65EB0C5195B0645CD50E22615CE79C9B0B391CD563B121DB ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys

21:34:19.0281 0x0234 Cdfs - ok

21:34:19.0343 0x0234 [ 1F4260CC5B42272D71F79E570A27A4FE, B51C2A3ED3C309953D0EA45869C8E464C10F2533DADE9E0286AF674979098D1D ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys

21:34:19.0343 0x0234 Cdrom - ok

21:34:19.0359 0x0234 Changer - ok

21:34:19.0421 0x0234 [ 1CFE720EB8D93A7158A4EBC3AB178BDE, 65D2A9D9A88F38D4AF323134C151BA0F4B3CD0F6A134AF86E7AC9D07319F1726 ] CiSvc C:\WINDOWS\system32\cisvc.exe

21:34:19.0421 0x0234 CiSvc - ok

21:34:19.0484 0x0234 [ 34CBE729F38138217F9C80212A2A0C82, A9FD7A758D12E0818A11BEEF1CE772FEFA8373E92EF6C0DA8628CD4572CC9A43 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe

21:34:19.0484 0x0234 ClipSrv - ok

21:34:19.0578 0x0234 [ D87ACAED61E417BBA546CED5E7E36D9C, 14AC6034A5BC0FB2A1AFDAD42BEF4DE641556E54AD30D0C46765660A4BE55462 ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

21:34:19.0671 0x0234 clr_optimization_v2.0.50727_32 - ok

21:34:19.0734 0x0234 [ C5A75EB48E2344ABDC162BDA79E16841, 6070A8AAFD38FBC6A68A2B10C20117612354DF21B4492D90CA522BFB6870D726 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

21:34:19.0812 0x0234 clr_optimization_v4.0.30319_32 - ok

21:34:19.0812 0x0234 CmdIde - ok

21:34:19.0843 0x0234 [ 7A0B457EEFEF8CBAA0CC44C8819113BD, F041B2DF7A68E9231DFF289056EF633FC4EED84C754A3D5EBD64C92FF468F3A1 ] CoachUsb C:\WINDOWS\system32\DRIVERS\CoachUsb.sys

21:34:19.0843 0x0234 CoachUsb - ok

21:34:19.0859 0x0234 [ 614CA0BFA09861E42AD8D14B83540758, F51917D30E7A7F286231B1E0A8F6C0E2C245AF96110D64D1A37A96EA683EF559 ] CoachVc C:\WINDOWS\system32\DRIVERS\CoachVc.sys

21:34:19.0875 0x0234 CoachVc - ok

21:34:19.0890 0x0234 COMSysApp - ok

21:34:19.0937 0x0234 Cpqarray - ok

21:34:19.0984 0x0234 [ 3D4E199942E29207970E04315D02AD3B, 0825960894CF9C86CC8775BDD2A262948A09CA495AA7FE9F210FAF49E7086383 ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll

21:34:19.0984 0x0234 CryptSvc - ok

21:34:20.0000 0x0234 dac2w2k - ok

21:34:20.0000 0x0234 dac960nt - ok

21:34:20.0078 0x0234 [ 6B27A5C03DFB94B4245739065431322C, 6AEAC16AB4E0DFD25123AAF4D4181FEE1B919B7B2793117006CE8CF30E826CFD ] DcomLaunch C:\WINDOWS\system32\rpcss.dll

21:34:20.0109 0x0234 DcomLaunch - ok

21:34:20.0140 0x0234 [ 5E38D7684A49CACFB752B046357E0589, F192AD4190BCFB6939A5CBC91648FE63168AF79A5E227A111DEAD6A92E42AB8D ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll

21:34:20.0156 0x0234 Dhcp - ok

21:34:20.0187 0x0234 [ 044452051F3E02E7963599FC8F4F3E25, 584BDDB074618BE76454CF90E74829CFF588B5B5FAEB793E2F7AAD26352DD689 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys

21:34:20.0187 0x0234 Disk - ok

21:34:20.0203 0x0234 dmadmin - ok

21:34:20.0281 0x0234 [ D992FE1274BDE0F84AD826ACAE022A41, C82BD6561A14F2932A761F5883A787B99031250EE5E9B7B5714AA045545C9B99 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys

21:34:20.0328 0x0234 dmboot - ok

21:34:20.0359 0x0234 [ 7C824CF7BBDE77D95C08005717A95F6F, A73CB323B7A6410C3D3F258BF204E716ADF8C84C9E4F6562C57AB73DAED8CCDE ] dmio C:\WINDOWS\system32\drivers\dmio.sys

21:34:20.0375 0x0234 dmio - ok

21:34:20.0390 0x0234 [ E9317282A63CA4D188C0DF5E09C6AC5F, D41E002F555FE9015EF620975255F58BB79198CA1FF0E09EC950CB450FF77CF7 ] dmload C:\WINDOWS\system32\drivers\dmload.sys

21:34:20.0390 0x0234 dmload - ok

21:34:20.0421 0x0234 [ 57EDEC2E5F59F0335E92F35184BC8631, 61F6F0DC2D1A6C61D5EF0D5CC4BE0FFC217F1E61FDA3EA9F704709293656600F ] dmserver C:\WINDOWS\System32\dmserver.dll

21:34:20.0437 0x0234 dmserver - ok

21:34:20.0453 0x0234 [ 8A208DFCF89792A484E76C40E5F50B45, 4E40E2EB38C6254E7CAA488200E89EE7DEBBBA773890BC6A84313CC68178D54F ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys

21:34:20.0453 0x0234 DMusic - ok

21:34:20.0500 0x0234 [ 5F7E24FA9EAB896051FFB87F840730D2, 356EEFDCD54DECAD0170B34B993E4BF80DD039E2B2922D7A8D09B84031E9FC7A ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll

21:34:20.0500 0x0234 Dnscache - ok

21:34:20.0593 0x0234 [ 0F0F6E687E5E15579EF4DA8DD6945814, 5C32D88119EB1465B2D719BEE2E05888D1A73454B5E33F2D4928DA710F8BFBA3 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll

21:34:20.0609 0x0234 Dot3svc - ok

21:34:20.0609 0x0234 dpti2o - ok

21:34:20.0625 0x0234 [ 8F5FCFF8E8848AFAC920905FBD9D33C8, C8C6FB97AB0871C8C88A2201525A5CF10D5131CB6980D32692ED7A8F58399AD5 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys

21:34:20.0625 0x0234 drmkaud - ok

21:34:20.0656 0x0234 [ B15F9E526BA511A48B1B1B8537815740, 5E3AD3B803FAF7EAEE8A63EF4B53ED547E95F8F5254D845AAA1BEF55068DFA9C ] drvmcdb C:\WINDOWS\system32\drivers\drvmcdb.sys

21:34:20.0656 0x0234 drvmcdb - ok

21:34:20.0671 0x0234 [ FA4670CAE95AE2BB857C68E535661145, 23AE41E92F03B93201BE140A41F02F2106AC4DDBD35B5A0F27FC3B7A28F36096 ] drvnddm C:\WINDOWS\system32\drivers\drvnddm.sys

21:34:20.0671 0x0234 drvnddm - ok

21:34:20.0718 0x0234 [ 7D91DC6342248369F94D6EBA0CF42E99, 3A0B94862AF1E085F1FD9B8B96FC1F7BD6FF00342AC04D697AB65BC686F7BC2F ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys

21:34:20.0734 0x0234 E100B - ok

21:34:20.0796 0x0234 [ 2187855A7703ADEF0CEF9EE4285182CC, 8233CC11F637866C0074043835A785EA2B616739B6B1181B143A253CF2508CFD ] EapHost C:\WINDOWS\System32\eapsvc.dll

21:34:20.0796 0x0234 EapHost - ok

21:34:20.0843 0x0234 [ BC93B4A066477954555966D77FEC9ECB, 27F5B780175EF46DA102EE33F7F33559C8B40C077EEA4405D579D9507F4B1C23 ] ERSvc C:\WINDOWS\System32\ersvc.dll

21:34:20.0843 0x0234 ERSvc - ok

21:34:20.0921 0x0234 [ 65DF52F5B8B6E9BBD183505225C37315, 59C606977DB40A3443DFF0BE2A4C761824881B22C9FDB3D23F6486DB580E92A4 ] Eventlog C:\WINDOWS\system32\services.exe

21:34:20.0921 0x0234 Eventlog - ok

21:34:21.0000 0x0234 [ D4991D98F2DB73C60D042F1AEF79EFAE, 58AF949EAEBF4FF3E3314DFB66CE4198BF65F0836B68CD27A6ED319742CCCCD2 ] EventSystem C:\WINDOWS\system32\es.dll

21:34:21.0015 0x0234 EventSystem - ok

21:34:21.0031 0x0234 [ 38D332A6D56AF32635675F132548343E, E6909DB836AF679B4F4D62C7396D6C82769CC7ABB8C919C2AABFE934FCE268F6 ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys

21:34:21.0031 0x0234 Fastfat - ok

21:34:21.0109 0x0234 [ 99BC0B50F511924348BE19C7C7313BBF, A1006C687BD352F700B140DC741515A0CDD9E1352C0FBD1EE410D404E344444B ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll

21:34:21.0125 0x0234 FastUserSwitchingCompatibility - ok

21:34:21.0140 0x0234 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81, 8307A532AB4D05CBBCE206DC2759497708BF5AAA880BD00F0E4F281D8578A1F5 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys

21:34:21.0140 0x0234 Fdc - ok

21:34:21.0187 0x0234 [ D45926117EB9FA946A6AF572FBE1CAA3, 4C94EF009D778BE0BDF8F812F026B96F91F641BE30AA2531427A5E63DBD280DA ] Fips C:\WINDOWS\system32\drivers\Fips.sys

21:34:21.0187 0x0234 Fips - ok

21:34:21.0203 0x0234 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0, 69C271AD5BCEBFD8AE5A769BDD7EC51256DA3A8ADAD5D12E5C0D13F4E82D8805 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys

21:34:21.0203 0x0234 Flpydisk - ok

21:34:21.0250 0x0234 [ B2CF4B0786F8212CB92ED2B50C6DB6B0, 280F5CF8A90F7BEDE73ADD0DD0F8952088133A7CA9A3D3B7041957E33B36845D ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys

21:34:21.0265 0x0234 FltMgr - ok

21:34:21.0359 0x0234 [ 8BA7C024070F2B7FDD98ED8A4BA41789, 47585006F86B2C6016EC54250A416794792D1E4024FF229C120BC25B684AF66A ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

21:34:21.0359 0x0234 FontCache3.0.0.0 - ok

21:34:21.0375 0x0234 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A, EC635E071201A766845D48973772CBE0958942B4162F3F5F70660D114CC877E0 ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys

21:34:21.0375 0x0234 Fs_Rec - ok

21:34:21.0390 0x0234 [ 6AC26732762483366C3969C9E4D2259D, FF2C9A23CC17F380093F0BEA955B1925794271C2FEA16B9B7639668E6999BAE3 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys

21:34:21.0406 0x0234 Ftdisk - ok

21:34:21.0437 0x0234 [ 0A02C63C8B144BD8C86B103DEE7C86A2, 7A3235DD3E1995DD72B212FAEB3ECA2A974434DE9BF6D269EA11BA65A80E7E50 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys

21:34:21.0437 0x0234 Gpc - ok

21:34:21.0562 0x0234 [ 0C03FB91E17987EED93F60007B08DAA0, BF4549F45FA1B291339E5053738B95BA50F021225F294F7B1ED9DACBD09BA426 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe

21:34:21.0578 0x0234 gupdate - ok

21:34:21.0578 0x0234 [ 0C03FB91E17987EED93F60007B08DAA0, BF4549F45FA1B291339E5053738B95BA50F021225F294F7B1ED9DACBD09BA426 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe

21:34:21.0593 0x0234 gupdatem - ok

21:34:21.0640 0x0234 [ 5D4BC124FAAE6730AC002CDB67BF1A1C, 00294F4DC7D17F6DD2A22B9C3299BED40146BA45C972367154D20DB502472551 ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

21:34:21.0656 0x0234 gusvc - ok

21:34:21.0671 0x0234 [ 160B24FD894E79E71C983EA403A6E6E7, 2D1A557BA9E1293A44BA00AB746A484A69B8DA1F95A1B6CEDA9D4352845E77C6 ] HdAudAddService C:\WINDOWS\system32\drivers\HdAudio.sys

21:34:21.0671 0x0234 HdAudAddService - ok

21:34:21.0718 0x0234 [ 573C7D0A32852B48F3058CFD8026F511, BC384BBA394AFDCDA1A9ABC858C692AA84A1F0A31AF3DDF7F38D120C027927FB ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

21:34:21.0734 0x0234 HDAudBus - ok

21:34:21.0843 0x0234 [ 4FCCA060DFE0C51A09DD5C3843888BCD, D82417706B517F2610DDF7C86BE03A72EFA9A2A389DF5C8F8ADEAB8144E2C80A ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

21:34:21.0859 0x0234 helpsvc - ok

21:34:21.0921 0x0234 [ DEB04DA35CC871B6D309B77E1443C796, F66A15C9528D661940F1F4CA453B3E95036D68C74C3B8AB53644211DBD3D2F32 ] HidServ C:\WINDOWS\System32\hidserv.dll

21:34:21.0921 0x0234 HidServ - ok

21:34:21.0937 0x0234 [ CCF82C5EC8A7326C3066DE870C06DAF1, 93395FA4C26B2E82DC8B7025ED3BCF583885E5D8C5F60CD6EEAA6335D6A126EC ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys

21:34:21.0937 0x0234 hidusb - ok

21:34:22.0031 0x0234 [ 8878BD685E490239777BFE51320B88E9, C5C3ECF6B049B6736E35B39518A8F830B45C45A88FFE8E3A6B7922AD946597E2 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll

21:34:22.0031 0x0234 hkmsvc - ok

21:34:22.0046 0x0234 hpn - ok

21:34:22.0140 0x0234 [ F80A415EF82CD06FFAF0D971528EAD38, 524D9E9201572929522F6805011783711B7C0F76308B924C89CF75F4B7A1FDF3 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys

21:34:22.0187 0x0234 HTTP - ok

21:34:22.0250 0x0234 [ 6100A808600F44D999CEBDEF8841C7A3, 61A75118C327812C60622010985A2E80E79B6FD9030A5732390EE5426E4AF6C9 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll

21:34:22.0265 0x0234 HTTPFilter - ok

21:34:22.0265 0x0234 i2omgmt - ok

21:34:22.0281 0x0234 i2omp - ok

21:34:22.0296 0x0234 [ 4A0B06AA8943C1E332520F7440C0AA30, DB2452390CCFE67E0C5FEB4FD42CA24ABE2DDD40D0B22DD5F5B8F70416863918 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys

21:34:22.0296 0x0234 i8042prt - ok

21:34:22.0375 0x0234 [ 1CF03C69B49ACB70C722DF92755C0C8C, C227850C133F29BB9DED91A26A22AE077FD69629CEF35B67D305F016C4BDAA81 ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

21:34:22.0375 0x0234 IDriverT - ok

21:34:22.0453 0x0234 [ C01AC32DC5C03076CFB852CB5DA5229C, A4D7749220B5BC965D96A267F1E02FE8284A230BA249109207BD4B9EA8DFAC96 ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

21:34:22.0515 0x0234 idsvc - ok

21:34:22.0531 0x0234 [ 083A052659F5310DD8B6A6CB05EDCF8E, 48D39B03FFB6FAA1529B774443BA12618AE3982D9F65A7B9D18F2269F78B31F4 ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys

21:34:22.0531 0x0234 Imapi - ok

21:34:22.0593 0x0234 [ 30DEAF54A9755BB8546168CFE8A6B5E1, 3936228CD3125C763ABFCB93E86E4B43838202BCC0913A28E84AC0263B43EE0D ] ImapiService C:\WINDOWS\system32\imapi.exe

21:34:22.0609 0x0234 ImapiService - ok

21:34:22.0625 0x0234 ini910u - ok

21:34:22.0640 0x0234 [ B5466A9250342A7AA0CD1FBA13420678, 87E735C4E8924A883AB692D387A83BCBFAE6E165688336AE7AB488F7CA8D339E ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys

21:34:22.0656 0x0234 IntelIde - ok

21:34:22.0671 0x0234 [ 8C953733D8F36EB2133F5BB58808B66B, 555868F246D73652E998B0B1296476E42FCEDED30D646CC000F31ECE4EBC25E6 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys

21:34:22.0671 0x0234 intelppm - ok

21:34:22.0687 0x0234 [ 3BB22519A194418D5FEC05D800A19AD0, F6662F440950596DC1382DD1DB5D7891CCEA30A6062BEA942C18445B5F0D8B16 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys

21:34:22.0687 0x0234 Ip6Fw - ok

21:34:22.0750 0x0234 [ 731F22BA402EE4B62748ADAF6363C182, 5C3BEBD008A5BE4DC2F92076FF41A10DDC01E10EC7E6552213CFA11970811848 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

21:34:22.0765 0x0234 IpFilterDriver - ok

21:34:22.0781 0x0234 [ B87AB476DCF76E72010632B5550955F5, E6E74D3A86A7917A8BAED44F8E97CCD2EB171E4E4B27E9907F60D1523FAF319A ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys

21:34:22.0781 0x0234 IpInIp - ok

21:34:22.0812 0x0234 [ CC748EA12C6EFFDE940EE98098BF96BB, AF523E21C25D9A1715EFEA573E4F52AF5D4FC9F28A2D613F5DB629C186C439E0 ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys

21:34:22.0812 0x0234 IpNat - ok

21:34:22.0843 0x0234 [ 23C74D75E36E7158768DD63D92789A91, 394D296F38E7D8EFD91A6EEC301D9CE6AF910E35EB9819F1A9E3363863AEDFDC ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys

21:34:22.0843 0x0234 IPSec - ok

21:34:22.0859 0x0234 [ C93C9FF7B04D772627A3646D89F7BF89, 805FA48E7A46D4F10240BF880A2468F53DEA36E83004399228AB70DB7D20544A ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys

21:34:22.0859 0x0234 IRENUM - ok

21:34:22.0875 0x0234 [ 05A299EC56E52649B1CF2FC52D20F2D7, 2654619DB3E6D6C385B63AB02F87D4241C4F0250CC31383D1B3586917166C2DC ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys

21:34:22.0875 0x0234 isapnp - ok

21:34:22.0937 0x0234 [ 77430E8234A0050ECCC5E2F5B30A7BEF, 3D05B97C01B1B7E0700369DEB15C8B5A083309518B6FDBADE6924637DEC4ABFF ] JavaQuickStarterService C:\Program Files\Java\jre7\bin\jqs.exe

21:34:22.0953 0x0234 JavaQuickStarterService - ok

21:34:23.0015 0x0234 [ 501EBB1AA7E3358AE70DD5F2BE2A69E0, 4BF94EDF4C1D315FC56C0B744DFF7D70F3A114FED4A00B4499865FEE36C13139 ] jswpsapi C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\jswpsapi.exe

21:34:23.0031 0x0234 jswpsapi - ok

21:34:23.0125 0x0234 [ 20E5E4D1C055F36D341D7CDA92B99DC8, 7B0447761E5A6AB6194AD42FED5113DE0AF282F069F530A9E209CFF677703A61 ] JSWSCIMD C:\WINDOWS\system32\DRIVERS\jswscimd.sys

21:34:23.0125 0x0234 JSWSCIMD - ok

21:34:23.0156 0x0234 [ 463C1EC80CD17420A542B7F36A36F128, E3B11BA26AFEAFB50B0FC168EA07F6049DA6B88BCDDEEE20310602D7FC27A3A7 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys

21:34:23.0156 0x0234 Kbdclass - ok

21:34:23.0203 0x0234 [ 9EF487A186DEA361AA06913A75B3FA99, B94EBA4EC6D85E11C81AF9927E9EF0AF2E6FE134CFF1FDB0535B7C5A794B4261 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys

21:34:23.0203 0x0234 kbdhid - ok

21:34:23.0250 0x0234 [ 692BCF44383D056AED41B045A323D378, 1A99DEE83FFAF64E73067FC049C0A4CE07D94E4AE31EFA17B38CEFA9E41D67DC ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys

21:34:23.0265 0x0234 kmixer - ok

21:34:23.0296 0x0234 [ B467646C54CC746128904E1654C750C1, 3BD71BE3663EA23463D236D8A2A2E42DFA10C502BDB4B6E131FAF0FBA748219E ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys

21:34:23.0312 0x0234 KSecDD - ok

21:34:23.0359 0x0234 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527, 0044F03132596A494448CCE5F3D6ECC12617BB4CF6BAE348F79D4DC40ACD6EE0 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll

21:34:23.0359 0x0234 lanmanserver - ok

21:34:23.0421 0x0234 [ A8888A5327621856C0CEC4E385F69309, B08B63300D824E35E31EEEA2C4C086DFA2C2A964CEDAE512E74D3D88AADAA2C1 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll

21:34:23.0437 0x0234 lanmanworkstation - ok

21:34:23.0453 0x0234 lbrtfdc - ok

21:34:23.0531 0x0234 [ 4DD47B5AF0B24871EBB9EFC012A7474E, D35F979787C6B6654D5D6E4D0C1433FCB7B3FF9512B03330B3ADB8F052314296 ] LgBttPort C:\WINDOWS\system32\DRIVERS\lgbtport.sys

21:34:23.0531 0x0234 LgBttPort - ok

21:34:23.0562 0x0234 [ 1D038CA6C529203087A990E5E97887B4, 71C6FF0AC29C61513A9AB64DF43AD4360116C91204DD69BA2B0CBAA3E26FB436 ] lgbusenum C:\WINDOWS\system32\DRIVERS\lgbtbus.sys

21:34:23.0562 0x0234 lgbusenum - ok

21:34:23.0609 0x0234 [ 26F1976A330195D62A6224C76968CF0D, C47B9F2B52D1721543481E213281487E76694C1C5485432DDC35D01DCE8B8E4D ] LGVMODEM C:\WINDOWS\system32\DRIVERS\lgvmodem.sys

21:34:23.0609 0x0234 LGVMODEM - ok

21:34:23.0687 0x0234 [ A7DB739AE99A796D91580147E919CC59, EDF4E039BA277B0E6D66FEB0B28096E67D682C09DFC18ECECF062D9DCFB75ACF ] LmHosts C:\WINDOWS\System32\lmhsvc.dll

21:34:23.0687 0x0234 LmHosts - ok

21:34:23.0718 0x0234 [ D8C0B2EB928D57C928522EFF500C4BA8, B7261AB2DD262140489087C1A8F1A1DA5EE6373D453E5BC8A3F7B93A5540CE6C ] ManyCam C:\WINDOWS\system32\DRIVERS\mcvidrv.sys

21:34:23.0718 0x0234 ManyCam - ok

21:34:23.0750 0x0234 [ 964BD01FD77026F93F15040027F6F579, 7812F242A06F638094F63A1A254E1F1693EBFE2883C85E02C08301512A5585A2 ] mcaudrv_simple C:\WINDOWS\system32\drivers\mcaudrv.sys

21:34:23.0750 0x0234 mcaudrv_simple - ok

21:34:23.0796 0x0234 [ 986B1FF5814366D71E0AC5755C88F2D3, E6AF051174531C24B38E73987755D366ABEC595476C6D17793E8DCCC73F55340 ] Messenger C:\WINDOWS\System32\msgsvc.dll

21:34:23.0796 0x0234 Messenger - ok

21:34:23.0843 0x0234 [ 4AE068242760A1FB6E1A44BF4E16AFA6, 1FB771162B96AAF787AC24867B818DF8511F0780BB094FA9A38C11D8DBFE68BC ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys

21:34:23.0843 0x0234 mnmdd - ok

21:34:23.0890 0x0234 [ D18F1F0C101D06A1C1ADF26EED16FCDD, BA0837C7780BD8262E143E2935AFA63BE59C3C39EF56CB8608EED0F50AF070D4 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe

21:34:23.0890 0x0234 mnmsrvc - ok

21:34:23.0906 0x0234 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1, B342CC9EC3729AB1AB4B5E2E99F890C1E0CA649162DE91F6768AB857B719E97B ] Modem C:\WINDOWS\system32\drivers\Modem.sys

21:34:23.0906 0x0234 Modem - ok

21:34:23.0921 0x0234 [ 35C9E97194C8CFB8430125F8DBC34D04, 0C0FCE6B0A23FB0ECB92E1663E1C72D2DD5B177D82E04782957690B69530DB39 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys

21:34:23.0921 0x0234 Mouclass - ok

21:34:23.0953 0x0234 [ B1C303E17FB9D46E87A98E4BA6769685, 161A45488522055D0F0474ABEDA04DDD0B5DAC2411AF9154B15190BBD66E7153 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys

21:34:23.0953 0x0234 mouhid - ok

21:34:23.0968 0x0234 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD, 2A5E15ED2C24C6C65EF2F7E1FD93374774076C9D8D451E4422561F4D269C012F ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys

21:34:23.0968 0x0234 MountMgr - ok

21:34:24.0046 0x0234 [ 03D14BF1DC59130002F6B8BA3AD89DB9, 1729CCD8AAF51CDB86ED67569974D0B6B1CFFA5F90EF6E6004B0D8A305D88C27 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

21:34:24.0078 0x0234 MozillaMaintenance - ok

21:34:24.0093 0x0234 mraid35x - ok

21:34:24.0125 0x0234 [ 11D42BB6206F33FBB3BA0288D3EF81BD, 76ABCFB62C5AC549F58C231F72A99882CDEB74928104B77FE52554765C2B1A22 ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys

21:34:24.0140 0x0234 MRxDAV - ok

21:34:24.0171 0x0234 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0, DB9B186F7076D7B94F45041AF7B77C1AD2CAB504D683B459C6CB1C22840ED170 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

21:34:24.0187 0x0234 MRxSmb - ok

21:34:24.0218 0x0234 [ A137F1470499A205ABBB9AAFB3B6F2B1, FB4951727543030D9E6ED74149C3FAACE2CA9DA8C1B5F616301B30B858C724E8 ] MSDTC C:\WINDOWS\system32\msdtc.exe

21:34:24.0218 0x0234 MSDTC - ok

21:34:24.0250 0x0234 [ C941EA2454BA8350021D774DAF0F1027, C940E978C7B66A713A0FDAB54B5F995DF59D089AFCD96221DD3222948CD49BBD ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys

21:34:24.0250 0x0234 Msfs - ok

21:34:24.0265 0x0234 MSIServer - ok

21:34:24.0265 0x0234 [ D1575E71568F4D9E14CA56B7B0453BF1, 4ABE0E24786C0D39FA2B885447E56204CA6942FB175E534DCE675D7BCF0B176A ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys

21:34:24.0281 0x0234 MSKSSRV - ok

21:34:24.0281 0x0234 [ 325BB26842FC7CCC1FCCE2C457317F3E, C07BE560513B1FB91D756494F0BA4AEEB2E1998DE0E1C21EE83DB1183B0CEE91 ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys

21:34:24.0296 0x0234 MSPCLOCK - ok

21:34:24.0328 0x0234 [ BAD59648BA099DA4A17680B39730CB3D, 9AD4C7C94C186C8815D0BC75DCAFB962158DA6935A244BA243EDDDEB33F9816C ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys

21:34:24.0328 0x0234 MSPQM - ok

21:34:24.0359 0x0234 [ AF5F4F3F14A8EA2C26DE30F7A1E17136, AC93A1E4ABB0D038B772E429015567E44CC2EDB66C54DBE23A5F98176FAC1520 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys

21:34:24.0359 0x0234 mssmbios - ok

21:34:24.0375 0x0234 [ E53736A9E30C45FA9E7B5EAC55056D1D, 38602F280BF69EBA3706AD175AFC1AEB561A8302B4B61E3FECB3C27D7A9BDB41 ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys

21:34:24.0375 0x0234 MSTEE - ok

21:34:24.0421 0x0234 [ DE6A75F5C270E756C5508D94B6CF68F5, FCC972DDC36C2C44D836913F10004C2C33B11C54DEFFF0C63E0FDF901D2F9261 ] Mup C:\WINDOWS\system32\drivers\Mup.sys

21:34:24.0437 0x0234 Mup - ok

21:34:24.0453 0x0234 [ 5B50F1B2A2ED47D560577B221DA734DB, C16A554B6E1A7F5F98C94DFA88163E0F7426506BF2F51FD351B1A05FC0DB3BC5 ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

21:34:24.0468 0x0234 NABTSFEC - ok

21:34:24.0531 0x0234 [ 0102140028FAD045756796E1C685D695, 5335B8278418CA200E2772124F0602C3E15A5CAF2D5CC59F6785DFAABF339B09 ] napagent C:\WINDOWS\System32\qagentrt.dll

21:34:24.0546 0x0234 napagent - ok

21:34:24.0578 0x0234 [ 1DF7F42665C94B825322FAE71721130D, FE0DCB728471465B39A42A7511F4133021FBA5DF88F88BCB5FE2FF34CFD713F9 ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys

21:34:24.0578 0x0234 NDIS - ok

21:34:24.0593 0x0234 [ 7FF1F1FD8609C149AA432F95A8163D97, 18CD1FF5AC1EF8A38D1EC53014F2BADD28D9CDF4ECE2EBC2313D08903776F323 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys

21:34:24.0593 0x0234 NdisIP - ok

21:34:24.0609 0x0234 [ 0109C4F3850DFBAB279542515386AE22, 4F6DB1E499AC853FD36FD603FBB6D3AC9BDCEB298C7FE1FB59A9236CB46729B2 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys

21:34:24.0609 0x0234 NdisTapi - ok

21:34:24.0656 0x0234 [ F927A4434C5028758A842943EF1A3849, B1AA3AF150C05307461774925901789456B0CCCD03A5E71ADA4AB58455962BEE ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys

21:34:24.0656 0x0234 Ndisuio - ok

21:34:24.0656 0x0234 [ EDC1531A49C80614B2CFDA43CA8659AB, 494042F790F33721328B4451E79842E21919681CC421A4F9633EC4D383E06097 ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys

21:34:24.0671 0x0234 NdisWan - ok

21:34:24.0703 0x0234 [ 2F597BB467E05B1FE3830EABD821B8E0, 141497F5A49D47CCE3C9289644F4BD838DCB238F6D8E847FC006652E21FE02AC ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys

21:34:24.0703 0x0234 NDProxy - ok

21:34:24.0718 0x0234 [ 5D81CF9A2F1A3A756B66CF684911CDF0, 7989C36607CAEA17AFA2C1C9904145CA0714A54B9F712D9D4C1AB140D0B2CC0C ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys

21:34:24.0718 0x0234 NetBIOS - ok

21:34:24.0750 0x0234 [ 74B2B2F5BEA5E9A3DC021D685551BD3D, 7932B71F98B4122BE88F576BF6D745A757AE378A48924B7F4358837B75640A82 ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys

21:34:24.0750 0x0234 NetBT - ok

21:34:24.0812 0x0234 [ B857BA82860D7FF85AE29B095645563B, 86FF0E4CDD9C394E8BABD93A4D57E73FF9A779261717DEC6E9CDE99F1C6B0F4C ] NetDDE C:\WINDOWS\system32\netdde.exe

21:34:24.0828 0x0234 NetDDE - ok

21:34:24.0828 0x0234 [ B857BA82860D7FF85AE29B095645563B, 86FF0E4CDD9C394E8BABD93A4D57E73FF9A779261717DEC6E9CDE99F1C6B0F4C ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe

21:34:24.0843 0x0234 NetDDEdsdm - ok

21:34:24.0890 0x0234 [ BF2466B3E18E970D8A976FB95FC1CA85, F7794B5D12DC5D820A162850F4388E2AA80426AD07CB221799CF941C682AB501 ] Netlogon C:\WINDOWS\system32\lsass.exe

21:34:24.0890 0x0234 Netlogon - ok

21:34:24.0968 0x0234 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE, 4E0A67B3CC897E80D4B342FFE8B7B4CC4F6CA2EF2D34C136027A098B2E1C6166 ] Netman C:\WINDOWS\System32\netman.dll

21:34:24.0968 0x0234 Netman - ok

21:34:25.0031 0x0234 [ D22CD77D4F0D63D1169BB35911BFF12D, 85B1FDFA02E1B8EA4FCB9B7EEB687C5C448697FC7EC9D178C5A2F64D2C9CFEE8 ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

21:34:25.0093 0x0234 NetTcpPortSharing - ok

21:34:25.0171 0x0234 [ 943337D786A56729263071623BBB9DE5, B631B47C869FE4ACF46E4AA272435D9A9CA536E3349E3FFBB8602636FEE7AFD4 ] Nla C:\WINDOWS\System32\mswsock.dll

21:34:25.0187 0x0234 Nla - ok

21:34:25.0203 0x0234 [ 3182D64AE053D6FB034F44B6DEF8034A, 4ADFC76965BA2A5F488E71789A4E4EA702A74AF42725F72130D1CA919406CF19 ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys

21:34:25.0203 0x0234 Npfs - ok

21:34:25.0234 0x0234 [ 78A08DD6A8D65E697C18E1DB01C5CDCA, E0E6F3ED05068E32F1D5C2D2B38CDEF4536B8656DB6756C66CF6B40B60C8F3DA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys

21:34:25.0265 0x0234 Ntfs - ok

21:34:25.0281 0x0234 [ BF2466B3E18E970D8A976FB95FC1CA85, F7794B5D12DC5D820A162850F4388E2AA80426AD07CB221799CF941C682AB501 ] NtLmSsp C:\WINDOWS\system32\lsass.exe

21:34:25.0281 0x0234 NtLmSsp - ok

21:34:25.0343 0x0234 [ 156F64A3345BD23C600655FB4D10BC08, 9611BE411586E068D9297D77102DB3BE48AA67F1BAD6F61A84F83FC3043FA9CD ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll

21:34:25.0359 0x0234 NtmsSvc - ok

21:34:25.0421 0x0234 [ 73C1E1F395918BC2C6DD67AF7591A3AD, B21133A75253EC15E2DFF66D3B480AB1A7E1A2360476C810E7AA55D0F0EB08D4 ] Null C:\WINDOWS\system32\drivers\Null.sys

21:34:25.0421 0x0234 Null - ok

21:34:25.0468 0x0234 [ B305F3FAD35083837EF46A0BBCE2FC57, 9D0E0E666D652D0FC9EAB97280A5D67AAF61D6B21929DF7CF8ED72A367720464 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

21:34:25.0500 0x0234 NwlnkFlt - ok

21:34:25.0500 0x0234 [ C99B3415198D1AAB7227F2C88FD664B9, DD8DA4B5E804F134AB9233859544C025062902DFC3E8FB8A09A67337A4E73F55 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

21:34:25.0515 0x0234 NwlnkFwd - ok

21:34:25.0546 0x0234 [ 937A02981F11B2CE96B1D493C95AED2B, C619E1B6593E4BF740E631CC5A886C8E10D8796145C0A38417F9C599C2F54191 ] p2pgasvc C:\WINDOWS\system32\p2pgasvc.dll

21:34:25.0562 0x0234 p2pgasvc - ok

21:34:25.0640 0x0234 [ 4A1035CB8F0D57BE41873B5183D96CF4, D6F53EEEA56C724BF3F7DABC2DD7E1E995B07BE32CB0AF0F77EB6651B741F050 ] p2pimsvc C:\WINDOWS\system32\p2psvc.dll

21:34:25.0687 0x0234 p2pimsvc - ok

21:34:25.0718 0x0234 [ 4A1035CB8F0D57BE41873B5183D96CF4, D6F53EEEA56C724BF3F7DABC2DD7E1E995B07BE32CB0AF0F77EB6651B741F050 ] p2psvc C:\WINDOWS\system32\p2psvc.dll

21:34:25.0750 0x0234 p2psvc - ok

21:34:25.0781 0x0234 [ 5575FAF8F97CE5E713D108C2A58D7C7C, 96D4595D19A78CCBE8B325A08780AC077AE5CC99642ACD72FB47AEAE8D344D3B ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys

21:34:25.0781 0x0234 Parport - ok

21:34:25.0796 0x0234 [ BEB3BA25197665D82EC7065B724171C6, 7E71C13BA30CD95CEE8A9CC85E6F48A01F30EDEAADEE69D80AE828BF97E5A5CA ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys

21:34:25.0796 0x0234 PartMgr - ok

21:34:25.0859 0x0234 [ 70E98B3FD8E963A6A46A2E6247E0BEA1, 6771313EC41B3B5BFD398F60706E40BE71617046880CC352DD110B001AFC22A1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys

21:34:25.0859 0x0234 ParVdm - ok

21:34:25.0875 0x0234 [ A219903CCF74233761D92BEF471A07B1, D4E6C360A1D2FCA4D17C991B834D68BF20F5111DD06B1FAB8B22984804CEC269 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys

21:34:25.0875 0x0234 PCI - ok

21:34:25.0890 0x0234 PCIDump - ok

21:34:25.0921 0x0234 [ CCF5F451BB1A5A2A522A76E670000FF0, D63F7E5A39653EC9CCE94B7D84B2D3EBD4F54533BD65701020198724042C9257 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys

21:34:25.0921 0x0234 PCIIde - ok

21:34:25.0968 0x0234 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1, 0BA3DB21DC7C641C181E2635B5C9B73965FDCDCD3EBBBE48FCFEC1C8C987F617 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys

21:34:25.0968 0x0234 Pcmcia - ok

21:34:25.0984 0x0234 PDCOMP - ok

21:34:26.0000 0x0234 PDFRAME - ok

21:34:26.0000 0x0234 PDRELI - ok

21:34:26.0031 0x0234 PDRFRAME - ok

21:34:26.0046 0x0234 perc2 - ok

21:34:26.0046 0x0234 perc2hib - ok

21:34:26.0093 0x0234 [ 444F122E68DB44C0589227781F3C8B3F, 99581AD22CBD3B647E719E250291C315099B62FDF80671225F0C5A05489D0F91 ] pfc C:\WINDOWS\system32\drivers\pfc.sys

21:34:26.0093 0x0234 pfc - ok

21:34:26.0156 0x0234 [ 8754763A924639B9D07D4C8EA9990F1E, 1BE6007A93E2DF2E6715250D65DBC7F5B461F36D9CBA3E7D80E88270552E392F ] PhilCam8116 C:\WINDOWS\system32\DRIVERS\CamDrO21.sys

21:34:26.0171 0x0234 PhilCam8116 - ok

21:34:26.0234 0x0234 [ 65DF52F5B8B6E9BBD183505225C37315, 59C606977DB40A3443DFF0BE2A4C761824881B22C9FDB3D23F6486DB580E92A4 ] PlugPlay C:\WINDOWS\system32\services.exe

21:34:26.0234 0x0234 PlugPlay - ok

21:34:26.0281 0x0234 [ 4A1035CB8F0D57BE41873B5183D96CF4, D6F53EEEA56C724BF3F7DABC2DD7E1E995B07BE32CB0AF0F77EB6651B741F050 ] PNRPSvc C:\WINDOWS\system32\p2psvc.dll

21:34:26.0296 0x0234 PNRPSvc - ok

21:34:26.0312 0x0234 [ BF2466B3E18E970D8A976FB95FC1CA85, F7794B5D12DC5D820A162850F4388E2AA80426AD07CB221799CF941C682AB501 ] PolicyAgent C:\WINDOWS\system32\lsass.exe

21:34:26.0312 0x0234 PolicyAgent - ok

21:34:26.0328 0x0234 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99, C5F0C8C66A3AF7E7BB04CEDE4AC5306F8387AB384A2107DC5BE413AAE968EFF1 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys

21:34:26.0343 0x0234 PptpMiniport - ok

21:34:26.0359 0x0234 [ BF2466B3E18E970D8A976FB95FC1CA85, F7794B5D12DC5D820A162850F4388E2AA80426AD07CB221799CF941C682AB501 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe

21:34:26.0359 0x0234 ProtectedStorage - ok

21:34:26.0375 0x0234 [ 09298EC810B07E5D582CB3A3F9255424, 35473A1BE25AC289474090EB0806AC6B3035DC33D1F3DF97A14BF1E361AC6AC3 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys

21:34:26.0375 0x0234 PSched - ok

21:34:26.0390 0x0234 [ 80D317BD1C3DBC5D4FE7B1678C60CADD, DA76804B55D0CAB3DDD01EFC06673764AE4860693375C658B6063FB14AF7F12C ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys

21:34:26.0390 0x0234 Ptilink - ok

21:34:26.0421 0x0234 [ 30CBAE0A34359F1CD19D1576245149ED, 3342640F1B3114CD4B426EE3B082AC008E244BF592BB0A9644ADB78A43C85A35 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys

21:34:26.0421 0x0234 PxHelp20 - ok

21:34:26.0437 0x0234 ql1080 - ok

21:34:26.0437 0x0234 Ql10wnt - ok

21:34:26.0453 0x0234 ql12160 - ok

21:34:26.0468 0x0234 ql1240 - ok

21:34:26.0484 0x0234 ql1280 - ok

21:34:26.0500 0x0234 [ FE0D99D6F31E4FAD8159F690D68DED9C, 998685622ABE631984B7E4DBF91AB3594B1F574378D75EB9F6265F4650470692 ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys

21:34:26.0500 0x0234 RasAcd - ok

21:34:26.0531 0x0234 [ AD188BE7BDF94E8DF4CA0A55C00A5073, C7D76CB579FAEBCCC2873499441BACDD6BD6668ACF5ED7F31862656E96E2B20C ] RasAuto C:\WINDOWS\System32\rasauto.dll

21:34:26.0546 0x0234 RasAuto - ok

21:34:26.0562 0x0234 [ 11B4A627BC9614B885C4969BFA5FF8A6, EAE0A412A2B0F68919C32A96B3A08CC1A06585E4998819F5C9051745F63FF5AD ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

21:34:26.0562 0x0234 Rasl2tp - ok

21:34:26.0625 0x0234 [ 76A9A3CBEADD68CC57CDA5E1D7448235, 4AFD048C5D2306AB8DE46F3AA60AC0213333DDA3B09A9E91F7585DB6EB978EC8 ] RasMan C:\WINDOWS\System32\rasmans.dll

21:34:26.0640 0x0234 RasMan - ok

21:34:26.0656 0x0234 [ 5BC962F2654137C9909C3D4603587DEE, A5CE5653D0105240F5E86CFAAB89E7917D42D939E2F27A5A7D6979289CA651B8 ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys

21:34:26.0656 0x0234 RasPppoe - ok

21:34:26.0671 0x0234 [ FDBB1D60066FCFBB7452FD8F9829B242, 10A2DACF944BD000032EBA8C095CB3D879CC55B28C377ADF6E52E508E47444DB ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys

21:34:26.0671 0x0234 Raspti - ok

21:34:26.0703 0x0234 [ 7AD224AD1A1437FE28D89CF22B17780A, 6645235CA27D671954E3557FA37082881C3D7D47492C71264CD8CB8D108EC801 ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys

21:34:26.0703 0x0234 Rdbss - ok

21:34:26.0718 0x0234 [ 4912D5B403614CE99C28420F75353332, 975341ECD660209987B5E5171B8315E032439E408CBE8A5986E67AF767F373BB ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

21:34:26.0718 0x0234 RDPCDD - ok

21:34:26.0796 0x0234 [ 43AF5212BD8FB5BA6EED9754358BD8F7, AF330F61CECA4AFA359CEABC5EB3227E6B56A9A2DCE50701381D665122D7356D ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys

21:34:26.0796 0x0234 RDPWD - ok

21:34:26.0843 0x0234 [ 3C37BF86641BDA977C3BF8A840F3B7FA, AB9A6E54DBA3F4561CD4837372BECCE0D73943D02E3288F944333039375AC08C ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe

21:34:26.0843 0x0234 RDSessMgr - ok

21:34:26.0859 0x0234 [ F828DD7E1419B6653894A8F97A0094C5, E6150E1F598BA4CFEDB8FF075BC0D576518C331B864388F1CAE8812EFF106ECF ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys

21:34:26.0859 0x0234 redbook - ok

21:34:26.0906 0x0234 [ 7E699FF5F59B5D9DE5390E3C34C67CF5, 3FCF0442D80AB181FED4303E570378736AA1F8718C0B8B70F689A1E45200FFE4 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll

21:34:26.0921 0x0234 RemoteAccess - ok

21:34:27.0015 0x0234 [ 616F6E52CAE254727A886BA8EDA1BEEA, 537EE7A8959E4CBCD243C66A54AF64E5D48F9780893D8450A07645FC3DA61C0B ] RichVideo C:\Program Files\CyberLink\Shared Files\RichVideo.exe

21:34:27.0031 0x0234 RichVideo - ok

21:34:27.0093 0x0234 [ 4F4A4C09CC5BE58A76CAC1C337E004E6, 5DFFB1C60709A80DAC46BCBB9BA76408332A681EFA6ABB330CD74236109F4296 ] RimUsb C:\WINDOWS\system32\Drivers\RimUsb.sys

21:34:27.0093 0x0234 RimUsb - ok

21:34:27.0140 0x0234 [ 3A5633AD615E2B15291BD0B1B97CCD8A, 17E6FE788E8FBC6CB84B68F49FAFB4F63398EA97D89AACF677B338464B68E2AD ] RimVSerPort C:\WINDOWS\system32\DRIVERS\RimSerial.sys

21:34:27.0140 0x0234 RimVSerPort - ok

21:34:27.0203 0x0234 [ D8B0B4ADE32574B2D9C5CC34DC0DBBE7, CDF10D3D8ADA7ADB1CC1567BFA986557C6D69F4099B70FDFABD4C3D09E3CA778 ] ROOTMODEM C:\WINDOWS\system32\Drivers\RootMdm.sys

21:34:27.0203 0x0234 ROOTMODEM - ok

21:34:27.0265 0x0234 [ AAED593F84AFA419BBAE8572AF87CF6A, CC0FFC5A69394C8830DC66320DA01A820BBF41AD7E57D0FC343561DC5EF9A360 ] RpcLocator C:\WINDOWS\system32\locator.exe

21:34:27.0265 0x0234 RpcLocator - ok

21:34:27.0312 0x0234 [ 6B27A5C03DFB94B4245739065431322C, 6AEAC16AB4E0DFD25123AAF4D4181FEE1B919B7B2793117006CE8CF30E826CFD ] RpcSs C:\WINDOWS\System32\rpcss.dll

21:34:27.0343 0x0234 RpcSs - ok

21:34:27.0390 0x0234 [ 471B3F9741D762ABE75E9DEEA4787E47, D9ADE42965EC22AEB4B2AD21D429C3C8232A60AA9853DEFDA7AED86A13FE8623 ] RSVP C:\WINDOWS\system32\rsvp.exe

21:34:27.0406 0x0234 RSVP - ok

21:34:27.0453 0x0234 [ 05691B0B52575C057E5AC35242E5D231, 6D3DBBD840B933410BBDDEE6724961D21333F943A55010F7EF94676342144AF1 ] RT25USBAP C:\WINDOWS\system32\DRIVERS\rt25usbap.sys

21:34:27.0468 0x0234 RT25USBAP - ok

21:34:27.0531 0x0234 [ BF2466B3E18E970D8A976FB95FC1CA85, F7794B5D12DC5D820A162850F4388E2AA80426AD07CB221799CF941C682AB501 ] SamSs C:\WINDOWS\system32\lsass.exe

21:34:27.0531 0x0234 SamSs - ok

21:34:27.0562 0x0234 [ 86D007E7A654B9A71D1D7D856B104353, 7B1DE53D637A5FC9619D5D07C48927AFEC89D959207F6F2E2F45DD054EEA04C7 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe

21:34:27.0578 0x0234 SCardSvr - ok

21:34:27.0640 0x0234 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA, 0B582F47BD70732BAC48B8B86E5D06CE7F299A20E8177F3F2E6F28217C3FB605 ] Schedule C:\WINDOWS\system32\schedsvc.dll

21:34:27.0656 0x0234 Schedule - ok

21:34:27.0703 0x0234 [ 8D837882B0C6750EDA99B82A13E5C9E2, 5982DD61615E69FD9CB2D4C5E681DED00F045592990A1D08D8C04C3E486FC04F ] scrcap C:\WINDOWS\system32\DRIVERS\scrcap.sys

21:34:27.0703 0x0234 scrcap - ok

21:34:27.0906 0x0234 [ D777F1417D9BB9F66CD9D9C3B61F730F, 0CBD830EB9D2B0F1946131F20907793B2D68A3BCEEC3EA5416972149F73DC815 ] SDScannerService C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe

21:34:28.0000 0x0234 SDScannerService - ok

21:34:28.0125 0x0234 [ 68D6C7F99BC73B88954D844FCCBEB2A0, F746861B103C8BE8EA234B9FCFBBDD2412C79FB65F2F1E0F5E6EBC0B34905FF1 ] SDUpdateService C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe

21:34:28.0671 0x0234 SDUpdateService - ok

21:34:28.0734 0x0234 [ 9B9B368A8FF5CAF91D7A333CF62CD2CC, A4AE7FFBBAF983BFDE15B521ED162CBC4E6FC85BCDB200C75D45878B3FFDFA68 ] SDWSCService C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe

21:34:28.0734 0x0234 SDWSCService - ok

21:34:28.0781 0x0234 [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys

21:34:28.0781 0x0234 Secdrv - ok

21:34:28.0843 0x0234 [ CBE612E2BB6A10E3563336191EDA1250, C331797DC3569F0E715766561DE2562F60B924378842246C35D2B1CF867E9D96 ] seclogon C:\WINDOWS\System32\seclogon.dll

21:34:28.0843 0x0234 seclogon - ok

21:34:28.0906 0x0234 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0, 7105B026F966A992430F86C3698ABE15EC73E4772F1A3E362E29FD5247A5DCA6 ] SENS C:\WINDOWS\system32\sens.dll

21:34:28.0906 0x0234 SENS - ok

21:34:28.0968 0x0234 [ 0F29512CCD6BEAD730039FB4BD2C85CE, 4F98AE390D1B14A755700DD6CEFB9CF921F0404AF2145D2D7E5F52394F87C6A5 ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys

21:34:28.0968 0x0234 serenum - ok

21:34:28.0984 0x0234 [ CCA207A8896D4C6A0C9CE29A4AE411A7, 5999B39242283CD803319AADCA171CCCC6E2A40FB2FAFA51B1D29F3FF2DD8D6C ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys

21:34:28.0984 0x0234 Serial - ok

21:34:29.0109 0x0234 [ 8E6B8C671615D126FDC553D1E2DE5562, CEEC0067514555D5CA489F50E3D7562FCA8DB8E952C3C878604C9277FC77959F ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys

21:34:29.0109 0x0234 Sfloppy - ok

21:34:29.0187 0x0234 [ 83F41D0D89645D7235C051AB1D9523AC, B681F33EEAA511D6A2DCB9FBAA407B739184C9FF6067C6B7E51F1FC37E9D4DD7 ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll

21:34:29.0203 0x0234 SharedAccess - ok

21:34:29.0265 0x0234 [ 99BC0B50F511924348BE19C7C7313BBF, A1006C687BD352F700B140DC741515A0CDD9E1352C0FBD1EE410D404E344444B ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll

21:34:29.0281 0x0234 ShellHWDetection - ok

21:34:29.0281 0x0234 Simbad - ok

21:34:29.0421 0x0234 [ 704B4F81729F676BBF034529FC334D82, 1E50DAF97836807A500284385D99272780A8B69CA88761250451060B207824F8 ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe

21:34:29.0437 0x0234 SkypeUpdate - ok

21:34:29.0484 0x0234 [ 866D538EBE33709A5C9F5C62B73B7D14, BC94BEB7C17B4FCAC8B5D0D5006A203BC209E0504EECE149651D8691935696CD ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys

21:34:29.0484 0x0234 SLIP - ok

21:34:29.0546 0x0234 [ D72A21424CA66C7A745BD995ECA6A710, 9B402DA63F6782828CA51864DF875B8B453967A3DAA83CBE7B508897F6B5873B ] SMBios C:\WINDOWS\system32\DRIVERS\SMBios.sys

21:34:29.0546 0x0234 SMBios - ok

21:34:30.0203 0x0234 [ 11BB0E11D42CC3A43D741D9B30839BE1, FDC35289D966A7CB318C5BD646148E1E2BCC0AB9F9FD4243C82FC567D72DDAE9 ] SNPSTD3 C:\WINDOWS\system32\DRIVERS\snpstd3.sys

21:34:30.0812 0x0234 SNPSTD3 - ok

21:34:30.0859 0x0234 Sparrow - ok

21:34:30.0890 0x0234 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F, DD17733CBB370FCA08F0296704D7CBEACA3C8F76D0ABE4761C3B1FFDF7481D9E ] splitter C:\WINDOWS\system32\drivers\splitter.sys

21:34:30.0890 0x0234 splitter - ok

21:34:30.0953 0x0234 [ 60784F891563FB1B767F70117FC2428F, E0B07F08E60FFBAD36C2E58180F4B2A16DCA47716044CBE0213DF7B74D742F1F ] Spooler C:\WINDOWS\system32\spoolsv.exe

21:34:30.0953 0x0234 Spooler - ok

21:34:31.0046 0x0234 [ 3F4892C5EFBF92B9332A6F3BFA9C57EC, 32A127AF45C0C8A4907D3A541072198028FDFFF6497A8B401F656548C85D0583 ] SpyroService C:\Program Files\FS\Spyro Portal\FlashPortal.exe

21:34:31.0046 0x0234 SpyroService - ok

21:34:31.0062 0x0234 [ 76BB022C2FB6902FD5BDD4F78FC13A5D, 6031CB2344D7277FC703480EB43CF856A0F8F818EA98FF26A2CA532336CD2DFA ] sr C:\WINDOWS\system32\DRIVERS\sr.sys

21:34:31.0062 0x0234 sr - ok

21:34:31.0125 0x0234 [ 3805DF0AC4296A34BA4BF93B346CC378, B57A14F1B7B0997E619DDD62B73157AA2399A9852166FB58139CBB358A88F6F3 ] srservice C:\WINDOWS\system32\srsvc.dll

21:34:31.0140 0x0234 srservice - ok

21:34:31.0218 0x0234 [ 47DDFC2F003F7F9F0592C6874962A2E7, 17C643BD4EB09B5666FE41817DC785BE04A6E491CE79E8E5A702CDBD98E1BDD7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys

21:34:31.0234 0x0234 Srv - ok

21:34:31.0265 0x0234 [ D7968049BE0ADBB6A57CEE3960320911, 6FB6D7BE384324211DAEDCCD80BA983E32183D08DF6C5B5B5453773DCC0F4D5B ] sscdbhk5 C:\WINDOWS\system32\drivers\sscdbhk5.sys

21:34:31.0265 0x0234 sscdbhk5 - ok

21:34:31.0328 0x0234 [ 0A5679B3714EDAB99E357057EE88FCA6, 01E1A101FFF48402C77E385A78FEF27876E04533B60EB1C18558A737E57E5FA8 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll

21:34:31.0328 0x0234 SSDPSRV - ok

21:34:31.0359 0x0234 [ C3FFD65ABFB6441E7606CF74F1155273, EFA481D5075A9C0490CEBA5F8223BE322EB3811465F41A1FB3386E30E8C81714 ] ssrtln C:\WINDOWS\system32\drivers\ssrtln.sys

21:34:31.0390 0x0234 ssrtln - ok

21:34:31.0406 0x0234 Steam Client Service - ok

21:34:31.0468 0x0234 [ 8BAD69CBAC032D4BBACFCE0306174C30, 2AA0DA710FCBFF38FE8DA91EE02E7A4503269347E61F8D3246FCA3384BBA2305 ] stisvc C:\WINDOWS\system32\wiaservc.dll

21:34:31.0484 0x0234 stisvc - ok

21:34:31.0546 0x0234 [ 77813007BA6265C4B6098187E6ED79D2, 93939120E803C46FBFD577C8FC2E6C7E71C0460E01D25CB29579490640AB50C7 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys

21:34:31.0546 0x0234 streamip - ok

21:34:31.0562 0x0234 [ 3941D127AEF12E93ADDF6FE6EE027E0F, EA1F0E32E1C5E90FA4AAC421DEBBE086512340758D3217A6334E886BCE638B51 ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys

21:34:31.0562 0x0234 swenum - ok

21:34:31.0578 0x0234 [ 8CE882BCC6CF8A62F2B2323D95CB3D01, B408550A581F3DA222355964AFA4E976AD8471F0AA37573C42C4948AE5A23A3B ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys

21:34:31.0578 0x0234 swmidi - ok

21:34:31.0593 0x0234 SwPrv - ok

21:34:31.0609 0x0234 symc810 - ok

21:34:31.0625 0x0234 symc8xx - ok

21:34:31.0625 0x0234 sym_hi - ok

21:34:31.0640 0x0234 sym_u3 - ok

21:34:31.0703 0x0234 [ 8B83F3ED0F1688B4958F77CD6D2BF290, 546D3602183702B4F53E84413CFA2C933D64C8540378E54A8DCD148F3F36A2DA ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys

21:34:31.0703 0x0234 sysaudio - ok

21:34:31.0718 0x0234 [ C7ABBC59B43274B1109DF6B24D617051, 4384CA0AA6CE9B603CF7DB775A3C721E46715D5B120B94FB57DEADAADE18535B ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe

21:34:31.0734 0x0234 SysmonLog - ok

21:34:31.0796 0x0234 [ 3CB78C17BB664637787C9A1C98F79C38, F35C31F6B7F366CB949D1044B357C76DEC9170441C5E559802794F62B72FD255 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll

21:34:31.0812 0x0234 TapiSrv - ok

21:34:31.0859 0x0234 [ 9AEFA14BD6B182D61E3119FA5F436D3D, EA29E49434585409272E7901AF89771FE9D6E911A7DC44AB3C7020CFF8A44552 ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys

21:34:31.0875 0x0234 Tcpip - ok

21:34:31.0937 0x0234 [ 4E53BBCC4BE37D7A4BD6EF1098C89FF7, D084EFE07AC200672A1CE7BB8AE736612B3E353271188D26E29EC973E26E1F5F ] Tcpip6 C:\WINDOWS\system32\DRIVERS\tcpip6.sys

21:34:31.0937 0x0234 Tcpip6 - ok

21:34:31.0968 0x0234 [ 6471A66807F5E104E4885F5B67349397, F35CBFFB8BB235CCE30EF94A5273333900DD49FD506BF9D55D99A320B8A53A5A ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys

21:34:31.0968 0x0234 TDPIPE - ok

21:34:31.0984 0x0234 [ C56B6D0402371CF3700EB322EF3AAF61, 7743FA4C734BCE38EFB1CA69BC17364D8421E2CD172F856F7E38E7AE1EE93F2F ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys

21:34:31.0984 0x0234 TDTCP - ok

21:34:32.0031 0x0234 [ 88155247177638048422893737429D9E, B6D4E8691917946332C2208D01F8C8281978C1AD1E9951C5D99DF0D49AC34B3B ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys

21:34:32.0031 0x0234 TermDD - ok

21:34:32.0125 0x0234 [ FF3477C03BE7201C294C35F684B3479F, D6246521539BA4ACD022D26983182F5E323D2EF1EA7C54265A248C43A1CE5202 ] TermService C:\WINDOWS\System32\termsrv.dll

21:34:32.0140 0x0234 TermService - ok

21:34:32.0343 0x0234 [ 1D265CD2FB1673A0873BF8CEC19DDC7F, 04A284BA8EAB1C47BB4D5114D0E812F40E76663AFE3268E0B21C47BD9D97FBEF ] tfsnboio C:\WINDOWS\system32\dla\tfsnboio.sys

21:34:32.0343 0x0234 tfsnboio - ok

21:34:32.0359 0x0234 [ 62E4901295E0467CAC78E5B4B131AE5C, A009B1E2CC024C3F638F488AB34E5CD21BA2FE67FB717D99EB932DDC2E5B49AA ] tfsncofs C:\WINDOWS\system32\dla\tfsncofs.sys

21:34:32.0359 0x0234 tfsncofs - ok

21:34:32.0375 0x0234 [ A2F380F9252AB3464C859ADF91EEAD9C, 789597FA7EB2AE66C12A40F39D78FC5CBF7B13D34487E7FE9AF2555FDCB8BCC4 ] tfsndrct C:\WINDOWS\system32\dla\tfsndrct.sys

21:34:32.0375 0x0234 tfsndrct - ok

21:34:32.0390 0x0234 [ EEE79BBEFE9C6A2A3CE6C8753CFEA950, F81AE604B8411A8A8EA69C07391F0FF4353BFC4BD9C5317EE8E33843863F6E88 ] tfsndres C:\WINDOWS\system32\dla\tfsndres.sys

21:34:32.0390 0x0234 tfsndres - ok

21:34:32.0437 0x0234 [ 9D644EB11FEC9487450C4CFCD63A5DF4, FF75E6DD5BDECDDEF6C2A8AC0965557EC800246BB92949886F8A9870A87C1A32 ] tfsnifs C:\WINDOWS\system32\dla\tfsnifs.sys

21:34:32.0437 0x0234 tfsnifs - ok

21:34:32.0453 0x0234 [ E656AF05C67EDB7C0E9230A5DF71ED1B, 09A0FCF985F65EBC13A5C12044082A6324FBFFF8B3B11584791D62A5682A6CEF ] tfsnopio C:\WINDOWS\system32\dla\tfsnopio.sys

21:34:32.0453 0x0234 tfsnopio - ok

21:34:32.0468 0x0234 [ 64FCCB9CCE703CA507DFFC3CEBF6B2CB, A5C1BDD7A93CBBD0286BB3EF5F1A7939F81E627295EE17EAC9F3782696714339 ] tfsnpool C:\WINDOWS\system32\dla\tfsnpool.sys

21:34:32.0468 0x0234 tfsnpool - ok

21:34:32.0484 0x0234 [ 48BC9D8AB4E4B9BFF70FB18E55CEC3D6, E3CC788CD5A1E6CC6998D082A80D0C88C077562C3F8C3887867DB8B9EF0FB5FD ] tfsnudf C:\WINDOWS\system32\dla\tfsnudf.sys

21:34:32.0500 0x0234 tfsnudf - ok

21:34:32.0515 0x0234 [ 79F60822224256B49BFC855DA8D651D5, 27CE1E861326CA6322EADE20137FB25D3E61EE6D952E03BF9E6A81C7E6814CBD ] tfsnudfa C:\WINDOWS\system32\dla\tfsnudfa.sys

21:34:32.0515 0x0234 tfsnudfa - ok

21:34:32.0562 0x0234 [ 99BC0B50F511924348BE19C7C7313BBF, A1006C687BD352F700B140DC741515A0CDD9E1352C0FBD1EE410D404E344444B ] Themes C:\WINDOWS\System32\shsvcs.dll

21:34:32.0578 0x0234 Themes - ok

21:34:32.0593 0x0234 TosIde - ok

21:34:32.0640 0x0234 [ 55BCA12F7F523D35CA3CB833C725F54E, 849FB1AE31B143B14B298BBC0D91230693D41DEB95F46516878F53A7F4186C38 ] TrkWks C:\WINDOWS\system32\trkwks.dll

21:34:32.0656 0x0234 TrkWks - ok

21:34:32.0718 0x0234 [ 8F861EDA21C05857EB8197300A92501C, 374FF9464F273610A051B9220C8D20F01FD4DD029095A7BE37244E20C5C8B5BB ] tunmp C:\WINDOWS\system32\DRIVERS\tunmp.sys

21:34:32.0718 0x0234 tunmp - ok

21:34:32.0750 0x0234 [ 5787B80C2E3C5E2F56C2A233D91FA2C9, 3774905CF77954DFCECDA5BCC7CDE3D0ED72712BFAAD85ADAE5246306447E46C ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys

21:34:32.0750 0x0234 Udfs - ok

21:34:32.0750 0x0234 ultra - ok

21:34:32.0812 0x0234 [ 402DDC88356B1BAC0EE3DD1580C76A31, 32A686595710336A6BFD54C03F552AE39439611662F84EF5D24193AE5665C6F3 ] Update C:\WINDOWS\system32\DRIVERS\update.sys

21:34:32.0828 0x0234 Update - ok

21:34:32.0890 0x0234 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91, 7746916DB48E3F5B243B63C066596AD9037A494BF1AD935946DD04AC85D983DF ] upnphost C:\WINDOWS\System32\upnphost.dll

21:34:32.0906 0x0234 upnphost - ok

21:34:32.0953 0x0234 [ 05365FB38FCA1E98F7A566AAAF5D1815, 16843048CEEC3DAA3B953A12FF1EE339E86783A08F2A56DA7F94AD9F9717D77D ] UPS C:\WINDOWS\System32\ups.exe

21:34:32.0953 0x0234 UPS - ok

21:34:33.0015 0x0234 [ 65898A183FBF1D1F7759D5CCB364DCD4, 85E823123FDB4CA5F8255064E22A444627999055EC3419DFD001371893F36AB9 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys

21:34:33.0015 0x0234 usbaudio - ok

21:34:33.0093 0x0234 [ 1B611611C28D2DF25BC057D79C6F13FC, B0D86F63E44B40413BBAE6402CC088046CFAE082D41BBC2ED5A916293356B846 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys

21:34:33.0093 0x0234 usbccgp - ok

21:34:33.0187 0x0234 [ 4BAC8DF07F1D8434FC640E677A62204E, 76C1351AF6752224BF59DEEE0F8665FE699F3DFD679F5BCD01C7D9383E6402A4 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys

21:34:33.0187 0x0234 usbehci - ok

21:34:33.0234 0x0234 [ 1AB3CDDE553B6E064D2E754EFE20285C, A99C4528C4227B1E96847614745AAFACD3C5F1BDFE435214DBF78740FFB300FE ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys

21:34:33.0234 0x0234 usbhub - ok

21:34:33.0281 0x0234 [ A717C8721046828520C9EDF31288FC00, 1530BBE832EDBB0974AD89D723A03FF7A0094B368992D73C2C3E62A181DF1E0A ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys

21:34:33.0281 0x0234 usbprint - ok

21:34:33.0328 0x0234 [ F8EDE2B6928970DCE3D5614C27D9E7F6, 6E5EBBC8B70C1D593634DAF0C190DEADFDA18C3CBC8F552A76F156F3869EF05B ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys

21:34:33.0328 0x0234 usbscan - ok

21:34:33.0390 0x0234 [ A32426D9B14A089EAA1D922E0C5801A9, ED1DC52EE45F8EAD3AEC4B1F817BB25634141CF48295494C5947DCE6CF7A9817 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

21:34:33.0390 0x0234 USBSTOR - ok

21:34:33.0453 0x0234 [ 26496F9DEE2D787FC3E61AD54821FFE6, 8BE7FF647470B9A951CBB478FAF83D657A15CC78037F42348A6B738F21D523DA ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys

21:34:33.0453 0x0234 usbuhci - ok

21:34:33.0531 0x0234 [ 813236B1183CFCF289E367BD5DE6E29E, 167FE18A96F330AEEC1A4C419770C15EFEB536D43838285E51E7A62E95DF4674 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys

21:34:33.0531 0x0234 usbvideo - ok

21:34:33.0609 0x0234 [ B4D7B7AD8A9F7C063C5CC3E2C1A0724E, CFA47A71403419CA7C94333B4F7766DFC97C5DCDBC3AD1B106044B93C979A5C5 ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys

21:34:33.0609 0x0234 usb_rndisx - ok

21:34:33.0656 0x0234 [ 0D3A8FAFCEACD8B7625CD549757A7DF1, B9CFDEFCD66AA139F3DC2F967B184669532922563AD5A71769BABDC4370D065E ] VgaSave C:\WINDOWS\System32\drivers\vga.sys

21:34:33.0656 0x0234 VgaSave - ok

21:34:33.0671 0x0234 ViaIde - ok

21:34:33.0734 0x0234 [ 4C8FCB5CC53AAB716D810740FE59D025, 010EAC43DBED700B73E4FC908FAAF9F6A0168EBBD5D86751E49BC33AAA18BFA4 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys

21:34:33.0734 0x0234 VolSnap - ok

21:34:33.0781 0x0234 [ 7A9DB3A67C333BF0BD42E42B8596854B, D31A9A3B1AAAB373EDD73B674102395212FCB616F829E938B7B2B7BE7D4752C5 ] VSS C:\WINDOWS\System32\vssvc.exe

21:34:33.0812 0x0234 VSS - ok

21:34:33.0859 0x0234 [ 54AF4B1D5459500EF0937F6D33B1914F, FA1876888BCB9C72A92369DBED4FF1A8666784523FB41E618FA0919490FCDDB9 ] W32Time C:\WINDOWS\system32\w32time.dll

21:34:33.0875 0x0234 W32Time - ok

21:34:33.0953 0x0234 [ E20B95BAEDB550F32DD489265C1DA1F6, 5589B2067E6C9FBA290D8C5EADDC198EBAF39C50C3CD7D2BC5CDA7CBFBC445E5 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys

21:34:33.0953 0x0234 Wanarp - ok

21:34:34.0000 0x0234 [ D918617B46457B9AC28027722E30F647, 407284D3055DC11944D4EE7E4357E7CF9CAF8CA40CA50633AB6FD4A82CB7EEA6 ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys

21:34:34.0031 0x0234 Wdf01000 - ok

21:34:34.0046 0x0234 WDICA - ok

21:34:34.0078 0x0234 [ 6768ACF64B18196494413695F0C3A00F, 3A8F8586F1D997D19A8478345338D2AECD785AEABDB61531DD3F92003D3230A5 ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys

21:34:34.0078 0x0234 wdmaud - ok

21:34:34.0140 0x0234 [ 77A354E28153AD2D5E120A5A8687BC06, 8B2D37A4443501C0A8E70BC2079BE27F0A36FD07B561E6F68B40A72EABBC2DFE ] WebClient C:\WINDOWS\System32\webclnt.dll

21:34:34.0156 0x0234 WebClient - ok

21:34:34.0296 0x0234 [ 2D0E4ED081963804CCC196A0929275B5, E1D75C7D7233D81DFDE13160B0C80138DF8B35230D04FB79B367A52FACF69BF8 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll

21:34:34.0312 0x0234 winmgmt - ok

21:34:34.0343 0x0234 [ 30FC6E5448D0CBAAA95280EEEF7FEDAE, 04374450882504D9031951F4E9317E5A128EBA5A22A3555ACD28BC742861AF9C ] WinUSB C:\WINDOWS\system32\DRIVERS\WinUSB.sys

21:34:34.0359 0x0234 WinUSB - ok

21:34:34.0421 0x0234 [ C51B4A5C05A5475708E3C81C7765B71D, F776D2680BD3407307B7072626F78460361FC5BC38623C9E16F394D300AB25DE ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll

21:34:34.0421 0x0234 WmdmPmSN - ok

21:34:34.0500 0x0234 [ E0673F1106E62A68D2257E376079F821, 12992F18C9653050B10DC61D12988067933FCFDF02123D3A7EF5DE607A785DDC ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe

21:34:34.0515 0x0234 WmiApSrv - ok

21:34:34.0640 0x0234 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B, C71FAAC752F6D58BF8556661252DBF8C5DDD090CAE002A2C7E09C9A014526066 ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe

21:34:34.0734 0x0234 WMPNetworkSvc - ok

21:34:34.0765 0x0234 [ CF4DEF1BF66F06964DC0D91844239104, CC1D9CECE2056D29A9651D51BB57C3F4F9BF9E90A4808CF7496C683C874FBD51 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys

21:34:34.0781 0x0234 WpdUsb - ok

21:34:34.0968 0x0234 [ 15673BD0B86150CB8E27766059C72A9B, 56C23289A8BFF4945EE532CF6D62D3EC81B827CA15A359F30A327789F9FE9CAF ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

21:34:37.0531 0x0234 WPFFontCache_v0400 - ok

21:34:37.0593 0x0234 [ 6ABE6E225ADB5A751622A9CC3BC19CE8, 4061C5D0F051DFF1730E2A3BFC1CCA97B29602FC50F10F6B44D93B0D28F42024 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys

21:34:37.0593 0x0234 WS2IFSL - ok

21:34:37.0656 0x0234 [ 7C278E6408D1DCE642230C0585A854D5, DA46079A04F6E8E3441E4AE454AEAC02B3E935DE29CE7F6D4476F57867FCC12A ] wscsvc C:\WINDOWS\system32\wscsvc.dll

21:34:37.0671 0x0234 wscsvc - ok

21:34:37.0734 0x0234 [ 43F767D59BFC25D8F4FC2EB42043EC1E, 9DC502AE199A93FD8492F7AEC41F0578AD8C75E91AE7A083BC37224243A4DCDE ] WSIMD C:\WINDOWS\system32\DRIVERS\wsimd.sys

21:34:37.0734 0x0234 WSIMD - ok

21:34:37.0750 0x0234 [ C98B39829C2BBD34E454150633C62C78, 71B60EA3AD0E2637917D528C6A9E7ECF2949E3E5E91036AA5BBADA95BD725511 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

21:34:37.0765 0x0234 WSTCODEC - ok

21:34:37.0812 0x0234 [ 35321FB577CDC98CE3EB3A3EB9E4610A, C9A6F5CF282D8FCB3CDFCC4B306013480E78E1B664E1A60A4E27B161F9FFD4CD ] wuauserv C:\WINDOWS\system32\wuauserv.dll

21:34:37.0812 0x0234 wuauserv - ok

21:34:37.0875 0x0234 [ F15FEAFFFBB3644CCC80C5DA584E6311, 79B3E9AF35976CE49921E9BEA3BA3B4A8AF762FD3F284B62954038B5FFB32471 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys

21:34:37.0875 0x0234 WudfPf - ok

21:34:37.0921 0x0234 [ 28B524262BCE6DE1F7EF9F510BA3985B, AEFF02B899801A63CBB262757C3D4369E38BFF0690BD085DE60E873DFBE3C3F4 ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys

21:34:37.0921 0x0234 WudfRd - ok

21:34:37.0984 0x0234 [ 05231C04253C5BC30B26CBAAE680ED89, 5C03C2D7E0B573646D32F4093E2FF2C3BA391C39F5BA37D67F69D38E357FCC3D ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll

21:34:38.0000 0x0234 WudfSvc - ok

21:34:38.0078 0x0234 [ 81DC3F549F44B1C1FFF022DEC9ECF30B, 3D14BFEA539F9CEB16555BD56C5E3C7C8F6692FC62C2789F8AAEA1C042E63940 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll

21:34:38.0109 0x0234 WZCSVC - ok

21:34:38.0187 0x0234 [ 295D21F14C335B53CB8154E5B1F892B9, 9418477C2E3EA93E93D931A4EDD4500DA568FAD6040204B5201D1080203B0BBC ] xmlprov C:\WINDOWS\System32\xmlprov.dll

21:34:38.0218 0x0234 xmlprov - ok

21:34:38.0250 0x0234 ================ Scan global ===============================

21:34:38.0312 0x0234 [ 42F1F4C0AFB08410E5F02D4B13EBB623, 924C30587C51C0D1E1F47991969AF492A644552E15F2480EA991DCB74A3E68D5 ] C:\WINDOWS\system32\basesrv.dll

21:34:38.0343 0x0234 [ 69AE2B2E6968C316536E5B10B9702E63, D9C5DA7A20DDE69D91E72400C3F06F3CB099DEF42EA6C53FCE076258A0C22391 ] C:\WINDOWS\system32\winsrv.dll

21:34:38.0406 0x0234 [ 69AE2B2E6968C316536E5B10B9702E63, D9C5DA7A20DDE69D91E72400C3F06F3CB099DEF42EA6C53FCE076258A0C22391 ] C:\WINDOWS\system32\winsrv.dll

21:34:38.0453 0x0234 [ 65DF52F5B8B6E9BBD183505225C37315, 59C606977DB40A3443DFF0BE2A4C761824881B22C9FDB3D23F6486DB580E92A4 ] C:\WINDOWS\system32\services.exe

21:34:38.0468 0x0234 [ Global ] - ok

21:34:38.0468 0x0234 ================ Scan MBR ==================================

21:34:38.0500 0x0234 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0

21:34:39.0015 0x0234 \Device\Harddisk0\DR0 - ok

21:34:39.0015 0x0234 ================ Scan VBR ==================================

21:34:39.0015 0x0234 [ 0C5222D20C084418ED483CC68598416E ] \Device\Harddisk0\DR0\Partition1

21:34:39.0093 0x0234 \Device\Harddisk0\DR0\Partition1 - ok

21:34:39.0093 0x0234 ================ Scan generic autorun ======================

21:34:39.0203 0x0234 [ 9ACFD9D5E12D849B28C78FED6D620EB3, 203D1EECFB44BA7D3936AAA2280B1D88207BA7655AB735C17BF9F3AAF3D8A803 ] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe

21:34:39.0218 0x0234 UpdatePDRShortCut - ok

21:34:39.0375 0x0234 [ 829E4805B0E12B383EE09ABDC9E2DC3C, 37121ECB7C1E112B735BD21B0DFE3E526352ECB98C434C5F40E6A2A582380CDD ] C:\Documents and Settings\Protoman\Local Settings\Application Data\Macromedia\Flash Player\FlashPlayerUpdateService.exe

21:34:39.0390 0x0234 FlashPlayerUpdate - ok

21:34:39.0468 0x0234 [ 9ACCBC5891BA51B5B29C1A88F80D4CE3, 4EA3D9CB239874232AE0D7F824AF8CC7AD9BB4657CB9978B41067B4447FBE71B ] C:\Program Files\QuickTime\qttask.exe

21:34:39.0484 0x0234 QuickTime Task - ok

21:34:39.0750 0x0234 [ 7EE68A122ED08E4AAD8DA551E34D2515, B3C9AB270AF595D3DBAFBF4A312B96CBF00C16F0A03CCC86BE56825CD1EB7143 ] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe

21:34:40.0046 0x0234 SDTray - ok

21:34:40.0140 0x0234 [ BE99918C2211431C6424EFFD087FD9C7, 2994D8B89E41A3C1D6BA01B032C3B16EF11401D57BBD45C124F7B00004705D19 ] C:\Documents and Settings\Protoman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

21:34:40.0140 0x0234 Google Update - ok

21:34:40.0156 0x0234 Waiting for KSN requests completion. In queue: 228

21:34:41.0156 0x0234 Waiting for KSN requests completion. In queue: 197

21:34:42.0156 0x0234 Waiting for KSN requests completion. In queue: 170

21:34:43.0156 0x0234 Waiting for KSN requests completion. In queue: 138

21:34:44.0156 0x0234 Waiting for KSN requests completion. In queue: 109

21:34:45.0156 0x0234 Waiting for KSN requests completion. In queue: 109

21:34:46.0156 0x0234 Waiting for KSN requests completion. In queue: 109

21:34:47.0156 0x0234 Waiting for KSN requests completion. In queue: 109

21:34:48.0156 0x0234 Waiting for KSN requests completion. In queue: 82

21:34:49.0156 0x0234 Waiting for KSN requests completion. In queue: 82

21:34:50.0156 0x0234 Waiting for KSN requests completion. In queue: 82

21:34:51.0156 0x0234 Waiting for KSN requests completion. In queue: 55

21:34:52.0156 0x0234 Waiting for KSN requests completion. In queue: 28

21:34:53.0156 0x0234 Waiting for KSN requests completion. In queue: 28

21:34:54.0156 0x0234 Waiting for KSN requests completion. In queue: 28

21:34:55.0156 0x0234 Waiting for KSN requests completion. In queue: 28

21:34:56.0156 0x0234 Waiting for KSN requests completion. In queue: 28

21:34:57.0156 0x0234 Waiting for KSN requests completion. In queue: 28

21:34:58.0328 0x0234 Win FW state via NFM: enabled

21:35:18.0328 0x0234 ============================================================

21:35:18.0328 0x0234 Scan finished

21:35:18.0328 0x0234 ============================================================

21:35:18.0343 0x0530 Detected object count: 0

21:35:18.0343 0x0530 Actual detected object count: 0

21:40:15.0171 0x10c4 Deinitialize success

Attachments:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

SUPER slow PC Usage - Maybe Malware [Solved]

✨ Ask AI

Ask AI